AI Assurance Directory

Updates

A dated record of what changed on this directory. Entries cite only work that is already on the site. The What changed this month digest is generated from these entries. Subscribe via the RSS feed.

Ten cited articles on EU AI Act duties, NIST AI security work, OWASP and MITRE ATLAS

Ten cited articles added in buyer-search topics where coverage was thin. Analyst framing is labeled editorial judgment. The pricing page now has a Free, Pro and Team comparison table and a longer FAQ. Prices unchanged.

  • EU AI Act: Article 4 AI literacy; Article 6 high-risk classification and the safety-component rule; Articles 9 and 15 on risk management, accuracy, robustness and cybersecurity; Articles 14 and 26 on human oversight.
  • NIST: AI RMF Playbook Measure and Manage suggested actions; the Cyber AI Profile (IR 8596) preliminary draft; SP 800-53 control overlays for securing AI systems (COSAiS).
  • Security: OWASP Top 10 for LLM and Gen AI apps 2025 vendor questions; MITRE ATLAS for AI red teaming; CISA and partners' principles for integrating AI into operational technology.

Pro depth for automotive, medical-device, machinery and process-industry landings

Ten cited articles and four Pro buyer kits added across the four manufacturing industries. Analyst framing is labeled editorial judgment. Prices unchanged.

  • Automotive: three articles (AI Act Annex I Section B and Article 2(2); ISO/PAS 8800 and ISO 26262 scope lines; tool claims versus vehicle-level claims) and the kit Automotive AI and the AI Act.
  • Medical devices: three articles (FDA Good Machine Learning Practice page; FDA AI-enabled device list; IEC 62304 and FDA PCCP change control) and the kit GMLP, FDA list and IEC 62304 amendment.
  • Industrial machinery and robotics: three articles (Regulation 2023/1230 in Annex I Section B; IEC 61508-3 and ISO/IEC TR 5469; ISO 10218 scope exclusions) and the kit AI Act boundary and software evidence.
  • Process industries: one new article on IEC 61511 SIS life-cycle questions (plus the IEC 61508-3 article) and the kit SIS life cycle and AI. Kit questions stay Pro; public pages show teasers only. Pro $49/$490, Team $149/$1,490 unchanged.

Pre-launch quality pass: official titles, canonical AIA Toolkit URL, brand metadata

Spot-check of 20 listings across all industries. Official page titles restored on cited sources, the CDAO AIA Toolkit listing URL points at the live Tradewinds page, and package metadata uses the AI Assurance Directory name. Claims and prices unchanged.

  • Sample of 20 listings re-checked against live official pages. Cited quotes for Credo, Dioptra, AdvoCATE, Vanta, TESSY, ENVOLOK, Greenlight Guru, UL Stages, KUKA, PolyScope, HIMax and AADvance still appear on those pages. NASA SWEHB 7.25/8.25 keep the published Artificial Intelligence topic titles; live Confluence chrome that says Super Intelligence is not used as the official title.
  • Source labels on that sample now match the official page titles. Razorcat vendor string is Razorcat Development GmbH as on the TESSY title. The CDAO AIA Toolkit official-site URL is https://www.tradewindai.com/aia-toolkit (rai.tradewindai.com 301s there).
  • package.json description now names AI Assurance Directory. Canonical host, robots Sitemap, sitemap and llms.txt already use https://aiassurancedirectory.com. Chrome brand stays AI Assurance Directory. Pro $49/$490, Team $149/$1,490. No DNS, Access or Stripe changes.

Cited tools added for FDA PCCP, ISO 10218 / Machinery Regulation and additional SIS listings

Eight official-page listings added so each manufacturing landing has cited products, including FDA PCCP, ISO 10218 clause 5.1.16 and IEC 61511 SIS controllers. Prices unchanged.

  • New listings (cited pages only): ComplianceQuest Medical Device QMS, Aligned Elements, ENVOLOK, Razorcat TESSY, Universal Robots PolyScope, CODESYS Virtual Safe Control SL, HIMA HIMax and Rockwell AADvance.
  • Framework tags only where the cited page names the instrument: FDA Predetermined Change Control Plans (PCCP), IEC 62304 (including Safety Classification A), ISO 26262-8:2018, IEC 61508 SIL 3, ISO 10218-1 (including clause 5.1.16), EU Machinery Regulation 2023/1230 and IEC 61511. No listing names the AI Act–MDR Annex I interplay as a product tag.
  • Cited mappings follow the existing quote-in-evidence rule. Public teasers stay source title plus framework noun; quotes stay behind Pro. Completeness, typecheck and related-tool linking follow the existing pattern. Pro $49/$490, Team $149/$1,490.

Cited tools added for automotive, medical devices, industrial machinery and process industries

Eighteen official-page listings added for the four manufacturing landings. Each summary and framework tag is taken from the vendor’s own page. Prices unchanged.

  • New listings (cited pages only): MathWorks IEC Certification Kit, Parasoft C/C++test, Perforce QAC, VectorCAST, QNX OS for Safety, Green Hills INTEGRITY, AbsInt Astrée, BTC TestStack, UL Stages, Greenlight Guru SiMD/SaMD, Jama Connect for Medical, exSILentia, aeShield, Yokogawa ProSafe-RS, Emerson DeltaV SIS, Honeywell Safety Manager SC, Siemens SIMATIC PCS 7 Safety and KUKA iiQKA.OS2.
  • Framework tags only where the cited page names the instrument: ISO 26262, ISO/PAS 8800, UL 4600, IEC 62304, IEC 61508, IEC 61511, ISO 10218 and Machinery Regulation 2023/1230 (KUKA MACH REG). No listing names FDA PCCP or the AI Act–MDR Annex I interplay as a product tag.
  • Cited mappings added where the same page names a clause, part or integrity level (ISO 26262-8, IEC 61508-3, IEC 62304 Class C, ISO 26262 6.5.4.6/7). Completeness, public teasers and gated detail follow the existing pattern. Pro $49/$490, Team $149/$1,490.

Safety-critical and regulated manufacturing, aerospace and defense as flagship

Owner-approved broaden: official-cited automotive, medical-device, industrial-machinery and process-industry frameworks and landings. Aerospace and defense stay the flagship. Prices unchanged.

  • New framework explainers from official catalog and guidance pages only: ISO 26262-1:2018, ISO/PAS 8800:2024, FDA AI-enabled device software / PCCP, IEC 62304, EU MDR listed as AI Act Annex I Section A item 11, IEC 61508, Machinery Regulation 2023/1230, ISO 10218-1:2025 and IEC 61511. UL 4600 now also tags automotive.
  • Industry landings for automotive, medical devices, industrial machinery and robotics, and process industries. Each has a cited explainer, listed tools, compare links where a pair exists, and a gated buyer kit (public teaser). Rail and nuclear stay context only.
  • Existing listings tagged only where the cited vendor page names the industry or framework. Ansys medini, SCADE and Rapita name ISO 26262; medini and SCADE name IEC 61508; Astah names automotive (ISO 26262). LDRA sector headings and CycloneDX medical-device authorization are industry tags only. No listing currently names ISO/PAS 8800, FDA PCCP, IEC 62304, MDR, Machinery 2023/1230, ISO 10218 or IEC 61511.
  • Homepage hook, meta/OG, llms.txt, About, Pricing and the readiness self-check now say safety-critical and regulated manufacturing, with aerospace and defense as the flagship. The self-check adds an industry selector and cited extra questions. Completeness gate kept. Pro $49/$490, Team $149/$1,490.

Cited literature: peer-reviewed evidence for aero verification tools

A new evidence type records peer-reviewed papers and official agency reports that explicitly apply a tool to a named certification activity. Full quotes stay on Pro. Prices unchanged.

  • Cited literature is a third coverage cell, distinct from vendor cited mappings and analyst assessments. Each cell has title, authors, venue, year, URL and an exact quote. Public pages show bibliographic teasers only.
  • Added papers that apply Marabou, nnenum, NNV, ERAN, CAISAR and PyRAT to ACAS Xu verification, PyRAT to operational design domain verification, and NASA AdvoCATE to assurance cases. Astah GSN stays searched-no-specific-source: no paper found that names the tool and a certification activity together. Evidence strength now counts cited plus cited-literature as named-source mappings. The method is on /coverage/methodology/.
  • Pro $49/$490, Team $149/$1,490.

Cited mappings added where official pages name a clause or function

New cited cells from official vendor and handbook pages that name a specific ISO/IEC 42001 clause or NIST AI RMF function. Remaining Emerging listings stay searched-no-specific-source. Prices unchanged.

  • Sprinto’s ISO 42001 guide names Clauses 4–10, Annex A (including A.2, A.3, A.5, A.6, A.9, A.10 and A.6.2.8), Annex B and Clause 6.1.2, and says Sprinto pre-builds the Annex A control set. NASA SWEHB 8.25 names the NIST AI RMF Map function. Saidot’s risk-management help page cites ISO/IEC 42001 item 6.1.1. Cited mappings 189→208; analyst 165→162 where those cells are now cited.
  • Aerospace and defense Emerging listings searched first (Resaro AIP, Marabou, nnenum, NNV, ERAN, NASA ProgPy, NASA AdvoCATE, HEART, Adelard ASCE, Foretellix, QuantPi, Fiddler, Advai, Edge Case, IARPA TrojAI, CAISAR, NNDK, Astah GSN, PyRAT). Official pages name products or ACAS Xu examples, not a directory clause, function or article, so they stay searched-no-specific-source. Completeness still requires the unsearched list to be empty.
  • Pro $49/$490, Team $149/$1,490.

Tool pages now lead with certification evidence

Every listing now opens with public cited versus analyst counts, a one-line certification-relevance summary from cited data, a teaser for the strongest cited mapping source, and the Pro gate for full evidence plus the evidence-pack link. An Evidence strength badge is scored from those counts. Prices unchanged.

  • Above the fold on each tool page: mapped frameworks with cited versus analyst counts, a certification-relevance line drawn only from cited mappings or cited framework tags, and a public teaser for the strongest cited mapping source. Quoted wording, requirement labels and analyst rationales stay on Pro.
  • Evidence strength is Strong (3+ cited), Moderate (1–2 cited), Emerging (analyst only), None yet (searched, neither), or Unreviewed. The method is on /coverage/methodology/. Completeness still fails the build on empty or placeholder claims.
  • Pro $49/$490, Team $149/$1,490.

Completeness audit: every claim has cited text and a source

Build-time validation now fails if a listing, mapping, kit, article, glossary term, compare page, RFP question, briefing item or readiness question is empty or a placeholder. Live counts on Home, Pricing, About and Coverage stay bound to the data. Prices unchanged.

  • validate-content now rejects empty claim text, missing https source URLs or titles, missing as-of dates where the schema requires them, and bare editorial placeholders. Official quotes of TBD or coming-soon wording stay, because those are the source’s words.
  • Analyst assessments must carry a requirement label, rationale and confidence. Public teasers, email onboarding counts and the RFP/kit banks are checked against the same generated totals.
  • Home, Coverage, Pricing and About live counts come from the data files. Pro $49/$490, Team $149/$1,490.

Positioning: which AI assurance tools actually help you certify

Homepage hero, About and Pricing now lead with the cited-evidence hook for aerospace, defense and safety-critical buyers. About states founder experience without naming employers. Prices unchanged.

