Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper proposes using the NIST OSCAL standard as an interchange format for AI governance, addressing the lack of executable formats for demonstrating compliance with frameworks like the EU AI Act. They define 16 property extensions to OSCAL covering AI-specific concerns like lifecycle phases and risk traceability. They then present a Compliance-as-Code architecture that generates OSCAL-based assurance evidence during model training, validated against the NIST JSON schema, and demonstrate it on credit scoring and medical imaging systems.
Bridging the gap between AI governance policy and practical implementation, this work offers a concrete, machine-readable format for AI compliance evidence using the NIST OSCAL standard.
AI Assurance -- producing the machine-readable evidence required to demonstrate compliance with AI governance frameworks -- has mature policy scaffolding but lacks the infrastructure to operationalize it. Organizations building high-risk AI systems under the EU AI Act face a gap: frameworks such as the EU AI Act, ISO/IEC 42001, and NIST AI RMF specify what to assure but provide no executable format for how. This paper proposes OSCAL -- the NIST standard adopted for FedRAMP cybersecurity compliance -- as a candidate interchange format for AI governance, complementing rather than replacing the emerging JTC21 standards stack. We define 16 property extensions covering lifecycle phases, enforcement semantics, risk traceability, and risk-acceptance justification, and present a three-layer Compliance-as-Code architecture (policy, evidence, enforcement) that generates assurance evidence as a byproduct of model training. The SDK produces native OSCAL Assessment Results validated against the NIST JSON schema. We test the approach on two Annex III high-risk systems: a credit scoring model and a medical imaging segmentation system. The architecture and reference implementation are open-source under Apache 2.0.