{ "format": "palo-source-review", "schemaVersion": "1.0.0", "reviewId": "source-review-2026-10-12", "reviewedAt": "2026-10-12T19:59:32Z", "status": "scoped-review-completed", "reviewer": "Codex, AI-assisted review under maintainer instruction; owner acceptance and independent assurance are not implied.", "scope": "Six formerly review-due sources; editions, current publication status, PALO source relationships and bounded control-pack clarifications.", "authorityBoundary": "Current means recently reviewed within this scope. It does not establish legal applicability, certification, completeness, incident truth or production authorization.", "records": [ { "sourceId": "src-nist-ai-rmf", "reviewedEdition": "AI RMF 1.0 / NIST AI 100-1, January 2023", "outcome": "Retain the published 1.0 reference; announced revision work warrants a shorter review cycle.", "previousRecord": { "sourceId": "src-nist-ai-rmf", "title": "AI Risk Management Framework", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "sourceType": "official", "publisher": "US National Institute of Standards and Technology", "checkedAt": "2026-07-12T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 90, "nextReviewAt": "2026-10-10T08:00:00Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Use as a risk-management reference; confirm the current publication and organizational applicability before use." }, "reviewedRecord": { "sourceId": "src-nist-ai-rmf", "title": "AI Risk Management Framework", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "sourceType": "official", "publisher": "US National Institute of Standards and Technology", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 30, "nextReviewAt": "2026-11-11T19:59:32Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Reviewed AI RMF 1.0 (NIST AI 100-1, January 2023). NIST announces revision work; no successor is inferred from that notice. Voluntary risk-management context, not certification. Review record: docs/source-review-2026-10-12.html." } }, { "sourceId": "src-nist-genai-profile", "reviewedEdition": "NIST AI 600-1, 26 July 2024", "outcome": "Retain the profile; illustrative PALO thresholds are not NIST requirements.", "previousRecord": { "sourceId": "src-nist-genai-profile", "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "sourceType": "official", "publisher": "US National Institute of Standards and Technology", "checkedAt": "2026-07-12T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 90, "nextReviewAt": "2026-10-10T08:00:00Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Use for generative-AI risk prompts; it is not a substitute for context-specific testing or accountable review." }, "reviewedRecord": { "sourceId": "src-nist-genai-profile", "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "sourceType": "official", "publisher": "US National Institute of Standards and Technology", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 90, "nextReviewAt": "2027-01-10T19:59:32Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Reviewed NIST AI 600-1 (26 July 2024), a voluntary companion profile to AI RMF 1.0. Use context-specific testing and accountable review; neither source presence nor a PALO threshold proves effectiveness. Review record: docs/source-review-2026-10-12.html." } }, { "sourceId": "src-eu-ai-act", "reviewedEdition": "Regulation 2024/1689; consolidated CELEX 02024R1689-20260727; amendment 2026/1744", "outcome": "Retain the original official URL; identify the consolidated text and clarify PALO-specific competence requirements.", "previousRecord": { "sourceId": "src-eu-ai-act", "title": "Regulation (EU) 2024/1689 (Artificial Intelligence Act)", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "sourceType": "official", "publisher": "Official Journal of the European Union", "checkedAt": "2026-08-23T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 30, "nextReviewAt": "2026-09-22T08:00:00Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Use the official text and current implementation timeline with qualified counsel; no gate or control here is a legal conclusion." }, "reviewedRecord": { "sourceId": "src-eu-ai-act", "title": "Regulation (EU) 2024/1689 (Artificial Intelligence Act)", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "sourceType": "official", "publisher": "Official Journal of the European Union", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 30, "nextReviewAt": "2026-11-11T19:59:32Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Read the official act with consolidated CELEX 02024R1689-20260727 and Regulation 2026/1744. Actor, scope, exceptions and transition dates require case-specific legal review. PALO competence tests are organizational controls, not a statutory guarantee of individual proficiency. Review record: docs/source-review-2026-10-12.html." } }, { "sourceId": "src-eu-article50-guidelines", "reviewedEdition": "C(2026) 5054 final, annex, 20 July 2026; policy page updated 6 August 2026", "outcome": "Clarify the existing Article 50 pack; retain guidance as non-binding interpretation.", "previousRecord": { "sourceId": "src-eu-article50-guidelines", "title": "Guidelines on Article 50 transparency obligations for providers and deployers