Framework currency and versioning
Every defensible assessment identifies the framework or legal snapshot used. A later publication, law, guidance document or product methodology must not silently rewrite an earlier conclusion.
What to record
Section titled “What to record”- Framework and methodology name and version.
- Legal “as of” date where applicable.
- System and model version.
- Assessment and evidence cutoff dates.
- Assessor and reviewer.
- Pending changes and next review trigger.
Source order
Section titled “Source order”Use authoritative primary sources: enacted law and official journals for legal obligations; publisher or canonical repository for frameworks; a licensed copy for ISO standards. Secondary summaries can help navigation but should not replace the source relied upon.
Current documentation basis
Section titled “Current documentation basis”| Module | Basis represented in these guides | Currency treatment |
|---|---|---|
| GTSAF | Gamut’s 358-control trust, security and assurance framework | Record the Gamut catalogue/version used. |
| ACRS | Four-dimension capability-risk method | Record the calculation and routing-method version. |
| MAESTRO | CSA agentic AI threat-modelling framework | Recheck the CSA publication when its catalogue changes. |
| ATF | Specification 0.9.1 and Conformance 0.9.0, Public Review Draft | Show draft status and exact version in conclusions. |
| NIST AI RMF | NIST AI RMF 1.0 and applicable Profiles | Identify the RMF and Profile publication used. |
| EU AI Act | Regulation (EU) 2024/1689 and the module’s stated legal snapshot | Check the Official Journal and adopted amendments before live legal conclusions. |
| NAGF | Consolidated Nigerian current-law, sector, policy and readiness model | Verify every relied-upon official source at the evidence cutoff. |
| ISO/IEC 42001 | ISO/IEC 42001:2023 | Use a licensed copy and record edition. |
| ISO/IEC 42005 | ISO/IEC 42005:2025 | Use a licensed copy and record edition. |
Legal currency note, 21 July 2026
Section titled “Legal currency note, 21 July 2026”The public documentation was rechecked on 21 July 2026 against the Official Journal text of
Regulation (EU) 2024/1689, current
European Commission implementation material, the
Nigeria Data Protection Act 2023 and official Nigerian AI
strategy material published by NCAIR/NITDA. The EU module retains its displayed
EUAIA-2026-07-16-defensible-system-scope identifier so the guide matches the implemented
assessment. Political agreement, proposed amendments and draft guidance are not silently treated
as enacted law.
This check is not legal advice and does not replace verification at the assessment date.
Change procedure
Section titled “Change procedure”When a source changes, determine whether it affects wording, applicability, scoring, evidence or the conclusion. Update methodology identifier and catalogue together where required. Keep the earlier assessment reproducible, mark affected systems for reassessment and record the change basis.