Skip to content

Changelog

Every change to a watched standard lands here, newest first. Entries are generated from the merged pull requests that update the reference pages, so this log doubles as the library's audit trail.

Severity follows the project rubric: version_bump (new edition/revision), substantive (changed definition, new control, changed threshold), and editorial (normally suppressed; surfaced only when notable).

2026-09-05 — September refresh: every standard re-observed, Switzerland and the Council of Europe Convention added

The library grew from nine watched instruments to eleven and every existing page was re-observed twice: first against the primary sources, then against the supervisors' and governments' news pages, which is where most of the July–September developments had appeared. All pages now carry last_observed_at 2026-09-05.

version_bump — ISO/IEC 42001 now also exists as EN ISO/IEC 42001:2026 (CEN/CENELEC JTC 21, published 18 March 2026, identical adoption; corroborated through the UNI national adoption, in force 30 July 2026) — the vehicle for any future harmonised-standard citation under the AI Act; not cited as such yet, and no JTC 21 deliverable has been cited in the Official Journal.

substantive — two new pages

  • Switzerland — AI regulation and data protection is the tenth watched instrument and the first Swiss one: the technology-neutral DSG applied directly to AI by the EDÖB (notice of 9 November 2023, updated 8 May 2025), the Federal Council's sectoral decision of 12 February 2025, the signature of the Council of Europe AI Convention on 27 March 2025, the soft-law track of February 2026, the EDÖB activity report 2025/26, and the consultation draft due by the end of 2026 (prepared by the Federal Office of Justice within the EJPD). Sources: Fedlex, EDÖB, Federal Chancellery, BAKOM, the CoE treaty chart and the EU Official Journal.
  • Council of Europe AI Convention (CETS 225) is the eleventh and the first international treaty here: adopted 17 May 2024, opened for signature 5 September 2024, read article by article from the text published in OJ L 2026/1081 (scope and the Art. 3(1)(b) private-actor declaration, the Chapter III principles, remedies, the Art. 16 risk and impact management framework, Art. 26 oversight, Art. 30 entry into force). The treaty chart as of 5 September 2026 shows 21 signatures and one ratification — the EU on 15 May 2026 — so the Convention is not in force. Implementation paths: the EU exclusively through the AI Act (Council Decision (EU) 2026/1080), Switzerland through sector laws, the UK signature only.

substantive — every existing page re-observed

  • EU AI Act — Commission soft law caught up with Art. 50: final transparency guidelines (20 July 2026), the opinion on the Code of Practice on AI-generated content (9 July 2026), draft high-risk classification guidelines (19 May 2026, still under consultation). Enforcement by the AI Office and national authorities began 2 August 2026, with a first list of more than 180 signatories of the AI-generated-content code and the complaints, whistleblower and GPAI downstream-provider channels live.
  • NIST AI RMF — NIST states that AI RMF 1.0 is being revised under the White House AI Action Plan (no date). Companions captured: AI 100-4 (synthetic content), IR 8596 iprd (Cyber AI Profile, draft), the concept note for a critical-infrastructure profile (7 April 2026), the CAISI AI Agent Standards Initiative (17 February 2026) and the zero draft NIST AI 300-1 ipd on public-facing AI documentation (July 2026).
  • DORA — the ESAs designated the first critical ICT third-party providers on 18 November 2025 (Art. 31 added as an anchor), then addressed AI directly in joint statement JC 2026 25 (31 July 2026) and published their first annual major-incident report (3 June 2026).
  • UK AI White Paper — the Advisory AI Growth Lab for legal services was announced on 8 June 2026 and has been open for applications since 3 August 2026; the King's Speech of 13 May 2026 brought the Regulating for Growth Bill with statutory sandboxing powers and cross-cutting AI sandboxes — but no AI bill.
  • CSA Agentic Profile — CSA's research-note series on NIST's AI Agent Standards Initiative (March–April 2026) around a profile that is still a draft; OWASP State of Agentic AI Security & Governance v2.01 (June 2026) supersedes v1.0, the GenAI LLM Top 10 2026 followed on 3 August 2026, and the Agent Control Standard and framework crosswalk were announced on 2 September 2026.
  • Berkeley CLTC — Evaluation of Frontier AI Company Practices using the GPAI profile v1.2 (April 2026), AIxCyber Threat Scenarios 2027–2029 (May), AgentWatch (June) and AI Risk Governance for Investors and Corporate Boards (August 2026).
  • NIST ITL landscape — the CAISI initiative, the AI 300-1 zero draft and the January 2026 report on measuring standards effectiveness; no newer landscape briefing than 6 March 2026.
  • ISO/IEC 23894 — re-observed, unchanged (1st edition, 2023).

