10. Reading list

The sources that formed the discipline, curated and annotated, each with a verified URL and a one-line note on why it matters.

By Jorge García Aibar
v0.5.0
Updated 2026-09-30
29 min read
5,826 words
CC BY 4.0

New to the field? Start with AI governance explained.

Key terms in this chapter

This is a working bibliography, not a canon. Entries are grouped by theme and annotated in one line. URLs are given inline with a verification tag (primary, secondary, reported) so the chapter is self-documenting; every URL is either drawn from the book’s research digest or verified for this edition. Tools are named as category examples, illustrative and not endorsements.

Every entry also carries two tags: the audience it serves best (engineering, governance, legal, leadership, research) and the jurisdiction it speaks to (global when it is not tied to one legal order). The tags are a reading aid, not a ranking. The same list, filterable by both tags, is on the site’s resources page. No commercial study guide for any certification is listed.

Foundational texts (the form and the method)

GRC Engineering Manifesto: the parent discipline’s founding statement; the structural and philosophical model for this book. https://grc.engineering/ (verified: primary) (audience: governance, engineering; jurisdiction: global)
“What is GRC Engineering” (Ayoub Fandi): the clearest definition of the parent method and the source of the “green dashboard over a broken control is theatre” test. https://grcengineer.com/what-is-grc-engineering/ (verified: primary) (audience: governance, engineering; jurisdiction: global)
The Agile Manifesto: the numbered values-and-principles form and the signatory model this book borrows. https://agilemanifesto.org/ (verified: primary) (audience: engineering, leadership; jurisdiction: global)
The Twelve-Factor App: the template for a numbered, practitioner-facing body of practice with a “who should read this” framing. https://12factor.net/ (verified: primary) (audience: engineering; jurisdiction: global)
CSIRO Responsible AI Pattern Catalogue: the pattern template (chapter 05) and proof that responsible-AI practice can be written as reusable patterns. https://research.csiro.au/ss/science/projects/responsible-ai-pattern-catalogue/ (verified: primary) (audience: engineering, research; jurisdiction: global)
privacypatterns.org: the precedent for translating a legal principle (privacy by design) into engineering patterns under CC BY. https://privacypatterns.org/ (verified: primary) (audience: engineering, legal; jurisdiction: global)

