Docs

Appearance

AI Governance Framework Updates ​

This page gives the dated changes for each framework that Modulos documents. A change is, for example, an adoption, a publication, an entry into force, a date of application, a new edition, guidance, or a proposal. An entry for a proposal or a draft gives its status on a stated date. Each section links to the framework pages, which give the rules and the sources. For the type and the legal status of each framework, see Frameworks by type. Changes to the Modulos Frameworks are in the changelog.

EU AI Act ​

  • 2024-07-12 — The EU AI Act, Regulation (EU) 2024/1689, is in the Official Journal of the European Union.
  • 2024-08-01 — The EU AI Act enters into force, on the twentieth day after its publication (Article 113).
  • 2025-02-02 — Chapters I and II of the EU AI Act apply (Article 113, point (a)). Examples are Article 4 on AI literacy and Article 5(1), points (a) to (h).
  • 2025-02-02 — Article 113, point (a), gives exceptions: Article 5(1), points (ba) and (bb), and Article 5(1a) and (1b). They apply only from 2 December 2026.
  • 2025-02-04 — The Commission publishes its guidelines on prohibited AI practices. See Prohibited AI practices.
  • 2025-02-06 — The Commission publishes its guidelines on the definition of an AI system. See AI system definition.
  • 2025-07-10 — The Commission publishes the General-Purpose AI Code of Practice, a voluntary tool for providers of general-purpose AI models. See Codes of Practice.
  • 2025-07-18 — The Commission publishes its guidelines on the scope of the obligations for providers of general-purpose AI models. See GPAI models.
  • 2025-08-01 — The Commission and the AI Board find that the General-Purpose AI Code of Practice is "an adequate voluntary tool for providers of GPAI models to demonstrate compliance with the AI Act".
  • 2025-08-02 — Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII, Chapter XII, and Article 78 apply, but not Article 101 (Article 113, point (b)).
  • 2025-09-26 — The Commission publishes a draft guidance document and a draft reporting template for serious incidents (Article 73). The consultation ends on 7 November 2025. See Article 73.
  • 2026-05-19 — The Commission publishes draft guidelines on the classification of high-risk AI systems. The consultation ends on 23 July 2026. As of October 2026, the guidelines are a draft. See High-risk classification.
  • 2026-06-10 — The Commission publishes the Code of Practice on Transparency of AI-generated Content, a voluntary tool for providers and deployers. See Code of Practice.
  • 2026-07-20 — Communication to the Commission C(2026) 5054 approves the content of the Article 50 guidelines. The guidelines apply only after the Commission formally adopts them: "It is only from that moment that these Guidelines will be applicable". See Publication and adoption dates.
  • 2026-07-24 — Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, is in the Official Journal. It amends the EU AI Act. See Digital Omnibus on AI.
  • 2026-07-27 — Regulation (EU) 2026/1744 enters into force, on the third day after its publication (its Article 4). Articles 102 to 110 of the EU AI Act apply from this date (Article 113, point (d)).
  • 2026-07-27 — The new Article 4 tells providers and deployers of AI systems to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". It adds: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
  • 2026-08-02 — This is the general date of application of the EU AI Act (Article 113, second paragraph). For example, Article 50, Chapter III Section 5, Chapter IX, and Article 101 apply from this date. Regulation (EU) 2026/1744 did not change the general date.
  • 2026-12-02 — Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) apply (Article 113, point (a)). See Prohibited AI practices.
  • 2026-12-02 — Providers of AI systems that generate synthetic audio, image, video, or text content and were placed on the market before 2 August 2026 must "take the necessary steps in order to comply with Article 50(2)" by this date (Article 111(4)). This includes general-purpose AI systems.
  • 2027-08-02 — Providers of general-purpose AI models placed on the market before 2 August 2025 must "take the necessary steps in order to comply" by this date (Article 111(3)).
  • 2027-08-02 — Article 57(1) tells Member States to make sure that their competent authorities "establish at least one AI regulatory sandbox at national level, which shall be operational by 2 August 2027".
  • 2027-12-02 — Chapter III Sections 1 to 3 apply to AI systems classified as high-risk in Article 6(2) and Annex III (Article 113, point (c)(i)). Article 6(5) is not included. Regulation (EU) 2026/1744 moved this date from 2 August 2026.
  • 2028-08-02 — Chapter III Sections 1 to 3 apply to AI systems classified as high-risk in Article 6(1) and Annex I (Article 113, point (c)(ii)). Article 6(5) is not included. For Annex I Section B products, Article 2(2) limits the provisions that apply to Article 6(1) systems.

