The organization should consider recording technical and management measures to address harms and secure benefits, for example: proposals for technical measures, to be taken into account in the system's approval processes (5.11), such as adding encryption to a user register after foreseeable privacy harms are found, governance to keep development and use appropriate and impacts handled across the life cycle, or operators deciding to withdraw, recall or update a system whose performance falls short, bearing in mind that withdrawal itself can affect interested parties (financial loss, health risk); and recommendations for top management to consider in setting and implementing AI policies, for example treating the sale of a text generation system to a customer whose outputs could be wrongly attributed to real people as a contractual and commercial matter, training and awareness for users, other staff and interested parties (harm can come from lack of awareness, for instance about automated decisions), or setting assessment priorities (privacy, labour relations, unwanted bias, discrimination, transparency, accountability) with a framework to map measures to them. These recommendations should inform the preparation and updating of the risk treatment plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.