Updates

Evidary Pulse

Regulatory updates, standards releases, and research developments that affect AI compliance, governance, and verifiable evidence.

Filter updates

California CPPA finalises rules on Automated Decision-Making Technology

The CPPA adopted regulations that require certain businesses to conduct risk assessments, annual cybersecurity audits, and provide access and opt-out rights for Automated Decision-Making Technology (ADMT). Effective 1 January 2026, with staged compliance.

23 Sept 2025

cppa.ca.gov

Read

Standard • GlobalHigh

ISO/IEC 42006 sets rules for AI management system auditors

The new ISO/IEC 42006:2025 specifies competence and process requirements for bodies certifying AI Management Systems under ISO/IEC 42001. This tightens audit quality and sets expectations procurement teams can reference in RFPs.

EU Code of Practice for General-Purpose AI is approved

The European Union approved a voluntary Code of Practice for General-Purpose AI (GPAI). It offers model providers a documented path to show compliance with transparency, copyright, and safety expectations under the European Union Artificial Intelligence Act (EU AI Act). Signing reduces administrative burden and signals readiness to auditors.

1 Aug 2025

digital-strategy.ec.europa.eu

Read

Guidance • EUHigh

EU issues GPAI guidelines and definition thresholds

The Commission's GPAI guidelines clarify which models are in scope and outline thresholds, documentation, and safety expectations, including criteria for systemic-risk models. This helps buyers and providers decide when EU AI Act General-Purpose AI duties apply.

18 Jul 2025

digital-strategy.ec.europa.eu

Read

Security • USMedium

NIST launches work on a Cyber AI Profile

NIST's Cyber AI Profile aims to help agencies and organisations defend against AI-enabled attacks and secure AI systems, complementing the AI Risk Management Framework (AI RMF) and the Generative AI Profile. Useful for audit mappings and security controls.

15 Sept 2025

nccoe.nist.gov

Read

Regulation • USMedium

Colorado delays AI Act implementation to 30 June 2026

Colorado extended the effective date of its AI law to 30 June 2026, giving developers and deployers more time to stand up governance, risk, and anti-bias controls. Substantive duties remain.

UK Government publishes updated AI Playbook for the public sector

The updated AI Playbook for UK government expands on the Generative AI framework, offering procurement and delivery guidance for safe, effective AI adoption across departments. Use it to align tender language and runtime assurance.

ENISA updates Cybersecurity Threat Landscape methodology

ENISA refreshed its Threat Landscape methodology, a useful reference for risk registers and runtime monitoring planning in AI deployments subject to the EU AI Act and the NIS2 Directive.

1 Aug 2025

enisa.europa.eu

Read

Disclaimer: Information only. Not legal advice.