AI Governance Engineer
GitHub
On this page

Pattern: Machine-Readable Evidence (OSCAL)

Control evidence emitted in a machine-readable standard format, OSCAL first, so an audit becomes a query and the same records feed assurance.

Layer 05 · Assurance & Continuous Compliance In the chapter 05 catalogue

One working control on the engineering side of AI governance.

Summary: Emit control evidence in a machine-readable, standard format so that the audit is a query and the same evidence feeds continuous assurance. OSCAL, extended with properties for AI, is the organising format: frameworks specify what to assure but provide no executable format for how, and this pattern supplies it1.

Machine-Readable Evidence A data-flow diagram generated by Archify. 01 / Sources 02 / OSCAL (Layer 05) 03 / Validator 04 / Consumers Control catalogue · controls · 01 / Sources Control catalogue controls Assessment results · eval runs · 01 / Sources Assessment results eval runs Evidence records · verdicts · 01 / Sources Evidence records verdicts OSCAL documents · component / assessment · 02 / OSCAL (Layer 05) · Layer 05 OSCAL documents component / assessment Layer 05 Validator · schema-checked · 03 / Validator Validator schema-checked Auditor · reads directly · 04 / Consumers Auditor reads directly Compliance tooling · continuous · 04 / Consumers Compliance tooling continuous Regulator · submission · 04 / Consumers Regulator submission map map map check read read submit Legend primary data data store data flow
Machine-Readable EvidenceControls, assessments and evidence become OSCAL documents that a validator checks and assurance consumers read without anyone re-typing them. Choose the format your assessor can ingest and generate it from data you already hold. Generated from the Body of Knowledge.Open interactive diagram (opens in a new tab)

Objectives

Make evidence queryable, diffable and aggregatable, and eliminate the screenshot as an evidence artefact.

Target users

AI governance engineer, auditor, platform team.

Impacted stakeholders

Auditors, regulators, model owners.

Relevant principles

Instrument the build to produce its own proof; give every control teeth.

Context

A stack whose controls already produce structured records, and an assurance function that must answer auditors repeatedly and at speed.

Problem

Evidence a human must format and file by hand does not scale, cannot be verified quickly, and is out of date the moment it is saved. Every audit re-collects it from scratch.

Solution

Emit control results as OSCAL component-definition and assessment-results artefacts. OSCAL’s native model is the stable substrate: a control layer (catalog, profile), an implementation layer (component-definition, system-security-plan) and an assessment layer (assessment-plan, assessment-results, POA&M), with traceability from a result back to the control it tested2. Build on it first. AI-specific extensions are still forming: one proposed approach, a single 2026 preprint, adds sixteen property extensions for lifecycle phase, enforcement semantics and risk traceability in a three-layer policy/evidence/enforcement architecture that generates OSCAL assessment results automatically and validates them against the NIST JSON schema1. Adopt the extensions if they fit, but the native assessment models carry most of the load today. Store the evidence so an auditor’s question is answered by a query.

Consequences

The audit becomes a query and evidence composes across tools and jurisdictions. The cost is adopting the schema and instrumenting controls to emit it.

Continuous Assurance Telemetry; Framework Crosswalk; Eval Gate in CI; Incident Pipeline.

Maps to: EU AI Act Art. 12, Art. 17, Art. 72 · ISO/IEC 42001 · NIST AI RMF (Manage, Govern) · Layer 05 Assurance & Continuous Compliance.

Function labels follow the NIST AI RMF3. Mappings are illustrative, not a claim of conformity.

Sources

  1. [1] “Making AI Compliance Evidence Machine-Readable” (OSCAL + 16 property extensions; three-layer policy/evidence/enforcement; “specify what to assure but provide no executable format for how”) (arXiv 2604.13767). UC3M. 2026-04-15. https://arxiv.org/abs/2604.13767 (verified: primary)
  2. [2] OSCAL native model (control layer: catalog, profile; implementation: component-definition, system-security-plan; assessment: assessment-plan, assessment-results, POA&M). NIST. 2026. https://pages.nist.gov/OSCAL/learn/concepts/layer/ (verified: primary)
  3. [3] AI Risk Management Framework (AI RMF 1.0; Govern, Map, Measure, Manage). NIST. 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)
Edit this page on GitHub
Cite this pattern