of certain AI systems", "url": "https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations", "sourceType": "official", "publisher": "European Commission", "checkedAt": "2026-08-23T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 30, "nextReviewAt": "2026-09-22T08:00:00Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Use with the consolidated AI Act and the current transparency Code of Practice. Applicability, exceptions and equivalent marking or labelling measures require accountable legal review." }, "reviewedRecord": { "sourceId": "src-eu-article50-guidelines", "title": "Guidelines on Article 50 transparency obligations for providers and deployers of certain AI systems", "url": "https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations", "sourceType": "official", "publisher": "European Commission", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 30, "nextReviewAt": "2026-11-11T19:59:32Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Reviewed C(2026) 5054 final annex (20 July 2026). These non-binding guidelines interpret Article 50; distinguish provider/deployer roles, disclosures, marks and exceptions. The synthetic-content transparency Code is separate from the GPAI Code. Review record: docs/source-review-2026-10-12.html." } }, { "sourceId": "src-eu-gpai-code", "reviewedEdition": "Code published 10 July 2025; Commission index updated 7 October 2026", "outcome": "Retain the Code; a page update does not establish a revised document edition.", "previousRecord": { "sourceId": "src-eu-gpai-code", "title": "General-Purpose AI Code of Practice", "url": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "sourceType": "official", "publisher": "European Commission", "checkedAt": "2026-08-23T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 30, "nextReviewAt": "2026-09-22T08:00:00Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Use as a voluntary compliance route for in-scope GPAI providers. Signing, applicability and actual conformity must be evidenced separately." }, "reviewedRecord": { "sourceId": "src-eu-gpai-code", "title": "General-Purpose AI Code of Practice", "url": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "sourceType": "official", "publisher": "European Commission", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 30, "nextReviewAt": "2026-11-11T19:59:32Z" }, "authorityStatus": "authoritative-primary", "usageNote": "Reviewed the Code published 10 July 2025; its index was updated 7 October 2026. Voluntary provider route; Safety and Security concerns systemic-risk models. PALO integrator controls do not automatically impose provider duties. Signing and conformity need separate evidence. Review record: docs/source-review-2026-10-12.html." } }, { "sourceId": "src-rogue-ai-tracker", "reviewedEdition": "Unversioned methodology page observed 12 October 2026", "outcome": "Retain non-authoritative status and optional metadata-only treatment; do not import incident narratives.", "previousRecord": { "sourceId": "src-rogue-ai-tracker", "title": "Rogue AI Tracker methodology", "url": "https://rogueaitracker.com/methodology/", "sourceType": "monitoring-signal", "publisher": "Rogue AI Tracker", "checkedAt": "2026-08-26T08:00:00Z", "freshness": { "status": "review-due", "reviewIntervalDays": 30, "nextReviewAt": "2026-09-25T08:00:00Z" }, "authorityStatus": "non-authoritative-monitoring-signal", "usageNote": "Use metadata and links as external capability context only. Do not mirror narrative content or treat provider scores as PALO use-case risk scores, findings or deployment decisions." }, "reviewedRecord": { "sourceId": "src-rogue-ai-tracker", "title": "Rogue AI Tracker methodology", "url": "https://rogueaitracker.com/methodology/", "sourceType": "monitoring-signal", "publisher": "Rogue AI Tracker", "checkedAt": "2026-10-12T19:59:32Z", "freshness": { "status": "current", "reviewIntervalDays": 30, "nextReviewAt": "2026-11-11T19:59:32Z" }, "authorityStatus": "non-authoritative-monitoring-signal", "usageNote": "Reviewed an unversioned methodology snapshot: AI-assisted capability scoring, not harm or prevalence measurement. PALO retains optional metadata-only context and a disabled-by-default adapter. No incident, provider score or deployment decision is validated by this review. Review record: docs/source-review-2026-10-12.html." } } ], "sourceAcquisition": [ { "evidenceId": "src-nist-ai-rmf", "requestedUrl": "https://www.nist.gov/itl/ai-risk-management-framework", "retrievedAt": "2026-10-12T19:53:47.353969+00:00", "status": 200, "finalUrl": "https://www.nist.gov/itl/ai-risk-management-framework", "contentType": "text/html; charset=UTF-8", "bytes": 93793, "sha256": "ea76c5a27cacffdf8cc18556776becd4664cf3e03bf0ff3c50300adbf551c775", "lastModified": "Mon, 12 Oct 2026 09:22:30 GMT", "usableContentSnapshot": true }, { "evidenceId": "src-nist-genai-profile", "requestedUrl": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "retrievedAt": "2026-10-12T19:53:47.354400+00:00", "status": 200, "finalUrl": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "contentType": "text/html; charset=UTF-8", "bytes": 83898, "sha256": "2aac8c20781e1c3e45573f50e6b024e5b593f5cbb7d50785ec7148775062b1ef", "lastModified": "Mon, 