  • Homepage hero is now “Which AI assurance tools actually help you certify — with the cited evidence.” Above-the-fold proof uses live counts (cited mappings, framework explainers, buyer kits). A “Why this directory is different” section contrasts generic AI tool lists without naming competitors. Evidence packs, the RFP question bank, the readiness self-check and the monthly briefing are featured on Home and Pricing.
  • About is rewritten around practitioner credibility: 25+ years in aerospace and defense engineering and program leadership, aerospace engineering degrees, and AI governance experience. Employers are not named.
  • Meta descriptions and the home Open Graph card match the hook. Pro $49/$490, Team $149/$1,490.

Free-tier funnel: quiet next steps and an AI assurance readiness self-check

Public pages now carry one quiet next step toward a free account or Pro. A free 10-question AI assurance readiness self-check cites official frameworks in the browser. Optional email saves the result to a free account and starts day-0 onboarding. Prices unchanged.

  • A single next-step strip on public pages that do not already have a Premium gate or upgrade prompt. Home, About and Checklists also name the self-check or free account. The strip hides for entitled sessions.
  • Free AI assurance readiness self-check at /readiness/: ten yes/no/not-sure questions, each citing an official page already used on this directory (NIST–ISO crosswalk, ISO explainer, EU AI Act, FAA roadmap, EASA Issue 02, DoD 3000.09, DoD ethical principles, DFARS 252.204-7021, SWEHB 7.25, JATIC FAQ). Results stay client-side. Optional email uses the existing magic-link form and can persist the score to a free account (D1 migration 0008_readiness_checks.sql).
  • Free signup still enrolls onboarding day 0 (Sample Pro: Arthur listing and the NIST AI RMF kit). Pro $49/$490, Team $149/$1,490.

Team admin, evidence packs and a vendor-neutral RFP question bank

Team and Enterprise owners get a Team admin page for seats, member activity and a shared watchlist. Pro adds a per-listing evidence pack print view and a gated RFP question bank for aerospace and defense AI assurance tools. Prices unchanged.

  • Team admin at /account/team/ is entitlement-checked. Seat invites stay on the existing Team API. New D1 tables team_watchlist and team_activity (migration 0007) back the shared watchlist and member activity summary.
  • Pro evidence pack at /api/exports/evidence/?id= is a PDF-ready HTML print view of cited mappings and analyst notes with source URLs. Public /export/evidence/ lists names only.
  • Vendor-neutral RFP question bank at /rfp/: nine cited-framework sections, public teasers, full questions Pro. Sources are the NIST–ISO crosswalk, ISO explainer, EU AI Act, FAA/EASA, DoD RAI and 3000.09, CMMC, NASA SWEHB 7.25/8.25, CDAO JATIC and the Federal Register title of EO 14434. Pro $49/$490, Team $149/$1,490.

EO 14434 Federal Register title, October 2026 Pro briefing, six more compare landings

The official Federal Register title of EO 14434 is Inaugurating the Era of Super Intelligence (document 2026-20321, 2 October 2026). The first curated Pro monthly briefing covers seven cited public changes from the last 30 days. Six more indexable compare landings. Prices unchanged.

  • Cited the Federal Register publication of record for Executive Order 14434: https://www.federalregister.gov/documents/2026/10/02/2026-20321/inaugurating-the-era-of-super-intelligence (91 FR 63129). The published title was already exact; the White House chrome uses different capitalization. validate-content now allows that FR/GovInfo title.
  • October 2026 Pro briefing is a curated issue of seven dated public changes (EO 14434 FR publication, Collibra docs 7 Oct, Re:In 6 Oct, Prisma AIRS docs 1 Oct, IBM watsonx.governance 29 Sep, Advai Cosine note 16 Sep, MITRE ATLAS 2026.09). Public /briefing/ lists topic names and a count. Dated sentences are Pro.
  • Six new cited compare landings: Arthur vs Credo AI, Promptfoo vs PyRIT, Vanta vs Secureframe Defense, HiddenLayer vs Prisma AIRS, Trustible vs watsonx.governance, NeMo Guardrails vs Bedrock Guardrails. Sixteen indexable pair pages. Pro $49/$490, Team $149/$1,490.

Accuracy audit: official titles restored, citation URLs checked, cited mappings spot-checked

Official titles of cited documents stay exactly as published. NASA SWEHB 7.25/8.25 and the CISA SBOM guidance title are quoted as Artificial Intelligence, not Super Intelligence. Site branding may still say SI. Citation URLs were probed; a CI job fails on hard-dead links. Twenty cited mappings were spot-checked against their sources. Prices unchanged.

  • Restored official NASA SWEHB topic titles to 7.25 - Artificial Intelligence And Software Engineering and 8.25 - Artificial Intelligence And Software Assurance. Restored the CISA source label to Software Bill of Materials for AI – Minimum Elements. Own-voice SI copy and EO 14434 titles are unchanged.
  • Citation URL check now covers tools, articles, frameworks, glossary terms and industry landings. New GitHub Action Citation links fails the PR on 404/410; 401/403/429/5xx stay blocked.
  • Spot-checked 20 random cited mappings against the vendor/official pages they quote. Unsupported mappings are removed or downgraded; counts stay cited-only.

AI-search and authority: expanded llms.txt, eight cited explainers, 40-term glossary, tool-page links

llms.txt and llms-full.txt now carry public-only summaries including kit teasers, glossary terms, industry landings and compare ledes. Eight new aerospace/defense explainer articles. Glossary is about 40 DefinedTerm entries. Every tool page links to at least two articles or buyer kits. Article cap raised to 75. Prices unchanged.

  • llms.txt is the crawler index; llms-full.txt is public full text. Both omit gated quotes, coverage-cell detail and kit questions.
  • New explainers: ARP4754B FDAL/IDAL for ML, DO-200B vs training sets, NIST SP 800-218A for defense software, DoD RAI Implementation Pathway, CDAO RAI vs Tradewinds AIA, NIST AI 100-2 adversarial ML, prompt guardrails vs airborne runtime assurance, NASA SWEHB Super Intelligence topics 7.25/8.25.
  • Glossary expanded from 16 to about 40 official terms with DefinedTerm/DefinedTermSet. Internal-link audit: tool pages use reverse relatedToolIds plus framework-matched kit teasers.

Conversion and retention: account dashboard, upgrade prompts, content changelog, Product schema

Signed-in Free accounts get a watchlist teaser and recent public framework changes. Pro shows watched source changes since the last /account/ visit. Ten high-intent pages share one upgrade prompt with the $98 annual saving. /changelog/ is generated from content git history. Pricing JSON-LD now includes Product and Offer.

  • Account dashboard: Free sees saved watchlist names, public framework-change titles from Updates, and a Pro upsell. Pro hydrates watchlist source changes since the previous visit from GET /api/dashboard/ (signed-in, Cache-Control: private, no-store). Watchlist save is signed-in, not Pro-only. New D1 migration 0006_account_visits.sql.
  • In-page upgrade prompts on /compare/, /kits/, and eight high-intent listings (Arthur, Dioptra, Credo AI, Vanta, HiddenLayer, Marabou, Promptfoo, CDAO JATIC). Same heading and “save $98 versus monthly” note. Hidden after an entitled session.
  • Public /changelog/ auto-built from git history of articles, framework explainers, tools.json and related cited data files. Indexable CollectionPage plus FAQ. Editorial Updates log is unchanged. Pricing adds Product/Offer schema for Pro and Team; BreadcrumbList and FAQPage checks stay in the SEO audit.

Content depth: coverage for remaining listings, six buyer-intent articles, article cap 65

Cited JSP 936 cells for the AI Practitioner’s Handbook, analyst cells for the remaining reviewed listings that had none, six high-intent aerospace/defense articles, and internal-link updates. Article cap raised from 55 to 65. Public pages stay counts only.

  • UK MOD AIPH now has cited JSP 936 Part 1 section cells (context, development, assurance, Section 9). Analyst cells added for Secureframe Defense (NIST Govern/Map/Manage from SSP, Defense Navigator and SPRS — not CMMC-to-ethical-principles), Dioptra and ARIA (Measure 2 TEVV / red-team), the EU AI Act Service Desk (NIST Govern/Map from the Compliance Checker), and ISMS.online (NIST functions from already-quoted AIMS capabilities). The NIST AI RMF Playbook stays cited-only: every Core function is already a cited cell. Four existing TEVV/runtime-treatment analyst cells lifted partial→strong where the quote already named attack simulation or inline blocking.
  • Six public buyer-intent articles (60 total; cap now 65): how to qualify an ML tool under DO-330; EASA Issue 2 for suppliers; DoD 3000.09 checklist for autonomy vendors; ISO 42001 vs NIST AI RMF for defense contractors; CMMC and AI tools handling CUI; choosing AI red-teaming tools for safety-critical programs. Each links related tools, frameworks and a Pro teaser (counts and kit links, no quotes).
  • Internal linking: bidirectional relatedArticleIds, path and industry landings, and framework explainers. JSP 936 is now a coverage-matrix column. Public HTML stays counts only; premium JSON is not in dist/.

Aerospace and defense frameworks: EASA, ARP4754B, DO-330, DO-200B, FAA roadmap, 3000.09, RAI Strategy, CDAO toolkit, SP 800-218A, CMMC

Ten aerospace and defense frameworks are now first-class coverage columns with public explainers. Cited and analyst mappings use the same quote-and-rationale rules. Two new Pro buyer kits: airborne AI certification vendor questions and a DoD RAI procurement checklist.

  • New public explainers: ARP4754B, DO-330 (tool qualification), DO-200B / aeronautical data, DoD Directive 3000.09, DoD RAI Strategy and Implementation Pathway, CDAO RAI / AIA Toolkit, and NIST SP 800-218A (SSDF for generative AI). EASA Issue 2, the FAA AI Roadmap, and CMMC were already public and are now coverage-matrix frameworks.
  • Cited mappings only where a vendor or official page names the requirement (for example DO-330 TQL-1, CMMC Level 1/2/3, DoD Directive 3000.09, CDAO Generative AI RAI Toolkit). Analyst cells quote a documented capability and stay labeled editorial.
  • Buyer kits added: AI in airborne software certification (EASA Issue 2, DO-330 TQL, ARP4754 FDAL/IDAL, FAA roadmap) and DoD RAI procurement (ethical-principle tenets, CDAO toolkit, 3000.09 scope, CMMC when CUI). Pro-gated; public HTML stays counts only.

Pro value: cited coverage matrix, alerts digest, buyer kits, monthly briefing

Pro adds cited framework-to-tool requirement cells, a source-change alerts feed with weekly Resend digest, buyer kits, and a monthly briefing generated from change data. Public pages show teaser counts only. No invented mappings.

  • Coverage matrix for NIST AI RMF functions/subcategories, ISO/IEC 42001 clauses, EU AI Act articles, DO-178C-related aerospace guidance, and DoD AI guidance. A cell exists only when a cited public page names that requirement. Free listings show a real count such as “Maps to 5 NIST AI RMF functions or subcategories — see which with Pro”.
  • Change alerts reuse the weekly freshness check plus the updates log. Pro /alerts/ lists what changed and the cited URL. Weekly digest from [email protected] includes an unsubscribe link. Monthly /briefing/ is generated from the same bundle.
  • Buyer kits are gated CSV and printable HTML (print to PDF) vendor-question checklists per framework, plus comparison sheets of cited coverage cells. Pricing copy lists these benefits. Stripe prices unchanged (Pro $49/$490, Team $149/$1,490).

