Source review — 12 October 2026

The six overdue PALO references have received a substantive, scoped source review. This addendum records the editions consulted, relevant findings, changes to PALO guidance and the next review dates. It supplements the semantic deep dive published earlier today. Source freshness measures the recency of this review; it does not certify legal applicability, factual completeness or operational conformity.

Review method and evidence#

The review compared primary publication pages, available documents and the publisher's own methodology against the PALO source registry, controls, indicators, gates and relevant evidence contracts. The machine-readable review record preserves the six earlier entries, review outcomes, supporting URLs, acquisition results and SHA-256 values. Failed or empty HTTP acquisitions are recorded separately from successful content retrieval.

This was an AI-assisted editorial and source-maintenance review under the maintainer's instruction. It is not a legal opinion, an independent audit or approval of a production deployment. GLM supplied a critical checklist based on the supplied public-source summary; its recommendations were adjudicated against the sources, not treated as evidence of their contents.

Findings by source#

NIST AI RMF#

The NIST project page still directs readers to AI RMF 1.0 while announcing revision work. Its four functions inform PALO's controls and gates; they are not identical to PALO's six-phase lifecycle. The revision notice is a reason for closer review, not permission to cite an unpublished successor. No replacement edition was identified in the inspected publication and development pages.

NIST Generative AI Profile#

The publication record and AI 600-1 document support continued use as a voluntary cross-sector profile. The inspected guidance supports contextual testing, human oversight, provenance, incident handling and caution against generalising narrow model evaluations. PALO's illustrative thresholds remain local choices; they are not thresholds mandated by NIST.

EU AI Act#

The official act points to the 27 July 2026 consolidated text. PALO's existing high-risk dates match Article 113. The December 2026 transition in Article 111(4) is limited to Article 50(2) and the specified earlier synthetic-content systems; it is not a general postponement of Article 50. Article 4 also distinguishes supporting literacy from guaranteeing an individual's proficiency. PALO now explicitly labels practical competence assessments as its own organizational governance requirement.

Article 50 guidelines#

The Commission guidance distinguishes provider notices and marking from deployer disclosures. The PALO control-pack questions now explicitly include emotion recognition and biometric categorisation, which were already represented in its evidence schema. Completion guidance now calls out timely, accessible information. The guideline publication page and the separate transparency Code retain their own status and scope; guidance is not itself the legislative obligation.

GPAI Code of Practice#

The Commission's Code page identifies a voluntary instrument with Transparency, Copyright, and Safety and Security chapters. The latter concerns providers of models with systemic risk. PALO's deployer and integrator controls do not automatically confer the legal role or duties of a model provider. A signature, an updated signatory list or a documentation form does not establish compliance with the Code.

Rogue AI Tracker#

The publisher's methodology describes 14 capability dimensions and AI-assisted scoring. The scale concerns reported capability, rather than harm or prevalence, and accepts some evidence without logs. PALO therefore retains the provider's disabled-by-default, optional, metadata-only integration. Reviewing the methodology does not validate individual incidents, import narrative content or convert provider scores into PALO risk scores. No explicit methodology version or publication date was identified on the inspected page; its URL, observation time and content digest identify this review's evidence.

Impact on PALO and preserved boundaries#

The dependency check found 86 declared source relationships across controls, indicators and gates for the five institutional references. These are supporting mappings, not 86 legal-equivalence assertions. Rogue remains a separate external-evidence provider. The 31 controls, 38 indicators, six gates, 409 mappings and JSON Schema contracts retain their identities. The amendments clarify two existing control packs; they introduce no new runtime permission or automatic legal decision.

The six registry entries now carry actual review timestamps and new deadlines. All other entries preserve their prior review state. In particular, the separate OWASP entry remains unknown; this review does not upgrade it.

The semantic catalogue, its validation results, the original PDF and the research package remain evidence of the earlier inspected snapshot. They must not be silently relabelled as a new runtime or ontology release. The current source registry and control packs include this addendum. Semantic, Knowledge Reader and stack integrity pins are reconciled together. The publication receipt records the actual canonical-site publication separately from GitHub and retains the preceding observation.

Reopening the review#

Recheck when an official successor, amendment, corrected document or changed methodology appears, or when a PALO use case, actor role or deployment context changes. A scheduled date is the latest planned checkpoint, not permission to ignore a material change. Each review must preserve the earlier evidence and state what was inspected, what changed and what remains unresolved.