editorial — The Convention's ratification status is from now on stated only on its own page; Switzerland, the EU AI Act and the UK pages link there instead of repeating counts. Sources allow-list extended to admin.ch sub-domains, coe.int and rm.coe.int; the NIST Playbook target corrected to the AI Resource Center (the ARIA repository is a different NIST programme); glossary, home, at-a-glance, llms.txt, navigation and the source manifest updated for both new pages. Site plumbing, no content change: the discovery metadata was rebuilt — per-page JSON-LD with a typed about node and the observation date as dateModified, an ItemList of every page on the home page, Dublin Core tags, and machine-readable alternates (Markdown source, llms.txt, sitemap) so AI answer engines can read the library directly.

2026-08-02 — EU AI Act: Digital Omnibus in force; page expanded

version_bump — The Digital Omnibus on AI was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The EU AI Act page now reflects the amended law instead of the May provisional agreement: stand-alone Annex III high-risk obligations move to 2 December 2027, Annex I product-embedded AI to 2 August 2028, the Art. 50(2) machine-readable marking of synthetic content gets a grace period until 2 December 2026 for systems already on the market, the new Art. 5 CSAM/NCII prohibition applies after a transition ending 2 December 2026, and the national sandbox deadline moves to 2 August 2027. Art. 50 transparency duties themselves apply from 2 August 2026 as originally scheduled; GPAI rules are unchanged.

With the timeline now settled, the page was expanded in the same update: an application-timeline table (Art. 113 as amended, from the 2025 prohibitions through the Art. 111 legacy transitions — GPAI models by 2027, public-authority systems by 2030, large-scale IT systems by end-2030), an "In depth" section on machine-readable transparency (Art. 50(2) + the Recital 133 technique families — watermarks, metadata identification, cryptographic provenance proofs, logging, fingerprints), a Penalties section (Art. 99 fine bands + Art. 101 GPAI fines), a soft-law section (GPAI Code of Practice, Commission guidelines on prohibited practices and the AI-system definition), Art. 26 deployer duties, Art. 40 harmonised standards (presumption of conformity — the standards delay behind the deferral), Art. 72/73 post-market monitoring and serious-incident reporting, a governance anchor (AI Office · AI Board · national market-surveillance authorities, Arts. 64/65/70), and an ISO/IEC 23894 column plus Art. 11/12/72 rows in the Cross-Framework Mapping — all terms and links with tooltips per the site convention. Also updated: Standards at a glance, the home page and llms.txt.

Completed tooltip coverage on the remaining pages. ISO/IEC 42001 (Clauses 4–10, Annex A–D) and ISO/IEC 23894 (Clauses 4–6, Annex A–C) now carry per-page hover definitions (kept page-local to avoid the "Annex B" cross-standard collision). Every linked Key Section entry — EU AI Act articles, DORA articles, UK principles, Berkeley CLTC papers and NIST ITL pages — now shows an explanatory tooltip on mouseover of the link itself, in addition to the existing term glossary.

