Already in force

Governance is an ongoing program — not a one-time audit. See what the law expects →

What’s New

The AI risk landscape changes every week.
So does SanctumShield.

By Lindsay Hiebert · Founder · CISSP

The recurring value behind the subscription isn’t a cron job. It’s that every month we refresh the regulatory citations, AI endpoint registry, tools catalog, and policy generation prompts so each audit you run reflects the AI landscape on the day you run it. You subscribe so we do the landscape-tracking work for you.

Why a monthly refresh matters

AI governance is not a one-time audit. It’s a continuously-drifting target.

01 · Regulations drift

EU AI Act delegated acts ship quarterly. State-level AI disclosure laws are being introduced monthly. NIST AI RMF profiles are being updated. Your AUP citations need to track.

02 · New AI tools ship weekly

The latest refresh (October 27, 2026) brought the registry to 118 known AI endpoints. Your log analyzer is only as good as the AI endpoint registry it matches against, and the registry keeps growing.

03 · Training policies change

Vendors update their training-on-inputs policies constantly. A tool that was “safe” last quarter may be training on customer prompts this quarter. Your tools catalog needs eyes on it.

Monthly changelog

Every change, dated, in one place.

October 27, 2026
2026-10-27

AI endpoint registry reconciled with the AI tools catalog: 82 to 118 known AI endpoints.

AI endpoint registry
  • Registry checked against every tool and built-in AI feature in the catalog. 36 hostnames that vendors publish for catalog tools were added, each from the vendor's own documentation: Gemini Code Assist and Gemini CLI, Google Antigravity, Vertex AI and Gemini Enterprise, Sec-Gemini, Amazon Q Developer and Q Business, Windsurf, Devin, the hosted endpoints of the Arcade, StackOne, Merge, Paragon and TrueFoundry gateways, PageIndex, DeepSeek chat and console, LangSmith, Copilot Studio, Zapier Agents, Adobe Firefly, Otter and Dropbox Dash.
  • Built-in AI features that run inside a vendor's own application have no separate AI hostname to match, so they stay in the catalog only.
AI tools catalog
  • OpenAI Sora removed from the catalog: OpenAI's help center states the Sora web and app experiences closed on April 26, 2026 and the API on September 24, 2026.
October 24, 2026
2026-10-24

AI Posture Summary: a one-page summary of your AI governance for your cyber insurance renewal.

Regulatory citations
  • Glossary entries for the terms in MITRE and Mosaic Insurance's series The New Economics of Cyber Risk (2026), including posture history, posture update provision, remediation velocity, CISA BOD 26-04 and Executive Order 14409, each cited to its primary source. The Coach answers questions about the AI Posture Summary and what insurers are asking about AI, without predicting coverage or price.
New on the platform
  • New on the platform plans: the AI Posture Summary, a one-page renewal summary of your four artifacts for your broker and underwriter, with what changed since your last summary. Built from your assessment with no model call, so it does not count toward the monthly generations. Each Summary has its own verification URL, and its verification page links the source documents. A sample is on the sample outputs page.
October 23, 2026
2026-10-23

New pricing, the Coach included in every platform plan, and Terms of Use updates

Pricing and Terms of Use
  • Pricing: the platform is now offered monthly or annually with the AI Governance Coach included, and the Coach is also available on its own. Current prices are on the pricing page (sanctumshield.com/pricing). New sign-ups from October 23, 2026 pay the new price; existing subscribers keep their current price for twelve months.
  • The free Shadow AI Risk Calculator is now the Shadow AI Check, at sanctumshield.com/check.
  • Terms of Use, last updated October 23, 2026 (effective date unchanged, May 8, 2026): the fee clause refers to the prices shown on the pricing page at the time you subscribe; a Coach-only subscription grants access to the Coach only and does not include generation of Artifacts (§1); the monthly entitlement of five generations per artifact type per calendar month is now enforced, with the remaining count shown in the dashboard (§4); the non-refundable period reads "the full billing period you paid for" (§6).
October 2026
2026-10

Cited-stats refresh: IBM Cost of a Data Breach 2026 and Anthropic's ATT&CK mapping enter the registry; a ninth board question

