Before anything else the body establishes what dataset the AI system will use and whether it contains personal data within the GDPR definition. If it does, the GDPR applies and further steps determine the risk level and the actions needed. Where data is wholly non-personal, or properly anonymised so it cannot be linked back to an individual directly or indirectly, the GDPR principles may not apply and synthetic data can be considered in line with European Data Protection Supervisor guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.