Freemium paywall: Stripe Checkout, D1 entitlements, magic-link sign-in

Public summaries stay crawlable. Quoted evidence, comparisons, exports and alerts are Pro. Checkout and the Customer Portal run on Stripe.

  • Cloudflare Pages Functions: /api/checkout (subscription Checkout), /api/portal (Customer Portal session), /api/stripe/webhook (signature verified; checkout.session.completed, customer.subscription.updated/deleted, invoice.payment_failed write entitlements to D1).
  • Passwordless magic-link login with a signed aigov_session cookie. Email sending is behind an interface; only the console stub is implemented (EMAIL_DRIVER=console). Premium JSON is bundled into Functions at build time and is not in dist/.
  • Pricing: Free; Pro $49/month or $490/year; Team (5 users) $149/month or $1,490/year; Enterprise contact (no form). Playwright gating tests mock Stripe and /api/*. SITE_HOST default unchanged.

Launch prep: pages.dev noindex, static newsletter, remaining DNS/Access steps

Pre-launch audit for the canonical host. Newsletter and sponsor inquiry forms removed. Cloudflare Pages production branch is live. Custom domain, Squarespace CNAME and Access changes are still human steps. No DNS from this commit.

  • public/_headers now sends X-Robots-Tag: noindex on https://:project.pages.dev/* and https://:version.:project.pages.dev/* so aigov-directory.pages.dev and branch aliases are not indexed. Canonical aigov.sparkysai.com is not in those host rules. Production robots.txt stays Allow: / with Sitemap https://aigov.sparkysai.com/sitemap-index.xml. Security headers unchanged.
  • Newsletter is a static “not open” notice with no form or email field. /sponsor/ keeps the labeled placeholder and listing-policy rules and no longer offers a mailto or form. Suggest-a-tool remains a disabled placeholder.
  • docs/LAUNCH.md now lists only the remaining operator steps: confirm the live branch deploy (Access-gated pages.dev), add aigov.sparkysai.com in Pages, CNAME aigov → aigov-directory.pages.dev at Squarespace, then remove Access for the custom domain only. Do not merge to main. SITE_HOST default unchanged.