Regulatory citations
  • Article 4 (AI literacy) wording synced site-wide to the Digital Omnibus text (Regulation (EU) 2026/1744): measures that support AI literacy, suited to each person's role and context, no fixed level per person; in force since February 2, 2025; national market surveillance authorities supervise from August 2, 2026. Three glossary entries added (AI literacy, Digital Omnibus on AI, AI literacy measures); AUP §12.2 carries the amended citation.
  • Eight figures added to the cited-stats registry, each read at the IBM or Anthropic page on October 8 with edition year and page recorded: one in five organizations reported a breach targeting their own AI models (IBM 2026); 92% of those lacked AI access controls and only 40% of organizations use them; fewer than half secure the non-human identities in their AI workflows; one in four malicious breaches were AI-enabled. Anthropic's June 2026 mapping: 832 banned accounts, 13,873 actions across 482 techniques and all 14 ATT&CK tactics, and the behaviors that mark the highest-risk actors are not yet ATT&CK techniques.
  • Dated addenda on The Three Numbers (the fourth number), the Two Faces pillar (one paragraph per face) and Why Now. A ninth question on the board table at Sample Outputs: can we show that the action an agent executed is the one that was authorized? Answered below the artifact layer, in runtime controls; SanctumShield records the policy side.
  • Glossary +3: AI access controls, agentic orchestration, authorization-execution gap. Coach corpus mirrored. Figures that could only be read inside IBM's form-gated PDF were not entered.
September 2026
2026-09

New Perspective essay on the Gemini evaluation incident, read from the deployer's side

Regulatory citations
  • New: the MCP Gateway category. The tools catalog now models managed connector catalogs (Type A) and bring-your-own-server gateways (Type B) as one category with two sub-types, 19 gateways verified on vendor pages; the endpoint registry gains the hosted hostnames vendors publish; three glossary terms; the MCP Gateway Governance Gap finding type with a new intake question. Two Perspectives: The Master Key Nobody Wrote Down (September 30) and Three Questions for Your MCP Gateway (October 7).
  • New Perspective essay, The Test Was Theirs. The Password Was Yours.: Gemini reached three real companies during an independent security evaluation through a guessed password and credentials in a public repository, and the essay sets out the four ordinary fixes, the agent-scope question, and why AI literacy under EU AI Act Article 4 is the floor
  • Coda added to The Frontier Debate Is Not Your Defense: Washington answered on September 21. Treasury's no-liability-shield position, read from the deployer's side of the table
AI endpoint registry
  • Registry: 71 → 82 known AI endpoints (September 29, 2026): the hosted endpoints of the MCP gateways in the new category, Composio (connect.composio.dev, mcp.composio.dev, backend.composio.dev), Klavis (api.klavis.ai, api.eu.klavis.ai), Pipedream (mcp.pipedream.com), Zapier MCP (mcp.zapier.com), Workato (apim.mcp.workato.com), CData (cloud.cdata.com), Kong Konnect (cloud.konghq.com) and Apideck (mcp.apideck.dev)
August 2026
2026-08

EU AI Act Article 50 transparency now IN FORCE (Aug 2, 2026); two new governance terms added — provable governance and governance theater

Regulatory citations
  • EU AI Act Article 50 (transparency — AI-interaction disclosure and synthetic-content labeling) is now in force as of August 2, 2026; every SanctumShield surface now states it as live rather than upcoming (legacy-content machine-readable marking remains due December 2, 2026)
  • Regulatory-date canon otherwise unchanged from July: high-risk regime Dec 2, 2027 (Annex III) / Aug 2, 2028 (Annex I) per the 2026 Digital Omnibus; Article 4 AI literacy in force since Feb 2, 2025; Colorado SB 26-189 effective Jan 1, 2027
  • Glossary: added two coined terms — Provable Governance (governance measured by a dated, clause-anchored, owner-named, third-party-verifiable artifact chain) and Governance Theater (performing the motions without producing the artifacts), anchored to the new Perspective essay as their canonical source
AI endpoint registry
  • AI endpoint registry re-verified against the August 2026 provider landscape; total holds at 71 known AI endpoints
AI tools catalog
  • Tools catalog training-policy flags re-reviewed; no changes this cycle
Policy generator prompts
  • Generated-artifact corpus (AUP, Executive Risk Report, Board Memo) confirmed date-clean against the in-force Article 50 milestone; no regeneration required
July 2026
2026-07

Regulatory landscape updated: EU Digital Omnibus adopted — high-risk timeline now Dec 2, 2027 / Aug 2, 2028; Article 4 literacy & Article 50 transparency unchanged; ARMCF added to glossary

Regulatory citations
  • EU AI Act high-risk obligations rescheduled per the 2026 Digital Omnibus (adopted by the European Parliament June 16 and the Council June 29, 2026; published in the Official Journal as Regulation (EU) 2026/1744 on July 24, 2026, in force July 27, 2026): standalone Annex III systems now Dec 2, 2027; AI embedded in regulated products (Annex I) now Aug 2, 2028
  • What did NOT move, and every SanctumShield surface now says so: Article 4 AI literacy (in force since Feb 2, 2025), Article 50 transparency (Aug 2, 2026; legacy-content machine-readable marking Dec 2, 2026), and new Article 5 prohibitions on AI-generated NCII/CSAM (Dec 2, 2026)
  • Colorado coherence pass: every surface now cites SB 26-189 (effective Jan 1, 2027) as the operative law, with SB 24-205 referenced only historically (repealed and replaced May 14, 2026)
  • Glossary + Authoritative References: added the EU Digital Omnibus primary-source citation and a new ARMCF (AI and Agentic Risk Management and Control Framework) entry — an analyst SecOps operating model, explicitly not a statutory or certifiable obligation source
AI endpoint registry
  • AI endpoint registry re-verified against the July 2026 provider landscape; total holds at 71 known AI endpoints
AI tools catalog
  • Tools catalog training-policy flags re-reviewed; no downgrades this cycle
Policy generator prompts
  • Generated-artifact corpus (AUP, Executive Risk Report, Board Memo) updated so EU AI Act high-risk findings now reference the Dec 2, 2027 runway with act-now framing (grandfathering + Article 4 literacy + Article 50 transparency as the live obligations) instead of the retired Aug 2, 2026 high-risk date
  • Acme Health public sample artifacts on /sample-outputs regenerated against the refreshed corpus
June 2026
2026-06

