Further Reading

Authoritative sources, internal documents, and sister-project references for policy readers who want to go deeper.

Primary regulatory texts

• EU AI Act (Regulation 2024/1689). The definitive source. Articles 5-7 define risk categories; Annex III lists high-risk use cases. FCC's data/compliance/eu_ai_act_requirements.yaml encodes 256+ requirements derived from the text.
• NIST AI RMF 1.0 (January 2023). The US risk-management framework. 29 subcategories mapped in FCC's data/compliance/nist_ai_rmf_mapping.yaml.
• ISO/IEC 42001:2023. AI management-system standard. Not currently encoded in FCC but commonly referenced in procurement clauses; map by hand using the NIST crosswalk as bridge.
• OECD AI Principles (2019, updated 2024). High-level principles that underlie both EU and US frameworks.

FCC internal documents

• ADR-0001 Plugin System — explains the plugin-type architecture (11 plugin types including vocabulary_providers). Relevant to procurement: plugins are the extensibility surface.
• ADR-0002 Persona Schema — the governance rationale for the ten R.I.S.C.E.A.R. fields.
• ADR-0003 Workflow Graphs — why graphs, not pipelines.
• ADR-0004 Compliance Framework — the authoritative rationale for the compliance model, the evidence graph design, and the dual-regulation approach.
• ADR-0005 Evidence Graph — the linked-data design. Read this if you are challenged in court.

Foundational papers

• Mitchell, M., Wu, S., Zaldivar, A., et al. (2019). Model Cards for Model Reporting. FAT '19. The origin paper for FCC's model-card format.
• Gebru, T., Morgenstern, J., Vecchione, B., et al. (2018). Datasheets for Datasets. FCC datasheets follow this structure.
• Bommasani, R., Hudson, D. A., Adeli, E., et al. (2021). On the Opportunities and Risks of Foundation Models. Useful context when you are asked "why does a multi-persona system help?"
• Raji, I. D., Smart, A., White, R. N., et al. (2020). Closing the AI Accountability Gap. This is the conceptual basis for the evidence graph.

Sister-project documentation

• POLARIS — policy ontology reasoning. See the POLARIS repository README and its docs/ontology/ tree. FCC consumes POLARIS outputs via a documented bridge (stable since v1.5.0).
• LYRA — graph-backed UX. See the LYRA repository for the bridge protocol. Stable since v1.5.0.
• Ophiuchus / Serpens / Libra / Crater / Scutum / Norma / Pyxis / Vela / Columba / Caelum — the ten constellation-vertical repositories. Each has its own README + docs/ tree. Policy staff typically read only the constellation that corresponds to their deployment.

Checklists and templates you can steal

• Procurement clause for FCC-based systems (suggested text): "Vendor shall deliver, for each release, a ComplianceReport in the FCC v1.7.0 format with EU AI Act and NIST AI RMF annotations, an evidence graph in JSON-LD, and model cards for every active persona. Vendor shall disclose risk classification changes within 10 business days."
• Biweekly remediation report template — three rows: open findings, closed this cycle, new this cycle. Delivered with the current bundle as a diff.
• Sunset clause template — "This deployment is approved for 90 days. Auto-rollback triggers if (a) any non-compliant finding in Article 14 remains open past 30 days, or (b) the overall non-compliant count exceeds 3%."

Academic and policy briefings

• Brookings AI Governance series — readable and well-sourced. Use for context when writing to a generalist audience.
• Stanford HAI Policy Briefs — quarterly, short, citation-rich.
• AlgorithmWatch reports (EU focus) — independent civil-society reviews, useful counter-balance to vendor documentation.

Where to file comments and questions

• Regulatory questions: your jurisdiction's AI supervisory authority (for EU member states, the national designated authority).
• FCC framework questions: open an issue on the FCC GitHub repository with the policy-question label.
• Constellation-vertical questions: open an issue on the specific constellation repo.

Reading order recommendation

If you are new and have one hour:

1. This track's index (5 min)
2. Getting Started (15 min)
3. Audit Primer (20 min)
4. Skim EU AI Act Articles 5, 6, 10, 13, 14 in the official text (20 min)

If you have three hours, add the full Compliance Walkthrough, one ADR of your choice (ADR-0004 recommended), and Mitchell et al. 2019 (the model cards paper).

If you have a full day, read the entire FCC Guidebook, Chapters 1, 14, 20, 22 (governance and compliance chapters), and one full constellation-vertical's README.

Keeping current

FCC ships roughly monthly. Each release notes document (RELEASE_NOTES.md) highlights changes relevant to policy readers at the top. Subscribe to release notifications on GitHub, or ask your technical team to flag policy-relevant releases.