From obligation to evidence

From obligation to evidence A data-flow diagram generated by Archify. 01 / Frameworks 02 / Crosswalk 03 / Stack layers 04 / Evidence EU AI Act · post-Omnibus · 01 / Frameworks · law EU AI Act post-Omnibus law ISO/IEC 42001 · AIMS · Annex A · 01 / Frameworks · standard ISO/IEC 42001 AIMS · Annex A standard NIST AI RMF · four functions · 01 / Frameworks · framework NIST AI RMF four functions framework Obligation crosswalk · obligation → artefact → layer · 02 / Crosswalk · OSCAL Obligation crosswalk obligation → artefact → layer OSCAL Govern-as-Code · policy-as-code, QMS · 03 / Stack layers · Layer 01 Govern-as-Code policy-as-code, QMS Layer 01 Inventory & Transparency · registry · AIBOM · cards · 03 / Stack layers · Layer 02 Inventory & Transparency registry · AIBOM · cards Layer 02 Evals & Red Teaming · eval gate · red-team · 03 / Stack layers · Layer 03 Evals & Red Teaming eval gate · red-team Layer 03 Runtime Controls · guardrails · kill switch · 03 / Stack layers · Layer 04 Runtime Controls guardrails · kill switch Layer 04 Assurance & Compliance · assurance telemetry · 03 / Stack layers · Layer 05 Assurance & Compliance assurance telemetry Layer 05 Machine-readable evidence · OSCAL · audit = query · 04 / Evidence · assurance Machine-readable evidence OSCAL · audit = query assurance Arts. 9–73 Annex A four functions Art. 9 Art. 11 Art. 15 Art. 14 Art. 72 OSCAL logs Legend primary data data store data flow

Read each row as a sentence

  • • This obligation is answered by this artefact, which lives in this layer
  • • The map is a crosswalk for finding the artefact, not a certificate of compliance
  • • Mappings are illustrative, not a claim of conformity

One reverse index

  • • Every 'Maps to' line in the book resolves backward through the crosswalk
  • • Maintained as a machine-readable file, emitted as OSCAL component definitions
  • • When the Omnibus moved a date, the change was a diff to one field per row

Audit = query

  • • Each layer's artefact produces machine-readable evidence for its obligation
  • • 'Show me what answers Article 15' becomes a query against the crosswalk
  • • Continuous assurance makes evidence cheap to produce and hard to fake