ISO/IEC 42001 glossary family and a Clause 8 to artifact mapping; regulatory dates shown as fixed dates

Regulatory citations
  • Regulatory deadlines now appear as fixed dates rather than day counts: EU AI Act Article 50 on August 2, 2026, and Colorado SB 26-189 on January 1, 2027, with SB 26-189 linked as the operative law and SB 24-205 as the original
AI endpoint registry
  • Every registry count on the site is now read from the registry itself, so pages always show the same number
Pricing and Terms of Use
  • Glossary: ISO/IEC 23894, 42005, 22989 and 42006 entries, the AI management system and Annex A terms, and a mapping from ISO/IEC 42001 Clauses 8.5 to 8.10 to the SanctumShield documents (/glossary#iso-42001-mapping)
May 2026
2026-05

Terms of Use published, subscription management in your account, and the Colorado AI Act date updated to January 1, 2027

Regulatory citations
  • Colorado AI Act: SB 26-189 repealed and replaced SB 24-205 on May 14, 2026 and takes effect January 1, 2027, cited to the primary source
  • Glossary: Due Care and Due Diligence, regulatory requirements at a glance, and new entries for MCP, indirect prompt injection and non-human identities
Policy generator prompts
  • AI Acceptable Use Policy: the generated sections now complete in full, and Appendix A lists the tools you selected
New on the platform
  • Manage your subscription, payment method and invoices through the customer portal, with welcome and cancellation emails
  • New pages: Why Now (/why-now) and Under the Hood (/under-the-hood)
Pricing and Terms of Use
  • Terms of Use published (effective May 8, 2026), with acceptance recorded at checkout
April 2026
2026-04

Launch month · 7 frameworks live, registry expanded to 71 known AI endpoints

Regulatory citations
  • SOC 2 CC6.1 / CC7.2 interpretive guidance refreshed with AICPA 2026 clarifications on AI tool inventory and shadow AI disclosure
  • EU AI Act Article 5 prohibited-practices citations updated to reflect March 2026 Commission delegated act on biometric inference
  • HIPAA §164.502(e) Business Associate Agreement language added for AI vendor sub-processor chains
  • NIST AI RMF GOVERN-1.4 mapping refined against the January 2026 Generative AI Profile supplement
AI endpoint registry
  • Added: OpenRouter (openrouter.ai, api.openrouter.ai), Fireworks AI (fireworks.ai, api.fireworks.ai), Deep Infra (deepinfra.com, api.deepinfra.com), Lambda Labs (api.lambda.ai), Modal (api.modal.com), RunPod (api.runpod.ai)
  • Added: MiniMax (api.minimax.io), Moonshot Kimi (api.moonshot.cn, kimi.moonshot.cn), OpenChat (openchat.team, api.openchat.com), HuggingChat (huggingchat.com)
  • Registry: 56 → 71 known AI endpoints (April 14, 2026)
AI tools catalog
  • Added training-policy flags for Anthropic Claude 4.6, Google Gemini 3.1 Pro, Google Gemini 3 Flash, OpenAI GPT-4.5, Mistral Large 3
  • Updated enterprise-tier availability for Cursor, GitHub Copilot Enterprise, Perplexity Enterprise
  • Total pre-rated AI tools: 60+ (catalog under continuous review)
Policy generator prompts
  • AI Acceptable Use Policy § 4 (Permitted Use) now generates industry-specific examples for healthcare, fintech, legal, and B2B SaaS buyers
  • Policy § 6 (Data Handling) now references EU AI Act transparency obligations for high-risk AI systems

Your subscription is a commitment.
Ours is too.

When you subscribe to SanctumShield you’re not paying for access to a static document library. You’re paying for continuous maintenance of the AI governance landscape — the endpoint registry, the regulation citations, the tool risk ratings, the policy prompts — so the report you run in month 2 reflects what’s actually happening in month 2. That is the work that justifies the recurring charge.

Start your AI Governance Audit →
What's New — SanctumShield Monthly Updates