Five thin listings expanded, four new tools, five oldest remaining articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: NASA SWEHB SI topics 7.25/8.25 (OCE/OSMA/OCHMO/OCIO; foundation-model/LLM/RAG/agentic scope; cross-functional teams; controller-or-pilot advisory example; NIST SI RMF still not tagged), IBM ART (raw README heading still v1.20; PyPI 1.20.1 uploaded 7 July 2025 lists Python 3.10–3.12; who-it’s-for from PyPI classifiers), Argevide PREMIS (Eliminative Argumentation defeaters; AI Assistant; SPI; CI/CD pipeiine spelling; Entra ID; free one-safety-case account; locally or Azure/AWS still not on-prem/SaaS), NIST AI RMF Playbook (PDF/CSV/Excel/JSON downloads; AIRC chrome currently says NIST SI Resource Center while the Playbook heading still says NIST AI RMF so that framework stays tagged), CycloneDX (homepage heading now names ECMA-424; spec overview Current Version 1.7 / Release Date 2025-10-21 / Published On 2025-12-10; ECMA-424 2nd edition December 2025 / DIS 27055). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Canada AIA (government-resource; 65 risk and 41 mitigation questions; Levels I–IV; Directive on Automated Decision-Making; MIT LICENSE on canada-ca/aia-eia-js; who-it’s-for from the README), Saidot (governance-platform; 260+ risks / 620+ controls / 110+ policies; EU AI Act / ISO/IEC 42001 / NIST AI RMF from the product-page policy sentence and homepage; Azure Marketplace is not the word SaaS; vendor ISO 27001 ISMS is not tagged), Llama Prompt Guard 2 (runtime-platform; 86M/22M BERT classifiers; benign/malicious; drop-in for Prompt Guard; Llama 4 Community License so no OSI badge; separate from Llama Guard 4), PyRAT (safety-engineering; CEA AISER; VNN-COMP 2024 second place / 12 regular-track benchmarks / more than 1700 properties / ACAS-XU; CAISAR news ranks PyRAT third at VNN-Comp 2026; closed-source so no OSI badge; DO-178C not tagged). Wired Saidot into the ISO 42001 and EU aerospace paths and the 42001-audit / 42005 / crosswalk / 42001-vs-9001 / GPAI / extra-territorial articles; PyRAT into the aircraft-ML path and the formal-verification and 24029 articles; Canada AIA into the DND/CAF strategy article. Prompt Guard is not on the aircraft path. Eclipse OpenCert was reviewed and not listed (latest release 1.0.0 dated 2019-06-30). CISA AI and the UK AI Playbook HTML sibling remain unlistable this pass.
  • Refreshed the five oldest remaining full articles against live official pages. ITAR/EAR: 15 CFR 740.27 still License Exception AIA and still names ECCN 4E091; eCFR still displays title 15 up to date as of 10/09/2026, last amended 9/24/2026. Space systems: SWEHB 7.25/8.25 still Super Intelligence; ESA AISSA still the 2025 Technology Harmonisation Dossier with four key domains; live ESA page now also dates a Call for Ideas (July 2026) and SPAICE at ESTEC 21–23 October 2026; Space Force FY2025 news 403. Rotorcraft/eVTOL: FAA Roadmap and Safety Framework HTML slugs now return the Version I and Safety Framework PDFs (HTTP 200); EASA VTOL page still special-condition wording; still no AI/ML words in AC 21.17-4 or SC-VTOL-02 on the last editorial search. AI in MRO: Roadmap slug now returns Version I PDF; ProgPy still an open-sourced python package for prognostics and predictive maintenance; AC 43-218 / ForMuLA PDFs kept from the last editorial search. EO 14434: still 29 September 2026; Section 2(b) still does not require alteration of previously issued regulations or historical documents; 15 U.S.C. § 9401(3) unchanged. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 94 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest remaining articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Trustible (Leidos 10 April 2026 story now fetchable in full; Defense/40 countries; 10×/4×/60% marketing figures left as caveat; FAQ still EU AI Act / NIST AI RMF / ISO 42001), MITRE ATLAS (atlas-data README still 2026.05 examples; live dist/manifest.yaml latest content 2026.09 released 15 September 2026, format still 6.0.0; STIX / Excel / Navigator 5.3.2; Public Release Case Numbers 21-2363, 26-1162), ERAN (raw README; DeepZ/DeepPoly/GPUPoly; ELINA; Gurobi academic license; ACAS Xu property 9; AI2 subsumed; who-it’s-for from the README goal statement), Advai (Model Arena; Agents/LLM/CV/time-series/multimodal; Cosine coalition 16 September 2026; ISO 27001 and Cyber Essentials Plus remain vendor certs so not tagged), Fiddler (Centor Models; inline guardrails in under 80ms; SaaS/VPC/on-premises; GovCloud and air-gapped; DIU Success Memo; aerial drones/UUV; “responsible AI” still not a DoD RAI tag). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Strike Graph ISO 42001 (compliance-automation; pre-loaded AIMS controls and 100% pre-built policy/procedure templates; Verify AI; CMMC on the same catalogue is a separate product so not tagged), Arthur Agent Security & Governance (governance-platform; five discovery sensors; Fully hosted SaaS, on-prem or hybrid; ISO 42001 / EU AI Act / NIST AI RMF tags from the official column’s evidence-mapping sentences, not from untitled Policy Templates), Portkey Guardrails (runtime-platform; Gateway input/output checks; deny 446 / log 246; fallback and retry; Portkey-Managed SaaS tagged; new fully air-gapped deployments no longer offered so air-gapped is not tagged; homepage rebrand to PRISMA AIRS AI Gateway is caveated against the separate Prisma AIRS Network Intercept listing), CAISAR (safety-engineering; CEA List 6.0 June 2026; WhyML; PyRAT/Marabou/nnenum/α,β-CROWN; ACAS Xu example; GNU LGPL v2.1 named on the docs but LICENSE file not independently fetchable so no OSI badge; DO-178C not tagged). Wired Strike Graph into the ISO 42001 path and the 42001-audit / 42005 / crosswalk / 42001-vs-9001 articles; Arthur into the ISO 42001 and EU aerospace paths and the GPAI / extra-territorial / 42001-audit / crosswalk / 42001-vs-9001 articles; CAISAR into the aircraft-ML path and the formal-verification and 24029 articles. Portkey is not on the aircraft path. Eclipse OpenCert was reviewed and not listed (latest release 1.0.0 dated 2019-06-30; GitLab last note 16 June 2021). Canada AIA was a qualifying government questionnaire but the four under-covered categories were filled first.
  • Refreshed the five oldest remaining full articles against live official pages. Autonomy and DoD Directive 3000.09: still effective 25 January 2023; esd.whs.mil / media.defense.gov / war.gov / CRS 403 this pass. Human-machine teaming: NATO 2021 and 10 July 2024 still live; JSP 936 still Published 13 November 2024; EASA Issue 2 still human-AI teaming; war.gov / ai.mil 403. Runtime assurance / Simplex: NASA/TM–20220015734 PDF still January 2023; ASTM F3269-21 still Active; NTRS citation pages timed out; FAA Roadmap HTML 403. FedRAMP and IL: Consolidated Rules still take effect 4 July 2026; live page now also dates Rev5 mandatory rulesets prior to 1 January 2027 and enforcement after that date; AI Prioritization Initiative still closed April 2026; ChatGPT Enterprise / Gemini for Government / Perplexity still listed; War CIO guide still IL2/IL4 reciprocity. ISO 42001 vs 9001/AS9100: UKAS still 15 January 2026; BSI ANAB still 10 March 2026; ISO / IAQG / ANAB AS9100 403; still no ICOP 42001 scheme. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 90 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest remaining articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Marabou (raw README; Marabou 2.0; DeepPoly/DeepSoI default; optional Gurobi, num-workers and Split-and-Conquer; Linux/MacOS; no Windows; Stanford AISafety; FAA/DARPA still acknowledgments only so DO-178C is not tagged), Hyperproof ISO 42001 (Clauses 4–10 and Annexes A–D in the guide; AI risk vs system impact assessments and statement of applicability; Jumpstart crosswalks still name NIST AI RMF; Audit Module dashboard; a co-author biography mentioning SaaS providers is not a deployment tag), Astah GSN (Auto-Layout, Script Editor, SysML Requirement-to-Goal sync; still GSN Community Standard 1.0 / OMG SACM / aerospace DO-178B so DO-178C is not tagged), Thoropass ISO 42001 (One audit; multiple frameworks; continuous monitoring; Risk Register; AI System Impact Assessment heading still does not name ISO/IEC 42005), SPDX AI Profile (SafetyRiskAssessmentType serious/high/medium/low citing EU general risk assessment methodology under Regulation (EC) No 765/2008 — not the EU AI Act; EnergyConsumption training/fine-tuning/inference; still Community-Spec-1.0 so no OSI badge). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Collibra AI Command Center (governance-platform; docs dated 7 October 2026; evolved from AI Governance; EU AI Act and NIST AI RMF templates; AI UC-1 from May 2026; guardian agents and agent contracts; Collibra’s own ISO 42001 certificate is not a customer AIMS template so 42001 is not tagged), ControlMap ISO 42001 (compliance-automation; 63+ frameworks; MSPs import ISO/IEC 42001 to client tenants; 2026 Jump Start and ISO 27001 crosswalk; CMMC on the same catalogue is a separate product so not tagged), Llama Guard 4 (runtime-platform; 12B multimodal classifier pruned from Llama 4 Scout; MLCommons S1–S14; drop-in for Llama Guard 3 8B/11B; Llama 4 Community License so no OSI badge), Neural Network Dependability Kit (safety-engineering; fortiss; AGPL-3.0; metrics/ATG/formal/runtime-NAP monitoring; GSN diagram in the docs; autonomous driving, medical imaging and space navigation; DO-178C not named so not tagged). Wired ControlMap into the ISO 42001 path and the 42001-audit / 42005 / crosswalk articles; Collibra into the EU aerospace path and the GPAI / 42001-crosswalk articles; NNDK into the GSN/AMLAS, formal-verification, space-systems and UL 4600 articles. Llama Guard is not on the aircraft path. CISA AI timed out; Canada AIA was a qualifying government questionnaire but the four under-covered categories were filled first; D-RisQ Modelworks names DO-178C/DO-333 for Simulink/Stateflow and was not listed as an NN toolbox.
  • Refreshed the five oldest remaining full articles against live official pages. Does the FAA certify AI today: Roadmap still Version I; Q3 2026 SAIL (30 September 2026) is now Current (HTML slug small_airplane_issue_list_2026q3); Artificial Intelligence Software still Emerging Technology/Issue with the same Policy and Standards / issue-paper wording; still no published CPP or AC; older FAA_AI_ML_Discipline_page.pdf 404s. NIST SP 800-171 for AI CUI: Rev. 3 PDF still has no “artificial intelligence” / “machine learning” / “ai system” matches; COSAiS still 800-53 overlays (January 8, 2026 predictive-AI annotated outline); CMMC still Rev 2 / 110 / 14 families. SBOM/AIBOM provenance: 2026 minimum elements HTML still Publish Date July 29, 2026; live HTML now also says AI and SaaS may require additional elements, shown beside the PDF’s “does not introduce additional elements for SBOMs for AI systems”; SPDX 3.0.1 AI Profile unchanged; CISA SBOM-for-AI HTML timed out. Formal NN verification: Marabou still research product / ACAS Xu / no Windows; nnenum who/dep still blank; α,β-CROWN still out. Model/system cards: Hub cards still README.md plus YAML citing Mitchell 2018; still no CDAO system-card template. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 86 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest remaining articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Moasoftware Re:In (W-Shape four stages; bias/sufficiency/augmentation/reliability reports; VLS, collision avoidance, UAV, engine health, aerial refueling; research directions; still maps ARP6983 §§6.2–6.5 as a vendor statement; ED-324 still draft so DO-178C is not tagged), UK MOD AIPH (BETA; COMING SOON on legal/ethics; DAIC AI Assurance Framework still Published 27 February 2026; people/process/evidence/technology; SROs and RAISOs), Hugging Face Dataset Cards (force-modality tags 3d/audio/geospatial/image/tabular/text/timeseries/video; RL-environment tags harbor/verifiers/openenv/nemo-gym/agentenv; tags describe compatibility and do not create a new repository type), Sprinto ISO 42001 (Get ISO 42001 ready, minus the grunt work; 4,000+ customers; policy drift; Trust Centre; Sprinto-for-SaaS nav is not a deployment tag), 6clicks ISO 42001 (homepage now names SaaS, sovereign cloud or on-prem and Cloud, on-premises, air-gapped or hybrid; government/defense/critical infrastructure operators; sovereign cloud is not a directory deployment value). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Optro AI Governance (governance-platform; fairnow.ai currently redirects to optro.ai/product/ai-governance; 25+ frameworks including EU AI Act, ISO 42001 and NIST AI RMF; Shadow AI; agents draft-and-recommend, the team decides; optro.ai homepage is a separate GRC Intelligence surface and is not mixed in), AI Verify Testing Framework (government-resource; 11 principles; Traditional and GenAI; mapped NIST AI RMF 13 Oct 2023, NIST AI 600-1 29 May 2025, ISO/IEC 42001 21 July 2025; IMDA/PDPC MVP 25 May 2022; GitHub 7 June 2023; European Union named without the words EU AI Act so that framework is not tagged), NIST ARIA (government-resource; model testing, red-teaming and field testing; sector/task agnostic; LLM pilot; Summer 2025 Pilot Summary Report Out still coming soon; NIST ITL named, AI RMF not tagged), ISMS.online ISO 42001 (compliance-automation; Updated 14 July 2026; templates/frameworks, dynamic risk and document management; three-year certificate with annual surveillance; ARM path; no SaaS word). Wired Optro and ISMS.online into the ISO 42001 path and the 42001-audit / 42005 / crosswalk articles (Optro also on the EU aerospace path and GPAI article); AI Verify into the ISO 42001 path and the 600-1 / 600-1-actions / crosswalk articles; ARIA into the DoD-contractor path and the red-teaming article. CISA AI timed out; IMDA aiverify.imda.gov.sg returned HTTP 500; UK AI Playbook HTML sibling 404ed — none of those three were listed.
  • Refreshed the five oldest remaining full articles against live official pages. JSP 936 vs DoD RAI: GOV.UK still Published 13 November 2024, 41 pages, principal policy framework; AIA Toolkit still IL2/IL5, DoW AI Ethical Principles, Program Managers through End Users; AIPH still Part 2-style; DAIC framework still Published 27 February 2026. EU extra-territorial aerospace: Annex I Section A item 1 still DELETED; Section B still unmanned-aircraft-limited 2018/1139; consolidated text still as at 27 July 2026. ISO/IEC 42001 certification audit: UKAS still first BSI accreditation 15 January 2026. Article 73 vs DoD: still 15/2/10-day clocks, incomplete initial report, no alter-the-system, Digital Omnibus NEW/AMENDED. EASA data/learning assurance: Proposed Issue 3 library page still titled Proposed Issue 3 (publication date 03/06/2026); ED-324 still Draft target 31/12/2026; ER-027 still published 31/12/2024. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 82 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest remaining articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Adelard ASCE (ASCAD 2.0 for autonomous/AI-driven ML; GSN Version 3 and Modular GSN plugin; DNRs; node-locked/floating licences; both models limited-or-no-Internet; MoD DE&S QEC ATM), QuantPi (Validation Layer; physical AI; MCP integration; HPE Private Cloud AI; public cloud/on-premises/air-gapped; SSO/RBAC/zero data retention; TÜV Süd first CARAT partner lab), IBM watsonx.governance (Govern smarter. Scale faster.; any AI anywhere; cloud and on-prem; Infosys 150%/2,700+ use cases; US Open court fairness 71% to 82%; Honda Technology Summit 29 Sep 2026; Compliance Accelerators still on the 18 June 2025 newsroom for EU AI Act/ISO 42001/NIST AI RMF), NIST Dioptra (docs and release 1.2.1; Measure function of the NIST AI RMF; docker images nginx/MLflow/REST API/pytorch-cpu/tensorflow2-cpu 1.2.1; localhost Hello World; CC BY 4.0; DOI 10.18434/mds2-3398), Microsoft PyRIT (Python 3.13 recommended; pip install pyrit; ~/.pyrit/.env and .pyrit_conf; pyrit_scan/pyrit_shell; RAMPART pytest-native; 0DIN Mozilla). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: NIST AI RMF Playbook (government-resource; suggested actions for the AI RMF Core; neither a checklist nor a set of steps; suggestions voluntary; banner that AI RMF 1.0 is being updated), Cloudflare AI Security for Apps (runtime-platform; formerly Firewall for AI; docs updated 8 September 2026; PII/unsafe-topic/prompt-injection; model-agnostic; cf-llm JSON; Enterprise paid add-on; WAF must be enabled; plan table is not the word SaaS so deployment stays blank), Ansys SCADE Suite (safety-engineering; KCG qualified DO-178B Level A and DO-178C/DO-330 at TQL-1; Avionics and Flight Controls named; AI-Driven webinar title is not an ML-verifier claim), Rapita Verification Suite (safety-engineering; qualification kits for DO-178C; more than 20 DO-178B and C projects up to DAL A; Rapi Coupling expected H1 2027). Wired the Playbook into the DoD-contractor path and the 600-1 / 600-1-actions / 42001-crosswalk articles; SCADE and Rapita into the aircraft-ML path and the mapping / DO-330 / DO-178C-gaps articles (SCADE also on the TR 5469 article for the IEC 61508 SIL 3 code-generator sentence). Cloudflare is not on the aircraft path.
  • Refreshed the five oldest remaining full articles against live official pages. Mapping AI models to DO-178C/DO-330: EUROCAE still lists ED-324 as Draft target 31/12/2026; ER-027 still published 31/12/2024. NIST AI 600-1 for defense contractors: publication page still Published July 26, 2024 and still cites EO 14110; AI RMF still voluntary. AI red-teaming for defense programs: CDAO lexicon/T&E sentences unchanged; NIST AI 200-3 still 18 September 2026; still no CMMC/DFARS clause. GSN/AMLAS: GSN still Version 3; AMLAS still six stages, still “Since launching in 2022”, Visio tool still v1 May 2022; still not an FAA/EASA AMC. ISO/IEC TR 5469 vs IEC 61508: still Technical Report edition 1.0, publication 2024-01-08, 73 pages; three-use abstract unchanged. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 78 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest remaining articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Edge Case (Guardian Digital Safety Twin; AUSA 2025 defense leaders; Aurora quote), Secureframe Defense (Defense Navigator; GCC High; FedRAMP Moderate MDM; CyberAB RPO since March 2025; Level 2 Certified September 2025), Apptega ISO 42001 (days-not-weeks title; 95% audit handoff; Foresite quote), Microsoft Counterfit (Version 1.1.0; pip install .[dev]; list targets/attacks; Windows/macOS still WIP), HiddenLayer (homepage Discovery/supply-chain/attack-simulation/runtime; US Federal mission assurance; EO 14110 still named). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Asenion AI Control System (governance-platform; formerly Fairly per a homepage quote; EU AI Act / ISO/IEC 42001 / NIST AI RMF; Assess/Verify/Witness; own 42001 certificate is not a customer AIMS), ServiceNow AI Control Tower (governance-platform; auto-discovers agents/models/copilots/MCP servers; out-of-the-box EU AI Act and NIST AI RMF content packs; ISO 42001 not named on the product FAQ so not tagged; SaaS not named), Foretellix Foretify (safety-engineering; AI-powered AV stacks; not an aviation AMC), LDRA AI/ML capability (safety-engineering; EASA Level 1 and 2 named; DO-178C not tagged). Wired Asenion into the ISO 42001 path and 42001/42005/crosswalk articles; Asenion and ServiceNow into the EU aerospace path and GPAI article; Foretify into the UL 4600 article; LDRA into the DO-178C/ML-gaps and EASA levels articles. Foretify and LDRA are not on the aircraft path.
  • Refreshed the five oldest remaining full articles against live official pages. ISO 42001 vs NIST AI RMF: FDIS PDF title still FDIS; AIRC listing now also hosts Microsoft ISO-IEC-42001 and INCITS 42005/23894 (14 August 2025) rows; ISO explained still says the standard does not replace laws, certification is voluntary, and ISO does not certify. Glossary: FAA Roadmap still Version I; EASA Issue 2 still published 6 March 2024; CMMC Phase II still suspended. DoD RAI Toolkit vs NIST AI RMF: Tradewinds AIA Toolkit still IL2/IL5, DoW AI Ethical Principles, Program Managers through End Users. EASA levels: Proposed Issue 3 library page still titled Proposed Issue 3 (publication date 03/06/2026); comments closed 12 August 2026 with no published Issue 03 found. CMMC Level 2 vs 3: Phase II remains suspended (13 July 2026). Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 74 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, five oldest articles re-verified

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Five oldest articles re-verified; status and dates updated. No deploy.