Regulation and standards

EU AI Act, consolidated text (EUR-Lex): Regulation (EU) 2024/1689 as amended by the Digital Omnibus (Regulation (EU) 2026/1744), consolidated on 27 July 2026; the primary obligation source for chapter 08. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary) (audience: legal, governance, engineering; jurisdiction: EU)
Digital Omnibus on AI, Regulation (EU) 2026/1744 (EUR-Lex): the amending act as published in the Official Journal on 24 July 2026, with the new dates and the new Articles 4a and 75a-75d. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng (verified: primary) (audience: legal, governance; jurisdiction: EU)
AI Act Explorer (Future of Life Institute): a navigable, article-by-article reading of the Act and the Omnibus changes; commentary and navigation, not the legal text. https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/ (verified: secondary) (audience: legal, governance, engineering; jurisdiction: EU)
GPAI Code of Practice: the Commission’s voluntary code for general-purpose AI, including the safety and security chapter whose signatories commit to model evaluations. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai (verified: primary) (audience: legal, engineering; jurisdiction: EU)
Standardisation of the AI Act (European Commission): the Commission’s own status page for the harmonised standards that would grant a presumption of conformity; as of 2026-09-24, none is OJ-cited. https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation (verified: primary) (audience: governance, legal; jurisdiction: EU)
“ISO/IEC 42001 and the AI Act: why certification is not yet a presumption of conformity”: the key relationship between the AIMS standard (and 42005/42006) and the Act. https://lawandtechnology.eu/en/iso-iec-42001-and-the-ai-act-why-certification-is-not-yet-a-presumption-of-conformity/ (verified: secondary) (audience: governance, legal; jurisdiction: EU)
JTC 21 harmonised-standards tracker: a vendor-maintained tracker of the stage each JTC 21 deliverable has reached; useful for dates, read against the Commission’s page above. https://kla.digital/blog/jtc-21-standards-tracker (verified: secondary) (audience: governance; jurisdiction: EU)
NIST AI Risk Management Framework 1.0: the Govern/Map/Measure/Manage functions used as a mapping target throughout. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary) (audience: governance, engineering; jurisdiction: US)
NIST NCCoE, “Software and AI Agent Identity and Authorization” (concept paper): the emerging reference for non-human identity, the precondition of agent governance. https://www.nccoe.nist.gov/news-insights/new-concept-paper-identity-and-authority-software-agents (verified: primary) (audience: engineering; jurisdiction: US)
NIST CAISI AI Agent Standards Initiative: the effort to make agent interoperability and security standard, not per-vendor. https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure (verified: primary) (audience: engineering, governance; jurisdiction: US)
OWASP GenAI Security Project: the home of the Top 10 for LLM Applications, the Top 10 for Agentic Applications, the AIBOM project and the AI Maturity Assessment. https://genai.owasp.org/ (verified: primary) (audience: engineering; jurisdiction: global)
CSA AI Controls Matrix and STAR for AI: the control framework and assurance programme mapped to ISO 42001 and NIST AI RMF (chapters 07-08). https://cloudsecurityalliance.org/star/ai (verified: primary) (audience: governance, engineering; jurisdiction: global)
MITRE ATLAS: the adversarial tactics-and-techniques knowledge base for AI, including agent techniques, that threat models draw on. https://atlas.mitre.org/ (verified: primary) (audience: engineering; jurisdiction: global)
NSA CSI, “MCP: Security Design Considerations”: government guidance on securing the Model Context Protocol that connects agents to tools. https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4496698/ (verified: primary) (audience: engineering; jurisdiction: US)
“California’s SB 53: the first frontier-AI law explained” (FPF): the clearest read on California’s SB 53 (TFAIA), the first US frontier-AI transparency law. https://fpf.org/blog/californias-sb-53-the-first-frontier-ai-law-explained/ (verified: secondary) (audience: legal, governance; jurisdiction: US)
New York RAISE Act (Governor’s signing announcement): New York’s frontier-AI safety law (S6953B), signed 19 December 2025 and effective 1 January 2027 after a March 2026 chapter amendment, with an oversight office in the Department of Financial Services. https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models (verified: primary) (audience: legal, governance; jurisdiction: US)
NIST AI 800-1, “Managing Misuse Risk for Dual-Use Foundation Models” (second public draft): US NIST/CAISI voluntary guidance on identifying, measuring and mitigating misuse risk across the model lifecycle; still a draft. https://www.nist.gov/news-events/news/2025/01/updated-guidelines-managing-misuse-risk-dual-use-foundation-models (verified: primary) (audience: engineering, governance; jurisdiction: US)
NIST ARIA (Assessing Risks and Impacts of AI): NIST’s evaluation environment that tests model risks and impacts through model testing, red teaming and field testing; a reference for layer 03. https://ai-challenges.nist.gov/aria (verified: primary) (audience: engineering, research; jurisdiction: US)
UK AI Security Institute: the UK government institute that evaluates advanced-AI risks and publishes the Inspect eval framework this book uses as the layer-03 reference. https://www.aisi.gov.uk/ (verified: primary) (audience: engineering, research; jurisdiction: UK)
US Center for AI Standards and Innovation (CAISI): NIST’s center for AI standards, testing and security, formerly the US AI Safety Institute; the US government’s point of contact for industry. https://www.nist.gov/caisi (verified: primary) (audience: governance, research; jurisdiction: US)
AI Safety Governance Framework 3.0 (TC260, under CAC guidance): China’s voluntary framework, bilingual PDF; Appendix 2 is the agentic AI risk-management framework (identity, human checkpoints, guardrails, memory, decommissioning). https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf (verified: primary) (audience: governance, engineering; jurisdiction: China)
Interim Measures for the Administration of Generative AI Services: China’s binding rule for generative AI offered to the public within the PRC, in force 2023-08-15; official Chinese text. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm (verified: primary) (audience: legal; jurisdiction: China)
Provisions on the Administration of Deep Synthesis in Internet Information Services: labelling, training-data and consent duties for deep synthesis, in force 2023-01-10; official Chinese text. https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm (verified: primary) (audience: legal; jurisdiction: China)
Provisions on the Administration of Algorithmic Recommendation in Internet Information Services: algorithm filing, security assessment and user opt-out, in force 2022-03-01; official Chinese text. https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm (verified: primary) (audience: legal; jurisdiction: China)
Measures for Labelling AI-Generated Synthetic Content: explicit and implicit labels, in force 2025-09-01 alongside the mandatory standard GB 45438-2025; official Chinese text. https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm (verified: primary) (audience: legal, engineering; jurisdiction: China)
South Korea AI Basic Act: the framework Act in force 2026-01-22, with heightened duties for high-impact AI; the source chapter 08 already cites. https://www.trade.gov/market-intelligence/south-korea-ai-basic-act (verified: secondary) (audience: legal, governance; jurisdiction: South Korea)
Model AI Governance Framework for Generative AI (IMDA / AI Verify Foundation): Singapore’s voluntary framework (May 2024): testing, transparency, incident reporting, security and content provenance. https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf (verified: primary) (audience: governance, engineering; jurisdiction: Singapore)

International principles and frameworks

OECD Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449): the AI Principles as revised in 2024, and the source of the AI-system definition and lifecycle that the AI Act and the Council of Europe Convention follow. https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 (verified: primary) (audience: governance, leadership, legal; jurisdiction: global)
Explanatory memorandum on the updated OECD definition of an AI system: why the 2023 definition changed and how autonomy and adaptiveness are meant. https://www.oecd.org/en/publications/explanatory-memorandum-on-the-updated-oecd-definition-of-an-ai-system_623da898-en.html (verified: primary) (audience: governance, legal; jurisdiction: global)
HUDERIA: risk and impact assessment of AI systems (Council of Europe): the human-rights impact methodology and its context model, to reconcile with an existing FRIA. https://www.coe.int/en/web/artificial-intelligence/huderia-risk-and-impact-assessment-of-ai-systems (verified: primary) (audience: governance, legal; jurisdiction: global)
Towards a common reporting framework for AI incidents (OECD, 2025): the 29 criteria an incident record can be aligned with across jurisdictions; the basis of the incident-record field names in the templates library. https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/02/towards-a-common-reporting-framework-for-ai-incidents_8c488fdb/f326d4ac-en.pdf (verified: primary) (audience: governance, engineering; jurisdiction: global)
“Defining AI incidents and related terms” (OECD.AI): the shared vocabulary of AI incident, AI hazard and their serious variants. https://oecd.ai/en/wonk/defining-ai-incidents-and-hazards (verified: primary) (audience: governance, legal; jurisdiction: global)

