Article 38 and the transitional provision: every in-scope system undergoes conformity assessment; MEDIA and ALTA systems need a certification audit (the Article 31 audit may serve), BÁSICA systems need a self-assessment for a declaration of conformity (certification optional), following Annex III and the conformity technical instruction; entities publish their declarations and certifications on their websites; systems existing on 5 May 2022, including private contractors', had 24 months to conform and new systems apply the ENS from design.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.