Release Notes
Public GAISSF v1.0 publication reproduced as accessible HTML from the final source document.
GAISSF™ v1.0
Release Notes
Version Communication, Change Disclosure and Compatibility Record
| Field | Value |
|---|---|
| Document ID | GAISSF-NOR-007 |
| Framework release | GAISSF™ v1.0 |
| Document version | 1.0 |
| Status | Final Publication v1.0 |
| Classification | Normative release record; explanatory commentary informative |
| Publisher | ODA3 Institute |
| Legal entity | ODA3 Pvt Ltd |
| Release date | 1 July 2026 |
| Control baseline | 59 controls across nine domains |
This document communicates the controlled GAISSF v1.0 release baseline and records material changes, compatibility impacts, corrections, known limitations and migration expectations.
Document Control
| Attribute | Controlled value |
|---|---|
| Title | GAISSF™ v1.0 Release Notes |
| Document ID | GAISSF-NOR-007 |
| Version | 1.0 |
| Purpose | Version communication and controlled disclosure of release changes |
| Applies to | GAISSF-NOR-001 through NOR-006 and downstream GAISSF artifacts |
| Normative authority | Normative for release status, supersession, compatibility classification and migration notices |
| Precedence | GAISSF-NOR-001 remains the authoritative source for framework requirements |
| Distribution | Public — Website and GitHub |
Copyright, Licensing and Legal Notices
© 2026 ODA3 Pvt Ltd. Published market-facing by ODA3 Institute.
GAISSF™ is used as a framework mark. Third-party names and marks remain the property of their respective owners.
These release notes do not constitute legal, regulatory, certification or implementation advice.
Where a release note conflicts with a normative requirement in GAISSF-NOR-001, GAISSF-NOR-001 prevails.
Foreword
Release notes are a controlled part of standards governance. They provide users, assessors, certification bodies, tool developers and regulators with a concise record of what changed, why it changed, what did not change, and whether migration action is required.
1. Release Identification
| Item | Release value |
|---|---|
| Release name | GAISSF™ v1.0 |
| Release type | Initial public major release |
| Normative baseline | 59 controls across D1-D9 |
| Foundational scope | 52 canonical controls in D1-D8 |
| Operational scope | All 59 controls |
| Optimized scope | All 59 controls plus continuous monitoring |
| Sector profiles | Additive and separately controlled |
| Primary normative source | GAISSF-NOR-001 |
| Control library | GAISSF-NOR-004 |
| Terminology authority | GAISSF-NOR-005 |
| Bibliographic authority | GAISSF-NOR-006 |
2. Executive Release Summary
GAISSF v1.0 establishes the initial controlled release of the Global AI Security & Safety Framework. It provides a 59-control baseline across nine domains, a 52-control Foundational scope, full Operational and Optimized scopes, evidence requirements, assessment expectations, certification considerations, implementation guidance and controlled terminology.
This release also closes an editorial reconciliation issue that had temporarily produced incorrect downstream drafts containing 45 controls. Those drafts are superseded. The authoritative v1.0 baseline remains 59 controls.
