The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle issues and technology readiness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.