  • Expanded the next five thinnest listings from official pages: Credo AI (GAIA generally available; 300+ integrations; Agent Registry; Mastercard quote; State of AI Governance 2026 Report), Monitaur (FlightSim AI pen test; Automate Record for CROs and boards; 33 controls; Launch in 90 days), ModelOp (Center 3.3; MADE 50+ technologies; inline agent prompt-injection blocking; MCP-enabled), Giskard (Python SDK; EU AI Act Policy Pack items; OPA/Rego; EU-sovereign; NeurIPS 2026 StereoTales), EU AI Act Service Desk (in force 1 August 2024; consolidated text as at 27 July 2026; Digital Omnibus NEW/AMENDED; Annex I Section A item 1 DELETED; Section B item 20 still unmanned-aircraft-limited 2018/1139). nnenum README still does not name who-it's-for or on-prem/SaaS/air-gapped, so those fields stay blank. Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Scytale ISO 42001 (compliance-automation; AIMS, CCM, evidence collection; ISO 27001/NIS2 named not tagged), Thoropass ISO 42001 (compliance-automation; AI System Impact Assessment templates, auditor comms; 42005 not named), Palo Alto Prisma AIRS (runtime-platform; Network Intercept + API Intercept; on-premises microperimeter tagged on-prem; Managed AIRS August 2026 is not the word SaaS), Cisco AI Defense (runtime-platform; 200+ threat subcategories; datasheet 21 May 2026 maps NIST AI-RMF; on-premises AI POD tagged on-prem). Wired Scytale and Thoropass into the ISO 42001 path and 42001/42005/crosswalk articles. Prisma AIRS and Cisco are not on the aircraft path.
  • Refreshed the five oldest full articles against live official pages. ISO 42001 explained still says the standard does not replace laws, certification is voluntary, and ISO does not certify. CMMC Phase II remains suspended (13 July 2026); Phase I self-assessment in place; NIST 800-171 Rev 2 plus select government-led assessments; ATS program review named on the About page; DFARS 7012 still required. EUROCAE WG-114 ED-324 still Draft target 31/12/2026; extra draft ERs (human factors, information security, supporting information, RL gap analysis, use cases) target 31/12/2026–30/06/2027. Service Desk Annex I Section A item 1 is DELETED by the Digital Omnibus; civil-aviation 2018/1139 remains Section B item 20, unmanned-aircraft-limited. FAA AI/ML discipline page still links Roadmap Version I. Status notes added on each article. Logged here on /updates/.
  • docs/READINESS.md updated for 70 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, rounds 26–27 fact-check

Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Ten claims from rounds 26–27 re-checked on /methodology/. No deploy.

  • Expanded the next five thinnest listings from official pages: CDAO JATIC (FY23–FY29; RAVEN and maite; CV classification/object detection for UAV, satellite and autonomous driving; not a certification), CISA SBOM for AI minimum elements (May 2026 SI heading; July 2026 general SBOM PDF adds no AI-only fields), OneTrust AI Governance (EU AI Act / NIST AI RMF / ISO 42001 templates; Python AI Guard SDK), Holistic AI (Identify/Protect/Enforce; Guardian Agents; EU AI Act / NIST AI RMF / ISO 42001), NASA ProgPy (1.8.0; Python ≥3.9,<3.14; NASA-1.3 — no OSI badge). Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: 6clicks ISO 42001 (compliance-automation; pre-configured AIMS, Hailey AI, SoA; EU AI Act cross-map), Apptega ISO 42001 (compliance-automation; questionnaires, Audit Manager), Check Point AI Guardrails (runtime-platform; Guard API api.lakera.ai/v2/guard; SaaS tagged, self-hosted not tagged on-prem), Ansys medini analyze (safety-engineering; ISO 26262 / IEC 61508 / ARP 4761 / ISO 21448 / MIL-STD-882E named but not directory frameworks; SOTIF perception-algorithm hazards). Wired 6clicks and Apptega into the ISO 42001 path and 42001/42005/crosswalk articles; medini into the UL 4600 article. Check Point and medini are not on the aircraft path. Protect AI LLM Guard (archived) and Argevide NOR-STA were reviewed and not listed.
  • Fact-check of 10 claims sampled across rounds 26–27 listings (Croissant pip/Python 3.10+/four layers, ERAN DeepZ/DeepPoly/ACAS Xu property 9, ATLAS 2026.05 / 6.0.0, Inspect inspect_ai ≥3.10 MIT, Hyperproof ISO 42001 template/Annex A/NIST AI RMF, Azure Prompt Shields/Task adherence/F0 S0, CycloneDX 260+ tools, NNV Star/zonotope/10+/48 layers, Astah GSN 1.0/DO-178B/OMG SACM, Drata Help Center 1 April 2025 AIMS). Zero corrections. Zero live re-fetches blocked this pass.
  • docs/READINESS.md updated for 66 tools. ProgPy pyproject evidence quotes were rewritten so the freshness checker’s HTML-tag strip does not eat the description. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Visual QA at 1024 and 768, five thin listings expanded, four new tools, rounds 25–26 fact-check

Tablet layout fix for the header at 1024 and 768. Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. Ten claims from rounds 25–26 re-checked on /methodology/. No deploy.

  • Visual QA of every template at 1024 and 768. Two header wrapping issues: at 768 the nav orphaned About on its own row with search on a third row; at 1024 search sat alone under a full brand+nav row. Fixed with a tablet header grid (brand + search on one row, nav wrapping below) below 80rem. No contrast issues found. Playwright asserts the 1024/768 brand and search share a row without overlapping, nav sits below, header search and home email do not clip, and tool facts do not overflow.
  • Expanded the next five thinnest listings from official pages: ERAN (raw README + LICENSE; DeepZ/DeepPoly/GPUPoly; Python 3.6+ / TensorFlow 1.11+; ACAS Xu property 9), CycloneDX (260+ tools, medical-device HBOM/SBOM, enterprises/governments/OSS audience), NNV (Star/zonotope, 10+ architectures, 48 layers, VNN-COMP/ARCH-COMP 11 entries, AFOSR/DARPA/NSF), MITRE ATLAS (atlas-data raw README; content 2026.05 / format 6.0.0; STIX, Excel, Navigator 5.3.2), Inspect (pip inspect-ai; Python ≥3.10; 20+ providers; MIT classifiers). Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Hyperproof ISO 42001 (compliance-automation; out-of-the-box AIMS template; NIST AI RMF crosswalk), Sprinto ISO 42001 (compliance-automation; AI discovery and auditor collaboration), Azure AI Content Safety (runtime-platform; Prompt Shields and Task adherence), Google Cloud Model Armor (runtime-platform; prompt/response screening; CSAM filter on by default). Wired Hyperproof and Sprinto into the ISO 42001 path and 42001/42005/crosswalk articles. Azure Content Safety and Model Armor are not on the aircraft path.
  • Fact-check of 10 claims sampled across rounds 25–26 listings (HiddenLayer NIST AI RMF/EO 14110/air-gapped, Resaro ASQI/IMDA, MathWorks DO-178C/278A/254/330 no-prequalify, garak Python 3.11–3.13, NeMo Guardrails pip/Python 3.10–3.13, PREMIS Core GSN locally-or-cloud, nnenum Python ≥3.9 GPL-3.0 VNN-COMP 2020, HEART 0.7.0 / W519TC-23-9-2037, Guardrails AI 0.11.0, Bedrock ApplyGuardrail). Zero corrections. Zero live re-fetches blocked this pass.
  • docs/READINESS.md updated for 62 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Visual QA at 390, five thin listings expanded, four new tools

Mobile layout fixes for header, newsletter, tool facts and search. Next five thinnest listings expanded from official pages. Four new listings in under-covered categories. No deploy.

  • Visual QA of every template at 1280 and 390. Fixed four wrapping issues at 390: header brand collapsed into the search control; home newsletter email clipped by nowrap; tool/framework facts two-column grid clipped long URLs; search query placeholder clipped. Contrast issues were not found.
  • Expanded the next five thinnest listings from official pages: nnenum (Python ≥3.9, zonotopes/star sets/ImageStar, pyproject 1.0.1 GPL-3.0-or-later), Croissant (pip mlcroissant, four layers, RAI spec v1.0 properties, working-group audiences), CDAO T&E of AI Models Framework (four focus areas, performance iceberg, SI = Systems Integration; PDF still 500-blocked on the checker), HEART (pip heart-library 0.7.0, Python 3.9–3.11, ART ≥1.20.1, CDAO contract W519TC-23-9-2037), Hugging Face Model Cards (README.md + YAML library_name/model-index/not-for-all-audiences; CDAO template kept). Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Drata ISO 42001 (compliance-automation; ISO/IEC 42001 AIMS), Guardrails AI (runtime-platform; pip guardrails-ai; Python 3.10–3.13; Apache-2.0), Amazon Bedrock Guardrails (runtime-platform; ApplyGuardrail without invoking an FM), Astah System Safety GSN (safety-engineering; GSN Community Standard 1.0 and OMG SACM; DO-178B named so DO-178C is not tagged). Wired Drata into the ISO 42001 path and 42001/42005 articles; Astah into the GSN article and aircraft-ML path. Guardrails AI and Bedrock Guardrails are not on the aircraft path.
  • docs/READINESS.md updated for 58 tools. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, rounds 23–24 fact-check

Next five thinnest tool listings expanded from live official pages. Four new listings in runtime, assurance-case, model-signing and red-teaming gaps. Fifteen claims from rounds 23–24 re-checked on /methodology/. Launch-readiness report updated. No deploy.

  • Expanded the next five thinnest listings from live official pages: HiddenLayer (NIST AI RMF plus still-named EO 14110; air-gapped classified disconnected), Resaro AIP (ASQI-structured evidence; IMDA/AI Verify pilot), TensorFlow Model Card Toolkit (pip model-card-toolkit, Python 3.7+, HTML export; TFX generator moved to tfx-addons from v2.0.0), MathWorks DO Qualification Kit (DO-178C/278A/254/330 and supplements; FAQ does not prequalify tools), NVIDIA garak (nmap/msf analogy; Hugging Face, OpenAI, Bedrock, NIM and REST generators; conda Python 3.11–3.13). Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: Sigstore model-transparency (Apache-2.0 model signing with Sigstore, keys or certificates), NVIDIA NeMo Guardrails (runtime rails; pip nemoguardrails; Python 3.10–3.13), Argevide PREMIS (Core GSN; locally or in a cloud — not tagged on-prem/SaaS), Microsoft Counterfit (ART + TextAttack + AugLy; Linux/WSL; MIT). Wired into the data-provenance, red-teaming and GSN/AMLAS articles and the DoD-contractor and aircraft-ML paths. NeMo Guardrails is not on the aircraft path.
  • Fact-check of 15 claims sampled across rounds 23–24 listings (Trustible FAQ/Leidos/30–60–90, Saimple SaaS/on-premises/ISO/IEC 24029, QuantPi cloud/HPE/air-gapped/CARAT/CISPA, LYNX MOSA.ic.AI 8 April 2026/DO-178C path/Vulkan SC, ART v1.20/DARPA, AIA Toolkit IL2/IL5, SPDX AIPackage MUST licenses, PyRIT Crescendo/TAP/CoPyRIT, Promptfoo 50+/157 plugins, Hugging Face Dataset Cards mlcroissant). Zero corrections. Zero live re-fetches blocked this pass.
  • docs/READINESS.md updated for 54 tools and this fact-check. Canonical stays https://aigov.sparkysai.com. No deploy, DNS, purchases or signups.

