Skip to content

FCC Compliance Audit Workflow

This guide walks through running a complete compliance audit against an FCC deployment. The workflow is non-interactive, reproducible, and produces JSON output that can be attached directly to an audit engagement record.

The compliance module lives at src/fcc/compliance/:

  • requirements.py — RequirementRegistry with 256+ EU AI Act and 29 NIST AI RMF entries
  • classifier.py — AIActClassifier mapping persona → risk category
  • auditor.py — ComplianceAuditor running dual-regulation audits
  • report.py — ComplianceReport serialisation
  • evidence_graph.py — build_compliance_evidence_graph()
  • pipeline.py — CompliancePipeline for automated audit + event emission

Step 1 — Scope and Prep

Every compliance audit starts with scoping:

  1. What deployment? — record git rev-parse HEAD, helm list -n fcc, and fcc --version
  2. Which regulation? — EU AI Act 2024/1689, NIST AI RMF, or both
  3. Which personas are in scope? — full registry, a category subset, or a named list
  4. Evidence cut-off — timestamp used for all evidence collection

Save this as the first page of the audit report.

Step 2 — Run the Dual Audit

# Against all personas, both regulations
fcc compliance-audit \
    --regulation eu-ai-act,nist-ai-rmf \
    --scope all \
    --output /audit/$(date +%F)/compliance.json \
    --evidence-graph /audit/$(date +%F)/evidence.jsonld

# Against a subset (e.g. the open_science category)
fcc compliance-audit \
    --regulation eu-ai-act \
    --scope category:open_science \
    --output /audit/$(date +%F)/open_science.json

The command is deterministic: running it twice against the same deployment produces byte-identical output. This is the property that makes re-audit cheap and historical audit reproducible.

Output shape

{
  "audit_id": "compliance-2026-04-22T14:00:00Z",
  "git_rev": "eeeabaa",
  "fcc_version": "1.3.9",
  "regulations": ["eu-ai-act", "nist-ai-rmf"],
  "summary": {
    "requirements_evaluated": 285,
    "passed": 271,
    "findings": 14,
    "by_severity": {"tier_1": 0, "tier_2": 9, "tier_3": 5}
  },
  "findings": [
    {
      "id": "EU-AIA-Art-15-3-001",
      "regulation": "eu-ai-act",
      "citation": "Article 15(3)",
      "severity": "tier_2",
      "description": "...",
      "evidence_gaps": [...],
      "remediation": "..."
    }
  ]
}

tier_1 findings are blockers. tier_2 must be remediated before production. tier_3 are improvement items tracked against the next release.

Step 3 — Classify Each Persona by Risk Category

The AIActClassifier maps each FCC persona to one of the four EU AI Act risk categories:

Category Definition Typical FCC Personas
Unacceptable Risk Prohibited under Article 5 None (FCC will not ship these)
High Risk Annex III systems Compliance Auditor, Risk Assessor, Forensic Auditor
Limited Risk Transparency obligations Most stakeholder & documentation personas
Minimal Risk No formal obligation Core workflow personas 
fcc compliance-audit --classify-only --output /audit/classification.json

Every High Risk persona triggers the full 40+ Article 6-15 requirement cascade. Verify this by opening the classification output and counting requirements_applicable per persona.

Step 4 — Build the Evidence Graph

The evidence graph is a JSON-LD document that links each requirement to the code artefact, test, model card, or data file that satisfies it. It is the single source of truth for the audit.

fcc compliance-audit \
    --regulation eu-ai-act \
    --evidence-graph /audit/evidence.jsonld \
    --evidence-format jsonld

The graph has three layers:

  1. Requirement nodes — 256+ EU AI Act + 29 NIST AI RMF subcategories
  2. Artefact nodes — persona YAML, model cards, quality gate records, test results
  3. Relationship edges — satisfies, contradicts, partially-satisfies, out-of-scope

Open the graph in any JSON-LD viewer (or import into Neo4j / rdflib) to inspect coverage.

