Organisations should assess risks relating to AI across the whole life cycle, producing a risk treatment plan, following ISO/IEC 23894 for identification, assessment and treatment. They should identify the potential harms and benefits of the system, conferring with representative users, which yields values able to guide features, interface, documentation and uses; the values should be studied and refined until they can become system requirements, drawing on frameworks for law, human rights, social responsibility and the environment. Beyond the usual security and privacy risks, the plan should address risks to the values identified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.