Five thin listings expanded, four new tools, launch-readiness report

Next five thinnest tool listings expanded from live official pages. Four new listings in red-teaming, assurance-case and dataset-provenance gaps. Short launch-readiness report at docs/READINESS.md. No deploy.

  • Expanded the next five thinnest listings from live official pages: ART v1.20 (LF AI & Data host; TensorFlow/Keras/PyTorch; evasion/poisoning/extraction/inference; DARPA HR001120C0013), Marabou (ONNX/VNNLIB, pip maraboupy, ACAS Xu ACASXU_experimental_v2a_2_7.nnet), CDAO AIA Toolkit (Program Managers through End Users; IL2 and IL5), IARPA TrojAI (closed BAA W911NF-19-S-0012; JHU APL/NIST/SEI/Sandia T&E; NIST page no longer updated), SPDX 3.0.1 AI Profile (hasConcludedLicense/hasDeclaredLicense plus AIPackage metadata). Who-it's-for, deployment and framework tags only where those pages name them.
  • New listings from official pages: PyRIT (Microsoft AI Red Team; Crescendo/TAP/Skeleton Key; MIT), Promptfoo (50+ vulnerability types; plugin IDs for NIST AI RMF, ISO/IEC 42001 and EU AI Act; MIT), NASA AdvoCATE (GSN, hazard analysis, bow-tie; NTRS User Guide 1.4, 12 July 2022), Hugging Face Dataset Cards (README.md cards with YAML license/language/size and mlcroissant). Wired into the red-teaming, GSN/AMLAS, SBOM/AIBOM, model-card and space-systems articles.
  • docs/READINESS.md records what is done, known blocked sources, remaining gaps, and the exact go-live steps from docs/LAUNCH.md. Those steps are not executed here. Canonical stays https://aigov.sparkysai.com.
  • No deploy, DNS, purchases or signups.

Five thin listings expanded, rounds 19–22 fact-check, framework completeness

Next five thinnest tool listings expanded from live official pages. Fifteen claims from rounds 19–22 re-checked on /methodology/. Framework explainers filled for status, dates, who they apply to, and official links (EASA Issue 03 / NPA 2025-07, EU AI Act Chapter V, ISO/IEC 42005 and 42006). No deploy.

  • Expanded the next five thinnest listings from live official pages: Trustible (homepage FAQ plus 10 April 2026 Leidos story), Saimple (SaaS and on-premises; ISO/IEC 24029 and Article 15), QuantPi (public cloud / HPE on-premises / air-gapped; TÜV Süd CARAT), LYNX MOSA.ic.AI (8 April 2026 launch; DO-178C still a path, not tagged), Re:In (ARP6983 §6.2–6.5 data-quality functions on the 25 August 2026 Korean page). Who-it's-for, deployment and framework tags only where those pages name them.
  • Fact-check of 15 claims sampled across rounds 19–22 (UL 4600 17 March 2023 ANSI, ISO/IEC 42005:2025 39 pages 2025-05-28, ISO/IEC TR 24029-1 and 24029-2 catalog dates, FDIS 24029-3 stage 50.00, Article 113(b) Chapter V 2 August 2025 vs postponed high-risk Chapter III, Art. 3(63)/51/54, GPAI Code of Practice 10 July 2025, nnenum VNN-COMP 2020, Dioptra Measure/CC BY 4.0, DAIC AI Assurance Framework 27 February 2026). Zero corrections. Zero live re-fetches blocked this pass.
  • Framework completeness: EASA explainer now records Proposed Issue 03 (3 June–12 August 2026) and NPA 2025-07 (10 Nov 2025, comments through 10/02/2026). EU AI Act status line and dates section name Chapter V from 2 August 2025. ISO/IEC 42001 explainer links ISO catalog pages for 42005 (guidance) and 42006 (certification bodies, published 2025-07-07). FAA roadmap adds an explicit who-it-applies-to sentence from the cited primary-purpose line.
  • No deploy, DNS, purchases or signups.

Lighthouse 100 gate, five thin listings expanded, 24029 and GPAI articles

Lighthouse pass bar raised from 95 to 100; methodology-mobile forced-reflow from display:block tables and smooth scrolling fixed. Next five thinnest tool listings expanded from live official pages. Two cited articles on path/framework gaps (ISO/IEC 24029 robustness; EU AI Act Chapter V GPAI). No deploy.

  • Lighthouse: Round 21 category scores were already 100; the script still printed “95 or higher” and listed a methodology-mobile forced-reflow insight. Tables no longer use display:block; html scroll-behavior is auto; the audit now fails the run if any category is below 100.
  • Expanded the next five thinnest listings from live official pages: ERAN (ETH SRI README: DeepZ/DeepPoly, ACAS Xu property 9, Apache License), nnenum (ONNX and vnnlib, VNN-COMP 2020 all ACAS-Xu under 10 seconds), MathWorks AI Verification (industry-standards sentence, airborne runway-sign example, ACAS Xu 45-network series), Giskard (banking/insurance, EU AI Act Policy Pack items, on-premise), Fiddler (SaaS/VPC/GovCloud/on-premises, air-gapped, DoD ML/LLM sentence). Who-it's-for, deployment and framework tags only where those pages name them.
  • Articles: ISO/IEC TR 24029-1:2021 (overview Technical Report, 31 pages, published 2021-03-10) and ISO/IEC 24029-2:2023 (formal-methods methodology, 23 pages, published 2023-08-01) sit next to the aircraft-ML path’s verifier listings; FDIS 24029-3 is still a draft. The EU AI Act explainer had said it does not cover general-purpose AI model obligations — Chapter V applies from 2 August 2025 and was not postponed with high-risk Chapter III. Added to the certifying-ML-aircraft and selling-AI-into-EU-aerospace paths.
  • No deploy, DNS, purchases or signups.

Five thin listings expanded, UL 4600 and ISO/IEC 42005 articles, unattended freshness

Next five thinnest tool listings expanded from live official pages. Two cited articles on path/framework gaps (UL 4600 vs aviation/3000.09; ISO/IEC 42005 impact assessment). Weekly freshness Action treats 500s as blocked, skips writing freshness.json in CI, and closes the standing issue when the run is clean. No deploy.

  • Expanded the next five thinnest listings from live official pages: NIST Dioptra (docs plus README Measure-function sentence for NIST AI RMF; CC BY 4.0 so no OSI badge), Adelard ASCE (CAE/ASCAD 2.0 and GSN Version 3), UK MOD AIPH (Part 1 section map plus DAIC AI Assurance Framework 27 February 2026), Inspect (200+ evals and sandbox list), Vanta (ISO 42001, NIST AI RMF, CMMC mapped to SP 800-171/172, EU AI Act evidence reuse). Who-it's-for and framework tags only where those pages name them.
  • Articles: UL 4600’s public catalog is scoped to autonomous vehicles and the dynamic driving task — not an FAA, EASA or DoD 3000.09 means of compliance we have found (the UL 4600 framework sat on the safety-critical landing with no path article). ISO/IEC 42005:2025 (edition 1, 39 pages, published 2025-05-28) is catalogued as guidance for AI system impact assessments and complements 42001 and 23894; it is not a certifiable AIMS. Added to the ISO/IEC 42001 path. Article cap raised 50 → 55.
  • Freshness automation: HTTP 500 and network timeouts are blocked, not failed; CAPTCHA/challenge bodies are uncheckable instead of false drift; each fetch uses a fresh abort timer; CI does not write src/data/freshness.json; the weekly Action still posts if the check does not finish; the standing Freshness review issue reopens on drift or hard failure and closes when the run is clean. /updates/ and /updates/this-month/ sort by date so a mis-ordered updates.json cannot hide the newest month. Validator now checks updates.json ids and dates.
  • No deploy, DNS, purchases or signups.

Rounds 11–18 fact-check, five thin listings expanded, SITE_HOST profiles

Fifteen claims from rounds 11–18 re-checked on /methodology/. Five next-thinnest tool listings expanded from live official pages. Canonical URL and chrome brand switch with SITE_HOST; the current canonical stays aigov.sparkysai.com. No deploy.

  • Fact-check of 15 claims sampled across rounds 11–18 (FedRAMP Certification vs DoD IL labels, NATO 2021/2024 PRUs, ISO/IEC 23894 and 5338 catalog abstracts, IAQG 9100-series vs 42001, UKAS first AIMS accreditation, DFARS 252.204-7012(m), EASA NPA 2025-07, Canada DND/CAF, DAF AI Strategy, Japan MOD compass, DST ethical-AI method, FAA Part 108 fact sheet). Zero corrections. Two live re-fetches blocked this pass (Federal Register CAPTCHA on the Part 108 NPRM and the BIS AI Diffusion rule; Australia Defence Policy Settings HTML HTTP 500); those claims were kept from other official pages of the same instrument (FAA BVLOS fact sheet; DST publication page).
  • Expanded the next five thinnest listings from live official pages: IBM watsonx.governance (product page plus 18 June 2025 newsroom Compliance Accelerators), Edge Case (homepage plus Guardian), Holistic AI, ModelOp (controls plus homepage), MITRE ATLAS (homepage plus atlas-data README). Framework tags still only where those pages name a directory framework. Who-it's-for and on-prem filled only from vendor-page wording.
  • Build-time SITE_HOST selects among aigov.sparkysai.com (default, current canonical), aigov.directory, and sigov.directory. Only URL, placeholder emails, Open Graph hostname and chrome name/tagline change. Article and listing wording does not. Documented in docs/LAUNCH.md. SITE_HOST is unset in this build.
  • No deploy, DNS, purchases or signups.

Rounds 1–10 fact-check, five thin listings expanded, homepage above the fold

Fifteen claims from older articles re-checked on /methodology/. One truncated EASA Issue 03 quote restored. Five thinnest tool listings expanded from live vendor pages. Homepage value proposition, paths, latest updates and the newsletter placeholder sit above the fold on mobile. No deploy.

  • Fact-check of 15 claims sampled across rounds 1–10 (glossary, DoD RAI vs NIST, EASA levels, DO-178C mapping, NIST AI 600-1, GSN/AMLAS, JSP 936, extra-territorial AI Act, FAA roadmap). Fourteen kept. One correction (before → after): proposed Issue 03 “covering Level 0, Level 1, Level 2 and Level 3 AI applications, but not covering ‘autonomy’” → the draft also says “or ‘autonomous systems’”. Live war.gov fetch of the 24 February 2020 ethical-principles release returned 403 this pass; the five principle names were confirmed on a Wayback snapshot of the same defense.gov release.
  • Expanded the five thinnest remaining listings from live official pages: OneTrust AI Governance (templates and runtime guardrails), Credo AI (policy packs and agent registry), Secureframe Defense (homepage plus /cmmc), Monitaur (FlightSim / Automate Record / Common Controls), Advai (homepage plus /platform). Framework tags still only where those pages name a directory framework. Who-it's-for filled only from vendor-page wording.
  • Homepage: shorter value proposition; top paths, latest changelog entries and the disconnected newsletter placeholder sit immediately under the hero so they are above the fold on a mobile viewport. Sponsor slot stays lower. Unique meta description and FAQ schema unchanged.
  • No deploy, DNS, purchases or signups.