See Dates and Guidance status on the EU AI Act page.

EN 18286 ​

  • 2026-07-12 — CEN approves EN 18286:2026, the European Standard for a quality management system for EU AI Act regulatory purposes.
  • 2026-07-31 — A CEN-CENELEC news page tells readers that EN 18286:2026, "the first standard in support of the implementation of the AI Act", "has been published".
  • 2026-10-14 — Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 publishes the reference of EN 18286:2026 in the Official Journal. From this date, compliance with the Table ZA.1 clauses gives a presumption of conformity for Article 17(1) and Article 11(1), first sentence, in the standard's scope and on each row's conditions.

See EN 18286 and Annex ZA and presumption of conformity.

ISO/IEC 42001 ​

  • 2023-12 — ISO and IEC publish ISO/IEC 42001:2023, the first edition of the standard for an AI management system.
  • 2025-05 — ISO and IEC publish ISO/IEC 42005:2025, guidance for AI system impact assessments.
  • 2025-07 — ISO and IEC publish ISO/IEC 42006:2025, the requirements for certification bodies that audit AI management systems to ISO/IEC 42001.

See ISO/IEC 42001 and Other standards for AI management systems.

IEEE 7003 ​

  • 2024-12-11 — The IEEE SA Standards Board approves IEEE Std 7003-2024, IEEE Standard for Algorithmic Bias Considerations.
  • 2025-01-24 — IEEE publishes IEEE Std 7003-2024.

See IEEE 7003.

NIST AI RMF ​

  • 2023-01-26 — NIST publishes the AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1, which is "intended for voluntary use".
  • 2024-07-26 — NIST publishes NIST AI 600-1, the Generative AI Profile, "a cross-sectoral profile of and companion resource for the AI Risk Management Framework".
  • 2025-12-16 — NIST publishes NIST IR 8596, the Cyber AI Profile, as an initial preliminary draft. It has three areas: "Secure", "Defend", and "Thwart". The publication page also announces workshop updates on the SP 800-53 Control Overlays for Securing AI Systems (COSAiS). As of October 2026, the Cyber AI Profile is a draft.
  • 2026-04-07 — NIST publishes a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. As of October 2026, this profile is not published.

As of October 2026, the NIST AI RMF page gives this status: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan."

See The framework and its status and NIST AI RMF profiles.

Colorado SB 26-189 ​

  • 2024-05-17 — Colorado enacts SB 24-205. SB 24-205 adds part 17 to article 1 of title 6, C.R.S., with duties for developers and deployers of "high-risk artificial intelligence systems". These duties apply "on and after February 1, 2026".
  • 2025-08-28 — SB 25B-004 is approved. Its Sections 1 to 3 change the date from which the SB 24-205 duties apply, from February 1, 2026 to June 30, 2026.
  • 2026-04-27 — In X.AI LLC v. Weiser (D. Colo.), a minute order tells the Attorney General not to start enforcement, an investigation included, for alleged violations of SB 24-205.
  • 2026-04-27 — The minute order also covers legislation that replaces or amends SB 24-205 "enacted during this legislative session". It covers alleged violations that "occurred or may occur" on or before 14 days after the court rules on the forthcoming motion of xAI for a preliminary injunction.
  • 2026-05-14 — The Governor signs SB 26-189. It repeals and reenacts part 17 for the use of covered automated decision-making technology (ADMT) in consequential decisions. See Sections of SB 26-189 for the duties and consumer rights.
  • 2026-05-14 — Some provisions of SB 26-189 take effect upon passage (Section 5(2)). These are §§ 6-1-1704(4), 6-1-1705(3), and 6-1-1706(6), § 10-3-1104.9(3)(e), and Sections 4, 5, and 6.
  • 2026-05-29 — HB 26-1263 is approved. It adds duties for operators of conversational artificial intelligence services, and its own § 6-1-1708, to part 17. Some operator duties apply from January 1, 2027.
  • 2026-05-29 — HB 26-1263 takes effect on August 12, 2026, if adjournment sine die was on May 13, 2026 and no referendum petition is filed (its Section 3). The Modulos Frameworks for SB 26-189 do not include HB 26-1263.
  • 2026-05-29 — As of October 2026, the codification of part 17 is not complete, because HB 26-1263 and SB 26-189 each have a § 6-1-1708.
  • 2026-07-01 — The U.S. Federal Trade Commission gives a proposed policy statement that refers to "Colorado’s recently revised Artificial Intelligence Act". As of October 2026, it is not adopted and it is not law.
  • 2026-08-11 — The Colorado Department of Law gives notice of proposed rules for SB 26-189 and HB 26-1263 (4 CCR 904-6). The public hearing starts on October 26, 2026.
  • 2027-01-01 — SB 26-189 takes effect, other than the provisions of Section 5(2), which took effect upon passage (Section 5(1)). It applies to consequential decisions made on or after this date (Section 5(3)).
  • 2027-01-01 — The Attorney General must adopt the rules of § 6-1-1704(4)(b) and § 6-1-1705(3) on or before this date.
  • 2028-01 — The Attorney General starts the annual reports on enforcement actions and cure periods (§ 6-1-1706(3)(e)).
  • 2030-01-01 — The cure subsection, § 6-1-1706(3), with its sixty-day cure period, is repealed (§ 6-1-1706(3)(f)).

