On January 1, 2026, a framework nobody is required to adopt became something you can plead in an enforcement action.

The Texas Responsible AI Governance Act (TRAIGA) took effect at the start of this year, with enforcement reserved exclusively for the Texas Attorney General and penalties that reach $80,000 to $200,000 per uncurable violation, plus $2,000 to $40,000 per day for continuing ones. Buried in the statute is the provision most legal briefings underplay: an organization has an affirmative defense if it substantially complies with the most current version of the NIST AI Risk Management Framework, including the Generative AI Profile.

Read that again from an operator's chair. The NIST AI RMF — voluntary guidance published January 26, 2023, at the direction of Congress, with no certification scheme, no auditors, no enforcement mechanism of its own — is now a statutory shield in the state with the second-largest economy in the country. Texas isn't alone in reaching for it. Colorado's AI Act names NIST AI RMF as an alignment target for deployer risk-management programs — we covered that in the Colorado deadline post — and California's SB 53 requires large frontier developers to explain their alignment with NIST AI RMF or ISO 42001 by name, per our April map of new US AI laws. The pattern is consistent: US legislatures don't want to write technical AI requirements, so they point at the framework that already exists and attach legal consequences to it.

What the framework actually asks

The AI RMF Core is four functions. Govern: policies, accountability, and risk culture across the AI lifecycle. Map: establish context — what systems exist, what they touch, what can go wrong. Measure: assess and track the risks you mapped. Manage: prioritize and respond to them. NIST supplies a Playbook, crosswalks to other standards, and profiles to tailor the core to a sector or system — but deliberately no control catalog and no certificate. It's a process model, technology-neutral by design.

That design choice is exactly why the safe harbor turns into an evidence fight. "Substantially comply" with ISO 42001 has a crisp answer: show the certificate. Substantial compliance with the AI RMF has no certificate to show. If the Texas AG's office ever tests your defense, what exists is whatever documentation trail you built — and as the TRAIGA compliance guides themselves warn, manual spreadsheet tracking creates audit risk when you can't prove systematic implementation.

A crosswalk is not evidence

The standard artifact here is the mapping spreadsheet: one column of framework functions, one column of vendor features, a row of checkmarks. Vendor has a policy engine, therefore Govern. Vendor has monitoring, therefore Measure.

A crosswalk asserts that compliance is possible. It says nothing about whether it happened. The feature existing in your stack and the feature having ever run against your agents are different facts, and only one of them is a defense.

For agent operators specifically, the four functions have unusually direct physical analogs — which means they're countable:

• Govern is not a policy PDF; it's the policy rules actually active on your tenant, deciding what agents may do.
• Map is not an architecture diagram; it's the inventory of registered agents with risk profiles attached.
• Measure is not a metrics slide; it's the security findings and score trends your scanners actually produced.
• Manage is not an incident-response doc; it's the moderation flags, tier demotions, and kill-switch activations your system actually recorded.

A report that counts instead of claims

This is how the NIST report in the VeriSwarm compliance API works. GET /v1/compliance/nist-ai-rmf assesses your tenant against the four functions and returns pass, warn, or fail per control — with the status computed from evidence counts in your actual data, not from your plan's feature matrix.

The semantics are strict on purpose. A control your plan doesn't include returns warn — the capability gap is flagged honestly. A control your plan does include but you've never exercised returns fail. Govern fails until at least one Guard or Cedar policy is active on your tenant. Manage fails until at least one moderation flag exists across your fleet — auto-generated or manual, but real. A Max-plan tenant with every feature enabled and zero recorded risk activity fails Manage, because "risks are prioritized, responded to, and managed" is a claim about what happened, not about what was purchased.

The test suite enforces this floor: a fresh tenant with no instrumentation scores at most 25% on the NIST report. An earlier version scored 75% out of the box because three of four controls auto-passed on plan entitlements alone — we rewrote it, because a report that flatters an empty tenant is a report an opposing counsel takes apart in one deposition question. The score is supposed to be embarrassing on first pull. That's what makes it worth something when it isn't anymore.

Each control that isn't a pass comes back with a specific recommendation — configure a policy, register your agents, enable scanning, track your first flag — so the report doubles as the remediation queue.

Evidence compounds

The artifacts that move the NIST score — active policies, agent registrations, scan findings, moderation flags, ledger events — are the same rows the EU AI Act and ISO 42001 reports read, from the same endpoint family. Instrument once; every framework report sharpens. And because flags, decisions, and policy changes land in Vault's hash-chained ledger, the evidence a defense would rest on carries its own integrity story — useful when the question isn't "do you have records" but "why should anyone believe them."

The framework is voluntary. The defense is statutory. The difference between the two is whether your governance leaves artifacts something can count.

Gate is free — register your agents, ingest events, activate a policy, and pull GET /v1/compliance/nist-ai-rmf against your own tenant. Sign up at veriswarm.ai; the report reads from live activity, so it starts improving the moment your agents do.