How can I be sure the RNGCryptoServiceProvider is able to produce 12 bytes that can have 2^96 values?
RNGCryptoServiceProvider - according to many sites including the following Wikipedia link itself - uses the CryptGenRandom functionality of the operating system. You therefore need to convince your clients that the OS functionality is sufficient.

The Wikipedia article contains references to FIPS and Common Criteria EAL4 evaluations of the operating systems containing the RNG. That should normally be sufficient - although I must admit that I cannot find the actual FIPS validation certificate of the RNG.

The best reference is probably the documentation of BCryptGenRandom which states:


  The default random number provider implements an algorithm for generating random numbers that complies with the NIST SP800-90 standard, specifically the CTR_DRBG portion of that standard.


This is for Windows versions after Windows Vista. Before that an RC4 based algorithm seems to have been used.