As of October 22, 2026, the Attorney General rules are proposed and not adopted. Modulos will update the Frameworks when the Attorney General adopts the rules of §§ 6-1-1704(4)(b) and 6-1-1705(3).

See SB 26-189 and the other Colorado acts and When SB 26-189 applies.

CCPA ADMT Regulations ​

  • 2025-07-24 — The Board of the California Privacy Protection Agency (the Agency) adopts the 2025 amendments to the CCPA regulations. The amendments include Article 10 on risk assessments and Article 11 on ADMT.
  • 2025-09-22 — The Office of Administrative Law approves the amendments. They take effect on January 1, 2026.
  • 2026-01-01 — The amendments take effect. Section 7150(a) applies to a business if its processing of personal information "presents significant risk to consumers’ privacy". That business "must conduct a risk assessment before initiating that processing".
  • 2026-01-01 — Section 7150(b) gives six processing activities of this type. One of them is the use of ADMT for a significant decision concerning a consumer.
  • 2026-09-30 — California SB 947, Chapter 859, is approved. It is a Labor Code statute on employers' use of automated decision systems, not a part of the CCPA regulations. The Modulos Frameworks do not include it.
  • 2027-01-01 — A business that uses ADMT for a significant decision before this date must comply with Article 11 on or before this date (§ 7200(b)). Article 11 gives the Pre-use Notice, the opt-out of ADMT, and access to ADMT.
  • 2027-01-01 — From this date, a business must comply with Article 11 each time that it uses ADMT for a significant decision (§ 7200(b)).
  • 2027-07-01 — SB 947 becomes operative (Labor Code § 1526.7).
  • 2027-12-31 — A business must complete and document its risk assessment for processing listed in § 7150(b) that started before January 1, 2026 and continues after that date (§ 7155(b)).
  • 2028-04-01 — The first submission to the Agency of the § 7157(b) information, for risk assessments conducted in 2026 and 2027, is due (§ 7157(a)(1)).

For risk assessments conducted after 2027, the submission deadline is April 1 after each year in which the business conducted risk assessments (§ 7157(a)(2)). The submission is information about the assessments, not the reports. The Agency or the Attorney General can tell the business to send the reports (§ 7157(e)).

Civil Code § 1798.199.95(d)(1) tells the Agency to adjust the CCPA monetary thresholds on January 1 of each odd-numbered year. As of October 2026, the adjusted thresholds of January 1, 2025 apply.

See Which instrument is which and Dates on the CCPA ADMT Regulations page.

NYC Local Law 144 ​

  • 2021-11-10 — The New York City Council passes Local Law 144 of 2021 (Council Int. No. 1894-A of 2020). The Mayor returns it unsigned on December 13, 2021. It adds §§ 20-870 to 20-874 to the Administrative Code. See Obligations of the law for its scope and duties.
  • 2022-09-23 — The Department of Consumer and Worker Protection (DCWP) proposes a first version of its rules for Local Law 144.
  • 2022-12-23 — DCWP proposes a second version of the rules. DCWP then adopts the rules at 6 RCNY §§ 5-300 to 5-304.
  • 2023-01-01 — Local Law 144 takes effect.
  • 2023-06-29 — DCWP publishes its FAQ, which is not law. The FAQ tells employers and employment agencies that they "are responsible for ensuring they do not use an AEDT unless a bias audit was done". It adds: "The vendor that created the AEDT is not responsible for a bias audit of the tool."
  • 2023-07-05 — DCWP starts the enforcement of Local Law 144.
  • 2025-12-02 — The New York State Comptroller makes an audit of the DCWP enforcement of Local Law 144 publicly available. The audit is not a source of obligations.

