AI Assurance -- producing the machine-readable evidence required to demonstrate compliance with AI governance frameworks -- has mature policy scaffolding but lacks the infrastructure to operationalize it. Organizations building high-risk AI systems under the EU AI Act face a gap: frameworks such as the EU AI Act, ISO/IEC 42001, and NIST AI RMF specify what to assure but provide no executable format for how. This paper proposes OSCAL -- the NIST standard adopted for FedRAMP cybersecurity compliance -- as a candidate interchange format for AI governance, complementing rather than replacing the emerging JTC21 standards stack. We define 16 property extensions covering lifecycle phases, enforcement semantics, risk traceability, and risk-acceptance justification, and present a three-layer Compliance-as-Code architecture (policy, evidence, enforcement) that generates assurance evidence as a byproduct of model training. The SDK produces native OSCAL Assessment Results validated against the NIST JSON schema. We test the approach on two Annex III high-risk systems: a credit scoring model and a medical imaging segmentation system. The architecture and reference implementation are open-source under Apache 2.0.

翻译：AI保证——生成符合AI治理框架要求的机器可读证据——已具备成熟的政策框架，但缺乏实现其可操作化的基础设施。依据欧盟《人工智能法案》构建高风险AI系统的组织面临空白：欧盟AI法案、ISO/IEC 42001以及NIST AI风险管理框架等框架规定了保证内容，却未提供可执行格式。本文提出将OSCAL（美国国家标准与技术研究院采纳的联邦风险与授权管理计划网络安全合规标准）作为AI治理候选交换格式，补充而非替代新兴的JTC21标准栈。我们定义了涵盖生命周期阶段、执行语义、风险可追溯性及风险接受理由的16项属性扩展，并提出一种三层合规即代码架构（策略层、证据层、执行层），该架构将保证证据作为模型训练的副产品生成。软件开发工具包可生成符合NIST JSON模式的原生OSCAL评估结果。我们在附件III中的两类高风险系统上测试该方法：信用评分模型与医学影像分割系统。该架构及参考实现均以Apache 2.0开源许可发布。