The organization should write down how it goes about completing impact assessments of its AI systems, keep that documentation current, make it available to relevant interested parties where appropriate, and cover the topics of clause 5 in it. What the documentation produces depends on the organization and the kind of AI system, for example: procedural guidance; an alignment guide or template linking the assessment to other assessments (Annex D) or a standalone template (Annex E); use cases for awareness and training; inputs to management reviews in the AI management system; and completed assessments with the other artefacts of the process. Documentation is kept throughout the assessment, at design, redesign, deployment and evaluation, within the organization's retention policies and its legal retention obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.