At planning and design the team defines where human oversight and intervention points sit, assigns role-specific oversight responsibilities (for example a RACI matrix), consults stakeholders including legal and subject experts and affected groups, assesses whether the system could produce legal or similarly significant effects so that people's entitlement to avoid purely automated decisions is honoured, and applies the Decision Framework. It aligns the system with data security policies, runs pre-deployment risk assessments, sets a fallback plan covering incident response, data recovery, rollback and cyber incidents, and engages IT security. It sets up privacy processes and a DPIA where required, reviews data access, designs in data minimisation, encryption, pseudonymisation and anonymisation, and identifies personal data fields the system must not use. It fixes the level of transparency and explainability required and an alternative human route where rights could be affected; plans stakeholder engagement, a fundamental rights impact assessment where needed, accessibility and universal design, and a diverse team; conducts social impact assessment; and establishes an accountability framework for each stage covering design, data, algorithmic, performance, technology, third-party, conduct and legal, and business process risk, with impact assessments such as red teaming and algorithmic impact assessment and named responsibility for noticing and correcting deviations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.