Coverage Map — Companion to "The Factory Builds, the Evidence Admits"

By Sam Wen, CEO & Founder of XInfer.AI — companion published July 29, 2026, to the essay of July 26, 2026

The essay reports that two engineering patterns — the Core decides and the Judge measures — were scored against 25 requirements, and that the result came back ten covered, ten partial, five open. It never showed the 25.

This is the 25. Split by framework, with subtotals, so the number is checkable rather than quotable.

Status. An interpretive engineering-to-governance mapping, not a conformance assessment and not legal advice. Requirement wording is paraphrased and condensed — consult NIST AI RMF 1.0 and the EU AI Act text for authoritative language. Legal classification of any real deployment is a call for counsel. "Open" marks what falls outside two engineering patterns. That is the expected result, not a deficiency.

Scope — read this before the numbers

We are limited-risk, and we scored against the high-risk articles anyway. A merchant-side commerce agent is not an Annex III system. Under the EU AI Act our binding obligation is disclosure, not truthfulness. We scored against Articles 9–15 regardless, as a voluntary bar, because the commercial cost of a false promise to a merchant does not care what tier the statute assigns. Every "partial" and "open" below on a high-risk article is a gap against a standard we chose, not a standard we are subject to. The one row that can bind us is Art. 50 — and it is the row with a date on it.

The EU section is not purely high-risk articles. Of its 12 rows: nine are high-risk provisions (Art. 9, 10, 11, 12, 13, 14, 15a, 15b, 15c), one is deployer duties (Art. 26), one is transparency that binds at any risk tier (Art. 50), and one — non-discrimination — is a rights theme rather than a single article. The essay's shorthand "the EU AI Act's high-risk articles" was loose.

The two frameworks are not the same kind of thing. NIST AI RMF is voluntary and process-shaped; its rows are subcategories. The EU AI Act is binding law with conformity assessment behind it; its rows are legal obligations. A "covered" against MEASURE 2 is a self-assessed alignment claim. A "covered" against Art. 12 is a claim about a legal control. Merging them into one score, as the essay did, made those two words look interchangeable. They aren't — which is why the subtotals below are separate.

Subtotals

Section	Rows	● Covered	◐ Partial	○ Open
NIST AI RMF 1.0	13	6	4	3
EU AI Act	12	4	7	1
Combined	25	10	11	4

The essay published 10 · 10 · 5. This corrects to 10 · 11 · 4 — the Reconciliation section below states every difference.

Section A — NIST AI RMF 1.0

Four functions: Govern, Map, Measure, Manage. The two patterns land almost entirely inside Measure (the Judge) and Manage (the Core), touch Map, and barely reach Govern — which is organizational by nature.

#	Requirement	Core · prevent	Judge · detect	Combined	Reasoning
1	GOVERN 1 — Policies, processes & risk tolerance _{Documented policy and a stated appetite for AI risk.}	◐	◐	◐ Partial	Decision rules and eval rubrics live as versioned, testable code — policy-as-code. No stated org-level risk tolerance.
2	GOVERN 2 — Accountability, roles & training _{Named owners, responsibilities, staff capability.}	○	○	○ Open	Neither pattern assigns ownership. Organizational, not architectural.
3	GOVERN 6 — Third-party & supply-chain risk _{Govern vendor models, tools, and data.}	○	○	○ Open	Vendor dependence is designed around — frozen voice prompts, a separate judge model — but never assessed.
4	MAP 1 — Context & framing established _{Purpose, setting, and constraints defined.}	●	◐	● Covered	The Core's four constraints — channels, frozen prompts, no-screen, money — are unusually explicit context mapping.
5	MAP 2 · 3 — Capabilities & limitations _{Document what the AI can and cannot reliably do.}	●	●	● Covered	"Models can't be trusted with money" and "fluent ≠ true" are the design premise.
6	MAP 5 — Impacts to individuals & groups _{Identify potential harms to people.}	◐	◐	◐ Partial	Monetary harm and misleading advice are named for this use case; no systematic impact assessment.
7	MEASURE 1 — Methods & metrics selected _{Appropriate, documented evaluation methods.}	◐	●	● Covered	Typed verdicts across orthogonal dimensions plus unit-tested thresholds. Measurement designed, not improvised.
8	MEASURE 2 — TEVV / trustworthy-characteristic testing _{Test, evaluate, verify & validate the system.}	●	●	● Covered	Isolated, unit-tested decisions plus an independent evaluator scoring honesty, provenance, tone. The strongest area.
9	MEASURE 3 — Tracking risk over time _{Monitor risks continuously, including in production.}	◐	○	◐ Partial	Decisions are logged and idempotent, but the judge is dev-only — point-in-time, not continuous.
10	MEASURE 4 — Measurement validity & feedback _{Ensure the measurement itself is valid.}	◐	●	● Covered	Calibration, distrust of single samples, false positives feeding recalibration. Rare: the evaluator is itself evaluated.
11	MANAGE 1 · 2 — Risk treatment & controls _{Prioritize and implement risk-reducing controls.}	●	◐	● Covered	Money removed from sampling; idempotency, evidence tokens, provenance gating. Highest-severity risk treated by design.
12	MANAGE 3 — Third-party risk managed _{Apply controls to vendor / supply-chain risk.}	○	○	○ Open	Out of scope for both patterns.
13	MANAGE 4 — Monitoring, incident response & recovery _{Detect, respond to, recover from issues in deployment.}	◐	○	◐ Partial	The seam. Idempotent retry-recovery exists, but nothing watches production narration in real time.

