Article 4(3): by making the statement available (or, for a micro or small primary operator, by submitting the simplified declaration) the operator takes responsibility for the product's compliance with Article 3, and keeps a record of its due diligence statements for five years from submission.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.