MAF paragraph 3.7(2): put in place risk management and internal control measures aimed at the risks of the selected model, including reasonable efforts to ensure training datasets are adequate for purpose and to assess inaccuracy and bias, reviewing exceptions found in training; monitoring and reporting so the right management level knows about performance and issues (models can report confidence levels); knowledge transfer when key AI personnel change; and reviewing the governance structure after significant organisational or personnel changes and periodically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.