Framework control shows the Framework you just adopted
Hovering leaves Notifications unread
Events can be planned ahead
Errors show an error page
Compliance has its own CLI
Status badges coloured on lists
Badge words keep one colour
Coming up rows fit their list
An Event cannot be dated in the future
Frameworks listed by name everywhere
Applicable Requirements show a green badge
Coming up stacks repeated Tasks
Page titles sit centred in their header
Every scrolling panel shows it scrolls
Overview shows what needs attention
Task page shows its record
Allowance page address survives License step
Links to records work again
The Owner holds undelegated tasks
Overview names overdue unheld tasks
Workflow tabs show hover and locked colours
Badges show their colours
Opening a Requirement decides nothing
Faster Findings list
Review Tasks follow a new Owner
Settings refuse empty values
Editor toolbar reads in Dutch
Guides name the mvdm CLI
Find an Asset by its external reference
Table toolbar sits in one row
Faster Asset changes for big Custodians
Errors and Imports follow your language
Dutch Kind label reads Soort
Four messages show current wording
Hovering a link keeps your filters
Faster Dutch pages, two buttons reworded
Assets start from a template
Assistant keeps answering after updates
New Incident links to its template
Default content lists every starting text
Incidents start from a template
Incidents get an External link
Editing a template keeps its settings
Approve and acknowledge from your row
Roles are given from the Person
Panels show who was not asked
Unread Notifications now stand out
Hovering a Notification keeps it unread
Add target keeps your chosen list
Notifications list ends after its rows
Party requirements readable on laptops
Person email addresses fit
Edit affected assets button fits
Add holder picker says what to do
Saving a draft keeps your way back
Reject and Reopen conflicts explained
Comments on every Edit page
Upload errors speak your language
Picker lists keep the form still
Assistant panel opens again
Owner pickers fit narrow columns
Finishing a Task takes you back
Record a Meeting by hand
Training Matrix stays compact
Place images in your text
Allowance stays with Commonplace
Rewrites keep your formatting
Empty allowance replaces the message box
External link replaces the Jira integration
Side questions leave Gap analysis sessions
Assistant notices follow your language
Closed sessions start a new conversation
Assistant answers about Tickets and Cadences
Assistant files documents on Roles
Import upload drops Anthropic notice
Only Owners cancel the License
Ticket sync stops for leavers
Schedules replace Evaluations and Tests
Comments show while you edit
Comments stay on long texts
File evidence link opens the Task
Disabled buttons look disabled
Agent setup guides move to /agents
Tidier line breaks in text
Setup guides for your Agent
MCP server for your Agent
API reference lives at /api
Install the compliance CLI
REST API for your own Agent
Assistant does every page action
ISO 9001:2026 edition arrives
Risk template, status, and category
Admin Conversations sorts by header
Import page list matches other tables
Applicability list becomes a table
Asset review lists become tables
Frameworks now read in Dutch
Settings tabs become their own pages
Ticket block leads with Create
Assistant panel drops summary notes
Copy link on every shared conversation
Assistant allowance back in Settings
Assistant opens what you started
Legal has its own menu entry
Task mail can be switched off
Ticket creation shows progress
One shared Assistant allowance
Judgments on Conversation Details
Dutch Arbo is now adoptable
Assistant search shows the mention
Account User on People
Email Owners at spending limit
Invite People from More actions
Role Details lists holdings
Packs show excl. tax
Opportunity Event Targets and Objectives
Automatic Ticket sync follows Jira
Details pages load Tickets
Jira Tickets for Vulnerabilities
Assistant decides faster before replying
Cached prompts billed once
Titles name what you asked
Jira connect stays when unset
Admin Conversations show Spend
Connect Jira by signing in
Share a Member conversation
Connections hosts Jira setup
Event Details lists stay live
Auto-topup buys Allowance packs
Jira Tickets for Findings
Vulnerabilities name Discovered during
Task mail is not repeated
Clear filters empties Table search
Pack buttons open checkout
Send names exhausted allowance
Left icon bar no longer shaded
Failed sign-in tries again
Pack buys look like buttons
Asset access review per Asset
Instants use your Timezone
Planning keeps finished work
Approval is one kind
Procedures has its own icon
Framework context in the header
Policies name their own approvers
Assignees get daily Task mail
Allowance packs sold in dollars
Opportunities sit after Risks
Linked items sit in columns
Requirement Edit keeps columns
Play reply sits top-right
Task Edit keeps the right column
Add comment keeps its outline
Comments no longer add bullets
Long Source stays readable
Overview hides others' assigned work
Other open tasks includes undated work
Party Requirements sit higher
Tool activity is one sentence
Archive cancels live attestation
Other open tasks stays residual
Closed-license clean-up completes
Meetings and gap analyses open wide
Assistant lookups list valid names
Resume no longer starts lookups
Edit keeps the right column
Meeting session hears the room
Account choice is at Auth
Voice follows spoken language
Meeting sessions with the Assistant
Checks moved under System
Planning filters and stacked months
People selection survives a refresh
Assistant panel gives back space
BIO2 is now adoptable
Draft expand opens the conversation
Compliance fits narrower screens
Comment notification emails get a design
Review covers Awareness
Requirement pages stay live
Pages keep loading during updates
Admin refusals answer 403
Asset Review per Custodian
Continuity Plans with tests cannot be removed
Edit forms keep their dates
Title band spans the Sheet
Dock and Rail follow your language
Your agreement on the Legal page
A clearer legal agreement page
Agree before using Compliance
Onboarding starts on Overview
Last updated opens history
Owner asked on one row everywhere
Awareness audience matches Owner
Search the requirement and link pickers
Title and Body on the left
Wide tables stay on Edit
Panels use your browser's scrollbar
Owner and Audience on the document lists
Select all on People
Choose an Account on first open
Next action outline is complete
Set Awareness on Edit
Awareness names who must read
Evaluations and Tests hold clocks
Planning shows the year's work
Title first; actions stay right
Title band stays put; Save lives there
Frameworks catalog is a table
