# Official Sources

Primary AI-risk-governance and legal-text provenance for the model-promotion claims.

Primary sources, verified 2026-07-26 against official upstream documentation and standards. Governance framings are non-certifying (see docs/compliance/).

## Source register

- https://www.nist.gov/itl/ai-risk-management-framework
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- https://www.iso.org/standard/81230.html

## Provenance notes

- NIST AI RMF and the Generative AI Profile are used for risk governance, not as certifications; EU AI Act legal classification and role must be confirmed by qualified owners.

## Grounding rule

Documentation and standards describe expected behaviour and control intent. They do not prove the target's live state, that a control operated, or that a framework applies. Applicability and compliance are owner determinations; treat any such claim as `assumption` until independently observed and owner-confirmed.