EU guidance, codes and adjacent law

Commission Guidelines on the definition of an AI system: the operative EU test for scope: the seven elements, the low autonomy bar and the excluded families of software. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-first-ai-acts-rules-application (verified: primary) (audience: legal, governance, engineering; jurisdiction: EU)
Commission Guidelines on the scope of obligations for providers of general-purpose AI models: the compute criteria for GPAI models, when fine-tuning or modifying a model makes you its provider, and the open-source monetisation test. https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act (verified: primary) (audience: legal, engineering; jurisdiction: EU)
Draft Commission guidelines on the classification of high-risk AI systems: practical examples for Art. 6 and the Art. 6(3) filter; still a draft as of 2026-09-24. https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems (verified: primary) (audience: legal, governance; jurisdiction: EU)
AI Literacy: Questions & Answers (European Commission): the Commission’s own reading of Article 4 after the Omnibus: no certificate required, internal records, and who counts as “other persons”. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers (verified: primary) (audience: governance, leadership; jurisdiction: EU)
Code of Practice on Transparency of AI-generated Content: the voluntary route to the Art. 50 marking and labelling duties. https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content (verified: primary) (audience: engineering, legal; jurisdiction: EU)
GPAI serious-incident reporting template (European Commission, 4 Nov 2025): the fields a GPAI serious-incident report carries, including root-cause analysis and near-miss patterns. https://digital-strategy.ec.europa.eu/en/library/ai-act-commission-publishes-reporting-template-serious-incidents-involving-general-purpose-ai (verified: primary) (audience: governance, engineering; jurisdiction: EU)
Updated EU AI model contractual clauses (MCC-AI): the reference contract text for buying AI, in a high-risk and a light version, with a commentary; usable beyond public procurement. https://public-buyers-community.ec.europa.eu/communities/procurement-ai/resources/updated-eu-ai-model-contractual-clauses (verified: primary) (audience: legal, governance; jurisdiction: EU)
EDPB Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models: the EU data protection authorities’ reference on model anonymity, legitimate interest for AI and what unlawful training means for deployers. https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en (verified: primary) (audience: legal, governance; jurisdiction: EU)
EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V of the GDPR: the three criteria that decide whether a remote inference call or a support access is an international transfer. https://www.edpb.europa.eu/system/files/documents/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf (verified: primary) (audience: legal; jurisdiction: EU)
CNIL, “Ensuring and facilitating the exercise of data subjects’ rights” (AI how-to sheet): the most practical regulator text on rights against trained models: retraining, output filters and their limits. https://www.cnil.fr/en/ensuring-and-facilitating-exercise-data-subjects-rights (verified: primary) (audience: legal, engineering; jurisdiction: EU, France)
CNIL, “Relying on the legal basis of legitimate interests to develop an AI system”: a step-by-step balancing test and the additional safeguards for AI training. https://www.cnil.fr/en/relying-legal-basis-legitimate-interests-develop-ai-system (verified: primary) (audience: legal; jurisdiction: EU, France)
AEPD guidance on agentic AI from a data protection perspective (press release): a regulator’s analysis of agents: autonomy, memory, threats and controller measures; in Spanish. https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-publica-unas-orientaciones-sobre-inteligencia (verified: primary) (audience: legal, engineering; jurisdiction: EU, Spain)
Hamburg DPA, “Discussion Paper: Large Language Models and Personal Data”: the view that LLMs do not store personal data; read it beside the EDPB opinion. https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/240715_Discussion_Paper_Hamburg_DPA_KI_Models.pdf (verified: primary) (audience: legal; jurisdiction: EU, Germany)
AESIA guides from the Spanish AI sandbox: sixteen non-binding guides with checklists for the EU high-risk requirements, produced in a regulatory sandbox; in Spanish. https://aesia.digital.gob.es/es/guias (verified: primary) (audience: governance, engineering; jurisdiction: EU, Spain)
Directive (EU) 2024/2853 on liability for defective products: the text that makes software a product, sets disclosure duties and presumptions, and ties liability to updates. https://eur-lex.europa.eu/eli/dir/2024/2853/oj (verified: primary) (audience: legal, leadership; jurisdiction: EU)