3. Release Contents
| Document | Title | Release role | Status |
|---|---|---|---|
| GAISSF-NOR-001 | Framework Standard | Authoritative normative source | Released |
| GAISSF-NOR-002 | Executive Summary | Executive interpretation | Released |
| GAISSF-NOR-003 | Quick Start Guide | Implementation onboarding | Released |
| GAISSF-NOR-004 | Control Catalogue | Single 59-control library | Released |
| GAISSF-NOR-005 | Glossary | Controlled terminology | Released |
| GAISSF-NOR-006 | Bibliography | Controlled references and citations | Released |
| GAISSF-NOR-007 | Release Notes | Release communication and change record | This release |
4. Control Baseline
| Domain | Control range | Count | Foundational status |
|---|---|---|---|
| D1 | D1-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D2 | D2-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D3 | D3-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D4 | D4-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D5 | D5-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D6 | D6-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D7 | D7-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D8 | D8-CTL-01 onward | As defined in NOR-001/NOR-004 | Included |
| D9 | D9-CTL-01 through D9-CTL-07 | 7 | Additional mandatory where physical AI or cyber-physical actuation is within scope |
| Total | D1-D9 | 59 | 52 included; seven controlled exclusions |
5. Material Changes and Corrections
| Change ID | Change | Reason | Impact | Required action |
|---|---|---|---|---|
| RN-001 | 59-control baseline confirmed across all normative artifacts | Reconcile downstream documents with authoritative source | High | Use only corrected 59-control editions |
| RN-002 | Foundational scope fixed at 52 canonical controls in D1-D8 | Close scope ambiguity | High | Update SoA, schemas and assessor materials |
| RN-003 | Seven D9 controls confirmed as additional and conditionally mandatory where physical AI or cyber-physical actuation is in scope | Preserve physical-AI control architecture | High | Apply D9 when scope includes physical AI or when profile requires it |
| RN-004 | Operational scope confirmed as all 59 controls | Ensure full control coverage | Medium | Update certification and assessment profiles |
| RN-005 | Optimized scope confirmed as all 59 controls plus continuous monitoring | Separate enhanced monitoring from control count | Medium | Update maturity and monitoring claims |
| RN-006 | Earlier 45-control drafts superseded | Correct erroneous reconstruction | Critical | Remove from publication and internal use |
| RN-007 | Glossary and bibliography established as controlled sources | Improve terminology and source consistency | Medium | Use NOR-005 and NOR-006 identifiers in downstream artifacts |
6. Superseded Materials
Any GAISSF-NOR-001, NOR-002, NOR-003 or NOR-004 draft that states or implies a 45-control baseline is superseded and SHALL NOT be used for implementation, assessment, certification, training, tooling, public claims or crosswalk development.
| Superseded artifact class | Superseding basis |
|---|---|
| 45-control Framework Standard drafts | Corrected GAISSF-NOR-001 |
| 45-control Executive Summary drafts | Corrected GAISSF-NOR-002 |
| 45-control Quick Start Guide drafts | Corrected GAISSF-NOR-003 |
| 45-control Control Catalogue drafts | Corrected GAISSF-NOR-004 |
| Derived spreadsheets, schemas, test plans or crosswalks using 45 controls | 59-control source baseline and downstream reconciliation |
7. Compatibility Classification
| Classification | Meaning | v1.0 applicability |
|---|---|---|
| Backward compatible | No change required to conforming implementations | Not applicable to the 45-to-59 correction |
| Conditionally compatible | Existing implementation remains usable after targeted updates | May apply to artifacts already based on 59 controls |
| Breaking | Scope, identifiers, evidence or certification outcomes may change | Applies to any artifact built on the incorrect 45-control set |
| Editorial | No semantic change to requirements | Applies only to formatting, references and non-substantive corrections |
8. Migration Requirements
- Organizations that created a Statement of Applicability, assessment record, control mapping, training artifact, tool configuration, or public claim using a superseded 45-control draft SHALL reconcile that artifact to the authoritative 59-control control register.
- Foundational implementations SHALL verify coverage of the canonical 52-control scope.
- Operational implementations SHALL assess all 59 controls.
- Optimized implementations SHALL assess all 59 controls and continuous-monitoring expectations.
- Assessment and certification bodies SHALL update sampling plans, evidence matrices and report templates.
- Tool vendors SHALL update schemas, control IDs, APIs, dashboards and validation tests.
- Training providers SHALL remove obsolete 45-control references from courseware and examinations.
- Crosswalk owners SHALL revalidate every mapping affected by missing controls.
- Public claims based on superseded drafts SHALL be corrected or withdrawn. No migration action is required solely because an organization is adopting GAISSF v1.0 for the first time from the authoritative publication set.
9. Known Limitations
- This release does not itself provide accreditation of certification bodies.
- Sector profiles remain additive and may introduce further obligations.
- Cross-jurisdictional legal applicability requires context-specific analysis.
- No certification or conformance result guarantees security, safety, legality or absence of harm.
- Some external standards referenced by GAISSF are subject to copyright and licensed access.
10. Notably Absent
- No controls were intentionally removed from the authoritative 59-control framework.
- No renumbering of the 59 controls was approved.