Find anything from the header
One header identity menu
Long conversations stop moving the page
Scrolling panels show they scroll
Accept starts a working conversation
Checks sit next to Tasks
You can speak to the Assistant
Settings save as you change them
The left dock names its sections
Title bands drop their description
Evidence download is a button
A new look and navigation
You can buy Compliance
You can edit Comments
Supplier Review follows Criticality
Overview names your next action
Comments notify owners and Mentions
Event Comments return to Event Details
Party Requirements have no Comments
Comments on a Phrase
Assistant reads whole documents
Send stays on screen
Assistant answers after reading
Pages keep their full height
Create follows Cadence holds
Conversation titles stay short
Assistant finds phrases
History stays readable
Record pages stay live
Changelog lists every Changelog Entry
Assistant runs only on xAI
Grok chats finish after tools
Archive and exclude stop Review
Evidence stays editable after Done
Pages look and work again
Continuity test dates follow the record
A Person identity needs an email
Reopen starts the walk again
Stop on an idle chat does nothing
Skipped Import pages stay unmarked
Import Continue follows failed pages
Scope is only there when you wrote it
Event targets stay on four kinds
Coverage cannot attach to an excluded Requirement
Requirement status is maturity only
Finding and Vulnerability state is the live step
A spawned Task is about one record
Return needs a real owner
Gap analysis names a Framework
Chat files stay put
Interrupted chat can continue
Assistant can search the web
Five more Details pages match
Cadence settings and opt-out
Dutch too-large conversation
Account picker Confirm works
Type to find growing lists
Dutch reads as native domain Dutch
Assistant plans before acting
Depart date starts today
Attach CSV in Assistant
Changelog list uses table rows
Tasks return after complete
Choose Assistant model per chat
Approvers skip Policy Awareness
Changelog layout fills the screen
Changelog in the app
Assistant composes one stored-record query
Creating or reworking a register records a Review
Tasks can be edited
History names who made each change
Tables you write line up with their headers
History shows what each Snapshot changed
Record rows that already ended
Retired assets stop asking reviews
Search keeps your cursor
Linked records show names
Finding Source names the record
Approval stays across ordinary edits
Requirement Details open again
Role-owned docs open attestation
Result fields keep the caret
Details tables look consistent
Workflow card and near-due tasks
History shows Current content
Filter selects stay open
Edit side column uses full form height
Procedure and Policy Edit side panels
Readable capped choice lists
Roles as owners
Interested Party register
Coverage proposals after adopt
Correctable register dates
Incident response timeline
Requirement Edit layout
Task state stays independent
Asset owner and custodian
Safer deletes for findings
Snapshot history everywhere
Mark Departed for people
Simpler People and Suppliers
Form errors stay on page
Departure transfers work
Event sign-off removed
Assistant historical dates
Reviews from review tasks
Assistant bulk-friendly tools
Reject or reopen Findings
Assistant accepts Word files
Person merge and identities
Smarter Assistant conversations
Tasks Related to filter
Import keeps history
Workflow as locked tabs
Richer Tasks register
Faster Assistant send
Assistant matches the UI
Full-page Assistant chat
Framework gap analysis
Procedures first-class
More regulation catalogs
Cyber Essentials catalog
Business Issue register
Policy approval and awareness
Filters you keep
Objectives and KPIs
Import v2 control surface
Live Policy and Scope
Policy and Scope replace Document
Details and menu redesign
Assistant admin oversight
Multilingual Assistant
Compliance Assistant
Unified Requirements page
App renamed Compliance
Import review redesign
Events and Findings model
Central Tasks system
Multi-framework navigation
Operations registers
Risks and Evidence
Policies and Controls
Accepting a Risk pauses its Risk Review
When you accept a Risk, its Risk Review now pauses: the open Review task is cancelled, no new one is scheduled, and Risk Details shows no next review date. This holds whether you accept it with the Accept button, in Edit, through the Assistant, or through the API. Reopening the Risk resumes Risk Review one Cadence after its last completed Review. Risks accepted earlier have their open Review task cancelled, and the Accept confirmation now says Risk Review stops.
Supplier frameworks for BIO2 and NIS2
Frameworks now lists BIO2 for suppliers (2026), NIS2 for suppliers, and NIS2 Netherlands for suppliers (Cbw, 2026), in English and Dutch. Each lists what BIO2 and NIS2 make your customers demand of you as a supplier, written as what you do or deliver, with the source code on every Requirement, such as 5.20.03. Adopting costs nothing extra on an account that already has BIO2 or NIS2, and work you already linked in BIO2 or NIS2 is proposed as coverage on the supplier version and the other way round.
ISO 9001 subclauses
ISO 9001:2015 and ISO 9001:2026 now give each titled subclause its own Requirement, such as 8.5.2 Identification and traceability and 9.2.2 Internal audit programme. ISO 9001:2015 has 58 Requirements and ISO 9001:2026 has 57. Your existing work carries over: the old Requirement becomes the first subclause with its comments and history, and every other new subclause starts with the same status, owner, narrative, applicability, coverage and review schedule.
Supplier reviews read as entries
On a Supplier's Supplier reviews tab, each review is now an entry: the date, reviewer, Outcome, Next due and Edit sit on a line that wraps when the page is narrow, with the Review body below it at the full width of the tab. Before, the reviews were a table that scrolled sideways, squeezed the Review body into a strip of one or two words per line, and hid the Review body and Next due off-screen on a 1280-pixel window.
Training shows each course's Cadence
On the Training page, the Cadence of each course now reads Repeats or One-shot. Before, stray text followed it, such as "Repeats else { — }".
A Voice Call names itself
Start Voice Call now starts the call at once, with no title to type. The Assistant names the call from its first three messages, or at the end of the call if it ends sooner, in your account's Content language, and the new title shows in the conversation switcher while the call is live. Before, you had to type a title into a dialog before you could talk, and a call that cannot start now shows its reason as a notice in the panel.