Government and regulator guidance beyond the EU

NIST AI 600-1, Generative Artificial Intelligence Profile: twelve risks that generative AI creates or worsens, with suggested actions keyed to AI RMF subcategories, usable as eval-suite names. https://doi.org/10.6028/NIST.AI.600-1 (verified: primary) (audience: governance, engineering; jurisdiction: US)
NIST AI RMF Playbook: suggested actions and documentation questions per subcategory; the documentation questions make good acceptance criteria for controls. https://airc.nist.gov/airmf-resources/playbook/govern/ (verified: primary) (audience: governance, engineering; jurisdiction: US)
NIST AI RMF Playbook: MANAGE: post-deployment monitoring, third-party risk and deactivation, subcategory by subcategory. https://airc.nist.gov/airmf-resources/playbook/manage/ (verified: primary) (audience: governance, engineering; jurisdiction: US)
Crosswalk: AI RMF (1.0) and ISO/IEC FDIS 23894 (NIST, 2023): a two-page map from the four AI RMF functions to ISO/IEC 23894 clauses; the quickest way to see they describe one process. https://www.nist.gov/system/files/documents/2023/01/26/crosswalk_AI_RMF_1_0_ISO_IEC_23894.pdf (verified: primary) (audience: governance; jurisdiction: US)
NIST SP 1270, “Towards a Standard for Identifying and Managing Bias in Artificial Intelligence”: the shortest authoritative map of where AI bias comes from (systemic, statistical, human). https://doi.org/10.6028/NIST.SP.1270 (verified: primary) (audience: engineering, governance; jurisdiction: US)
NIST IR 8312, “Four Principles of Explainable Artificial Intelligence”: four principles, including explanation accuracy and knowledge limits, that translate into eval criteria for explanations. https://doi.org/10.6028/NIST.IR.8312 (verified: primary) (audience: engineering, research; jurisdiction: US)
NIST AI 100-2 E2025, “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations”: the shared vocabulary of attacks on predictive and generative AI that red-team plans and threat models can cite. https://doi.org/10.6028/NIST.AI.100-2e2025 (verified: primary) (audience: engineering, research; jurisdiction: US)
NIST SP 800-61 Rev. 3, “Incident Response Recommendations and Considerations for Cybersecurity Risk Management”: incident response recast around the CSF 2.0 functions; the base the AI-specific lifecycle adapts. https://csrc.nist.gov/pubs/sp/800/61/r3/final (verified: primary) (audience: engineering, governance; jurisdiction: US)
NIST SP 800-226, “Guidelines for Evaluating Differential Privacy Guarantees”: how to evaluate a differential-privacy claim and the hazards that break it in practice. https://csrc.nist.gov/pubs/sp/800/226/final (verified: primary) (audience: engineering, legal; jurisdiction: US)
OMB Memorandum M-25-21: the US federal definition of high-impact AI, its minimum practices and a public template for a Chief AI Officer’s duties and an AI governance board. https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf (verified: primary) (audience: governance, leadership; jurisdiction: US)
SR 26-2, Revised Guidance on Model Risk Management (Federal Reserve, OCC, FDIC): supersedes SR 11-7; effective challenge and validation, tailored to risk profile, with generative and agentic AI explicitly out of scope. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm (verified: primary) (audience: governance, legal; jurisdiction: US)
CFPB Circular 2022-03: adverse action and complex algorithms: why model complexity does not excuse inaccurate adverse-action reasons; withdrawn by the CFPB on 12 May 2025, while the Regulation B duty it read stands. https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/ (verified: primary) (audience: legal, engineering; jurisdiction: US)
NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers: a regulator-written template for an AI governance programme in a regulated industry, including third-party AI. https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf (verified: primary) (audience: governance, legal; jurisdiction: US)
Copyright and Artificial Intelligence (U.S. Copyright Office): the Office’s position on authorship of AI outputs and on training, with the registration guidance. https://copyright.gov/ai/ (verified: primary) (audience: legal; jurisdiction: US)
ICO, Guidance on AI and data protection: the UK view on lawfulness, inferences, fairness and individual rights in AI; under review after the Data (Use and Access) Act as of 2026-09-24. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (verified: primary) (audience: legal, governance; jurisdiction: UK)
ICO and The Alan Turing Institute, “Explaining decisions made with AI”: six explanation types and a task-by-task method for explaining AI decisions to affected people; under review as of 2026-09-24. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/explaining-decisions-made-with-artificial-intelligence/ (verified: primary) (audience: engineering, legal; jurisdiction: UK)
General Understanding on AI and Copyright in Japan (Japan Copyright Office): a short official reading of Article 30-4 that shows where the Japanese training exception ends. https://www.bunka.go.jp/english/policy/copyright/pdf/94055801_01.pdf (verified: primary) (audience: legal; jurisdiction: Japan)
Directive on Automated Decision-Making (Treasury Board of Canada Secretariat): a mature, published impact-assessment regime with requirements scaled by impact level. https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592 (verified: primary) (audience: governance, legal; jurisdiction: Canada)
Model AI Governance Framework for Agentic AI, v1.5 (IMDA): a government framework for agents organised in four practical dimensions, from bounding risk to end-user responsibility. https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf (verified: primary) (audience: governance, engineering; jurisdiction: Singapore)
Korea AI Basic Act and Enforcement Decree (Korean Law Information Center): the primary text of the non-EU horizontal AI act with the most operator duties; the decree carries the thresholds; in Korean. https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543 (verified: primary) (audience: legal; jurisdiction: South Korea)

Frontier safety frameworks (the labs’ own commitments)

Anthropic Responsible Scaling Policy: Anthropic’s own frontier-safety framework of capability thresholds and required safeguards; the page states version 3.4, effective 8 July 2026. https://www.anthropic.com/responsible-scaling-policy (verified: primary) (audience: governance, research; jurisdiction: global)
OpenAI Preparedness Framework: OpenAI’s own framework for tracking and preparing for frontier capabilities that could cause severe harm; the document states Version 2, last updated 15 April 2025. https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf (verified: primary) (audience: governance, research; jurisdiction: global)
Google DeepMind Frontier Safety Framework: DeepMind’s own framework of critical capability levels and mitigations; the page states version 3.1, updated 17 April 2026. https://deepmind.google/discover/blog/strengthening-our-frontier-safety-framework/ (verified: primary) (audience: governance, research; jurisdiction: global)

The frontier safety frameworks crosswalk maps these three frameworks to the NIST AI RMF and ISO/IEC 42001 across 13 governance dimensions.

