Policy & Regulatory Engagement
Setting Technical Realities for AI Audio Policy
Box Commons engages directly with federal, state, and international regulators to ensure AI audio standards reflect the operational realities of independent creators and broadcasters.
Where our work landed
On the record with 14 regulators. Cited by NHTSA, credited by Singapore.
Cited by an agency · NHTSA
“Some comments suggested requiring some form of independent or additional verification of the reported information.”
NHTSA's May 26, 2026 notice on its crash-reporting order cites our comment among them (FR Doc. 2026-10363, n. 18). It decided the change was not necessary at this time.
Acknowledged by an agency · Singapore IMDA
“We extend our sincere gratitude to the organisations and individuals that supported the development of this document by sharing their feedback and real-world experiences.”
Box Commons is listed in the Acknowledgements of the Model AI Governance Framework for Agentic AI (Version 1.5, p. 53), alongside Google, Microsoft, IBM, and Amazon Web Services.
Agencies acted
proceedings where the agency acted after we filed, with a proposed rule or a decision: Federal Reserve, FAR Council, NHTSA.
On the record
filings with 14 agencies, including NIH, the Copyright Office, the FCC, and the CDC.
Audio Provenance & Watermarking
All 2 in the archive →Comment on the Copyright Office Notice of Inquiry: Music Streaming Fraud
Streaming fraud runs on recordings whose origin no one in the payment chain can verify. Detection and clawbacks act after money moves. Recommends a voluntary, minimum provenance record attached to each recording at ingestion, a protected fraud-information safe harbor with appeal rights, and factual labels kept separate from legal royalty eligibility.
Comment on the Robocall Mitigation Database FNPRM: Content Provenance as a Complement to Call Authentication
STIR/SHAKEN authenticates who is calling, not what the caller says. Recommends the Commission recognize independent content provenance certification, aligned with C2PA content credentials, as a media-layer complement to signaling-layer call authentication within the Robocall Mitigation Database framework. Reply comments filed October 13, 2026 show the initial record confirms two verification gaps — program and content — and propose how to close each without new mandates.
Clean Training Data & Licensing
All 3 in the archive →Comment on the CDC Data Intermediaries RFI: Data Quality Certification as a Universal Intermediary Baseline
Health data exchange has independently certified cybersecurity but no equivalent certification for data quality, accuracy, or provenance. Recommends the CDC include independent data quality and provenance certification in the proposed Universal Intermediary Baseline, building on the NCQA Data Aggregator Validation program.
Comment on Colorado ADMT Proposed Rules: Training Data Certification
Recommends that Colorado's ADMT proposed rules recognize independent data certification as a mechanism for developers to satisfy training data documentation obligations, with a rebuttable presumption that certified datasets meet disclosure requirements. Backed by a live 22-station broadcast radio certification pipeline.
Consent & Synthetic Voice/Likeness
All 5 in the archive →Comment on the NIH DPCPSI Reorganization (OCAIO): Make Bridge2AI's Consent and Provenance Practices the NIH Default
NIH's own Bridge2AI-Voice project releases voice data first as derived measurements, holds raw recordings back, and tiers access by how identifying the data is. Asks the new Office of the Chief AI Officer to make Bridge2AI's consent and provenance practices the NIH-wide default for data used to develop AI.
Preliminary Comment on CPPA Opt-Out Preference Signals
Addresses AB 566, AI systems processing opt-out signals, the verification gap, and independent third-party credentialing as a scalable compliance pathway for California's expanding privacy framework.
AI Developer Liability & Allocation
All 24 in the archive →Comment on the Federal Reserve's GENIUS Act Proposal (R-1899): Build on the OCC Rule, Name Automated Systems, Clarify Tying for Software
The Fed's GENIUS Act proposal sets risk-management, reporting, and tying rules for payment stablecoin issuers. Suggests building on the OCC's final rule, giving automated systems outside the agencies' new model risk guidance a named place in the issuer's IT program, and clarifying how the tying prohibition applies to programmatic access, default settings, and single-stablecoin tools.
Comment on NHTSA ADS Incident Reporting (SGO 2021-01)
Supports the three-year extension of SGO 2021-01 ADS incident reporting but identifies a verification gap in manufacturer self-reporting. Proposes three complementary verification mechanisms: third-party audit, cryptographic software version attestation, and safety case cross-referencing.
Comment on Unleashing American Drone Dominance: Credential-Based Trust for Autonomous Systems
A trusted-supplier list is fixed when it is published, while drone systems change with every firmware update. Proposes credential-based trust as a complement: published technical criteria, accredited independent assessment, machine-readable credentials, and periodic reassessment.