Beyond ISO/IEC 17021-1:2015, 5.3.1, the certification body can show a contract for insurance or some alternative arrangement, and whichever it uses gives adequate cover, expressed as a sum insured or a liability cap, for bodily injury, damage to property and financial loss, sized to the annual gross revenue (turnover) of the clients it audits or certifies. The note explains that the body's own damage potential is what matters, shaped by its clients and their AI systems; the cover is not product liability but meets damage from the body breaching its organizational duties through failures against ISO/IEC 42001 in the course of certification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.