Already in force

Governance is an ongoing program — not a one-time audit. See what the law expects →

What’s New

The AI risk landscape changes every week.
So does SanctumShield.

By Lindsay Hiebert · Founder · CISSP

The recurring value behind the $99/month subscription isn’t a cron job. It’s that every month we refresh the regulatory citations, AI endpoint registry, tools catalog, and policy generation prompts so the audit you run in April is not the same audit you run in May. You subscribe so we do the landscape-tracking work for you.

Why a monthly refresh matters

AI governance is not a one-time audit. It’s a continuously-drifting target.

01 · Regulations drift

EU AI Act delegated acts ship quarterly. State-level AI disclosure laws are being introduced monthly. NIST AI RMF profiles are being updated. Your AUP citations need to track.

02 · New AI tools ship weekly

OpenRouter, Fireworks, Deep Infra, MiniMax, Moonshot — all added this month. Your log analyzer is only as good as the AI endpoint registry it matches against, and the registry is a moving target.

03 · Training policies change

Vendors update their training-on-inputs policies constantly. A tool that was “safe” last quarter may be training on customer prompts this quarter. Your tools catalog needs eyes on it.

Monthly changelog

Every change, every month, in one place.

October 2026
2026-10

Cited-stats refresh: IBM Cost of a Data Breach 2026 and Anthropic's ATT&CK mapping enter the registry; a ninth board question

Regulatory citations
  • Article 4 (AI literacy) wording synced site-wide to the Digital Omnibus text (Regulation (EU) 2026/1744): measures that support AI literacy, suited to each person's role and context, no fixed level per person; in force since February 2, 2025; national market surveillance authorities supervise from August 2, 2026. Three glossary entries added (AI literacy, Digital Omnibus on AI, AI literacy measures); AUP §12.2 carries the amended citation.
  • Eight figures added to the cited-stats registry, each read at the IBM or Anthropic page on October 8 with edition year and page recorded: one in five organizations reported a breach targeting their own AI models (IBM 2026); 92% of those lacked AI access controls and only 40% of organizations use them; fewer than half secure the non-human identities in their AI workflows; one in four malicious breaches were AI-enabled. Anthropic's June 2026 mapping: 832 banned accounts, 13,873 actions across 482 techniques and all 14 ATT&CK tactics, and the behaviors that mark the highest-risk actors are not yet ATT&CK techniques.
  • Dated addenda on The Three Numbers (the fourth number), the Two Faces pillar (one paragraph per face) and Why Now. A ninth question on the board table at Sample Outputs: can we show that the action an agent executed is the one that was authorized? Answered below the artifact layer, in runtime controls; SanctumShield records the policy side.
  • Glossary +3: AI access controls, agentic orchestration, authorization-execution gap. Coach corpus mirrored. Figures that could only be read inside IBM's form-gated PDF were not entered.
September 2026
2026-09

New Perspective essay on the Gemini evaluation incident, read from the deployer's side

Regulatory citations
  • New: the MCP Gateway category. The tools catalog now models managed connector catalogs (Type A) and bring-your-own-server gateways (Type B) as one category with two sub-types, 19 gateways verified on vendor pages; the endpoint registry gains the hosted hostnames vendors publish; three glossary terms; the MCP Gateway Governance Gap finding type with a new intake question. Two Perspectives: The Master Key Nobody Wrote Down (September 30) and Three Questions for Your MCP Gateway (October 7).
  • New Perspective essay, The Test Was Theirs. The Password Was Yours.: Gemini reached three real companies during an independent security evaluation through a guessed password and credentials in a public repository, and the essay sets out the four ordinary fixes, the agent-scope question, and why AI literacy under EU AI Act Article 4 is the floor
  • Coda added to The Frontier Debate Is Not Your Defense: Washington answered on September 21. Treasury's no-liability-shield position, read from the deployer's side of the table
August 2026
2026-08

EU AI Act Article 50 transparency now IN FORCE (Aug 2, 2026); two new governance terms added — provable governance and governance theater

Regulatory citations
  • EU AI Act Article 50 (transparency — AI-interaction disclosure and synthetic-content labeling) is now in force as of August 2, 2026; every SanctumShield surface now states it as live rather than upcoming (legacy-content machine-readable marking remains due December 2, 2026)
  • Regulatory-date canon otherwise unchanged from July: high-risk regime Dec 2, 2027 (Annex III) / Aug 2, 2028 (Annex I) per the 2026 Digital Omnibus; Article 4 AI literacy in force since Feb 2, 2025; Colorado SB 26-189 effective Jan 1, 2027
  • Glossary: added two coined terms — Provable Governance (governance measured by a dated, clause-anchored, owner-named, independently verifiable artifact chain) and Governance Theater (performing the motions without producing the artifacts), anchored to the new Perspective essay as their canonical source
AI endpoint registry
  • AI endpoint registry re-verified against the August 2026 provider landscape; total holds at 72 domains
AI tools catalog
  • Tools catalog training-policy flags re-reviewed; no changes this cycle
Policy generator prompts
  • Generated-artifact corpus (AUP, Executive Risk Report, Board Memo) confirmed date-clean against the in-force Article 50 milestone; no regeneration required
July 2026
2026-07