See Obligations of the law and Enforcement and penalties.

OWASP Top 10 for LLM / Agentic ​

  • 2023-08-01 — OWASP publishes Version 1.0 of the OWASP Top 10 for LLM Applications.
  • 2023-10-16 — OWASP publishes Version 1.1 of the OWASP Top 10 for LLM Applications.
  • 2024-11-18 — OWASP publishes Version 2025 of the OWASP Top 10 for LLM Applications, also named v2.0, with the entries LLM01:2025 to LLM10:2025.
  • 2025-12-09 — The OWASP GenAI Security Project makes Version 2026 of the OWASP Top 10 for Agentic Applications available. Its entries are ASI01 to ASI10. Its own text has the date December 2025.
  • 2026-08-04 — OWASP publishes the OWASP Top 10 for LLM Applications 2026, with new numbers for most entries. OWASP calls the 2026 edition the "Current release".

As of October 2026, the Modulos Framework MFF-11 maps the 2025 edition of the OWASP Top 10 for LLM Applications.

See OWASP for AI, Changes in 2025 and 2026, and Date and effect.

UAE AI Ethics ​

  • 2022-12 — The UAE AI Office gives the DEC 2022 edition of the AI Ethics Principles and Guidelines. Section 1.2 calls the guidelines "a living document".

See Non-binding guidelines.

UAE Consumer AI ​

  • 2026-02-11 — The Central Bank of the UAE (CBUAE) issues its Guidance Note on consumer protection and AI for licensed financial institutions.

See UAE Consumer AI.

MAS FEAT ​

  • 2022-02 — The Veritas Consortium publishes Veritas Documents 3, 3A, 3B, and 3C, the assessment methodology for the MAS FEAT Principles. MAS announced the end of Veritas Phase 2 on 4 February 2022.
  • 2026-10-07 — MAS publishes the Guidelines on Artificial Intelligence Risk Management for Financial Institutions, which are different from MAS FEAT.
  • 2026-10-07 — The MAS Guidelines tell financial institutions that the FEAT principles "continue to apply for guiding the use of AI in the financial sector" (§ 1.2).
  • 2027-10-07 — The MAS Guidelines on Artificial Intelligence Risk Management take effect (§ 1.8).

See MAS AI Risk Management Guidelines and Veritas assessment.

FINMA Guidance 08/2024 ​

  • 2024-12-18 — FINMA publishes Guidance 08/2024, "Governance and risk management when using artificial intelligence".
  • 2024-12-18 — On that date, section 1 of the guidance gives this information: "To date, there is no AI-specific legislation in Switzerland."

See The guidance and the law.

Singapore MGF for Agentic AI ​

  • 2026-01 — The Infocomm Media Development Authority (IMDA) of Singapore launches the Model AI Governance Framework for Agentic AI at the World Economic Forum.
  • 2026-05-20 — IMDA publishes Version 1.5 of the Model AI Governance Framework for Agentic AI. IMDA updates it on 5 June 2026. The framework is voluntary guidance with four dimensions.

See Changes in Version 1.5.

Saudi AI Risk Management ​

  • 2026-04 — The Saudi Data and Artificial Intelligence Authority (SDAIA) issues its advisory National Artificial Intelligence Risk Management Framework, SDAIA-P145, version 1, in Arabic. The Arabic text is authoritative.
  • 2026-04 — SDAIA also issues an English executive summary of the framework, SDAIA-P145EN, version 1.0.

See Saudi AI Risk Management.

GDPR ​

  • 2018-05-25 — The GDPR, Regulation (EU) 2016/679, applies (Article 99(2)).
  • 2025-11-19 — The Commission proposes the Digital Omnibus, COM(2025) 837. Its Article 3 amends the GDPR. As of October 2026, the proposal is not law.
  • 2025-12-12 — Regulation (EU) 2025/2518, with more procedural rules for the enforcement of the GDPR, is in the Official Journal. It applies from 2 April 2027 (its Article 37(2)).
  • 2026-07-08 — The feedback period of the European Data Protection Board starts for two draft guidelines: 02/2026 on Anonymisation and 03/2026 on web scraping in the context of generative AI.
  • 2026-10-30 — The feedback period for the two draft guidelines ends. As of October 2026, the two guidelines are drafts.

See Dates and rules of the GDPR and The Digital Omnibus proposal.