Papers (machine-readable evidence and agent governance)

“Making AI Compliance Evidence Machine-Readable” (arXiv 2604.13767): extends OSCAL for AI and argues frameworks specify what to assure but no executable how. https://arxiv.org/html/2604.13767v1 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Audit-as-code” (Frontiers in AI): an assured-readiness score with proceed/remediate/block gates; audit output as a build artefact. https://pubmed.ncbi.nlm.nih.gov/41837238/ (verified: primary) (audience: engineering, research; jurisdiction: global)
Policy Cards (arXiv 2510.24383): JSON-schema, machine-readable runtime governance artefacts for agents. https://arxiv.org/abs/2510.24383 (verified: primary) (audience: engineering, research; jurisdiction: global)
TAIP (arXiv 2603.03340): treats NIST TEVV outputs as AI assurance objects. https://arxiv.org/abs/2603.03340 (verified: primary) (audience: engineering, research; jurisdiction: global)
AI Trust OS (arXiv 2604.04749): an operating-system framing for continuous AI trust and assurance. https://arxiv.org/abs/2604.04749 (verified: primary) (audience: engineering, research; jurisdiction: global)
AAGATE (arXiv 2510.25863): a NIST AI RMF-aligned agent governance platform design. https://arxiv.org/abs/2510.25863 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims” (Brundage et al., 2020): institutional, software and hardware mechanisms that turn a developer’s claim into something an outsider can check; the argument behind evidence over assertion. https://arxiv.org/abs/2004.07213 (verified: primary) (audience: governance, research; jurisdiction: global)
“Practices for Governing Agentic AI Systems” (Shavit et al., OpenAI, 2023): a definition of agentic systems, the parties in their lifecycle and baseline practices such as constraining the action space, legibility of activity and the ability to interrupt. https://cdn.openai.com/papers/practices-for-governing-agentic-ai-systems.pdf (verified: primary) (audience: engineering, governance; jurisdiction: global)
“Visibility into AI Agents” (Chan et al., 2024): agent identifiers, real-time monitoring and activity logging as the three measures that make deployed agents visible. https://arxiv.org/abs/2401.13138 (verified: primary) (audience: engineering, governance; jurisdiction: global)

Canonical papers: documentation, audit and accountability

“Datasheets for Datasets” (Gebru et al.): the origin of structured dataset documentation; the human-readable half of a dataset admission record. https://arxiv.org/abs/1803.09010 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Model Cards for Model Reporting” (Mitchell et al., 2018): intended use and evaluation across groups and conditions, reported beside the model; the template behind every model card since. https://arxiv.org/abs/1810.03993 (verified: primary) (audience: engineering, governance; jurisdiction: global)
“Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing” (Raji et al., 2020): an internal audit run alongside development, stage by stage, with a documented artefact at each step. https://arxiv.org/abs/2001.00973 (verified: primary) (audience: governance, engineering; jurisdiction: global)
“Actionable Auditing” (Raji and Buolamwini, 2019): what happened after publicly naming the performance gaps of commercial systems; evidence that external audits move vendors. https://doi.org/10.1145/3306618.3314244 (verified: primary) (audience: governance, research; jurisdiction: global)
“Auditing large language models: a three-layered approach” (Mökander et al., 2023): governance, model and application audits as three complementary layers. https://arxiv.org/abs/2302.08500 (verified: primary) (audience: governance, research; jurisdiction: global)
“The Gradient of Generative AI Release” (Irene Solaiman, 2023): a vocabulary for release decisions, from fully closed to fully open. https://arxiv.org/abs/2302.04844 (verified: primary) (audience: governance, leadership; jurisdiction: global)
“How the machine ‘thinks’: Understanding opacity in machine learning algorithms” (Burrell, 2016): three sources of opacity, each needing a different fix. https://doi.org/10.1177/2053951715622512 (verified: primary) (audience: governance, research; jurisdiction: global)
“Fairness and Abstraction in Sociotechnical Systems” (Selbst et al., 2019): five traps a technical fairness intervention falls into when it abstracts away the social context. https://doi.org/10.1145/3287560.3287598 (verified: primary) (audience: engineering, research; jurisdiction: global)
“On the Dangers of Stochastic Parrots” (Bender, Gebru et al., 2021): the costs and risks of ever larger language models, from undocumented training data to environmental cost. https://doi.org/10.1145/3442188.3445922 (verified: primary) (audience: research, leadership; jurisdiction: global)
“Ethical and social risks of harm from Language Models” (Weidinger et al., 2021): a structured taxonomy of language-model harms, a ready starting list for a risk register. https://arxiv.org/abs/2112.04359 (verified: primary) (audience: governance, research; jurisdiction: global)
“Concrete Problems in AI Safety” (Amodei et al., 2016): five practical failure modes (side effects, reward hacking, oversight, safe exploration, distributional shift) stated as engineering problems. https://arxiv.org/abs/1606.06565 (verified: primary) (audience: engineering, research; jurisdiction: global)

