Control framework changelog
We maintain the default control frameworks so they stay accurate and usable. This page lists the changes to their content, what each change means for your use cases, and the Deeploy release that contains it. For changes to the Deeploy platform itself, see the changelog.
Frameworks and versions
| Framework | Current version | Based on | Last updated |
|---|
| EU AI Act | 2024/1689 | EU regulation laying down harmonised rules on artificial intelligence | November 2026 |
| ISO/IEC 42001 | 2023 | ISO/IEC 42001 AI management system standard | November 2026 |
| AIUC-1 | October 2026 | AIUC-1 standard | November 2026 |
| NIST AI RMF | 1.0 | NIST AI Risk Management Framework | November 2026 |
| Deeploy AI Control Framework | 1.0 | Developed by Deeploy | November 2026 |
How we version frameworks
- Corrections and improvements are made to the current version of a framework and listed below.
- Significant changes, for example when the underlying standard or regulation is revised, are released as a new version. A new version shows up as a new framework in your list of control frameworks, next to the existing version, such as AIUC-1 (October 2026). It doesn't replace the existing version, and you choose when to apply it to a Workspace.
How to read the tables
The date is the release date of the Deeploy version that contains the change. The version is the version of the standard or regulation that the framework reflects, for example 2023 for ISO/IEC 42001:2023. For the Deeploy AI Control Framework, it is Deeploy's own version. Changes that apply to every default framework are listed once under All frameworks, not repeated for each framework.
| Type | Meaning |
|---|
| New version | A framework, or a new version of a framework, was released |
| Added | Controls were added to an existing version |
| Changed | Names, descriptions or other details of existing controls were changed |
| Fixed | A mistake was corrected, such as a typo or a missing risk classification |
| Removed | Controls were removed from an existing version |
| Impact | Meaning |
|---|
| No action needed | Wording, names or other details changed. Your use cases and their progress are unaffected. |
| Applicability changed | The use cases a control applies to changed, for example because a risk classification was added. New use cases are affected right away. Existing use cases are updated the next time their risk classification or role is saved. |
| Stage changed | A control moved to a different lifecycle stage. |
| Checks changed | Checks of a control were removed. The progress of the control in your use cases can change, and documentation that was linked to a removed check is unlinked. The documentation itself is kept. |
| Control added, Control removed | A control was added to or removed from a framework. Timing is the same as for Applicability changed. |
All frameworks
Changes that apply to every default framework.
| Date | Version | Type | Change | Impact | Release |
|---|
| 06-11-2026 | All | Changed | Every control in the default frameworks now has a scope, Organization or Use case. It shows whether you provide the evidence for the control once for your organization or per use case, and appears as a label on the control. Controls you create yourself can have a scope too | No action needed | 1.67 |
| 06-11-2026 | All | Changed | The control descriptions are rewritten as a requirement followed by implementation guidance. | No action needed | 1.67 |
EU AI Act
Deeploy chooses to apply controls AIA 49.1 (Registration) and AIA 71.1 (EU database for high-risk AI systems listed in Annex III) to high-risk use cases only. Be aware of the exceptions where these controls also apply to non high-risk use cases. If this applies to your use case, duplicate the control, to customize the applicable risk classification which is relevant for your use case.
| Date | Version | Type | Change | Impact | Release |
|---|
| 06-11-2026 | 2024/1689 | Added | Controls AIA 26.1 (obligations of deployers of high-risk AI systems) and AIA 4a.1 (processing of special categories of personal data for bias detection and correction) | Control added | 1.67 |
| 06-11-2026 | 2024/1689 | Fixed | The roles of three controls were updated: AIA 13.1 now applies to Deployers only, AIA 72.1 to Providers only, and AIA 5.1 to both Deployers and Providers. Control AIA 17.1 moved to the Development stage, and controls AIA 72.1, AIA 73.1 and AIA 86.1 moved to the Production stage | Applicability changed, Stage changed | 1.67 |
| 06-11-2026 | 2024/1689 | Changed | Removed 17 checks that are no longer part of controls AIA 13.1, AIA 15.1 and AIA 86.1 | Checks changed | 1.67 |
| 06-11-2026 | 2024/1689 | Changed | Added categories to controls AIA 4.1, AIA 5.1, AIA 6.1, AIA 8.1, AIA 9.1 and AIA 10.1, and renamed AIA 43.1 to "Conformity Assessments" | No action needed | 1.67 |
| 16-10-2026 | 2024/1689 | Changed | Control AIA 71.1 now applies to high-risk use cases | Applicability changed | 1.66 |
| 02-09-2026 | 2024/1689 | Fixed | Added the missing high risk classification to control AIA 49.1 | Applicability changed | 1.65 |
| 19-02-2026 | 2024/1689 | New version | EU AI Act control framework released | – | 1.58 |
ISO/IEC 42001
Since release 1.67 the IDs of the Annex A controls start with ISO42001. Entries from before that release use the previous IDs.