- No reduction of the Operational or Optimized scope was approved.
- No claim of equivalence with ISO, IEC, NIST, OWASP, MITRE, CIS or regulation is introduced by this release.
- No certification guarantee or regulator endorsement is asserted.
- No universal implementation deadline is prescribed.
11. Release Governance
- Each GAISSF release SHALL have a unique version identifier and publication date.
- Release notes SHALL identify material changes, superseded artifacts, compatibility impact and migration action.
- Breaking changes SHALL require a major-version increment unless an emergency correction is approved through controlled governance.
- Editorial corrections MAY use a patch version where no requirement meaning changes.
- A source-reconciliation defect affecting control count, scope or certification SHALL be treated as material.
- Release notes SHALL preserve a record of what did not change.
12. Verification Checklist
☐ All published documents state 59 total controls.
☐ Foundational scope states 52 controls.
☐ Operational scope states all 59 controls.
☐ Optimized scope states all 59 controls plus continuous monitoring.
☐ All 45-control drafts are marked superseded.
☐ Control identifiers match NOR-001 and NOR-004.
☐ Glossary terms match NOR-005.
☐ Citations and source identifiers match NOR-006.
☐ Training, assessment, schemas and crosswalks have been impact-assessed.
Annex A — Change Classification Template
| Field | Required content |
|---|---|
| Change ID | Unique release-note identifier |
| Artifact | Affected document, schema, test or tool |
| Change type | Breaking, compatible, conditional, editorial or deprecation |
| Description | Concise statement of what changed |
| Reason | Decision basis |
| Normative impact | Requirement, scope, evidence, certification or none |
| Migration action | Required user action |
| Effective date | Date change takes effect |
| Verification | Evidence that downstream updates are complete |
Annex B — Release Record
| Release | Date | Type | Summary | Status |
|---|---|---|---|---|
| GAISSF v1.0 | 1 July 2026 | Initial major release | 59-control baseline; 52-control Foundational scope; full normative and supporting document set | Final Publication v1.0 |
Controlled Profile Reconciliation Notice
The Foundational profile comprises the 52 canonical controls in D1-D8. The seven D9 controls are additional mandatory controls whenever physical AI or cyber-physical actuation is within the assessed scope.
Any earlier wording that described the Foundational profile as spanning all nine domains, or that treated D9 as universally mandatory or universally excluded, is superseded by this statement. D9 applicability shall be determined and justified for every assessed scope.
Release Communication Package
| Audience | Required communication |
|---|---|
| Implementers | Changed requirements, migration actions and effective date. |
| Assessors | Sampling, evidence and compatibility impact. |
| Tool vendors | Schema, identifier and validation changes. |
| Certification stakeholders | Scope, transition and claim implications. |
| Public users | Plain-language summary and superseded-material notice. |
Release Acceptance Checklist
- All artifacts carry the correct version and status.
- Control counts and profile statements are consistent.
- Changes have an owner, rationale and compatibility classification.
- Superseded files are removed from active publication paths.
- Migration and validation instructions are available.
The Foundational profile comprises the 52 canonical controls in D1-D8. The seven D9 controls are additional mandatory controls whenever physical AI or cyber-physical actuation is within the assessed scope.
Publication Completeness and Intended Use
This full publication edition of GAISSF-NOR-007 is designed to stand on its own for its stated role: authoritative version communication and release-impact notice. It includes purpose, scope, governance, operating guidance, evidence expectations, limitations, decision criteria and reusable records appropriate to that role.
Completeness does not mean that the document replaces the normative control statements, applicable law, sector-specific engineering, organizational procedures or professional judgement. Cross-referenced GAISSF documents remain part of the controlled document system.
| Completeness dimension | Treatment in this edition |
|---|---|
| Normative alignment | Reconciled to the authoritative 59-control baseline and controlled profile structure. |
| Operational usability | Includes roles, workflows, gates, evidence, metrics, escalation and examples where relevant. |
| Traceability | Identifies dependencies and preserves the distinction between requirements, guidance and examples. |
| Limitations | States what the document does not establish or guarantee. |
| Maintenance | Includes review triggers, change control and publication status. |