García Aibar, J. (2026). Pattern: Machine-Readable Evidence (OSCAL). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), chapter 05, Patterns. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/patterns/machine-readable-evidence-oscal. CC BY 4.0

BibTeX

@misc{aige2026bok,
  author  = {Jorge García Aibar},
  title   = {{AI Governance Engineering: The Thesis \& Body of Knowledge}},
  chapter = {05. Patterns: Machine-Readable Evidence (OSCAL)},
  year    = {2026},
  version = {0.5.0},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/patterns/machine-readable-evidence-oscal},
  note    = {Version 0.5.0}
}
Share on LinkedIn
Around Machine-Readable Evidence (OSCAL)The patterns Machine-Readable Evidence (OSCAL) is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code03 Evals05 AssuranceMachine-Readable Evidence(OSCAL)Related patterns (4)Continuous Assurance Telemetry · Related patternContinuous Assurance TelemetryEval Gate in CI · Related patternEval Gate in CIFramework Crosswalk · Related patternFramework CrosswalkIncident Pipeline · Related patternIncident PipelineObligations (6)EU AI Act Art. 12: record-keeping and logging · Names this patternEU AI Act Art. 12EU AI Act Art. 17: quality management system · Names this patternEU AI Act Art. 17EU AI Act Art. 17(1)(m): accountability framework within the quality management system · Names this patternEU AI Act Art. 17(1)(m)EU AI Act Art. 72: post-market monitoring · Names this patternEU AI Act Art. 72NIST AI RMF GOVERN · Names this patternNIST AI RMF GOVERNNIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGEControls (5)AIGE-CTL-ASSURE-006 Control Observations Filed Against Control Ids · Names this patternControl Observations Filed…AIGE-CTL-ASSURE-008 Evidence Retention as Code · Names this patternEvidence Retention as CodeAIGE-CTL-EVAL-007 Incident Evidence Preservation · Names this patternIncident Evidence PreservationAIGE-CTL-ASSURE-009 Internal Audit Answered from the Evidence Store · Names this patternInternal Audit Answered…AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL · Names this patternMachine-Readable Evidence…Cases (1)SyRI: a fraud risk model no court could verify · Names this patternSyRI judgmentSource: the pattern catalogue, theobligation register, the opencontrols and the cases
Around Machine-Readable Evidence (OSCAL)The patterns Machine-Readable Evidence (OSCAL) is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code03 Evals05 AssuranceRelated patterns (4)Continuous Assurance Telemetry · Related patternContinuous Assurance…Eval Gate in CI · Related patternEval Gate in CIFramework Crosswalk · Related patternFramework CrosswalkIncident Pipeline · Related patternIncident PipelineControls (5)AIGE-CTL-ASSURE-006 Control Observations Filed Against Control Ids · Names this patternControl Observations Filed…AIGE-CTL-ASSURE-008 Evidence Retention as Code · Names this patternEvidence Retention as CodeAIGE-CTL-EVAL-007 Incident Evidence Preservation · Names this patternIncident Evidence…AIGE-CTL-ASSURE-009 Internal Audit Answered from the Evidence Store · Names this patternInternal Audit Answered…AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL · Names this patternMachine-Readable…Obligations (6)EU AI Act Art. 12: record-keeping and logging · Names this patternEU AI Act Art. 12EU AI Act Art. 17: quality management system · Names this patternEU AI Act Art. 17EU AI Act Art. 17(1)(m): accountability framework within the quality management system · Names this patternEU AI Act Art. 17(1)(m)EU AI Act Art. 72: post-market monitoring · Names this patternEU AI Act Art. 72NIST AI RMF GOVERN · Names this patternNIST AI RMF GOVERNNIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGECases (1)SyRI: a fraud risk model no court could verify · Names this patternSyRI judgmentMachine-ReadableEvidence (OSCAL)Source: the pattern catalogue, the obligation register, the open controls and thecases
Around Machine-Readable Evidence (OSCAL) The patterns listed with this one, in their layer colour, and the obligations, open controls and incident cases that name it. Follow a node to see why the pattern is worth building, and what to build with it.
Data table
What Machine-Readable Evidence (OSCAL) connects to
FamilyItemRelation
Related patternsContinuous Assurance TelemetryRelated pattern
Related patternsEval Gate in CIRelated pattern
Related patternsFramework CrosswalkRelated pattern
Related patternsIncident PipelineRelated pattern
ObligationsEU AI Act Art. 12: record-keeping and loggingNames this pattern
ObligationsEU AI Act Art. 17: quality management systemNames this pattern
ObligationsEU AI Act Art. 17(1)(m): accountability framework within the quality management systemNames this pattern
ObligationsEU AI Act Art. 72: post-market monitoringNames this pattern
ObligationsNIST AI RMF GOVERNNames this pattern
ObligationsNIST AI RMF MANAGENames this pattern
ControlsAIGE-CTL-ASSURE-006 Control Observations Filed Against Control IdsNames this pattern
ControlsAIGE-CTL-ASSURE-008 Evidence Retention as CodeNames this pattern
ControlsAIGE-CTL-EVAL-007 Incident Evidence PreservationNames this pattern
ControlsAIGE-CTL-ASSURE-009 Internal Audit Answered from the Evidence StoreNames this pattern
ControlsAIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCALNames this pattern
CasesSyRI: a fraud risk model no court could verifyNames this pattern