Regulatory landscape updated: EU Digital Omnibus adopted — high-risk timeline now Dec 2, 2027 / Aug 2, 2028; Article 4 literacy & Article 50 transparency unchanged; ARMCF added to glossary

Regulatory citations
  • EU AI Act high-risk obligations rescheduled per the 2026 Digital Omnibus (adopted by the European Parliament June 16 and the Council June 29, 2026; published in the Official Journal as Regulation (EU) 2026/1744 on July 24, 2026, in force July 27, 2026): standalone Annex III systems now Dec 2, 2027; AI embedded in regulated products (Annex I) now Aug 2, 2028
  • What did NOT move, and every SanctumShield surface now says so: Article 4 AI literacy (in force since Feb 2, 2025), Article 50 transparency (Aug 2, 2026; legacy-content machine-readable marking Dec 2, 2026), and new Article 5 prohibitions on AI-generated NCII/CSAM (Dec 2, 2026)
  • Colorado coherence pass: every surface now cites SB 26-189 (effective Jan 1, 2027) as the operative law, with SB 24-205 referenced only historically (repealed and replaced May 14, 2026)
  • Glossary + Authoritative References: added the EU Digital Omnibus primary-source citation and a new ARMCF (AI and Agentic Risk Management and Control Framework) entry — an analyst SecOps operating model, explicitly not a statutory or certifiable obligation source
AI endpoint registry
  • AI endpoint registry re-verified against the July 2026 provider landscape; total holds at 72 domains
AI tools catalog
  • Tools catalog training-policy flags re-reviewed; no downgrades this cycle
Policy generator prompts
  • Generated-artifact corpus (AUP, Executive Risk Report, Board Memo) updated so EU AI Act high-risk findings now reference the Dec 2, 2027 runway with act-now framing (grandfathering + Article 4 literacy + Article 50 transparency as the live obligations) instead of the retired Aug 2, 2026 high-risk date
  • Acme Health public sample artifacts on /sample-outputs regenerated against the refreshed corpus
April 2026
2026-04

Launch month · 7 frameworks live, registry expanded to 64 domains

Regulatory citations
  • SOC 2 CC6.1 / CC7.2 interpretive guidance refreshed with AICPA 2026 clarifications on AI tool inventory and shadow AI disclosure
  • EU AI Act Article 5 prohibited-practices citations updated to reflect March 2026 Commission delegated act on biometric inference
  • HIPAA §164.502(e) Business Associate Agreement language added for AI vendor sub-processor chains
  • NIST AI RMF GOVERN-1.4 mapping refined against the January 2026 Generative AI Profile supplement
AI endpoint registry
  • Added: OpenRouter (openrouter.ai), Fireworks AI (api.fireworks.ai), Deep Infra (api.deepinfra.com), Lambda Labs (api.lambda.ai), Modal (modal.com), RunPod (api.runpod.ai)
  • Added: MiniMax (api.minimax.chat), Moonshot Kimi (api.moonshot.cn), OpenChat (api.openchat.team)
  • Total AI endpoint registry: 64 domains (was 50)
AI tools catalog
  • Added training-policy flags for Anthropic Claude 4.6, Google Gemini 3.1 Pro, Google Gemini 3 Flash, OpenAI GPT-4.5, Mistral Large 3
  • Updated enterprise-tier availability for Cursor, GitHub Copilot Enterprise, Perplexity Enterprise
  • Total pre-rated AI tools: 60+ (catalog under continuous review)
Policy generator prompts
  • AI Acceptable Use Policy § 4 (Permitted Use) now generates industry-specific examples for healthcare, fintech, legal, and B2B SaaS buyers
  • Policy § 6 (Data Handling) now references EU AI Act transparency obligations for high-risk AI systems

Your subscription is a commitment.
Ours is too.

When you subscribe to SanctumShield you’re not paying for access to a static document library. You’re paying for continuous maintenance of the AI governance landscape — the endpoint registry, the regulation citations, the tool risk ratings, the policy prompts — so the report you run in month 2 reflects what’s actually happening in month 2. That is the work that justifies the recurring charge.

What's New — SanctumShield Monthly Updates