NIS2 ​

  • 2023-01-16 — NIS2, Directive (EU) 2022/2555, enters into force (Article 45).
  • 2024-10-17 — This is the time limit for each Member State to adopt and publish its national measures for NIS2 (Article 41(1)).
  • 2024-10-18 — Member States apply their national measures from this date (Article 41(1)). The NIS2 obligations of an entity apply through the national law of a Member State that transposed NIS2.
  • 2026-01-20 — The Commission proposes COM(2026) 13, a directive that amends NIS2. As of October 2026, it is not law.
  • 2026-07-08 — The Commission refers Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union "for failing to notify measures transposing the NIS2 Directive" (IP/26/1499).

See Dates and transposition of NIS2 and Proposals to amend NIS2.

DORA ​

  • 2023-01-16 — DORA, Regulation (EU) 2022/2554, enters into force.
  • 2025-01-17 — DORA applies to the entities in Article 2(1) (Article 64). These are financial entities in points (a) to (t), and ICT third-party service providers in point (u). Article 2(3) and (4) give exclusions.
  • 2025-11-18 — The European Supervisory Authorities (ESAs) designate critical ICT third-party service providers and publish their names.

See Dates and status of DORA and Who DORA applies to.

Cyber Resilience Act ​

  • 2024-11-20 — The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is in the Official Journal.
  • 2024-12-10 — The CRA enters into force (Article 71(1)).
  • 2025-11-28 — The Commission adopts Implementing Regulation (EU) 2025/2392 "on the technical description of the categories of important and critical products with digital elements". It is in the Official Journal of 1 December 2025.
  • 2026-06-11 — Chapter IV of the CRA (Articles 35 to 51), notification of conformity assessment bodies, applies (Article 71(2)).
  • 2026-07-27 — Communication C(2026) 5252 approves the content of the draft Commission guidance for the CRA (Article 26). The guidance applies only after the Commission formally adopts it, and it is not binding.
  • 2026-09-11 — The reporting obligations of manufacturers in Article 14 of the CRA apply (Article 71(2)). Article 14 also applies to products placed on the market before 11 December 2027 (Article 69(3)). See Article 14 for the reporting duties.
  • 2026-09-11 — ENISA launches the "initial operating capability" of the single reporting platform.
  • 2027-12-11 — The CRA applies in full, for all economic operators (Article 71(2)). Products placed on the market before this date are subject to the CRA only after a substantial modification from this date (Article 69(2)). Article 69(3) keeps Article 14 for them.

The Commission standardization page (updated July 31, 2026) names no harmonized standard for the CRA with a reference in the Official Journal.

See Dates and transitional provisions, Guidance and related information, and Article 14.

ISO/IEC 27001 ​

  • 2022-10 — ISO and IEC publish ISO/IEC 27001:2022, the third edition of the standard. It replaces ISO/IEC 27001:2013.
  • 2024-02 — ISO and IEC publish ISO/IEC 27001:2022/Amd 1:2024, "Climate action changes".

See The standard and its edition.

ISO/IEC 27701 ​

  • 2019-08 — ISO and IEC publish ISO/IEC 27701:2019, the first edition, for privacy information management as an extension of ISO/IEC 27001 and ISO/IEC 27002.
  • 2025-10-14 — ISO and IEC publish ISO/IEC 27701:2025, the second edition. Organizations can use this management system standard alone. On the same date, the 2019 edition is withdrawn.

See The standard and its edition.

UAE PDPL ​

  • 2021-09-20 — The UAE issues Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). This is the date of issue on the UAE Legislation website.
  • 2021-09-26 — The UAE PDPL is in the Official Gazette No. 712.
  • 2022-01-02 — The UAE PDPL enters into force (Article 31).

As of October 2026, check the UAE Legislation website for the Executive Regulations before you use a date from them.

See Dates on the UAE PDPL page.

Microsoft Supplier DPR ​

  • 2024-10 — Microsoft issues Version 10 of the Microsoft Supplier Data Protection Requirements (DPR). The Modulos Frameworks MFF-8 and OFF-8 map Version 10.
  • 2025-04 — Microsoft issues Version 11 of the DPR.
  • 2026-03 — Microsoft issues Version 12 of the DPR. As of October 2026, Version 12 is the current version in the Microsoft publications. These publications give no date from which Version 12 applies.

See Microsoft Supplier DPR.

Framework versions in Modulos ​

Modulos notifies the Organization admins of Organizations that have a Framework when a new version becomes available. It also notifies the Owners of AI Systems that use that Framework.

See Frameworks in Modulos.

Disclaimer

This page gives general information. It is not legal advice. Before you use a date, compare it with its official source.