Law / Frameworks / What changed
What changed in the frameworks
Every change to a governance framework we read or watch, since : a framework read against the law or moved to a new edition, a draft or a final edition its publisher released, and a final framework added to the candidates. Each one links the page it can be checked on.
October 2026
-
Read against the law LexLint
ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and SystemsEuropean Telecommunications Standards Institute (ETSI)
Read against the law through the UK AI Cyber Security Code it transposes, showing ETSI's provision numbers with our own summaries and none of ETSI's text. Source
-
Added as a candidate LexLint
OWASP AI Testing GuideOWASP Foundation
Added to the candidates: a final framework under a license that lets LexLint print it, to read against the law next. Source
-
Read against the law LexLint
NIST TEVV-Athlon Framework for Evaluating AI SystemsNational Institute of Standards and Technology
Read against the law while still a draft, and listed with the drafts rather than in its group's table. Source
-
Read against the law LexLint
ENISA NIS2 Technical Implementation GuidanceEuropean Union Agency for Cybersecurity (ENISA)
Read against the law, leaving out of its own counts the Implementing Regulation it was written from. Source
-
Added as a candidate LexLint
Code of Practice on marking and labelling of AI-generated contentEuropean Commission, AI Office
Added to the candidates: a final framework under a license that lets LexLint print it, to read against the law next. Source
-
Read against the law LexLint
FINOS AI Governance FrameworkFINOS
Read against the law across the three NIST hub frameworks, with a page of its own on the financial-services law it cites. Source
-
Read against the law LexLint
CIS Critical Security ControlsCenter for Internet Security
Read against the law and given pages of its own once UnGovr's CIS Controls Supporter agreement was in force. Source
September 2026
-
Read against the law LexLint
OWASP Top 10 for LLM ApplicationsOWASP GenAI Security Project
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
OWASP Top 10 for Agentic ApplicationsOWASP GenAI Security Project
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
NIST Privacy FrameworkNational Institute of Standards and Technology
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
NIST Generative AI ProfileNational Institute of Standards and Technology
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
NIST Cybersecurity FrameworkNational Institute of Standards and Technology
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
NIST AI Risk Management FrameworkNational Institute of Standards and Technology
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
-
Read against the law LexLint
MIT AI Risk Mitigation TaxonomyMIT AI Risk Initiative
Read against the law and given pages of its own, one of the seven frameworks LexLint's frameworks section opened with. Source
August 2026
-
Draft released National Institute of Standards and Technology
NIST TEVV-Athlon Framework for Evaluating AI Systems
NIST released the initial public draft for comment, with comments open until . Source
July 2026
-
Draft released National Institute of Standards and Technology
Guidance and Templates for Public-Facing AI Documentation
NIST released the initial public draft of its zero draft on AI documentation, taking input until . Source
June 2026
-
Final published European Commission, AI Office
Code of Practice on marking and labelling of AI-generated content
The Commission published the final code of practice on transparency of AI-generated content. Source
How this list is kept
A person writes each entry when a framework joins, changes or leaves these pages, and when a publisher releases a draft or a final edition of a framework we watch. A change dated by its publisher carries the publisher's day; one of ours carries the day it reached these pages. A change whose day is not on record is left out rather than guessed.
Changes to the law itself are on What changed in the law.