Assistant reads a Task's Requirement
The Assistant can now show the Requirement a Task is linked to, so asking it to go through your open Tasks together with what each is about is answered in one go. Before, it failed with a tool error on any Task linked to a Requirement and fell back to a plain list of Tasks. The same fix applies to the REST API and MCP when they expand a Task link's Requirement.
The Assistant speaks in your voice
Read-back now reads a reply aloud in the Assistant voice you picked on User settings, so two members who play the same reply each hear their own. A Voice Call speaks in the host's voice, fixed when capture first starts and kept for the rest of the call. Before, everyone heard the same voice, and Aurora now replaces it for anyone who has not picked.
Cyber Essentials (2026) follows v3.3
Frameworks now lists Cyber Essentials (2026), written from NCSC's Requirements for IT Infrastructure v3.3 (April 2026), in English and Dutch. It adds that cloud services must be in scope, says FIDO2 authenticators count as multi-factor authentication, and has Cyber Essentials Plus retest a new random sample after a failed update check. Adopting it costs nothing extra on an account that already has Cyber Essentials. Cyber Essentials (2025) stays and now says it follows v3.2, April 2025; its Malware protection no longer offers sandboxing, which NCSC does not accept.
The message box keeps your cursor in view
When your Assistant message is long enough that the box scrolls, the box now stays where your cursor is while you type, paste, or edit. Before, it jumped back to the top after each key press, so you typed without seeing the line you were writing.
Role tab reads Accountable for
The middle tab on a Role's Details page reads "Accountable for" in English again, matching the Dutch "Verantwoordelijk voor". Since the Details pages moved into tabs it had read "Holdings", so the two languages named the same list differently. Links saved to that tab keep working.
Task results ask before you leave
A Task's result now has one button: Mark done, or Complete all on an Asset access review. Save draft is gone, and on a Done Task the button now reads Save. If you have typed a result, picked an outcome, or entered a date and try to leave without submitting, Compliance asks first. Before, following a link such as "File evidence on the task →" threw away what you had typed.
Change the kind of an Event
You can now fix an Event recorded under the wrong kind, on its Edit page, through the REST API, and by asking the Assistant. The Event gets the next code of its new kind, keeps its Findings, Targets, Comments, and Tasks, and drops only what the old kind alone carried, such as a Meeting's attendees. Sending an empty `attendees` to the API now clears a Meeting's attendees, as the API reference already said.
Unadopting a Framework clears its Requirements
When you unadopt a Framework, its Requirements now leave your Policies, Procedures, Scope, Risks, Objectives, KPIs, Business Issues, Interested Parties, and Opportunities, along with the counts, the Requirement pickers, and the API. This also applies to a Sub-framework that unadopts with its parent or when you remove its country. Before, they stayed behind, pointing at Requirements you no longer held; those leftovers are cleaned up, and a Framework you adopt again starts with no covered Requirements.
The message box fits after resizing
The Assistant message box now resizes to fit your text when you widen, narrow, or unfold the panel. Before, it kept its old height until your next keystroke: mostly blank after Widen, and hiding text with no scrollbar after Narrow or after unfolding a panel you had resized the window behind.
Deleted chats leave no draft
When you delete an Assistant conversation, the text you had typed and the files you had attached to it are deleted with it. Before, after an update the new empty conversation could open with that old text in its message box. If the delete fails, your text stays.
Pages reconnect after an update
When Compliance is updated while a page is open, the page now reconnects by itself and catches up. The Assistant panel shows a reply that finished meanwhile and stops showing the Assistant as working, and keeps the text you were typing and the files you had attached. Before, the page went quiet and only a reload brought it back. Record pages also show other people's saves again.
The message box grows as you type
The Assistant message box now grows with what you write, one line at a time, up to a third of the window's height. Past that it scrolls inside itself, and the send button and the conversation stay in view. It shrinks when you delete text and goes back to two lines after you send. Pasted and dictated text make it grow the same way.
The Assistant runs on Grok 4.7
The model select under the message box is gone, and every new conversation, including a Topic Split, a Gap analysis session, an Import, and a Check result you accept, runs on Grok 4.7. A conversation you started on Grok 4.6 or Grok 4.5 keeps answering on that model. A conversation on a model that is no longer offered, such as Sonnet 5, now says so in place of the message box and offers a New conversation button; the API and the Assistant's send_to_assistant tool refuse a message to it with the same sentence, and they ignore a model they are sent.
Risk Status offers Accepted and Closed on Edit
A Risk's Edit page now lists all five statuses, so you accept or close a Risk, or move an Accepted or Closed Risk back to Open, Treating, or Mitigated, where you change everything else. Picking Accepted or Closed shows Accepted on or Closure date, filled in with today and open to change. Closing pauses the Risk's review and moving it out of Closed resumes it. The Assistant's update_risk tool and the API's PATCH do the same, create_risk can record an already Accepted Risk, and the separate accept, close, and reopen tools and API endpoints are gone.
Details pages switch sections with tabs
Every Details page now shows its sections as tabs beside the page instead of stacking them under the description. Each tab shows its count, an amber dot when it holds open work, and is greyed out when empty, and the address remembers the open tab. Reject, Accept risk, and Mark false positive now sit in the Workflow tab, and Comment links from Notifications open the Comments tab at that Comment.
Risk Status comes first
On a Risk's Edit page, Status is now the first field in the right column, above Category, so changing where a Risk stands no longer means looking down the form. On the New Risk page, Status now comes right after Title. Picking Closed, Accepted, or Mitigated still shows the closure date, the accepted date, or the residual scores further down the form, as before.
ISO 9001 7.1.5 relates to resources
ISO 9001 7.1.5, Monitoring and measuring resources, now relates to the Requirements about resources, such as ISO 27001 7.1, in both ISO 9001:2015 and ISO 9001:2026, and shows them as Partial. Before, it was linked to the performance-evaluation Requirements, such as ISO 27001 9.1 and SOC 2 CC4.1, as Equivalent, so covering one of those could be proposed as covering calibration of measuring equipment. Proposed coverage no longer offers that, and now proposes 7.1.5 from the resource Requirements instead.
