Validation

This bundle uses a selective citation posture. The claims that carry weight — the NIST AI RMF's four function definitions, ISO/IEC 42001's scope, Microsoft's worked-example review practices, and the reporting-line survey data — are cited to primary sources and verified. The "three lines of defense" framing used to distinguish this role from the AI Risk Officer is practitioner convention, not a regulatory citation, and is presented as such.

Every embedded fact is verified against a primary source before it ships (verify-embedded-facts), whether or not it carries a citation. Note: research surfaced a newer-sounding IAPP figure set ("2025-26," larger sample, salary data) that could not be independently confirmed on re-fetch — only the 2024-survey breakdown that was directly verified is cited here. Verified claims live in evidence.yaml; each page's ## Sources list is generated from it. Validation sweeps are recorded here as dated audits.