Subtotal — NIST AI RMF: 6 covered · 4 partial · 3 open (13 rows). Strong on Measure and Manage; thin on Govern.

Note on rows 3 and 12. Third-party risk is scored twice because NIST separates it: GOVERN 6 is the policy obligation, MANAGE 3 is the treatment obligation. Both are genuinely open, but they are one gap, not two. Counting them as two overstates the breadth of the open column by one.

Section B — EU AI Act

Binding obligations on high-risk systems, plus deployer duties and the transparency article that applies at any tier. Assumes the operator is a deployer / application builder, not a GPAI model provider.

#	Requirement	Core · prevent	Judge · detect	Combined	Reasoning
14	Art. 9 — Risk management system _{A continuous, iterative process across the lifecycle.}	◐	◐	◐ Partial	Both patterns are risk-driven by design; neither is a formal, continuous lifecycle RMS.
15	Art. 10 — Data & data governance _{Relevant, representative data; examined for bias.}	◐	◐	◐ Partial	Provenance tiers, normalization, single-use evidence tokens and claim-to-evidence tracing are strong. Bias and representativeness are untouched.
16	Art. 11 — Technical documentation _{Documentation sufficient to assess compliance.}	◐	●	● Covered	Every prompt change logs the case that forced it, the reasoning, the edit, and the judged verification. Core logic is versioned and testable.
17	Art. 12 — Record-keeping & logging _{Automatic event logging for traceability.}	●	●	● Covered	Typed outcomes are auditable by construction; the judge logs both violations and cleared claims. Built into the interfaces, not bolted on.
18	Art. 13 — Transparency & information to users _{Operation transparent to deployers; users informed.}	◐	◐	◐ Partial	Static prompts and typed verdicts make behavior inspectable and explain pass/fail. End-user disclosure ships by default but is merchant-editable — see row 23.
19	Art. 14 — Human oversight _{Interpret, intervene, override.}	◐	◐	◐ Partial	Deterministic, inspectable decisions are oversight-ready, and humans act on verdicts in development. No explicit runtime override path.
20	Art. 15 · a — Accuracy _{Appropriate accuracy for the purpose.}	●	●	● Covered	Correct deterministic decisions plus measured factual truthfulness. Accuracy is the explicit target of both patterns.
21	Art. 15 · b — Robustness & reliability _{Resilient to errors, faults, inconsistencies.}	●	◐	● Covered	Idempotent orders, retry-safe, consistent across every channel; reruns reduce evaluator variance.
22	Art. 15 · c — Cybersecurity _{Resilience against manipulation, e.g. prompt injection.}	◐	○	◐ Partial	Customer data travels as tool results, not prompt text — one injection vector hardened. Not a full security posture.
23	Art. 50 — Disclosure of AI interaction _{Inform people they are interacting with an AI.}	○	○	◐ Partial	Rescored — see reconciliation. Every agent introduces itself as an AI in its opening line across chat, voice, and phone — but the greeting is a configurable field a merchant can edit away, so the disclosure is handled by default rather than guaranteed by construction. The partial credits that shipped product default, not either pattern; both pattern columns stay open. This is the row with a statute and a date behind it.
24	Rights — Non-discrimination & fairness _{Guard against biased or discriminatory outcomes.}	○	○	○ Open	No fairness or bias controls in either pattern.
25	Art. 26 — Deployer duties & post-market monitoring _{Use per instructions, keep logs, monitor, report risks.}	◐	○	◐ Partial	Logging is covered. Ongoing operational monitoring and risk reporting are not.

Subtotal — EU AI Act: 4 covered · 7 partial · 1 open (12 rows). Strongest on Art. 12 logging and Art. 15 accuracy and robustness; partial across data governance, transparency, oversight, and post-market duties.