ISO 9001:2026 internal audit note fixed
The ISO 9001:2026 Framework description, in English and Dutch, no longer says the edition subdivides internal audit. Clauses 9.2.1 and 9.2.2 already existed in ISO 9001:2015; what the 2026 edition changes is that both now carry titles, and the description now says so. The rest of the description, and every Requirement in the Framework, stays as it was.
Review Outcomes read as phrases
A Supplier review's Outcome now shows as a label instead of its stored name: "Continue with conditions" (Dutch "Doorgaan onder voorwaarden") where it used to read "ContinueWithConditions", and "Doorgaan" and "Beëindigen" in Dutch. The labels appear in the Reviews table on the Supplier's page and in the Outcome choice on Record review and Edit review. The REST API keeps returning the same Outcome values as before.
Proposed coverage shows the best match
A proposal on Proposed coverage now shows the strength of its strongest path, where it showed the loosest. EU GDPR Art. 28 is proposed against UK GDPR Art. 28 as Equivalent instead of Related, because one of its paths, through processor contracts and oversight, is Equivalent. The strength filter, the sort by strength, the REST API's `strength` and the Assistant follow the same value, and each path under a proposal still shows its own strength.
SOC 2 Processing Integrity titles fixed
In the SOC 2 Framework, the titles and descriptions of PI1.2, PI1.3 and PI1.4 now name only what the SOC 2 criteria themselves name, in English and Dutch. PI1.2 covers completeness and accuracy of system inputs, PI1.3 covers system processing, and PI1.4 covers complete, accurate and timely delivery of outputs. Before, they also mentioned authorisation and, for PI1.2 and PI1.3, timeliness, which could lead you to file access-control evidence there.
Supplier categories read as labels
A Supplier's category now shows as a label instead of its stored name: "Subprocessor" (Dutch "Subverwerker") where it used to read "SubProcessor", and "Professionele dienstverlening" and "Overig" in Dutch. The labels appear in the Suppliers list and its Category filter, on the Supplier's page, and in the Category choice on New and Edit Supplier. Saved filter links and the REST API keep working as before.
Supplier status reads as a phrase
A Supplier's status now shows as a readable label, in English and Dutch, where it showed the stored name such as "UnderReview". The label appears in the badge on the Suppliers list and on the Supplier's page, in the Status filter, and in the Status dropdown on New Supplier and Edit Supplier. Badge colours, saved links to a filtered list and the REST API stay as they were.
Filter Suppliers by personal data
The Suppliers list now has a "Processes personal data" filter next to Category, with the choices All, Yes and No. Before, you could only narrow the list this way by typing it into the address bar. It combines with the other filters, is cleared by "Clear filters" and is kept when you come back.
SOC 2 Privacy criteria fixed
The SOC 2 Framework now gives Privacy criteria P6.2 to P6.7 the subject the AICPA gives each code, in English and Dutch: P6.2 record of authorised disclosures, P6.3 record of unauthorised disclosures, P6.4 privacy commitments from vendors and third parties, P6.5 breach and incident notification by those parties, P6.6 breach notification to affected data subjects and regulators, and P6.7 accounting of personal information held and disclosed. Proposed coverage follows the new subjects; evidence you filed under these codes before stays on the code, so check it still fits.
SOC 2 Processing Integrity criteria fixed
The SOC 2 Framework now gives each Processing Integrity criterion the subject the AICPA gives its code, in English and Dutch: PI1.1 quality information and data definitions, PI1.2 inputs, PI1.3 system processing, PI1.4 outputs and PI1.5 stored data. The old "quality assurance" entry is gone, and Proposed coverage follows the new subjects. Evidence you filed under these codes before stays on the code, so check it still fits.
SOC 2 criteria carry the right subjects
The SOC 2 Framework now gives each Common Criterion the subject the AICPA gives its code, in English and Dutch. CC6.1 covers logical access security software and infrastructure, CC6.2 registration and authorisation, CC6.4 physical access, CC6.5 disposal of physical assets, CC7.5 recovery from incidents, CC9.1 business disruption and CC9.2 vendors and partners. Proposed coverage follows the new subjects; evidence you filed under these codes before stays on the code, so check it still fits.
UK GDPR cites the right complaints provision
The UK GDPR Framework now lists the duty to handle data-subject complaints as "DPA 2018 s. 164A", in English and Dutch, where it said "DUAA Sch. 10". The duty sits in section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025, and its text now says so. Your statuses, narratives and coverage stay as they are.
UK GDPR names the Information Commission
The UK GDPR Framework now names the Information Commission, in English and Dutch, where it named the Information Commissioner's Office (the ICO). The Information Commission replaced the Commissioner's Office on 30 September 2026, as the law on legislation.gov.uk now reads. Your statuses, narratives and coverage stay as they are.
Check runs survive a restart
A Check run you started now finishes even when Compliance restarts or crashes before it is done. Before, the run was lost and you had to start it again. Checks keeps showing that the run is in progress, then shows the new results as usual, and the run uses your Assistant allowance once.
Information icon is read aloud
On Settings > Assistant, the Grounding tab's information icon is now read by a screen reader as its explanation of the organisation profile, in the page's language. Before, it was read only as "button". The tooltip looks and shows as before.
Schedule menu is read aloud
A screen reader now reads the small arrow next to Record event on a Schedule as "More actions", in the page's language. Before, it said only "button".
Icon buttons are read aloud
A screen reader now reads the name of an icon-only link or button, such as "Back", "New", "Delete", "Edit", "Settings", "Home", "Clear", or "Close", in the page's language. Before, it said only "link" or "button". The cross on a notification is now a real button that the keyboard can reach and dismiss with Enter or Space.
Icon buttons show their name on hover
Hovering an icon-only button, such as the back arrow, the plus on a list, the trash, pencil, or filter icon, or the cross on a notification, now shows its name as a tooltip, in the page's language. Before, the name was set but never appeared. Icons without a name still show nothing.