Added hover/focus tooltips for ~27 key terms (defined once in a shared glossary, shown wherever a term appears) and expanded each definition. Linked the Key Sections, Audit-Relevant Anchors and Cross-Framework Mapping entries to their direct sources: EU AI Act articles/annexes (artificialintelligenceact.eu), DORA articles, NIST functions (AIRC Playbook), UK principles (gov.uk) and the CSA/Berkeley pages. ISO clauses are paywalled, so those cells point to the ISO catalogue rather than fabricated deep links.

2026-06-16 — Deeper own-words explainers

Expanded the five lighter pages — ISO/IEC 42001, ISO/IEC 23894, CSA Agentic Profile, Berkeley CLTC and NIST ITL Landscape — with an "In depth (in our own words)" section. These explain the concepts in our own words (no verbatim text), so the paywalled/licence-restricted standards gain depth without reproducing any provider wording.

2026-06-16 — New pages + SEO/GEO

Added three pages: Standards at a glance (comparison of all nine), a consolidated Glossary, and an applied AI audit for enterprise CMS guide. SEO/GEO: robots.txt (search + AI crawlers, sitemap) and JSON-LD structured data (Person · WebSite · ProfessionalService) on the home page.

2026-06-16 — Fact-check pass & corrections

Intensive accuracy review of all nine pages (dates, versions, article/clause numbers, verbatim quotes, licences), cross-checked via web sources and an independent verifier. Corrections made: ISO/IEC 42006 is published (42006:2025), not a draft; the CLTC "Intolerable Risk Threshold Recommendations" is February 2025, not January 2025; the CSA Agentic Profile draft date softened to "early 2026" (public page dated April 2026). All four verbatim "Source text" quotes (NIST, EU AI Act, DORA, UK) confirmed against their primary sources.

2026-06-16 — Plain-language explainer + licence layer

Each page gained an "In plain language" explainer (our own words, not the normative text), a Key terms glossary, and a "Provenance & licence" box. Per-source license + reproduction tiers were added to the schema and seed (public-domain / open-attribution / share-alike-noncommercial / facts-and-quotation / proprietary-metadata-only) so reproduction stays within each provider's licence. No change to any underlying standard.

2026-06-16 — Library depth enrichment

All nine reference pages gained an Auditor Checklist (evidence-oriented checks) and a Cross-Framework Mapping (indicative cross-references to NIST / ISO / EU AI Act / OWASP). No change to any underlying standard — an editorial depth pass on the baseline. Future entries here track standard changes only.

2026-06-16 — Initial baseline

First baseline snapshot of all five watched standards. Each reference page was hand-authored from current primary sources and the local research library, pending the first automated routine run.

Standard Severity Note
NIST AI RMF baseline AI RMF 1.0, GenAI Profile 600-1, Adversarial ML 100-2e2025. Agentic Profile noted as forthcoming (~Q4 2026).
EU AI Act baseline Base regulation + 2026-05-07 Digital Omnibus provisional agreement (high-risk deferral to 2027/2028), pending OJ publication.
ISO/IEC 42001 baseline 2023 1st edition current; ISO/IEC 42006:2025 (cert-body requirements) at DIS stage.
CSA Agentic Profile baseline Lab Space draft v1 (2026-03-27) + CSA 2026 catastrophic-risk / AICM / STAR-for-AI programme.
Berkeley CLTC baseline Cyber-threat thresholds white paper (2026-01-22) + intolerable-risk recommendations (2025-01).
ISO/IEC 23894 baseline 2023 1st edition; AI risk-management guidance, companion to ISO/IEC 42001 and ISO 31000.
UK AI White Paper baseline 2023 pro-innovation White Paper (CP 815) + 2024 response; AI Growth Lab consultation (Oct 2025 → Jan 2026).
DORA baseline Reg. (EU) 2022/2554, applies since 2025-01-17; five pillars + ICT third-party oversight (AI vendor resilience).
NIST ITL Standards Landscape baseline ITL AI program landscape, anchored to the 2026-03-06 AI Standards Landscape webinar.