Where an AI system processes personal data in its processing, inputs or outputs, it can affect privacy (ISO/IEC 23894 A.8 covers collection, use, disclosure and inference). For each identified interested party, data subjects included, the organization should analyse the foreseeable benefits and harms tied to privacy, for example: whether personal data was collected to develop or use the system (such as for model training); the effects of a confidentiality breach in that processing; and the organization's obligations towards, and the party's expectations about, the processing and how they are met, covering fairness, the risk of unwanted bias, discrimination or inaccuracy, the risk of profiling and behavioural monitoring, automated decision-making and human intervention, access to information, and the means of exercising rights. Privacy or data protection impact assessments (ISO/IEC 29134) and ISO/IEC 27701 can help.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.