Compliance follows your own day
Every "today" in Compliance is now your day, from the Timezone you saved in User settings, then your browser's zone, then UTC. Overdue and due-soon marks, Expired and Expiring soon on Evidence, Planned Events, date defaults, and the "cannot be in the future" checks all use it, so you can record today's date just after your local midnight. The Assistant, your Agent over REST and MCP, and Import use your day too, and the Task mail and other scheduled jobs stay on UTC.
EU AI Act dates and wording updated
The EU AI Act Framework, in English and Dutch, now follows the Digital Omnibus (Regulation (EU) 2026/1744). Art. 16 and Art. 26 say high-risk duties apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I), Art. 5 lists two new prohibitions from 2 December 2026, Art. 4 describes the simpler AI literacy duty, and Art. 50 gives the 2 December 2026 marking deadline. Art. 6(1) no longer lists machinery, and your adoption and decisions are kept.
Task mail names what each Task is about
Task mail now bundles Tasks that share a title and mark into one block, with one link per Task that names the Requirement, Risk, or Policy it is about. The subject names the Account and counts what is overdue, due soon, and newly assigned, and the mail has an Open your Tasks button and a link to the Email page where you switch it off. Compliance mail now shows Compliance | mvdm.io as its sender, and Comment mail names the Account in its header and footer.
Switch off every AI feature
An Owner can now switch off every AI feature for the Account under Settings → Assistant → Settings, so that no account data goes to an AI provider. While it is off, the Assistant panel is gone, and Checks, Gap analysis, and Import refuse to start and say where an Owner switches AI on. A saved Policy, Procedure, or Scope body gets no "what changed" sentence, and a turn queued before the switch stops without calling a model.
Dropdown search keeps the list right
Clearing the search in a dropdown now lists exactly the options the page holds, in the page's order, each once. When the page refreshed the list during a search, clearing it could bring back an option the page had removed, show a rewritten option twice, or leave a new option at the bottom.
NIS2 with country Sub-frameworks
NIS2 is now one Framework with a Sub-framework for each country you operate in, starting with the Dutch Cyberbeveiligingswet and Cyberbeveiligingsbesluit. A new Countries page under System sets your countries (existing Accounts start with the Netherlands), and saving it adopts or unadopts the matching Sub-frameworks, asking first before it removes one. The Frameworks page, the Framework picker and the Framework homes show NIS2 with its Sub-frameworks beneath it.
Confirmation boxes survive a page refresh
When the page refreshed while an "Are you sure?" box was open, because a colleague saved the record or the app updated the page, the box vanished but still blocked the page, and its warning was replaced by a generic text. The box now stays open with its own warning, and Confirm still carries out the action. Cancel and Escape still close it.
Framework control shows the Framework you just adopted
After you unadopt your last Framework and adopt another without reloading the page, the Framework control in the top bar now lists the Frameworks you have adopted, where it used to offer the ones from when the page first loaded. You no longer need to reload to scope pages to the Framework you just adopted.
Hovering leaves Notifications unread
Resting the pointer on a link to a record no longer marks that record's Comment Notifications as read; they are marked once the record is on your screen, and the bell in the top bar drops its count at once. The bell now also updates when you open the Comments strip on a Policy or Procedure Edit page and when you open a commented Phrase. Rows on the Notifications list open as fast as other links again.
Events can be planned ahead
New Event and Edit Event now accept a date after today, and the Event shows a blue "Planned" label on its page and in the Events lists, a Schedule's Events and a Continuity Plan's tests. A Planned Event that counts toward a Schedule books that Schedule's reminder for its date; the reminder completes on its own that day, and the next one takes over. A Continuity test can be planned with no Outcome, and its Plan's Last tested counts only tests that took place. The date field and columns are now called "Date" instead of "Occurred".
Errors show an error page
A server error on any page now shows the "Something went wrong" page with a request ID, where it used to show a blank screen. When a box on a page reloads on its own and the answer does not fit the box, the answer now opens as a full page instead of leaving the box collapsed or showing "Content missing".
Compliance has its own CLI
Compliance's install addresses `/cli/install.sh` and `/cli/install.ps1` lead to the latest `compliance` CLI again. The CLI guide, and the Codex, Cursor and Grok Build guides, now name the `compliance` command and the `COMPLIANCE_TOKEN` variable. API & Agent Access shows the install lines and `compliance login` in the Compliance panel.
Status badges coloured on lists
A Task's state, an Asset's lifecycle state, and the status of a Business Issue, Interested Party, Opportunity, Objective, Person and Supplier now have the colour their own page gives them wherever they show. That covers the Tasks, Assets, Business Issues, Interested Parties, Opportunities, Objectives, People and Suppliers lists, the open-Tasks panel, Training, a Risk's treatment actions, the Requirement coverage sections, the Objectives on a KPI and the holders of a Role. Before, those lists showed the same words in pale grey.
Badge words keep one colour
A word that shows as a badge in more than one place now has the same colour in all of them. Finding, Incident and Vulnerability states are coloured on their lists as on their Details pages, and Minor is orange on Finding Details and Event Details. "Archived" is grey and "Edited since last review" amber on Policy and Procedure Details, "Addressed" is green on the Framework page, and "In progress" is blue in a Task's result history.
Coming up rows fit their list
On the Overview, every row in Coming up now ends inside the list, so the holder of a Task or the number of people is no longer cut off. The Task title keeps a readable width, and the kind label and icon appear only when the list is wide enough. Health now sits beside Coming up from a wider window, about 1060px; below that the two stack.
An Event cannot be dated in the future
New Event and Edit Event now refuse a date after today: the date picker stops at today, and a later date typed by hand shows an error at the top of the form and saves nothing. The REST API and the Assistant refuse it the same way. Before, a future-dated Event that counted toward a Schedule pushed that Schedule's next due date out by the same distance. Plan ahead on the Schedule's Next occurrence instead.
Frameworks listed by name everywhere
The Framework cards on the Overview, the Framework picker in the header, the groups on the Requirements page, the Framework pickers on Events and Schedules, and the Frameworks offered when linking Requirements now follow the Framework names you read, in your own language. In Dutch they read AI-verordening, Arbowet, AVG. Before, they followed an internal code, so the order meant nothing and differed from the Frameworks page.
