The organization should set and document its record-keeping requirements for AI system impact assessments and how results and the responses to identified impacts are documented, whether through templates, system features or another suitable means. Reporting can be internal, to top management, to workers and contracted staff or their representatives, to AI producers and to AI partners, and external, to competent authorities including policymakers and regulators, to AI customers, to AI partners and to the individuals, groups and societies the system affects. External reporting should suit who the audience is and what transparency it expects, while leaving out disclosures that would be inappropriate for security, confidentiality or the protection of personal data. Reports can cover the actual or foreseeable impacts of the intended uses and, at least in general terms, of other beneficial uses and foreseeable unintended uses (omitting details that could help malicious actors), a reasonable range of the impact types described for impacts in clause 6, and the measures taken in response. Reports should give interested parties what they need to judge, where relevant, whether the system meets legal requirements on impact assessment, and should stay understandable when parts are withheld to protect intellectual property or security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.