Canonical papers: measurement, fairness and evaluation

“Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification” (Buolamwini and Gebru, 2018): the audit that made disaggregated, intersectional evaluation the norm. https://proceedings.mlr.press/v81/buolamwini18a.html (verified: primary) (audience: engineering, research; jurisdiction: global)
“Dissecting racial bias in an algorithm used to manage the health of populations” (Obermeyer et al., Science, 2019): the canonical proxy-label failure: a model accurate on cost and biased on need; the reason a model card must state the construct. https://doi.org/10.1126/science.aax2342 (verified: primary) (audience: engineering, governance; jurisdiction: US)
“Racial disparities in automated speech recognition” (Koenecke et al., PNAS, 2020): why one average hides a group’s worse service; the argument for disaggregated evals. https://doi.org/10.1073/pnas.1915768117 (verified: primary) (audience: engineering, research; jurisdiction: US)
“Inherent Trade-Offs in the Fair Determination of Risk Scores” (Kleinberg, Mullainathan and Raghavan): the impossibility result that makes the choice of fairness metric a governance decision rather than a technical one. https://arxiv.org/abs/1609.05807 (verified: primary) (audience: governance, research; jurisdiction: global)
“Stop Explaining Black Box Machine Learning Models for High Stakes Decisions and Use Interpretable Models Instead” (Rudin): the case for interpretable-by-design models in high-stakes decisions. https://arxiv.org/abs/1811.10154 (verified: primary) (audience: engineering, governance; jurisdiction: global)
“The Mythos of Model Interpretability” (Lipton, 2016): why “interpretable” names several different properties, and which one a requirement should ask for. https://arxiv.org/abs/1606.03490 (verified: primary) (audience: engineering, research; jurisdiction: global)
“On Calibration of Modern Neural Networks” (Guo et al., 2017): why a model score is not a probability until calibration is measured. https://arxiv.org/abs/1706.04599 (verified: primary) (audience: engineering, research; jurisdiction: global)
“A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification” (Angelopoulos and Bates): a practical, distribution-free way to turn scores into sets with a coverage guarantee. https://arxiv.org/abs/2107.07511 (verified: primary) (audience: engineering, research; jurisdiction: global)
“What’s Wrong with Risk Matrices?” (L. A. Cox Jr., Risk Analysis, 2008): the standard critique of likelihood-by-severity matrices and why a catastrophic track is needed. https://doi.org/10.1111/j.1539-6924.2008.01030.x (verified: primary) (audience: governance, research; jurisdiction: global)
“Adding Error Bars to Evals” (Evan Miller, 2024): evals treated as experiments: standard errors, model comparison and sample-size planning for eval gates. https://arxiv.org/abs/2411.00640 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Holistic Evaluation of Language Models” (Liang et al., 2022): many metrics across many scenarios, reported together, instead of one leaderboard number. https://arxiv.org/abs/2211.09110 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Model evaluation for extreme risks” (Shevlane et al., 2023): dangerous-capability and alignment evaluations as inputs to training, deployment and security decisions. https://arxiv.org/abs/2305.15324 (verified: primary) (audience: governance, research; jurisdiction: global)
“Red Teaming Language Models with Language Models” (Perez et al., 2022): automated red teaming, one model generating test cases for another. https://arxiv.org/abs/2202.03286 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” (Greshake et al., 2023): the paper that named indirect prompt injection, the core threat to agents that read untrusted content. https://arxiv.org/abs/2302.12173 (verified: primary) (audience: engineering, research; jurisdiction: global)
“Extracting Training Data from Large Language Models” (Carlini et al.): the canonical demonstration that language models regurgitate training data, and why extraction evals belong in the gate. https://arxiv.org/abs/2012.07805 (verified: primary) (audience: engineering, legal; jurisdiction: global)
“Power Hungry Processing: Watts Driving the Cost of AI Deployment?” (Luccioni, Jernite, Strubell): measures the inference energy gap between general-purpose generative and task-specific models. https://arxiv.org/abs/2311.16863 (verified: primary) (audience: engineering, leadership; jurisdiction: global)
“The Leaderboard Illusion” (Singh et al., 2025): why a public leaderboard cannot decide a model choice. https://arxiv.org/abs/2504.20879 (verified: primary) (audience: engineering, leadership; jurisdiction: global)
“Hidden Technical Debt in Machine Learning Systems” (Sculley et al., NeurIPS 2015): why the model is the small box in a production ML system, and where the debt accumulates around it. https://papers.nips.cc/paper_files/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html (verified: primary) (audience: engineering; jurisdiction: global)

Reports (the market and the profession)

IAPP AI Governance Profession Report 2025 (with Credo AI): where the function sits and how it is staffed; the profession’s baseline census. https://iapp.org/resources/article/ai-governance-profession-report/ (verified: primary) (audience: leadership, governance; jurisdiction: global)
IAPP Salary & Jobs Report 2025-26: the salary bands that anchor chapter 06, including the technical-AI-governance premium. https://iapp.org/resources/article/salary-survey-summary/ (verified: primary) (audience: leadership, governance; jurisdiction: global)
IAPP AI Governance Vendor Report 2026: the four vendor categories and the claim that AI governance “is not a single function, discipline or technology”. https://iapp.org/resources/article/ai-governance-vendor-report (verified: primary) (audience: governance, leadership; jurisdiction: global)
State of GRC 2026: the practitioner survey behind the “spreadsheet is still the #1 GRC tool” reality the discipline reacts against. https://grcengineer.com/report/ (verified: primary) (audience: governance; jurisdiction: global)
“Global AI Regulations Fuel Billion-Dollar Market for AI Governance Platforms” (Gartner): the analyst’s own framing of the platform category, including runtime policy enforcement, and its spend forecast. https://www.gartner.com/en/newsroom/press-releases/2026-02-17-gartner-global-ai-regulations-fuel-billion-dollar-market-for-ai-governance-platforms (verified: primary) (audience: leadership; jurisdiction: global)
Gartner Magic Quadrant for AI Governance Platforms, June 2026 (via IBM): one named vendor’s account of the first MQ for the category; the report itself is licensed, so read this as a vendor’s summary. https://www.ibm.com/new/announcements/ibm-recognized-as-a-leader-in-gartner-magic-quadrant-for-ai-governance-platforms (verified: secondary) (audience: leadership; jurisdiction: global)
HiddenLayer 2026 AI Threat Landscape Report: a security vendor’s survey and the source of the “one in eight breaches were agentic” finding; read it as a vendor survey. https://www.hiddenlayer.com/report-and-guide/threatreport2026 (verified: primary) (audience: engineering, leadership; jurisdiction: global)
International AI Safety Report 2026: the second edition (3 February 2026) of the scientific assessment of general-purpose AI capabilities, risks and risk management, chaired by Yoshua Bengio and backed by more than 30 countries and international organisations. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026 (verified: primary) (audience: leadership, research, governance; jurisdiction: global)
The 2026 AI Index Report (Stanford HAI): the annual data record of AI across research, technical performance, responsible AI, the economy, policy and public opinion; the place to check a trend before quoting it. https://hai.stanford.edu/ai-index/2026-ai-index-report (verified: primary) (audience: leadership, research; jurisdiction: global)