12 Oct 2026 09:22:25 GMT", "usableContentSnapshot": true }, { "evidenceId": "src-eu-ai-act", "requestedUrl": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "retrievedAt": "2026-10-12T19:53:47.354507+00:00", "status": 202, "finalUrl": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "contentType": "text/html; charset=UTF-8", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "lastModified": null, "usableContentSnapshot": false }, { "evidenceId": "src-eu-article50-guidelines", "requestedUrl": "https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations", "retrievedAt": "2026-10-12T19:53:47.354568+00:00", "status": 200, "finalUrl": "https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations", "contentType": "text/html; charset=UTF-8", "bytes": 53676, "sha256": "7a71d95f2fbc69b580ff54baa28848463dd04d0b85d3d718542497564d901ee9", "lastModified": "Mon, 12 Oct 2026 19:13:27 GMT", "usableContentSnapshot": true }, { "evidenceId": "src-eu-gpai-code", "requestedUrl": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "retrievedAt": "2026-10-12T19:53:47.525603+00:00", "status": 200, "finalUrl": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "contentType": "text/html; charset=UTF-8", "bytes": 60288, "sha256": "6e9df6dc71178cb8d0c78517b42ac8b64723bc8899340a1e20cf2c3e16b03f4c", "lastModified": "Mon, 12 Oct 2026 19:13:11 GMT", "usableContentSnapshot": true }, { "evidenceId": "src-rogue-ai-tracker", "requestedUrl": "https://rogueaitracker.com/methodology/", "retrievedAt": "2026-10-12T19:53:48.029606+00:00", "status": 200, "finalUrl": "https://rogueaitracker.com/methodology/", "contentType": "text/html; charset=utf-8", "bytes": 54301, "sha256": "b6332c0b5fd02b1e05114d082e24b9c2df059c30fd87b2c449ed756cd17a4c16", "lastModified": null, "usableContentSnapshot": true }, { "evidenceId": "nist-rmf-pdf", "requestedUrl": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf", "retrievedAt": "2026-10-12T19:53:48.042337+00:00", "status": 200, "finalUrl": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf", "contentType": "application/pdf", "bytes": 1946127, "sha256": "7576edb531d9848825814ee88e28b1795d3a84b435b4b797d3670eafdc4a89f1", "lastModified": "Wed, 04 Jun 2025 17:14:26 GMT", "usableContentSnapshot": true }, { "evidenceId": "nist-genai-pdf", "requestedUrl": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "retrievedAt": "2026-10-12T19:53:48.299759+00:00", "status": 200, "finalUrl": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "contentType": "application/pdf", "bytes": 1174643, "sha256": "6e73620ab6b64e90ef2c04bf0e0d6246185a2f4b1b13cab0df494496cff89b6a", "lastModified": "Mon, 24 Mar 2025 19:11:27 GMT", "usableContentSnapshot": true }, { "evidenceId": "eu-ai-act-consolidated", "requestedUrl": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727", "retrievedAt": "2026-10-12T19:53:48.299913+00:00", "status": 202, "finalUrl": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727", "contentType": "text/html; charset=UTF-8", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "lastModified": null, "usableContentSnapshot": false }, { "evidenceId": "eu-ai-act-amendment", "requestedUrl": "https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng", "retrievedAt": "2026-10-12T19:53:48.409847+00:00", "status": 202, "finalUrl": "https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng", "contentType": "text/html; charset=UTF-8", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "lastModified": null, "usableContentSnapshot": false }, { "evidenceId": "article50-library", "requestedUrl": "https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems", "retrievedAt": "2026-10-12T19:53:48.515748+00:00", "status": 200, "finalUrl": "https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems", "contentType": "text/html; charset=UTF-8", "bytes": 51865, "sha256": "a3f950c7eb6af84e827b1f4dbaaf31eeeeb79c9664b1c550de1633b2aae4bc60", "lastModified": "Mon, 12 Oct 2026 19:13:49 GMT", "usableContentSnapshot": true }, { "evidenceId": "article50-guidelines-pdf", "requestedUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/131215", "retrievedAt": "2026-10-12T19:55:38.160812+00:00", "status": 200, "finalUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/131215", "contentType": "/", "bytes": 837633, "sha256": "30861fc5de31205846f023068069c92fabc7271ebeac6af7bef68b97f0a33f66", "usableContentSnapshot": true }, { "evidenceId": "gpai-model-documentation-form", "requestedUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118118", "retrievedAt": "2026-10-12T19:55:38.161057+00:00", "status": 200, "finalUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118118", "contentType": "/", "bytes": 104696, "sha256": "c9319ab941744155040e4ceeddbf189efb69d6c4f063453d208eac8e2f691a6f", "documentType": "DOCX model documentation form, not Transparency chapter", "usableContentSnapshot": true }, { "evidenceId": "gpai-copyright-pdf", "requestedUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "retrievedAt": "2026-10-12T19:55:38.161149+00:00", "status": 200, "finalUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "contentType": "/", "bytes": 446847, "sha256": "cdb3c117e8e51282ab61fad8af9d5cd1acaf1773a5eadce178c3d10498ca864a", "usableContentSnapshot": true }, { "evidenceId": "gpai-safety-security-pdf", "requestedUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "retrievedAt": "2026-10-12T19:55:38.161190+00:00", "status": 200, "finalUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "contentType": "/", "bytes": 1050925, "sha256": "d879f9b54c6068aae57ebaead9d90ddaa46f2503312b9185367a724fa8da2f4a", "usableContentSnapshot": true }, { "evidenceId": "gpai-transparency-pdf", "requestedUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "retrievedAt": "2026-10-12T19:57:53.718196+00:00", "status": 200, "finalUrl": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "contentType": "/", "bytes": 441142, "sha256": "407e3a0a66327847a4bddb811fe619c8a588892ec451d23435d06485c20a4cf8", "usableContentSnapshot": true } ], "legalTextAcquisition": { "method": "Primary EUR-Lex content observed through the web reader; direct HTTP acquisitions returned empty 202 responses and are not content evidence.", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727", "readerCaptureSha256": "2ea574109fd1ef00f9b9003ef6ccad02f80c3ab2bd36c0663520959d22f6e8a4", "reviewedSections": [ "Article 4", "Article 50", "Article 111(4)", "Article 113" ] }, "dependencyReview": { "relationshipCount": 86, "mappingStrength": "supporting, not legal equivalence", "relationships": [ { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-purpose-boundary" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-data-provenance" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-data-provenance" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-human-review" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-human-review" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-third-party-due-diligence" }, { "sourceId": "src-nist-genai-profile", "path": "data/control-library.json", "entityId": "ctrl-adversarial-testing" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-incident-response" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-change-gate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-decision-trace" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-decision-trace" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-agentic-authority" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-fairness-quality-of-service" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-fairness-quality-of-service" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-fair-allocation" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-fair-allocation" }, { "sourceId": "src-nist-genai-profile", "path": "data/control-library.json", "entityId": "ctrl-harmful-representation" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-system-card-explanations" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-system-card-explanations" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-affected-person-notice" }, { "sourceId": "src-eu-article50-guidelines", "path": "data/control-library.json", "entityId": "ctrl-affected-person-notice" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-appeal-remedy" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-article50-transparency" }, { "sourceId": "src-eu-article50-guidelines", "path": "data/control-library.json", "entityId": "ctrl-article50-transparency" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-data-governance-lifecycle" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-data-governance-lifecycle" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-annotation-quality" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-privacy-lifecycle" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-gpai-provider" }, { "sourceId": "src-eu-gpai-code", "path": "data/control-library.json", "entityId": "ctrl-gpai-provider" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-gpai-deployer" }, { "sourceId": "src-eu-gpai-code", "path": "data/control-library.json", "entityId": "ctrl-gpai-deployer" }, { "sourceId": "src-nist-genai-profile", "path": "data/control-library.json", "entityId": "ctrl-gpai-deployer" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-systemic-risk" }, { "sourceId": "src-eu-gpai-code", "path": "data/control-library.json", "entityId": "ctrl-systemic-risk" }, { "sourceId": "src-nist-genai-profile", "path": "data/control-library.json", "entityId": "ctrl-systemic-risk" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-regulatory-incident-reporting" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-decommissioning" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-decommissioning" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-ai-output-accessibility" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-environmental-performance" }, { "sourceId": "src-eu-ai-act", "path": "data/control-library.json", "entityId": "ctrl-ai-literacy-effectiveness" }, { "sourceId": "src-nist-ai-rmf", "path": "data/control-library.json", "entityId": "ctrl-runtime-production-boundary" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-provenance-coverage" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-review-completion" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-incident-triage-time" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