What changed in the framework, and when

10 legal reviews since 09/07/2026; the methodological framework stayed at v1.0.

1. 13/10/2026framework v1.1

   Dimension E gains a seventh indicator, "Frugal AI", and is measured where electricity is consumed

   Methodology v1.1. Indicator built on the definition of AFNOR Spec 2314, the commitment kit of the French Ministry for Ecological Transition and art. 95(2)(b) of the AI Act; AI leaves the "digital sobriety" question, which gains the retention periods of art. 6 para. 4 FADP. Hosting and measurement are judged where the electricity is consumed (GHG Protocol, Scope 2 Guidance 2015; AFNOR Spec 2314, chapter 4): offsets and purchased green electricity do not count. Named scopes (GHG Protocol 2004; cloud and AI services in category 1 of scope 3) and the VSME format (Delegated Regulation (EU) 2026/1560: B3 within the value chain cap, C3 outside it). Swiss law reread: art. 5 Climate and Innovation Act, art. 964a and 964b CO, preliminary draft of a federal act on sustainable corporate governance, PPA art. 2 and 29. Weights and calculation unchanged; an earlier assessment counts the new question as zero until it is retaken.

2. 09/10/2026framework v1.0

   High-risk profiling triggers the impact assessment on its own

   Re-reading on Fedlex of Art. 5 let. f and g, Art. 6 para. 6 and 7, Art. 12 para. 5 and Art. 21 to 23 FADP, as well as Art. 24 of the Data Protection Ordinance. High-risk profiling contains the high risk in its definition: the /aipd module treats it as a statutory qualification with the same effect as a presumption under Art. 22 para. 2, recalling the record of processing activities that becomes mandatory even below 250 employees (Art. 24 let. b). A single factor calls for a reasoned decision, plain profiling becomes an appreciation factor, and Art. 35(3) GDPR applies to companies subject to it. Reading consistent with the FDPIC and the online commentary on Art. 22.

3. 28/09/2026framework v1.0

   Two attributions corrected: prosecution of FADP offences and Art. 328b CO

   Re-reading of Art. 60 to 64 FADP and Art. 328b CO on Fedlex. Only Art. 60 para. 1, Art. 61 and Art. 62 FADP are prosecuted on complaint; Art. 60 para. 2 and Art. 63 are prosecuted ex officio. The fine shown as “on complaint” now cites Art. 60 para. 1 rather than the whole article. Art. 328b CO covers only the employee: the limit applied to applicants is the FDPIC's, and is now cited as such. This review corrects the wording of the 26 August 2026 review, which attributed applicants to the text of the CO.

4. 28/08/2026framework v1.0

   Cited duties become measured duties

   Three binding duties were cited by the questionnaire without any question measuring them: documenting every breach and notifying the FDPIC where the risk is high (art. 24 FADP, art. 15 para. 4 DPO), data protection by design and by default (art. 7 FADP), and prohibited practices (art. 5 AI Act). The questions and levels concerned were widened; the number of indicators, the weights and the score calculation are unchanged.

5. 27/08/2026framework v1.0

   The Environment dimension gets its first binding anchors

   OREA art. 5, 8 and 9 para. 3 and OEEE art. 4 para. 2, re-read in their consolidated texts, for hardware end of life and procurement — measuring and reducing the footprint remain voluntary. Same review: the legal bases of the register's supply-chain signals (art. 9, 16, 17 and 6 para. 3 FADP) and of the duties triggered by an incident (art. 24 FADP, art. 26(5) AI Act, art. 15 para. 4 DPO).

6. 26/08/2026framework v1.0

   Anchoring in Swiss law beyond data protection

   Art. 328b CO (workers' and applicants' data), art. 26 OLW 3 (monitoring at the workstation), art. 3 GEA and art. 8 Cst. (non-discrimination), art. 3 para. 1 let. b UCA, art. 2 and 10 CopA. The Environment dimension is left without a binding anchor, and documented as such: zero indicators out of six.

7. 02/08/2026framework v1.0

   The application of art. 50 verified against primary sources

   No postponement: the transparency obligations apply from 2 August 2026. Clarification of art. 99(6) for SMEs — the lower of the two caps applies, exactly the opposite of the general rule.

8. 31/07/2026framework v1.0

   The “Digital Omnibus AI” is identified and the calendar consolidated

   Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July. It postpones the Annex III high-risk obligations to 2 December 2027 and keeps art. 50 at 2 August 2026. Framework anchors unchanged.

9. 14/07/2026framework v1.0

   Review of our own processing

   Cookieless audience measurement declared in the privacy policy. This review concerns what we process, not the grid: the framework's anchors do not move.

10. 09/07/2026framework v1.0

    Initial version of the framework

    24 indicators across four dimensions, a 0 to 4 maturity scale, sector weighting profiles capped at 40 % per axis, label threshold at 70 out of 100, synthetic reference panel.

The version that governs is the engine's, not a document's: it is the one printed on your exports and dossiers. Reviews that touch the score calculation would increment the methodological framework version; none has done so to date.

The upcoming deadlines, as the framework keeps them. Each one opens a gap analysis between the framework and the text that entered into force; what comes out of it is recorded above, dated.

1. 02/12/2026UpcomingEU

   AI Act: new prohibitions and end of the marking transition

   New prohibitions under Art. 5 (generators of non-consensual intimate images, CSAM); end of the machine-readable marking transition (Art. 50(2)) for generative systems placed on the market before 2 August 2026.

2. 31/12/2026UpcomingSwitzerland

   Switzerland: draft AI legislation expected

   Implementation of the Council of Europe Framework Convention on AI (signed in March 2025): transparency, data protection, non-discrimination, oversight. Consultation expected by the end of 2026; first legislative amendments in 2027 at the earliest. Sectoral approach, no cross-cutting statute.

3. 02/12/2027UpcomingEU

   AI Act: “high-risk” obligations under Annex III (POSTPONED by the omnibus)

   Standalone systems in the Annex III areas (recruitment and HR, credit, life and health insurance pricing, education, biometrics, essential services, etc.): full obligations of providers and deployers (Art. 26: competent human oversight, control of input data, logs kept for at least 6 months, information of workers and of affected persons, etc.). The initial date of 2 August 2026 has been postponed by 16 months.

4. 02/08/2028UpcomingEU

   AI Act: high risk under Annex I (AI embedded in regulated products)

   Machinery, medical devices, toys and the like that embed AI subject to sectoral product regulations.