Incident and risk repositories (the empirical record)

AI Incident Database: the Responsible AI Collaborative’s catalogue of real-world AI harms and near-harms; a reference corpus for threat modelling and post-market monitoring. https://incidentdatabase.ai/ (verified: primary) (audience: governance, engineering, research; jurisdiction: global)
AIAAIC Repository: an independent, open register of AI, algorithmic and automation incidents and controversies across sectors. https://www.aiaaic.org/aiaaic-repository (verified: primary) (audience: governance, research; jurisdiction: global)
OECD.AI Incidents & Hazards Monitor (AIM): the OECD’s live monitor of AI incidents and hazards drawn from global media, built to inform policy. https://oecd.ai/en/incidents (verified: primary) (audience: governance, leadership; jurisdiction: global)
AI Vulnerability Database (AVID): the AI Risk and Vulnerability Alliance’s open knowledge base of failure modes for general-purpose AI systems. https://avidml.org/ (verified: primary) (audience: engineering, research; jurisdiction: global)
MIT AI Risk Repository: MIT FutureTech’s living database of 1,700+ AI risks classified across 65 frameworks; a taxonomy for intake and risk tiers. https://airisk.mit.edu/ (verified: primary) (audience: governance, research; jurisdiction: global)
NJCM et al. v. The State of the Netherlands (SyRI), The Hague District Court, 5 Feb 2020: a court striking down a risk-scoring system because it was not transparent and verifiable enough to weigh. https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBDHA:2020:1878 (verified: primary) (audience: legal, governance; jurisdiction: EU, Netherlands)
“Xenophobic machines” (Amnesty International, 2021): the fullest public account of how a nationality indicator entered the Dutch childcare-benefits risk system. https://www.amnesty.org/en/documents/eur35/4686/2021/en/ (verified: primary) (audience: governance, legal; jurisdiction: EU, Netherlands)

Engineering and assurance practice

The IIA’s Three Lines Model (2020): the split between governing body, management’s first and second lines and independent internal audit, which an AI governance programme has to map onto, including who accepts residual risk. https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/ (verified: primary) (audience: governance, leadership; jurisdiction: global)
“Postmortem Culture: Learning from Failure” (Google SRE book): the reference text for blameless post-mortems and for setting post-mortem triggers in advance, which AI incident and near-miss reviews should borrow. https://sre.google/sre-book/postmortem-culture/ (verified: primary) (audience: engineering, governance; jurisdiction: global)
“Canarying Releases” (The Site Reliability Workbook, Google): the engineering basis for progressive delivery as a governance control. https://sre.google/workbook/canarying-releases/ (verified: primary) (audience: engineering; jurisdiction: global)
Fairlearn user guide, “Fairness in machine learning”: a practitioner’s introduction to allocation and quality-of-service harms and to disparity metrics, with runnable examples. https://fairlearn.org/main/user_guide/fairness_in_machine_learning.html (verified: primary) (audience: engineering; jurisdiction: global)
“Responsible Sourcing of Data Enrichment Services” (Partnership on AI): practical guidance on annotator conditions (pilots, instructions, pay, communication, quality assurance), the labour side of data governance. https://partnershiponai.org/paper/responsible-sourcing-considerations/ (verified: primary) (audience: governance, leadership; jurisdiction: global)
JSON Schema Draft 2020-12: the specification the templates library is written in; any conforming validator checks the records. https://json-schema.org/draft/2020-12 (verified: primary) (audience: engineering; jurisdiction: global)

Tools (illustrative categories, not endorsements)

Inspect AI (UK AI Security Institute): an open eval framework, the reference example for evals-as-evidence and eval gates. https://github.com/UKGovernmentBEIS/inspect_ai (verified: primary) (audience: engineering; jurisdiction: global)
Awesome Responsible AI (AthenaCore): a broad, maintained index of responsible-, trustworthy- and human-centred-AI resources spanning every layer of the stack. https://github.com/AthenaCore/AwesomeResponsibleAI (verified: primary) (audience: engineering, governance; jurisdiction: global)
Awesome Production Machine Learning (EthicalML): the reference index of open-source libraries to deploy, monitor, version and scale ML; the tooling map for layers 02 and 04. https://github.com/EthicalML/awesome-production-machine-learning (verified: primary) (audience: engineering; jurisdiction: global)
awesome-opa (Open Policy Agent): the OPA ecosystem’s own index of policy-as-code tools and integrations for layer 01. https://github.com/open-policy-agent/awesome-opa (verified: primary) (audience: engineering; jurisdiction: global)
Awesome OSCAL (OSCAL Club): a curated index of OSCAL tools and resources for the machine-readable evidence of layer 05. https://github.com/oscal-club/awesome-oscal (verified: primary) (audience: engineering, governance; jurisdiction: global)
awesome-ml-security (Trail of Bits): a curated index of machine-learning security resources feeding layer 03 red teaming and layer 04 runtime controls. https://github.com/trailofbits/awesome-ml-security (verified: primary) (audience: engineering; jurisdiction: global)