Applicable Requirements show a green badge
On a Framework's Applicability page, the State column now shows "Applicable" in green, and "Not yet reviewed" and "Excluded" in the same grey as the Requirement page. Before, all three badges showed the same pale grey, so you could not tell applicable Requirements apart at a glance.
Coming up stacks repeated Tasks
On the Overview, Coming up now folds two or more Tasks of the same kind within one group into a single line, such as "8 Policy approvals", that shows the earliest date. Click the line to see each Task and open it; it starts closed every time you open the page. Ad-hoc Tasks keep their own rows, and a kind with only one Task stays an ordinary row.
Page titles sit centred in their header
On pages without a breadcrumb line, such as the Overview and the Attachments upload page, the title now sits with equal space above and below inside the tinted header bar. Before, it sat too high in the bar. Pages with a breadcrumb line look the same as before.
Every scrolling panel shows it scrolls
Some panels scroll only at certain window widths: the Overview's Coming up list and Health column on a wide window, the editor panes of Policies, Procedures and Scopes on a narrow one, and the side list of Default content. Before, these had no thin tinted scrollbar and no faded edge, so on a browser that hides its scrollbar you could not tell there was more below. They now look like every other scrolling panel, with a faded edge wherever more content lies in that direction.
Overview shows what needs attention
Overview now shows how far the last audit or review is from the next one due, and lists open Tasks by week with a switch between Everyone and Mine; Next action is gone. Below Health, Needs attention counts running breach clocks, Critical Vulnerabilities, overdue and unheld Tasks, Objectives past their target date and Evidence that expires soon, and each line opens the matching list. Objectives gets a "Past target date" filter, and the Assistant describes the same page.
Task page shows its record
A Task that is about one Policy, Finding or other record now shows that record's code, title and full description on the left, with the Workflow beside it that stays in view while you scroll. On a narrow screen the record sits above the Workflow. A Task's facts now sit in one strip under its title instead of a sidebar. The Workflow box is always white, and only its badge shows Overdue or Due soon. In the result form, the result and "Record an earlier date" now start closed unless the result is required or already has a draft, behind the links "Add a result" and "Record an earlier date".
Allowance page address survives License step
When the Assistant Allowance page needs a License you do not have, you now come back to that page with every setting in its address after the License step. Before, the address was cut at its second setting.
Links to records work again
A link in a description that points at another record, such as a Policy that links to another Policy, a Procedure or a Role, opened a "not found" page after the description was saved. Many links that broke this way now open their record again, in Policies, Procedures, Tasks, Suppliers, Findings and every other description. Links to outside sites, email addresses and links within the page stay as you wrote them, and a description you save from now on keeps its links as written.
The Owner holds undelegated tasks
A Task with an Owner and no Assignee now counts as held by its Owner, or by everyone who holds the Owner Role. On Overview, the line about tasks nobody holds counts only Tasks with nobody behind them, and it stays hidden when every Task has a live Owner. The Tasks page filter and column now read "Held by" ("Houder" in Dutch) and show the Owner when nobody is assigned, the Planning "Who" filter follows the same rule, and Task mail now reaches the Owner of an undelegated Task, with the footer "You are receiving this because you have a task to do." Owners get no reminders for dates that have already passed. The API and the Assistant describe an omitted Assignee as "the Owner does the task".
Overview names overdue unheld tasks
On Overview, the line under the work list now reads "N more task(s) nobody holds are overdue or fall due within 31 days." The number already counted tasks nobody holds that are past their due date, but the line said they were only falling due soon. The number, the warning colour, and the link to every task nobody holds are the same as before.
Workflow tabs show hover and locked colours
In the Workflow panel on a Finding or a Vulnerability, a step you can open now darkens by one shade of grey when you point at it, so it reads as clickable. A step that is not reachable yet now shows faded text, and still shows the "not allowed" pointer without changing on hover. On a Task, the steps it has not reached yet show faded text in the step strip too; the selected step stays blue.
Badges show their colours
About 40 badges that showed the same pale grey now show the colour their page meant. Evidence is red when Expired and amber when Expiring soon, Findings and Incidents show severity in red, orange and amber, and an adopted Framework is green. Policy and Procedure badges, the Risk matrix legend, Requirement badges, the Unread label on Notifications and the error badge on Assistant conversations are coloured too; badges that were already pale grey look the same as before.
Opening a Requirement decides nothing
Resting the pointer on, or opening, a Requirement you have not reviewed yet no longer marks it Applicable. It now opens a read-only page with its text, any coverage already linked, and a "Not yet reviewed" badge, where you choose Mark applicable or Mark excluded (which asks for a justification). The Applicability page also has a Mark applicable button on each Requirement not yet reviewed, and a coverage table row for a Requirement that already has a record now opens its page instead of an error.
Faster Findings list
The Findings list now opens faster when an account holds many Findings, because it no longer looks up each Finding's workflow one at a time. The rows, States, filters, search, sorting and paging are the same as before. A Finding without any Tasks yet still appears with the same State.
Review Tasks follow a new Owner
When you change the Owner of a Policy, Procedure, Scope, Requirement, Risk, Supplier, Opportunity, Objective, KPI, Continuity Plan or Asset, its open Review Task now moves to the new Owner, and so do the Reviews that follow. A Task someone already gave to another person by hand stays where it is, and the due date and progress do not change. Review Tasks that were already left with an earlier Owner of most of these records have been moved to the current Owner.
Settings refuse empty values
On Settings, Email now refuses a Task mail value that is not one of its listed options and changes nothing, so an empty value can no longer turn the account's Task mail off. An empty content language on the Assistant page now says the language is required. Adopting a Framework with a missing id answers "not found", and the Import mark toggle changes nothing when its page is missing.
Editor toolbar reads in Dutch
In Dutch, the editor on the register forms, such as Assets, Business Issues, and Continuity Activities and Plans, now shows its toolbar, button tooltips, menus, and dialogs in Dutch. That includes the Link, Image, Media, Table, and Help dialogs. In English, the editor looks and works as before.
