When setting up the process the organization should decide when assessments are carried out and in how much depth, and when an earlier assessment can be used again, adapted to a new purpose or updated, and to what extent. Timing can be shaped by applicable law; contractual and professional duties; the organization's own structures, policies, processes, procedures and resources, technology among them; the AI system's risk level (clause 6.3.4 of ISO/IEC 23894:2023 offers guidance); what relevant interested parties, customers among them, expect; and the internal AI life cycle processes (Annex D covers timing alongside other assessments). Reassessment should be considered when something changes: the intended use, including who uses the system; customer expectations; the AI system itself (its data, its complexity or type, its performance); its operating environment; or the context around it (applicable law, contracts, internal policies, relevant interested parties, and the places and sectors the organization works in or plans to). Risk and impact assessments should be done before the triggering change is put into effect. Timing questions include how often assessments happen, at which life cycle stage, how often they are refreshed, what circumstances call for a new or updated assessment, and which other impact assessments are tied to it. The organization should also consider triage: if only high-risk AI systems are to be assessed, the process should state what makes a system high-risk and what triggers an assessment, and a shortened assessment can be used to decide whether a full one is needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.