Books

Fairness and Machine Learning: Limitations and Opportunities (Barocas, Hardt and Narayanan; MIT Press, 2023): the standard text on what fairness criteria can and cannot say; readable in full online. https://fairmlbook.org/ (verified: primary) (audience: engineering, research; jurisdiction: global)
Interpretable Machine Learning (Christoph Molnar): a practical guide to interpretable models and post-hoc explanation methods, with their limits; readable in full online. https://christophm.github.io/interpretable-ml-book/ (verified: primary) (audience: engineering; jurisdiction: global)
Patterns, Predictions, and Actions (Hardt and Recht; Princeton University Press): machine learning from prediction to action, including the datasets and benchmarks the field relies on; a full preprint is online. https://mlstory.org/ (verified: primary) (audience: engineering, research; jurisdiction: global)
Introduction to AI Safety, Ethics and Society (Dan Hendrycks; Taylor & Francis, 2024): a broad textbook on AI risk, from single-system failures to governance; readable online. https://www.aisafetybook.com/ (verified: primary) (audience: governance, leadership, research; jurisdiction: global)
The Algorithmic Foundations of Differential Privacy (Dwork and Roth, 2014): the formal reference behind every differential-privacy claim a vendor makes. https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf (verified: primary) (audience: engineering, research; jurisdiction: global)
Site Reliability Engineering (Google): the operating discipline that runtime controls, incident response and error budgets borrow from; readable in full online. https://sre.google/sre-book/table-of-contents/ (verified: primary) (audience: engineering; jurisdiction: global)
Designing Machine Learning Systems (Chip Huyen; O’Reilly, 2022): the production lifecycle of ML systems, from data to monitoring; linked here through the author’s companion repository. https://github.com/chiphuyen/dmls-book (verified: primary) (audience: engineering; jurisdiction: global)
AI Engineering (Chip Huyen, 2025): building applications on foundation models, with a long treatment of evaluation; linked here through the author’s companion repository. https://github.com/chiphuyen/aie-book (verified: primary) (audience: engineering; jurisdiction: global)
Responsible AI: Best Practices for Creating Trustworthy AI Systems (Lu, Zhu, Whittle and Xu; Addison-Wesley, 2023): the CSIRO team’s book-length treatment of responsible-AI patterns and governance mechanisms. https://www.informit.com/store/responsible-ai-best-practices-for-creating-trustworthy-9780138073923 (verified: primary) (audience: engineering, governance; jurisdiction: global)

Courses

Elements of AI (University of Helsinki and MinnaLearn): free online courses that introduce AI to non-experts; one way to start the AI-literacy programme Article 4 asks for. https://www.elementsofai.com/ (verified: primary) (audience: leadership, governance; jurisdiction: global)
Practical Data Ethics (fast.ai): a course first taught at the University of San Francisco Data Institute in 2020, on disinformation, bias and fairness, privacy and surveillance, and metrics. https://ethics.fast.ai/ (verified: primary) (audience: engineering, governance; jurisdiction: global)
Made With ML (Goku Mohandas): a course on designing, developing, deploying and iterating on production ML, the pipeline that governance gates plug into. https://madewithml.com/ (verified: primary) (audience: engineering; jurisdiction: global)
Frontier AI Governance (BlueDot Impact): a cohort-based course on the policy and governance of frontier AI. https://bluedot.org/courses/ai-governance (verified: primary) (audience: governance, leadership; jurisdiction: global)
AI Safety, Ethics and Society virtual course (Center for AI Safety): the course that follows the Hendrycks textbook above. https://www.aisafetybook.com/virtual-course (verified: primary) (audience: governance, research; jurisdiction: global)
Red Teaming LLM Applications (DeepLearning.AI, with Giskard): a short, hands-on course on finding and scripting LLM application failures. https://www.deeplearning.ai/courses/red-teaming-llm-applications (verified: primary) (audience: engineering; jurisdiction: global)
Secure AI/ML-Driven Software Development, LFEL1012 (Linux Foundation): a short, self-paced course on the security of software built with and around AI. https://training.linuxfoundation.org/express-learning/secure-ai-ml-driven-software-development-lfel1012/ (verified: primary) (audience: engineering; jurisdiction: global)
Machine Learning Crash Course: Fairness (Google for Developers): a short module on types of bias and on identifying, mitigating and evaluating for bias. https://developers.google.com/machine-learning/crash-course/fairness (verified: primary) (audience: engineering; jurisdiction: global)

Communities and newsletters

GRC Engineer (grcengineer.com): the parent community’s hub; the analyst-vs-engineer framing and the role definitions this book adapts. https://grcengineer.com/ (verified: primary) (audience: governance, engineering; jurisdiction: global)
blog.grc.engineering, “GRC Engineering in 2026” (Justin Pagano): the forward view: policy-as- code guardrails in CI/CD, trust operations centres, agentic extensions. https://blog.grc.engineering/p/grc-engineering-in-2026 (verified: primary) (audience: governance, engineering; jurisdiction: global)
IAPP (iapp.org): the professional body whose reports, certifications and events map the AI governance profession. https://iapp.org/ (verified: primary) (audience: governance, legal, leadership; jurisdiction: global)

Maps to: this chapter makes no normative claim; the standards and frameworks it lists are treated in full in chapters 04, 05, 07 and 08. Mappings elsewhere in the book are illustrative, not a claim of conformity.

Sources

The reading list is its own source set: each entry above carries its URL and a verification tag inline, and every URL is recorded as a row in this chapter’s section of sources/SOURCES.md. Items whose URL could not be drawn from the research digest or verified for this edition were left out. The v0.5.0 additions were checked on 2026-09-24: each URL answered, arXiv entries were matched against the arXiv API and DOIs against Crossref.