Guides name the mvdm CLI
The Compliance guides for the CLI and the REST API now use the `mvdm` command and the `MVDM_TOKEN` variable, and their install lines point to the mvdm CLI installers on the Auth address. The `compliance skill` and host-setting sections are gone from the CLI guide. Compliance no longer serves its own CLI install addresses.
Find an Asset by its external reference
Type an Asset's external reference, or part of it, into the Assets search box or Global Search and the Asset comes up, whatever the case. The Assistant's search finds it by its external reference too, so you can ask for a device by that value. Assets that are Retired or Returned to owner are found the same way.
Table toolbar sits in one row
The small toolbar that appears under a table in a text field when you click inside it is now a short row of buttons. It had shrunk into a narrow column of icons, one per row, that ran past the bottom of the field.
Faster Asset changes for big Custodians
Changing an Asset now answers faster when its Custodian holds many Assets, such as a whole account's hardware list. The Custodian's Asset Review Task lists the same Assets as before, and an Asset change that does not alter that list no longer touches the Task. A long hardware import no longer slows down as each Custodian's list grows.
Errors and Imports follow your language
The messages that explain a refused save on register forms now appear in your language, and so do the error messages in the REST API's 422 answers, with the same field names as before. An Import's progress and failures are written in the language of whoever reads them, so a colleague sees them in their own language, and a failed Import now says what failed instead of showing error text. Import Control, Diagnostics, Training Matrix, the Admin pages, the Evidence upload prompts, and the character counters also read in Dutch, and the License ending email reaches each Owner in their own language.
Dutch Kind label reads Soort
In Dutch, the Kind column, filter, and field on Assets, Events, Business issues, Interested parties, Schedules, Tasks, and Role details now read "Soort" instead of "Vriendelijk", and the Assistant settings tab reads "Achtergrond". A Schedule's hint now says that the kind and the framework or continuity plan cannot change after you create it, and unadopting a framework now warns that it removes the listed Schedules and keeps their Events as One-offs. A Schedule with no linked Events now says "Nog geen gebeurtenissen gekoppeld." in Dutch, a failed dictation says the speech could not be transcribed, and the Dutch button to buy Assistant funds reads "Pakket kopen".
Four messages show current wording
Policy details now says "No Policy Approvers are designated yet." when nobody has been designated, instead of an older wording. When an Owner runs out of Assistant funds, the Assistant now tells them to buy a pack or turn Auto-topup on. The Assistant's errors for an unknown Event kind or Risk status also use their current text.
Hovering a link keeps your filters
Resting the pointer on a Risk matrix cell, an Evidence kind chip, a Planning year link, Clear filters, or any other filtering link no longer changes the filters and search your lists remember. Going Back or Forward to a list now saves the view on screen, and the list reopens on that view next time. The Welcome Letter now opens a moment after your first page appears, and resting the pointer on a link no longer makes it wait for a later page.
Faster Dutch pages, two buttons reworded
In Dutch, Asset and Task pages now open a little faster. Two Dutch buttons now read like every other button: "Risico accepteren" on a Vulnerability, and "Toewijzen aan alle actieve personen" on a Course.
Assets start from a template
A new Asset's description now starts with headings for its kind, such as Manufacturer, Model, Serial number, Inventory tag and Notes for Hardware; you can change each kind's headings on Settings → Default content, and on new Asset, picking another kind swaps them in until you start typing. The Assets list gains a Custodian column and a Custodian filter, and its search also matches the description and the Custodian's name, so you can find a device by its serial number or list every device one person uses. When you ask the Assistant to register a hardware list, it writes each row under the kind's headings and makes the person who uses each device its Custodian.
Assistant keeps answering after updates
When Compliance is updated while you have the Assistant panel open, the panel gets its answers and title changes again as soon as you go to another page in the same tab. Before, it stayed silent until you reloaded the page. A tab you opened before this update needs one reload, and after that no reload is needed.
New Incident links to its template
New Incident now has the same Edit the default text link as Record review and new Risk: it opens Settings → Default content on Incident description, and the Back button there reopens the form with the text you just saved. New Incident also asks before you leave with unsaved input; before, it dropped what you had typed without warning.
Default content lists every starting text
Settings → Default content now lists every starting text down the left, with the register it belongs to and a dot when your account has changed it, and shows only the one you pick in the editor beside it. Record review and new Risk each have an Edit the default text link that opens that page on the form's own text, and a Back button there reopens the form with the text you just saved. Record review, new Risk and new Asset now ask before you leave with unsaved input; before, the first two dropped it without warning and new Asset's links stopped working.
Incidents start from a template
A new Incident's description now starts with six headings, Summary, Impact, Response, Notifications, Root cause and Lessons learned, which you can change for your account on Settings → Default content. An Incident is now just Open or Closed, with Close and Reopen on its Details page; the response steps, the timeline, and the separate root cause, lessons learned, commander, reporter and detection source fields are gone, and you write that under the headings instead. On a personal data breach you can now record the date you reported it to the authority, which stops the 72-hour clock.
Incidents get an External link
An Incident now has an optional External link, a web address for the matching item in whatever tracker you use, just like a Finding or a Vulnerability. You can set it when you create the Incident and change or clear it on Edit, and Details shows it in the sidebar as a link that opens in a new tab, whatever the Incident's State. The Assistant can set it when it records or updates an Incident and can find Incidents by their link, and your own Agent can read and set it through the REST API and MCP.
Editing a template keeps its settings
Saving a recurring task template on Tasks → Templates → Edit now changes only what the form shows: title, default owner and assignee, recurrence, next spawn date, and Active. Before, a save also cleared the template's description, due offset, and evidence requirement, and turned a review template into an Ad-hoc one, so its tasks no longer updated the register entry or set the next review date. When a save is refused, the form now tells you why.
Approve and acknowledge from your row
On a Policy or Procedure Details page, your own row on the Pending approvals or Pending awareness panel now has a button while your task for it is still open: Approve this policy, Acknowledge this policy, or Acknowledge this procedure. One click completes that task, and you stay on the page, where your row then reads Approved or Acknowledged. The button under the table, which only opened your task, is gone; you can still complete the task from the Tasks inbox.
