When a Group 2 business relationship is flagged as high risk, engage it directly to understand its due diligence and encourage further action, gathering its commitments to responsible AI standards, significant risks identified and assessed, prioritisation criteria, prevention and mitigation actions with timelines, tracking measures and remediation; where it will not disclose enough, use industry or multi-stakeholder assessments, academic studies, AI safety ratings or NGO reports while continuing to press for disclosure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.