-scope-change-rate" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kri-sensitive-data-events" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-sensitive-data-events" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kri-override-failure-rate" }, { "sourceId": "src-nist-genai-profile", "path": "data/kpi-kri-registry.json", "entityId": "kri-critical-test-failure-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-tool-call-error-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-multi-agent-conflict-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-subgroup-evaluation-coverage" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-residual-disparity-rate" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kri-residual-disparity-rate" }, { "sourceId": "src-nist-genai-profile", "path": "data/kpi-kri-registry.json", "entityId": "kri-harmful-representation-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-system-card-coverage" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-system-card-coverage" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-notice-delivery-coverage" }, { "sourceId": "src-eu-article50-guidelines", "path": "data/kpi-kri-registry.json", "entityId": "kpi-notice-delivery-coverage" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-appeal-resolution-sla" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-machine-readable-marking-coverage" }, { "sourceId": "src-eu-article50-guidelines", "path": "data/kpi-kri-registry.json", "entityId": "kpi-machine-readable-marking-coverage" }, { "sourceId": "src-eu-article50-guidelines", "path": "data/kpi-kri-registry.json", "entityId": "kri-provenance-verification-failure-rate" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-data-lifecycle-coverage" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-data-lifecycle-coverage" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-annotation-quality-coverage" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-gpai-obligation-evidence-coverage" }, { "sourceId": "src-eu-gpai-code", "path": "data/kpi-kri-registry.json", "entityId": "kpi-gpai-obligation-evidence-coverage" }, { "sourceId": "src-eu-gpai-code", "path": "data/kpi-kri-registry.json", "entityId": "kri-systemic-risk-finding-rate" }, { "sourceId": "src-nist-genai-profile", "path": "data/kpi-kri-registry.json", "entityId": "kri-systemic-risk-finding-rate" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-regulatory-reporting-clock-compliance" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-decommissioning-evidence-coverage" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kpi-ai-literacy-competence-rate" }, { "sourceId": "src-eu-ai-act", "path": "data/kpi-kri-registry.json", "entityId": "kri-trained-control-error-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kpi-production-admission-coverage" }, { "sourceId": "src-nist-ai-rmf", "path": "data/kpi-kri-registry.json", "entityId": "kri-execution-bypass-rate" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "frame" }, { "sourceId": "src-eu-ai-act", "path": "data/decision-gates.json", "entityId": "classify" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "classify" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "assess" }, { "sourceId": "src-nist-genai-profile", "path": "data/decision-gates.json", "entityId": "assess" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "control" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "measure" }, { "sourceId": "src-nist-ai-rmf", "path": "data/decision-gates.json", "entityId": "prove" } ] }, "changes": [ "Renew only the six reviewed source records; shorten AI RMF interval to 30 days because revision is announced.", "Clarify that practical competence tests are PALO organizational requirements.", "Make emotion recognition, biometric categorisation and timely accessible disclosures explicit in the existing Article 50 pack.", "Reconcile source-registry and control-pack pins in semantic, Knowledge Reader and stack manifests." ], "unresolved": [ { "item": "Rogue methodology edition/date", "status": "not-published-on-inspected-page", "treatment": "Use retrieval timestamp and snapshot digest; do not invent a version." }, { "item": "OWASP source already marked unknown", "status": "outside-six-source-scope", "treatment": "Preserve unknown and its existing dates; do not imply all registry entries are current." } ], "glmConsultation": { "model": "GLM-5.3-Flash", "setting": "Deep Think Max", "conversation": "https://chat.z.ai/c/1fc51297-c10a-426d-bf29-60045b139c59", "status": "advisory-checklist-reviewed", "retained": [ "Separate page dates, document editions and applicability dates.", "Preserve historical evidence separately from the current source registry.", "Do not upgrade publisher claims into accepted PALO evidence." ], "notAdopted": [ "No assertion of a new NIST or GPAI edition.", "No claim that existing mapping machinery is an immutable review-event store.", "No verbatim mirroring of the Rogue scoring rubric." ] }, "historicalSnapshot": "The earlier semantic catalogue, PDF and research package remain historical snapshots; this record is a later addendum.", "publicationReceipt": "data/semantic-publication-2026-10-12-receipt.json" }