The Art. 50 row, in detail

Verified against primary text on 29 July 2026:

Article 50 sits in Chapter IV. Article 113 of Regulation (EU) 2024/1689 excepts Chapters I and II, parts of Chapter III, Chapters V, VII and XII, Article 78, and Article 6(1). Chapter IV is in none of them, so it falls to the general date: 2 August 2026.
The Digital Omnibus — Regulation (EU) 2026/1744, OJ L, 24 July 2026, in force 27 July — amends Article 113's third paragraph at Article 1 point (40). It replaces point (a), replaces point (c) to defer Chapter III Sections 1–3 to 2 December 2027 and 2 August 2028, and adds point (d). The string "Chapter IV" does not appear anywhere in the amending regulation. Article 50 was not deferred.
The only Article 50 relief is a new Article 111(4): providers of systems generating synthetic audio, image, video or text content placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2) machine-readable marking. There is no equivalent transitional for Article 50(1). No grandfathering on the duty to tell people they are talking to an AI.
Article 50(1) obliges providers to ensure systems are "designed and developed in such a way that" people are informed. That is a design-time duty on the provider, not an operational one on the merchant — which is precisely the distinction between handled-by-default and guaranteed-by-construction.
The statute's carve-out — "unless this is obvious" — is weakest exactly where we are most exposed. For a branded chat widget, obviousness is arguable. For a voice or phone agent, it is not.

Unscored and flagged for counsel: Article 50(2) machine-readable marking of synthetic audio and text output is a distinct obligation that this map never scored. It may read onto a voice agent. Applicability turns on territorial scope — Article 2 catches third-country providers where the output is used in the Union — so if no merchant serves EU end-users, none of this binds.

Reconciliation — what changed since the essay

The essay's open column tracks the source artifact's prose summary, not its scored rows. Four items reconcile below: one map verdict corrected, one map note corrected, and two essay claims the scored rows never supported. Stated plainly, because an essay arguing that a certification you cannot replay is an opinion does not get to skip its own replay.

Item	Essay said	Map says	Resolution
Art. 50 — AI disclosure	Partial ("handled by default… a merchant could edit it away")	Open	Essay was right; map corrected to Partial. The map was built from the two published essays, neither of which mentions the disclosure greeting. The product ships one. Moves one row Open → Partial.
Runtime monitoring & incident response	Open	Partial (MANAGE 4, MEASURE 3, Art. 26 all Partial)	Map is right; essay overstated the gap. Idempotent retry-recovery and decision logging exist. What's missing is continuous production monitoring, not the whole category.
Privacy / PII handling	Listed as one of five open items	Not a scored row at all	Neither. PII appeared only in the source artifact's prose summary, never in the 25. It is a real gap, but it was never in the denominator, so it cannot be one of the opens. Noted below instead of promoted to a 26th row, to keep the denominator traceable to the original exercise.
Art. 13 note	—	"there is no end-user AI disclosure"	Note corrected for the same reason as Art. 50. Verdict unchanged at Partial; no effect on any count.

Net effect: 10 · 10 · 5 becomes 10 · 11 · 4.

Known gaps outside the denominator, recorded so they are not lost by being unscored: privacy and PII handling; Article 50(2) synthetic-content marking; and no SBOM or AIBOM for the agent supply chain.

What the two patterns own, and what stays open

Owned. Accuracy and truthfulness, measured rather than assumed. Reliability and robustness — idempotent, cross-channel, retry-safe. Auditability and logging, traceable by construction because typed outputs are already values. Independent measurement, with the evaluator itself calibrated. Risk treatment by architecture: money out of model sampling.

Still open, all four rows. Accountability and ownership (GOVERN 2). Third-party and vendor-model governance (GOVERN 6 and MANAGE 3 — one gap scored twice). Non-discrimination and fairness (row 24).

The essay claimed every open item is organizational. That claim was made against a list that included privacy/PII and runtime monitoring — two items that are substantially tooling categories you can buy, and neither of which is actually in the scored open column. Against the real rows the claim holds better than the essay's own version of it, but the honest form is narrower:

Every open item needs a standing owner, not a design decision. Fairness is the instructive case: bias testing is technical work with mature tooling, but nothing can run until a person defines what fair means for this system and owns the answer. You can buy the monitor. Someone still has to watch it.

And the row the original map put in the open column — Art. 50 disclosure — was never organizational at all. It is a gate: designable, cheap, and now dated. Correcting it to Partial does not close it. Making the disclosure non-editable does.

The seam, unchanged. The Core keeps the model out of decisions at runtime. The Judge checks the model's words, but only in development. So at runtime nothing independently verifies the narration. That is a reasoned trade for this risk profile, and it is also the precise specification of the next mechanism.

Source essays: The LLM Narrates, the Core Decides · The Model Writes, the Judge Measures · The Factory Builds, the Evidence Admits.

Coverage judgments map each essay's described mechanisms onto framework requirements. Requirement wording is paraphrased. Not a conformance assessment; not legal advice.