Part 108 BVLOS vs 3000.09, ISO/IEC 23894 and 5338, DFARS/FAR flow-down, thin-page pass

Three source-cited articles on remaining autonomy, engineering-process and contract-flow-down gaps. Folded the aviation publisher-map into the FAA/EASA timelines page and expanded thin articles and framework explainers. No deploy.

  • Articles: FAA proposed Part 108 BVLOS (NPRM Normalizing Unmanned Aircraft Systems Beyond Visual Line of Sight Operations, still proposed; NPRM PDF search found no “artificial intelligence” or “machine learning”) versus DoD Directive 3000.09 (excludes unarmed platforms and non-weapon systems); ISO/IEC 23894:2023 risk-management guidance versus ISO/IEC 5338:2023 AI system life cycle processes for engineering teams, quoting catalog abstracts only and recording current 15288:2023 / 12207:2026 editions without claiming 5338 was revised to match 12207:2026; supplier flow-down on defense contracts that use SI/AI — no DFARS/FAR clause titled AI or Super Intelligence; live Acquisition.gov text of 252.204-7012(m), 252.204-7020(g), 252.204-7021(f) and FAR 52.204-21(c), plus EO 14434 §2(b) that does not require altering previously issued contracts.
  • Content quality: merged aviation-ai-assurance-who-publishes-what into faa-easa-ai-certification-timelines (Astro redirect) to stay at the 50-article cap; expanded Australia Defence Policy Settings, EASA levels, ISO/IEC 23894 and NIST AI RMF pages that were thin on stripped prose.
  • Methodology: TensorFlow Model Card Toolkit is listed from the GitHub README (repository archived; tensorflow.org guide currently redirects unauthenticated clients to Google sign-in). No deploy, DNS, purchases or signups.

Australia and Japan Defence AI policies, FAA/EASA timelines, four listings, monthly digest

Three source-cited articles on remaining Allied and certification-timeline gaps. Four listings from official pages for model cards, dataset provenance, CISA SBOM-for-AI/SI guidance, and LLM robustness scanning. A What changed this month digest generated from this updates log. No deploy.

  • Articles: Australia Defence Policy Settings for Responsible Use of Artificial Intelligence in Defence (live HTML obligations; DST A Method for Ethical AI in Defence kept as research that does not represent Australian Government views); Japan 防衛省ＡＩ活用推進基本方針 (July 2024) and ATLA Guideline for Responsible AI Application in Research and Development of AI-Equipped Defense Systems (Ver. 1), using live Japanese titles and ATLA’s provisional English edition; FAA and EASA AI certification timelines compared (Roadmap Version I / Roadmap 2.0 / RMT.0742 NPA 2025-07 dates versus still-draft ED-324).
  • Listed TensorFlow Model Card Toolkit (Apache-2.0; GitHub archived), MLCommons Croissant dataset provenance vocabulary, CISA Software Bill of Materials for AI – Minimum Elements (live webpage heading uses Super Intelligence (SI); guidance title on the same page still says AI), and NVIDIA garak. Framework tags omitted where the cited page does not name a directory framework.
  • New /updates/this-month/ digest generated from this changelog, grouped by calendar month, with unique meta description and FAQ schema.
  • No deploy, DNS, purchases or signups.

Service AI acquisition policies, NATO revised strategy, DND/CAF strategy, landing SEO, fact-check

Three source-cited articles on remaining Allied and service-level gaps. Unique meta descriptions and FAQ schema on collection landings. Breadcrumb schema remains on inner pages. llms.txt lists every article. Ten claims from rounds 14–15 re-checked on /methodology/. No deploy.

  • Articles: Army, Navy and Air Force AI policies that name acquisition (Project Linchpin / ASA(ALT) / SBIR and xTech; DON Strategy to Weaponize Data and Artificial Intelligence; DAF Artificial Intelligence Strategy with SAF/AQ and SAF/SQ acquisition pathways), using live AI names; NATO’s revised Artificial Intelligence Strategy and the six Principles of Responsible Use (2021 wording, 2024 TEV&V / DIANA / NIF / Defence Planning Process outcomes); Canada DND/CAF Artificial Intelligence Strategy (catalogue D2-633/2024E-PDF, 2030 vision, five lines of effort, PSPC procurement line).
  • SEO: unique meta descriptions on collection landings; FAQPage JSON-LD plus an on-page Questions heading on those landings; BreadcrumbList remains on inner pages; llms.txt and llms-full.txt continue to list every article from the content collection.
  • Fact-check of 10 claims from the rounds 14–15 DO-330, SAE G-34, CDAO T&E, NIST AI 600-1, CMMC Program scoping and JSP 936 supplier articles. Zero corrections. Two live re-fetches blocked this pass (CDAO T&E PDF HTTP 500; eCFR Part 170 CAPTCHA); those two claims were kept from the cited article quotes.
  • No deploy, DNS, purchases or signups.

NIST AI 600-1 actions, CMMC Program scoping, JSP 936 suppliers, freshness last-verified, path checklists

Three source-cited articles on remaining gaps. Last verified on every tool and framework page from freshness data. A printable one-page checklist for each Path. No deploy.

  • Articles: NIST AI 600-1 suggested actions that name acquisition, contractors, national security and information security for generative AI on a defense program (voluntary; not a CMMC overlay); CMMC Program scoping for generative systems that handle CUI, using live names (32 CFR Part 170 CMMC Program, DoD CIO, the live CMMC 2.0 resource page, Model Overview Version 2.13) and § 170.19 asset categories; what UK MOD JSP 936 Part 1 asks of industry partners and suppliers (must vs should, legacy AI, AIPH as Part 2 guidance).
  • Tool and framework pages show Last verified from src/data/freshness.json (written by npm run check:freshness). Editorial Last reviewed remains on framework pages. The weekly freshness Action still does not rewrite listings or commit that file.
  • Printable one-page checklists at /checklists/{path-slug}/ for the four existing Paths, items cited only from those Paths’ existing sources and articles.
  • No deploy, DNS, purchases or signups.

DO-330 ML toolchains, G-34/ARP6983 status, CDAO T&E, four listings, article linking

Three source-cited articles on remaining gaps. Four listings from official pages. Every article page now has a related-articles block and at least two related tool or framework links. No deploy.

  • Articles: DO-330 tool qualification for ML development and verification toolchains (FTP1055 12.2/TQL, FAA Order 8110.49A, MathWorks DO Qualification Kit does not prequalify); SAE G-34 / ARP6983 status from the live EUROCAE WG-114 table including companion ER drafts through 30 June 2027; CDAO Test and Evaluation of Artificial Intelligence Models Framework (April 2024), using live AI names and noting that SI T&E in that document means Systems Integration.
  • Listed MathWorks DO Qualification Kit (names DO-178C and DO-330), the CDAO T&E of AI Models Framework PDF (names DoD Ethical AI Principles and NIST AI RMF; not binding policy), CDAO JATIC (DoD/CDAO T&E software; no RAI/NIST tag), and HEART (MIT-licensed JATIC/ART extension for DoD T&E; no RAI/NIST tag). Left out AdaCore QGen (no ML-model assurance claim) and MAITE as a separate listing (LICENSE 404).
  • Internal linking: article template always renders Related on this site and Related articles in the main column (print-visible). Optional relatedToolIds / relatedArticleIds / relatedFrameworkIds on frontmatter. Validator fails if a page would have fewer than two tool/framework links or fewer than two related articles.
  • No deploy, DNS, purchases or signups.

EO 14434 explainer, SI terminology pass, third fact-check

Cited explainer on Executive Order 14434. Site voice uses Super Intelligence (SI), formerly called AI, only for current U.S. executive-branch policy. Official published names stay as printed. Three overstatements from the newest articles corrected. No deploy.

  • Article: Executive Order 14434 — Super Intelligence (SI) terminology for aerospace and defense teams. What Section 2(a) changes for new non-statutory executive-branch documents, and what Section 2(b) does not require altering: previously issued regulations, Presidential actions, contracts, grants, and other historical documents. Statutes stay at 15 U.S.C. 9401(3). Non-federal standards keep their published names.
  • Site voice: about, methodology, disclaimer, homepage, llms.txt, glossary, and the defense/space industry FAQs use Super Intelligence (SI) with a formerly-called-AI note when speaking about current U.S. executive-branch policy. Official names such as the FAA AI Roadmap, DoD Responsible AI, NIST AI RMF, and the EU AI Act stay as published.
  • Fact-check of 10 claims from the space, eVTOL, MRO and EO 14434 articles. Three corrections (before → after): (1) Section 2(b) quoted as “does not require the alteration of previously issued” historical documents → full list: previously issued regulations, Presidential actions, contracts, grants, or other historical documents. (2) Live NASA titles use Super Intelligence “after EO 14434” → live titles use Super Intelligence; the Order is the executive-branch website policy; we found no NASA sentence that names the Order. (3) Space/industry FAQs omitted “to the maximum extent permitted by law” → that qualifier is restored.

Space industry, three NASA/FAA/EASA articles, ProgPy and SWEHB listings, accessibility pass

Space industry landing from NASA, ESA and Space Force pages. Three source-cited articles. Two new listings plus a CycloneDX space tag. Keyboard, reduced-motion, article print styles, and axe-core tests. No deploy.

  • Articles: space systems and AI assurance (NASA SWEHB 7.25/8.25, ESA AISSA public pages, USSF FY2025 Data and AI plan); rotorcraft and eVTOL autonomy (FAA AC 21.17-4, FAA Safety Framework for Aircraft Automation, EASA SC-VTOL-02 with no AI/ML words found); AI in MRO and predictive maintenance (FAA Roadmap maintenance sentences, AC 43-218 IAHM with no AI words found, EASA-hosted ForMuLA research).
  • Added a space industry tag and /industries/space/ after those official pages named space systems, spacecraft software or Space Force data/AI governance. No MRO industry slug: AC 43-218 is already aviation health-management guidance.
  • Listed NASA ProgPy (PCoE names aeronautics and space exploration; no OSI badge) and NASA SWEHB topics 7.25/8.25 using the live Super Intelligence / SI titles. Those titles follow Executive Order 14434 (29 September 2026) and the White House fact sheet: executive-branch websites use SI in place of AI; historical documents need not be rewritten. Topic 8.25 writes “NIST SI RMF”, so that listing has no NIST AI RMF tag. Tagged CycloneDX space from the homepage satellite and space-systems sentence. Left out NASA IV&V (page does not name AI) and commercial eVTOL AI-assurance products (no official page named that use).
  • Accessibility: filters stay visible without waiting for JS; compare Open comparison is a disabled button until two tools are selected; prefers-reduced-motion; article print hides the aside and prints link URLs. Playwright axe-core covers every page template.

EU AI Act Service Desk, three articles, article feeds, rounds 8–10 fact-check

Official Commission Service Desk listed for the EU aerospace path. Three source-cited articles. RSS, Atom and JSON Feed for articles. Seven overstatements from rounds 8–10 corrected. No deploy.

