What changed in the framework, and when

7 legal reviews since 09/07/2026; the methodological framework stayed at v1.0.

1. 28/08/2026framework v1.0

   Cited duties become measured duties

   Three binding duties were cited by the questionnaire without any question measuring them: documenting every breach and notifying the FDPIC where the risk is high (art. 24 FADP, art. 15 para. 4 DPO), data protection by design and by default (art. 7 FADP), and prohibited practices (art. 5 AI Act). The questions and levels concerned were widened; the number of indicators, the weights and the score calculation are unchanged.

2. 27/08/2026framework v1.0

   The Environment dimension gets its first binding anchors

   OREA art. 5, 8 and 9 para. 3 and OEEE art. 4 para. 2, re-read in their consolidated texts, for hardware end of life and procurement — measuring and reducing the footprint remain voluntary. Same review: the legal bases of the register's supply-chain signals (art. 9, 16, 17 and 6 para. 3 FADP) and of the duties triggered by an incident (art. 24 FADP, art. 26(5) AI Act, art. 15 para. 4 DPO).

3. 26/08/2026framework v1.0

   Anchoring in Swiss law beyond data protection

   Art. 328b CO (workers' and applicants' data), art. 26 OLW 3 (monitoring at the workstation), art. 3 GEA and art. 8 Cst. (non-discrimination), art. 3 para. 1 let. b UCA, art. 2 and 10 CopA. The Environment dimension is left without a binding anchor, and documented as such: zero indicators out of six.

4. 02/08/2026framework v1.0

   The application of art. 50 verified against primary sources

   No postponement: the transparency obligations apply from 2 August 2026. Clarification of art. 99(6) for SMEs — the lower of the two caps applies, exactly the opposite of the general rule.

5. 31/07/2026framework v1.0

   The “Digital Omnibus AI” is identified and the calendar consolidated

   Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July. It postpones the Annex III high-risk obligations to 2 December 2027 and keeps art. 50 at 2 August 2026. Framework anchors unchanged.

6. 14/07/2026framework v1.0

   Review of our own processing

   Cookieless audience measurement declared in the privacy policy. This review concerns what we process, not the grid: the framework's anchors do not move.

7. 09/07/2026framework v1.0

   Initial version of the framework

   24 indicators across four dimensions, a 0 to 4 maturity scale, sector weighting profiles capped at 40 % per axis, label threshold at 70 out of 100, synthetic reference panel.

The version that governs is the engine's, not a document's: it is the one printed on your exports and dossiers. Reviews that touch the score calculation would increment the methodological framework version; none has done so to date.

The upcoming deadlines, as the framework keeps them. Each one opens a gap analysis between the framework and the text that entered into force; what comes out of it is recorded above, dated.

1. 02/12/2026UpcomingEU

   AI Act — new prohibitions and end of the marking transition

   New prohibitions under Art. 5 (generators of non-consensual intimate images, CSAM); end of the machine-readable marking transition (Art. 50(2)) for generative systems placed on the market before 2 August 2026.

2. 31/12/2026UpcomingSwitzerland

   Switzerland — draft AI legislation expected

   Implementation of the Council of Europe Framework Convention on AI (signed in March 2025): transparency, data protection, non-discrimination, oversight. Consultation expected by the end of 2026; first legislative amendments in 2027 at the earliest. Sectoral approach, no cross-cutting statute.

3. 02/12/2027UpcomingEU

   AI Act — “high-risk” obligations under Annex III (POSTPONED by the omnibus)

   Standalone systems in the Annex III areas (recruitment and HR, credit, life and health insurance pricing, education, biometrics, essential services, etc.): full obligations of providers and deployers (Art. 26: competent human oversight, control of input data, logs kept for at least 6 months, information of workers and of affected persons, etc.). The initial date of 2 August 2026 has been postponed by 16 months.

4. 02/08/2028UpcomingEU

   AI Act — high risk under Annex I (AI embedded in regulated products)

   Machinery, medical devices, toys and the like that embed AI subject to sectoral product regulations.