| Date | Version | Type | Change | Impact | Release |
|---|
| 06-11-2026 | 2023 | Added | Added the 32 controls for the requirements of the management system (clauses 4 to 10 of the standard), from ISO42001 4.1 to ISO42001 10.2, next to the existing Annex A controls | Control added | 1.67 |
| 06-11-2026 | 2023 | Changed | Renamed the 38 Annex A controls so their IDs start with ISO42001, for example A.4.3 is now ISO42001 A.4.3. The ID now shows which standard a control belongs to | No action needed | 1.67 |
| 06-11-2026 | 2023 | Changed | Removed 24 checks that are no longer part of controls ISO42001 A.4.4, ISO42001 A.4.5, ISO42001 A.5.3, ISO42001 A.5.5, ISO42001 A.6.2.6, ISO42001 A.9.3 and ISO42001 A.9.4 | Checks changed | 1.67 |
| 06-11-2026 | 2023 | Fixed | Corrected "ISO/EIC" to "ISO/IEC" in the documentation template name in the check of control ISO42001 A.6.2.7. Documentation you already linked stays linked | No action needed | 1.67 |
| 16-10-2026 | 2023 | Fixed | Corrected the framework name and its documentation template name from "ISO/EIC 42001" to "ISO/IEC 42001" | No action needed | 1.66 |
| 30-07-2026 | 2023 | Fixed | Corrected the description of control A.4.3 | No action needed | 1.64 |
| 08-09-2025 | 2023 | New version | ISO/IEC 42001 control framework released | – | 1.52 |
AIUC-1
AIUC publishes a new version of the AIUC-1 standard every quarter, in January, April, July and October. An AIUC-1 certification is tied to one version and stays on that version for a year. To let you stay on the version you are certified against, we add each AIUC-1 version we support as a separate framework instead of changing an existing one.
| Date | Version | Type | Change | Impact | Release |
|---|
| 06-11-2026 | October 2026 | New version | AIUC-1 (October 2026) released with 50 controls. It adds A008 (Prevent leakage of credentials and secrets), A009 (Third-party testing for data & privacy risk), B010 (Promote secure patterns in generated code) and E018 (Third-party testing for accountability risk), and leaves out the five controls AIUC retired: C011, C012, D002, E007 and E014. These five stay in AIUC-1 (October 2025). See the AIUC-1 changelog for what changed in this version of the standard | – | 1.67 |
| 06-11-2026 | October 2025, October 2026 | Changed | Updated the wording of 46 controls to the October 2026 version of the standard, in both versions of the framework. 12 of them were renamed: A003, B001, B006, B008, C005, C007, C008, C010, D004, E005, E006 and E015. See the AIUC-1 changelog for the differences. The framework "AIUC-1" was also renamed to "AIUC-1 (October 2025)" to tell it apart from the October 2026 version | No action needed | 1.67 |
| 22-06-2026 | October 2025 | Fixed | Controls A005, A006 and A007 now belong to the Development stage, so they show in the use case control list as intended | Stage changed | 1.62 |
| 19-02-2026 | October 2025 | Fixed | Corrected typos in the names of controls D004 and E005 | No action needed | 1.58 |
| 28-01-2026 | October 2025 | New version | AIUC-1 control framework released | – | 1.57 |
NIST AI RMF
| Date | Version | Type | Change | Impact | Release |
|---|
| 28-01-2026 | 1.0 | New version | NIST AI RMF control framework released | – | 1.57 |
Deeploy AI Control Framework
| Date | Version | Type | Change | Impact | Release |
|---|
| 19-02-2026 | 1.0 | Changed | Renamed from "Responsible AI" to "Deeploy AI Control Framework" | No action needed | 1.58 |
| 11-07-2025 | 1.0 | New version | Control framework released as "Responsible AI" | – | 1.50 |