Step 5 — Walk the EU AI Act Crosswalk

Article-by-article coverage matrix:

Article Title FCC Coverage
Art. 5 Prohibited Practices Enforced at classification time
Art. 6 Classification of High-Risk Systems AIActClassifier
Art. 9 Risk Management System Quality gates QG-AMS-, QG-RIS-
Art. 10 Data and Data Governance OPEN-SCI-004b, OPEN-SCI-010
Art. 11 Technical Documentation Auto-generated model cards
Art. 12 Record-Keeping Event bus + OTel traces
Art. 13 Transparency Agent Transparency Cards (OPEN-SCI-009)
Art. 14 Human Oversight Collaboration engine + approval gates
Art. 15 Accuracy, Robustness, Cybersecurity CLEAR+ benchmarks + security review

See Quality Gates Reference for the gate-level mapping.

Step 6 — Walk the NIST AI RMF Crosswalk

NIST AI RMF uses 4 functions and 29 subcategories:

Function Subcategories FCC Coverage Pattern
GOVERN GV-1 through GV-6 Governance module, constitutions, tags
MAP MP-1 through MP-5 Classifier, evidence graph
MEASURE MS-1 through MS-4 CLEAR+ benchmarks, quality gates
MANAGE MG-1 through MG-4 Compliance pipeline, incident response

The bidirectional crosswalk (NIST ↔ EU AI Act) lives in src/fcc/data/compliance/nist_ai_rmf_mapping.yaml. An EU AI Act requirement satisfied is, via the crosswalk, evidence against the matching NIST subcategory.

Step 7 — Review Findings

The dashboard is the most efficient way to triage:

fcc dashboard compliance_audit --input /audit/compliance.json

The dashboard renders:

  • Risk heatmap across personas × risk categories
  • Findings browser with filter by severity, regulation, persona
  • Evidence graph summary with coverage percentages

For each finding, record:

  • Disposition (accepted, remediation planned, deferred)
  • Owner (which engineering or governance lead)
  • Target resolution date

Step 8 — Re-Run After Remediation

The pipeline makes re-audit almost free:

# After engineers push a remediation PR and deploy
fcc compliance-audit \
    --regulation eu-ai-act \
    --output /audit/reaudit.json

# Diff the two audits
python -m fcc.compliance.report_diff /audit/compliance.json /audit/reaudit.json

CompliancePipeline also supports reactive re-audit via the event bus: subscribe to persona.updated, quality_gate.failed, or model_card.changed events and re-audit automatically. See the compliance pipeline demo.

Step 9 — Export for External Assessors

External assessors typically want a portable bundle:

fcc compliance-audit \
    --regulation eu-ai-act,nist-ai-rmf \
    --bundle /audit/external-bundle.zip \
    --include-evidence-graph \
    --include-model-cards \
    --include-quality-gate-records

The bundle is a ZIP containing the JSON audit, JSON-LD evidence graph, the 173 model cards, all quality-gate records, and a human-readable summary. Attach it to your engagement.

Workflow Diagram

flowchart LR
    Scope[Step 1: Scope] --> Run[Step 2: Dual Audit]
    Run --> Classify[Step 3: Classify]
    Classify --> Graph[Step 4: Evidence Graph]
    Graph --> EU[Step 5: EU AI Act Walk]
    Graph --> NIST[Step 6: NIST Walk]
    EU --> Review[Step 7: Review Findings]
    NIST --> Review
    Review --> Remediate[Step 8: Re-Audit]
    Remediate --> Export[Step 9: Export]
    Export --> Done([Sign-Off])

    classDef step fill:#e3f2fd,stroke:#0d47a1;
    classDef finish fill:#c8e6c9,stroke:#2e7d32;
    class Scope,Run,Classify,Graph,EU,NIST,Review,Remediate,Export step;
    class Done finish;