What's new
The releases below are listed newest first. Every regulatory addition carries a law-review date and a pending legal sign-off marker.
Premium modules
The hosted service is a free pilot: every module, premium included, is open to every organization. The premium modules are licensed for self-hosted installations, activated with an offline licence file.
How the premium modules are offered
- Open to everyone on the hosted pilot.
- Licensed for self-hosted installations.
AIUC-1, the certification standard for AI agents
Unreleased22 September 2026AIUC-1 joins the frameworks an organisation can map its systems against, and the frameworks wheel.
AIUC-1 as a compliance framework
Its six domains and the 51 requirements in force in the Q3 2026 release, each with its identifier and a one-line summary, and 186 links to ISO/IEC 42001, the NIST AI RMF and the EU AI Act taken from the crosswalks the standard publishes. It never attaches by risk tier: you choose it on the compliance page for the systems that are agents.
The frameworks wheel: thirteen frameworks
AIUC-1 is the first framework on the wheel written for agents, and the only one with mandatory technical evals. The selector asks whether you deploy or build AI agents and, if you do, suggests AIUC-1 as the certification for agents.
A programme in minutes, and the builder's view
0.4.0 to 0.5.011 to 13 September 2026These releases shorten the path from an empty account to a working programme, and add the records a team building AI, a board and a defence team each need.
A programme in minutes
Onboarding asks who the programme is for and goes straight into the Quick Start wizard, which now covers nine industries, adds a core policy pack for any policy type that is missing, and drafts an impact assessment for each high-risk system and a due-diligence review for each catalogue vendor. An existing inventory can be imported from a spreadsheet; a risk tier is imported only when the sheet states it, and stays unconfirmed until a person confirms it.
Threat modelling for builders
Tick what a system can see, retrieve, remember, call and do, and the scenarios that follow are proposed with controls at five layers, each with a concrete test. Only a control with a current passing test can be written into the compliance register as evidence.
The program pack
One archive in the reader's language: the program and register reports, every policy, the obligations calendar, per-system impact assessments, notices and review protocols, vendor reviews, threat models and the inventory, with an integrity manifest. Every export states when it was generated, from which version, and under which rule packs.
Legal hold, proceedings and board reporting
A legal hold refuses every deletion path it covers while it is in force. A proceedings register keeps each inquiry or claim with its deadlines and the position taken, incidents gain statutory clocks, and board reports capture a program snapshot so the figures shown can be reproduced.
Audit trail and dated versions
A readable audit trail with filters and a full export, for owners, admins and AI officers, and dated versions of every assessment's answers, appended on each change, submission and decision.
One assessment, five regimes
0.3.08 September 2026Most organisations deploying AI now answer to several regulators at once, and reconciling them by hand is where governance programmes stall. This release makes one impact assessment answer all of them, and generates the documents each regime expects.
Four more regulatory regimes
GDPR, Colorado SB 26-189, Texas TRAIGA and Washington's five domain instruments join the EU AI Act, NIST AI RMF, ISO 42001 and California ADMT. That is 294 requirements across eight frameworks and 115 cross-framework mappings, all bilingual. Each regime resolves its own scope from your declared jurisdictions and a few screening answers, and an unanswered question stays visibly undetermined rather than quietly reading as a no.
The unified impact assessment
One question set with a common core drafted to the strictest formulation among the regimes, plus overlays that appear only where a regime applies. Every question declares the requirement codes its answer evidences, so one answer stands as evidence in several compliance registers at once. Where two regimes ask the same legal question the product reuses the answer: a California ADMT sole-factor finding also answers the GDPR Article 22 question.
Three documents you can take away
The unified impact assessment, a multi-jurisdictional notice built as a universal core plus one addendum per jurisdiction, and a human review and appeal protocol with a table of what each jurisdiction words differently. Assembly is deterministic, so a document that cites statute is reproducible. They download as Markdown, to go straight into your own systems of record.
Gaps are shown, not hidden
An unanswered question becomes a visible gap carrying the obligation it would have evidenced, collected into an open-items summary at the top of every document. Citations are filtered to the regimes that actually apply, so a document never names a state you do not operate in.
The agentic stress test
Eleven findings covering where each document breaks when the system hands its output to an autonomous downstream agent: the Article 22 boundary moving to the agent, the California human-involvement prongs failing at the handoff, a notice that no longer describes the decision, a protocol that reviews what cannot be reversed, records that trace the output rather than the action, and an agent that reaches past the processing contract. Each names the assumption the regime made and the provision the agentic layer demands.
The vendor supply chain
The vendor catalog has carried structured subprocessor lists for 254 vendors, with 604 entries cross-linked to other catalog vendors. They are now rendered: a supply chain on each catalog entry with the reverse view of who depends on it, a supply-chain tab on each of your vendors marking the subprocessors you already govern, and a shared-subprocessors card showing the providers sitting beneath more than one of your vendors. The Annex IV draft receives the list too.
A self-hosting upgrade fix
The migrator's pre-baseline check had never fired, so installs created before the migrations baseline could not upgrade. Both faults are fixed and the upgrade path is now verified against the published image on every release.
California, jurisdictions and the obligation calendar
0.2.xAugust 2026The releases that made the product multi-jurisdictional in the first place.
California CCPA ADMT
The fourth compliance framework: 92 requirements, the three-prong human-involvement determination, significant-decision domains, opt-out basis, designated reviewer and appeal route, and the risk-assessment deadlines.
Jurisdictions and the regulatory calendar
A jurisdiction model on the organisation and per system, driving a dated obligation timeline bound to your own inventory rather than a generic list of deadlines.
Article 50 transparency
Per-system transparency profiles, the four obligations, marking methods and generated transparency statements.
Legal review status
The GDPR, Colorado, Texas and Washington packs, the unified assessment and the agentic stress test were signed off on 8 September 2026. The two Washington items previously flagged as unconfirmed were verified against the session laws first: HB 1170 is chapter 167, Laws of 2026, effective 1 February 2027, and HB 2225 is chapter 168, effective 1 January 2027. The prior-authorisation limits are in force from 11 June 2026, not 2027, because the January 2027 date shown against RCW 48.43.830 belongs to a later section that reconciles two 2025 amendments rather than to the artificial-intelligence duties. The EU AI Act and California ADMT packs carry their own review dates and are still pending sign-off; any document citing them says so.
See it in the product
Open any AI system and choose the Cross-border regimes tab.
Read the cross-border documentation