Recent updates to the AI Assured Framework
What changed in the framework and the regulatory landscape for 2026 - and what each change means for the work on your desk.
2026 framework changes
- New Copilot governance article - reflects Microsoft 365 Copilot data-boundary and Restricted SharePoint Search updates.
- Purview for AI article - added DLP-for-AI patterns now generally available across M365 Copilot, ChatGPT Enterprise and Gemini Enterprise.
- Agentic AI playbook - first edition. Covers tool/permission scoping, kill-switches and OpenTelemetry GenAI semantic conventions.
- Red-teaming & evals - aligned to OWASP LLM Top 10 2025 (Prompt Injection, Sensitive Information Disclosure, Supply Chain, Insecure Output Handling, etc.).
- Bias testing techniques - deep-dive companion to the foundation bias article: Fairlearn, Aequitas, HELM, Giskard.
Regulatory context driving the changes
- EU AI Act - prohibited-practice ban in force since Feb 2025; GPAI obligations since Aug 2025; Digital Omnibus (Regulation (EU) 2026/1744) in force since 27 July 2026; Art 50 transparency from 2 Aug 2026; high-risk obligations from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I). See the dedicated article for dates.
- UK - Data (Use and Access) Act 2025, s.80 replaced UK GDPR Art 22 with Arts 22A to 22D from 5 February 2026.
- UK ICO - updated generative-AI guidance through 2025 on lawful basis, purpose limitation and accuracy.
- NIST AI RMF 1.0 + GenAI Profile (NIST AI 600-1) - now the de facto US baseline.
- ISO/IEC 42001 - first AI management system standard; expect customer RFPs to ask for it from 2026.
Do this Monday
- Diff your AI risk register against the new articles - anything missing becomes a backlog ticket.
- Add EU AI Act key dates to your compliance calendar.