Recent updates to the AI Assured Framework

What changed in the framework and the regulatory landscape for 2026 - and what each change means for the work on your desk.

2026 framework changes

• New Copilot governance article - reflects Microsoft 365 Copilot data-boundary and Restricted SharePoint Search updates.
• Purview for AI article - added DLP-for-AI patterns now generally available across M365 Copilot, ChatGPT Enterprise and Gemini Enterprise.
• Agentic AI playbook - first edition. Covers tool/permission scoping, kill-switches and OpenTelemetry GenAI semantic conventions.
• Red-teaming & evals - aligned to OWASP LLM Top 10 2025 (Prompt Injection, Sensitive Information Disclosure, Supply Chain, Insecure Output Handling, etc.).
• Bias testing techniques - deep-dive companion to the foundation bias article: Fairlearn, Aequitas, HELM, Giskard.

Regulatory context driving the changes

• EU AI Act - prohibited-practice ban in force since Feb 2025; GPAI obligations since Aug 2025; high-risk obligations (Annex III) phase in through Aug 2026 and Aug 2027. See the dedicated article for dates.
• UK ICO - updated generative-AI guidance through 2025 on lawful basis, purpose limitation and accuracy.
• NIST AI RMF 1.0 + GenAI Profile (NIST AI 600-1) - now the de facto US baseline.
• ISO/IEC 42001 - first AI management system standard; expect customer RFPs to ask for it from 2026.

Do this Monday

1. Diff your AI risk register against the new articles - anything missing becomes a backlog ticket.
2. Add EU AI Act key dates to your compliance calendar.