  • Listed the EU AI Act Service Desk after the official home, Annex I and Article 108 pages named interactive compliance tools and civil-aviation law. The EU aerospace path also lists EASA RMT.0742, EUROCAE WG-114 and Article 43 as official resources.
  • Articles: ITAR/EAR and AI models (BIS and DDTC only); FedRAMP Certification versus DoD Impact Levels for AI SaaS; ISO/IEC 42001 versus ISO 9001 / AS9100 (ISO, IAQG, ANAB, UKAS, BSI).
  • Article feeds at /articles/rss.xml, /articles/atom.xml and /articles/feed.json. llms.txt and llms-full.txt list the new pages.
  • Fact-check of 30 claims from rounds 8–10. Seven corrections (before → after): (1) HMT title “Human-machine teaming requirements in DoD and NATO guidance” / description “actually require” → title without “requirements”, description “actually say”. (2) CUI path “implementation is paused in Phase 1 after the 13 July 2026 Phase II suspension; Phase I self-assessments remain in place” → three linked official clauses: Phase II suspended 13 July 2026; Phase I self-assessment requirements remain; implementation is paused in Phase 1. (3) Formal verification: “usable today as a property check” → “a property check… We found no official source that treats those ACAS Xu artifacts as certified airborne software.” (4) EASA data: “treats data as a first-class assurance object” → Issue 2 “places an emphasis on data management aspects and learning processes.” (5) RTA: “Later NASA papers treat Simplex as the ancestor of RTA used with untrusted controllers” → “Our reading of the 2024 NASA record… NASA later treats Simplex as an instance of RTA used with an untrusted controller.” (6) Hugging Face industries included “defense” → “cross-industry” only (Hub page does not name defense; CDAO toolkit still supports the DoD RAI framework tag). (7) ISO 42001 matrix cell attributed “Not a product-level assurance method” to the ISO catalog → catalog wording: rather than looking at details of specific AI applications, it manages AI-related risks and opportunities across an organization.

Static search, Paths, framework matrix, three articles, weekly freshness issue

Client-side Pagefind search built at build time. Four intent Paths. A framework comparison matrix cited only from explainer sources. Three articles. A weekly GitHub Action that reports quote drift and does not edit content.

  • Search at /search/ indexes tools, frameworks, articles and the glossary with Pagefind after the static build. Nothing is sent to an external search service. The header form is a GET; Pagefind JavaScript loads only when a query is present.
  • Paths: DoD contractor using AI with CUI; certifying ML in an aircraft system; ISO/IEC 42001 certification; selling AI into EU aerospace. Each has a short cited intro and links to existing pages.
  • Articles: Autonomy and DoD Directive 3000.09 explained; Runtime assurance and simplex architectures for ML in flight (NASA, ASTM F3269-21, 1998 IEEE Simplex paper); Human-machine teaming requirements in DoD and NATO guidance.
  • Framework comparison matrix on /frameworks/: scope, binding vs voluntary, certifiable or not, issuing body, date. Every cell URL is already on that explainer's source list.
  • Weekly GitHub Action runs check:freshness and opens or updates a single Freshness review issue listing any DRIFT. It does not rewrite listings.

Neural-network verifiers, model-card and SBOM articles, OSI open-source badge

Eight research and supply-chain listings added from official repos and pages. Three cited articles. An OSI-license badge and filter. Content schemas extracted and documented.

  • Added Marabou, nnenum, NNV, ERAN (ACAS Xu / aerospace pages), ART (DARPA acknowledgment), CycloneDX AI/ML-BOM, SPDX AI Profile, and Hugging Face Model Cards (named in the CDAO GenAI RAI Toolkit).
  • Left out α,β-CROWN and the archived TensorFlow Model Card Toolkit: official pages we fetched do not support an aerospace or defense listing.
  • Articles: formal verification of neural networks (tool docs and papers only); model cards and system cards for defense AI documentation; data provenance and SBOM/AIBOM citing CISA, NIST and NTIA.
  • Open-source badge and filter apply only when the official repo LICENSE or COPYING is an OSI-approved license. Inspect, Marabou, nnenum, ERAN, ART and CycloneDX qualify. Dioptra (CC BY 4.0), NNV (no license file) and SPDX (Community-Spec-1.0) do not.
  • Content schemas now live in src/lib/content-schema.ts. The README documents the content model. Behavior of existing tags and pages is unchanged.

Four practitioner articles, glossary index, tool audience and deployment fields

Cited answers to four practitioner questions, a /glossary/ index with DefinedTerm markup, and Who it's for / Deployment fields only where the vendor page states them.

  • Fixed mobile tap targets on article pages (table links, breadcrumbs, related-link lists and source lists) after the JSP 936 vs DoD article scored 96 accessibility on mobile.
  • Articles: Does the FAA certify AI today; which NIST SP 800-171 controls official pages actually discuss for AI tools that handle CUI (no invented ranking); EASA learning assurance and data sets; EU AI Act Article 73 vs public DoD RAI incident guidance.
  • New /glossary/ index harvests the glossary-article terms as individual anchors with DefinedTerm JSON-LD. Each term cites the same official source the article uses.
  • Tool listings gained optional Who it's for and Deployment (on-prem, air-gapped, SaaS) fields. Only HiddenLayer (air-gapped), Giskard (on-prem) and Resaro (on-prem and air-gapped) had vendor-page language that supported filling them. Other listings stay blank.

Launch checklist, newsletter research, sponsor kit, freshness check, two articles

Go-live steps written down but not executed. Newsletter providers compared from official pricing pages. A sponsor media kit with no invented numbers. A freshness-check script. Two source-cited articles.

  • docs/LAUNCH.md lists merge, Pages production branch, custom domain aigov.sparkysai.com, the Squarespace CNAME, Access removal, Search Console, Bing Webmaster, and a post-launch smoke test. None of those steps were performed.
  • docs/NEWSLETTER.md compares Buttondown, beehiiv, Mailchimp and Kit from their official pages (fetched 14 October 2026) and how each would replace the placeholder form. None were wired or signed up.
  • New /sponsor/ media kit: audience, what a labeled slot is, listing-policy rules, placeholder contact. No traffic figures or prices.
  • npm run check:freshness re-fetches every cited URL and every tool evidence quote and reports drift. It does not rewrite listings.
  • Articles: EU AI Act obligations for aerospace suppliers outside the EU; What auditors ask for in an ISO/IEC 42001 certification audit (accreditation and certification-body public pages only).

Outside-reviewer fact-check and verification log

Every listing re-checked against its cited page. Seven listings corrected, none removed, two added. Forty-four article and explainer claims spot-checked; six overstatements or stale names fixed.

  • Re-verified all 25 existing tool listings against the official pages they cite. Corrected Trustible, Vanta, Fiddler, Advai, LYNX MOSA.ic.AI, HiddenLayer and the CDAO toolkit listing. No listing was removed.
  • The live Tradewinds page now titles the CDAO resource the AIA Toolkit (released November 2023 as the RAI Toolkit). The current page no longer uses the minimum-viable-product label.
  • Added AI Practitioner's Handbook (official JSP 936 Part 2 guidance) and Resaro Approved Intelligence Platform (official TEVV / defence pages). No commercial page we fetched named NATO PRUAI, UL 4600, ISO/IEC 23894 or ISO/IEC TR 5469.
  • Spot-checked 44 claims, prioritizing CMMC Phase 2 suspension, EU AI Act dates after Regulation (EU) 2026/1744, ED-324 draft status, and must/required language. Split the AIR6988 / ER-022 publication dates and stopped treating the current toolkit page as still saying MVP.
  • Methodology now has a Verification log with the review date and the counts checked, corrected and removed.

Five frameworks, industry pages, printable checklists, two articles

Explainers for ISO/IEC 23894, ISO/IEC TR 5469, UK MOD JSP 936, NATO Principles of Responsible Use of AI, and UL 4600, plus industry landings and printable cited checklists.

  • Framework explainers for ISO/IEC 23894, ISO/IEC TR 5469, UK MOD JSP 936, NATO PRUAI, and UL 4600. Each has a Last reviewed date and official sources.
  • Those frameworks appear in the tool filters. No listed product page named them, so the filter pages list official documents and stay indexable.
  • Industry landing pages for aerospace, defense, and safety-critical (rail, automotive and medical as context only).
  • Printable /checklists/ page: AI audit evidence items and CMMC + AI items, each with a source citation and print CSS.
  • Articles: UK MOD JSP 936 vs DoD Responsible AI; ISO/IEC TR 5469 and IEC 61508 for ML components.

Compare view, listing policy, OG cards, and two articles

A client-side compare table, placeholder suggestion flow, build-time social cards, and two source-cited articles on red-teaming and GSN/AMLAS.

  • Compare two or three listings from cited directory fields. /compare/view/ query URLs are noindex.
  • Suggest a tool is a disabled form and an unmonitored mailto placeholder.
  • Listing policy states that sponsors do not affect which tools are listed or how they are tagged.
  • Each page type has a 1200 by 630 Open Graph and Twitter image generated at build time.
  • New articles: AI red-teaming requirements for defense programs (DoD/CDAO/NIST only); Building an AI assurance case (GSN/AMLAS) for certification.

FAA and SAE G-34 filter pages, three articles, and this changelog

Official documents now fill the FAA Roadmap and SAE G-34 tool filters. One G-34-tagged listing was added. Three source-cited articles and this updates feed landed the same day.

  • The FAA AI Safety Assurance Roadmap filter lists official FAA documents and working-group pages. No product page we checked names that roadmap, so no tool is tagged for it.
  • The SAE G-34 filter lists official EUROCAE WG-114 and SAE pages, plus Re:In (Moasoftware), whose page names ARP6983 / ED-324 sections 6.2 to 6.5.
  • Both framework filter pages stay in the sitemap once they have that official content.
  • New articles: CMMC Level 2 vs Level 3 for AI systems; mapping an AI model to DO-178C / DO-330 tool qualification; NIST AI 600-1 for defense contractors.
  • Every framework explainer now shows a Last reviewed date and a Sources list.
  • This /updates/ page and its RSS feed record directory changes.

Directory expansion, filter tests, and site-wide schema

More verified tool listings, three starter articles, and Organization, WebSite and BreadcrumbList JSON-LD on the static pages.

  • Added verified listings including Holistic AI, ModelOp and Monitaur, each tagged only from a cited public page.
  • Added articles on the aerospace-defense glossary, DoD RAI Toolkit vs NIST AI RMF, and EASA AI concept-paper levels.
  • Playwright coverage for the /tools/ filters on desktop and a mobile viewport.
  • Organization and WebSite JSON-LD on every page; BreadcrumbList on inner pages.

Pre-launch preview of the directory

First public-source snapshot: framework explainers, a cited tool directory, and starter articles. The site is not live.

  • Framework explainers for ISO/IEC 42001, NIST AI RMF, the FAA AI Safety Assurance Roadmap, DO-178C / DO-330, SAE G-34, CMMC / NIST SP 800-171, DoD Responsible AI, the EU AI Act, and the EASA AI Concept Paper.
  • Tool listings only where a public vendor or publisher page could be quoted.
  • Starter articles with every factual claim linked to a source.
  • llms.txt, sitemap, robots.txt, and an informational disclaimer.

Questions

Is this changelog a corrections log?

It is the public record of what changed, including fact-check corrections summarized in each entry. A separate submissions process will be published at launch; none is open yet.

How do I subscribe?

The same entries are published as RSS at /updates/rss.xml. Article-only feeds are on the articles index.

Free next step: take the AI assurance readiness self-check or create a free account. Quoted evidence stays on Pro.