Obligations this pattern evidences

Register rows that list this pattern among the patterns that build their evidence. Mappings are illustrative, not a claim of conformity.

When these obligations applyThe obligations Machine-Readable Evidence (OSCAL) evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadAs of 2026-09-244still to come2027-12-022028-08-022030-08-02EU AI Act Art. 12 · applies from 2027-12-02 · DeferredArt. 12EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 17(1)(m) · applies from 2027-12-02 · DeferredArt. 17(1)(m)EU AI Act Art. 72 · applies from 2027-12-02 · DeferredArt. 72Art. 12Art. 17Art. 17(1)(m)Art. 72Art. 12Art. 17Art. 17(1)(m)Art. 722 without a date (Voluntary)Source: the obligation register(/obligations)As of 2026-09-24
When these obligations applyThe obligations Machine-Readable Evidence (OSCAL) evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadDateits place on the time axis4still to come2026202720282029203020312027-12-022028-08-022030-08-02EU AI Act Art. 12 · applies from 2027-12-02 · DeferredArt. 12EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 17(1)(m) · applies from 2027-12-02 · DeferredArt. 17(1)(m)EU AI Act Art. 72 · applies from 2027-12-02 · DeferredArt. 72Art. 12Art. 17Art. 17(1)(m)Art. 72Art. 12Art. 17Art. 17(1)(m)Art. 72As of 2026-09-242 without a date (Voluntary)Source: the obligation register (/obligations)As of 2026-09-24
When these obligations apply Each obligation this pattern evidences, on the date it first applies, drawn by its status in the register, and on each later dated step (a square, filled once reached); the dashed line is the date the rows were last reviewed. What comes before the line is already due, so the pattern's evidence is needed now; what comes after it sets the deadline to build it by.
Data table
When the obligations Machine-Readable Evidence (OSCAL) evidences apply
DateObligationStepStatus
2027-12-02EU AI Act Art. 12: record-keeping and loggingApplies fromDeferred
2027-12-02EU AI Act Art. 17: quality management systemApplies fromDeferred
2027-12-02EU AI Act Art. 17(1)(m): accountability framework within the quality management systemApplies fromDeferred
2027-12-02EU AI Act Art. 72: post-market monitoringApplies fromDeferred
2028-08-02EU AI Act Art. 12: record-keeping and loggingLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 17: quality management systemLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 17(1)(m): accountability framework within the quality management systemLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 72: post-market monitoringLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 12: record-keeping and loggingLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 17: quality management systemLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 17(1)(m): accountability framework within the quality management systemLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 72: post-market monitoringLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
No dateNIST AI RMF GOVERNVoluntary
No dateNIST AI RMF MANAGEVoluntary

Cases where it applies

Incident post-mortems that name this pattern as a control that would have caught the failure.

Draft controls in the open control profiles that build on this pattern. A control states the requirement and the evidence it must leave behind.