Roles are given from the Person
You now give someone a Role on their Person page: tick it when you add a new Person, or on Edit later; the REST API takes the same Roles when it creates a Person. A Role's own page no longer adds or removes holders, but still lists them as a table you can search, sort, and page, with each row opening that Person. Deleting a Role that people still hold now tells you to remove its holders first, from each holder's Person Edit page.
Panels show who was not asked
On a Policy or Procedure Details page, a person on the Pending approvals or Pending awareness panel now reads Pending only when they hold an open task for it, and Not asked, on a grey badge, when they hold none. Before, both cases read Pending, so a page where nobody had been asked looked the same as one with work still to do. People who already approved or acknowledged the current version keep their green badge.
Unread Notifications now stand out
On the Notifications page, unread Notifications now have a light violet background, so you can see at a glance which ones are new. Read Notifications keep a plain white background. Before, every Notification looked the same, whether you had read it or not.
Hovering a Notification keeps it unread
On the Notifications page, resting the pointer on a Notification no longer marks it read. It stays unread until you click it, tap it, or open it from its email, so unread now means you have not opened it yet, and the unread count at the top of the page drops only for what you opened. A click still takes you to the Comment and marks that Notification read.
Add target keeps your chosen list
On an Event, when Add target refuses a target, for example because it is already linked to the Event, the list for the Target kind you chose now stays on screen with that target still selected. You can pick another target right away. Before, the list disappeared and you had to switch Target kind to something else and back.
Notifications list ends after its rows
On the Notifications page, the white box around your Notifications is now only as tall as the Notifications in it, so you can see at a glance where the list ends. Before, it ran to the bottom of the page even when you had only one Notification. With a long list, the list scrolls and the page title and Mark all as read stay on screen, as on the Checks page.
Party requirements readable on laptops
On an Interested Party's page, the Party requirements table no longer breaks a Source such as "Dutch Data Protection Authority" in the middle of a word on a narrower screen, such as a 1280-pixel-wide laptop. When the table is too narrow for its columns, each requirement now lists its values one under the other, so the Source and the requirement wrap only between words. On a wide screen the table keeps its columns, and a long web address still wraps inside its own cell.
Person email addresses fit
On a Person's page, the Email addresses list in the sidebar no longer runs past the sidebar's edge in a narrower window, such as a 1280-pixel-wide laptop screen. Each address now sits on its own line with its Primary badge, and "linked" or "Not linked" shows on the line under it. A long address wraps inside the sidebar and is always shown in full.
Edit affected assets button fits
On a Vulnerability's page, the Edit affected assets button no longer runs past the edge of the sidebar in a narrower window, such as a 1280-pixel-wide laptop screen or a window with the Assistant open. When the button does not fit beside the Affected assets heading, it moves under the heading, and when it is wider than the sidebar, as the Dutch "Betrokken bedrijfsmiddelen bewerken" can be, its label wraps onto more lines. The page also no longer slides a few pixels sideways.
Add holder picker says what to do
On a Role's page, the empty Add holder picker now says "Choose a Person" ("Kies een persoon" in Dutch) in grey, instead of "undefined". A screen reader now reads the picker out as "Add holder". The Conducted by picker on a Continuity test also looks empty until you pick someone, and picking a Person works as before.
Saving a draft keeps your way back
When you save a draft result on a Kpi, then choose "File evidence on the task" and Mark Done, you now land back on the Kpi. Before, saving the draft first left you on the Task instead. The step links in the timeline on a Finding or a Vulnerability now work the same way after you save a draft.
Reject and Reopen conflicts explained
When you press Reject or Reopen on a Finding that changed after you opened its page, for example because someone else closed or reopened it first, you now see one short sentence in your own language instead of English technical text. The sentence names the Finding and the state it is in now, so you know to reload the page and look again. The Assistant gets the same sentence when it cannot reopen a Finding for you, so it can tell you why.
Comments on every Edit page
Every Edit page with a text field you can comment on, such as a Risk, an Asset, a Supplier, a Scope, a Requirement narrative or a Person's notes, now shows its Comments inside the text, as the Policy and Procedure Edit pages already did: highlights you click to open, new Comments that post when you Save, "Save removes N Comments" beside Save, and a strip for Comments on the whole record. On an Objective, a Role or an Incident, each of the two text fields keeps its own Comments, the "Save removes" list names the field of each one, and a Comment never moves into the other field when you paste there. Comments on an Incident's lessons learned stay on Details, where you write them when you close the Incident.
Upload errors speak your language
When an upload of a Confluence export on the Import page breaks partway or comes up short, you now see one short sentence telling you to upload the file again, instead of technical text with ids and byte counts. "Uploading…", "Finalizing…" and every error line on the Import page and on an Upload link form now show in Dutch when you use Dutch. When an Upload link refuses a file, you see its own sentence as it is, without extra English around it.
Picker lists keep the form still
Opening the Owner, Approval audience, or Awareness audience picker on a Policy or Procedure no longer slides the form sideways and cuts off its title. The picker's list is now never wider than the picker, so it fits inside the column, and a long Role name is cut short to fit its row. Every other field where you pick a Person or a Role, such as on a Risk, a Schedule, or an Asset's Custodian, follows the same rule.
Assistant panel opens again
The Assistant panel opens again, and the Allowance tab under Settings, Assistant loads again. Both showed an error page for a few hours today. Owners can again see the allowance, buy a pack, and change Auto-topup.
Owner pickers fit narrow columns
When the Assistant panel leaves little room on a Policy or Procedure, the Owner, Approval audience, and Awareness audience pickers now move to their own line under the kind dropdown, so a name is no longer cut off at the edge. Every other field where you pick a Person or a Role, such as on a Risk, a Schedule, or an Asset's Custodian, does the same, and the picker's list stays inside the column. When there is room, the kind dropdown and the picker still sit side by side.
Finishing a Task takes you back
When you open a Task from a Kpi or another page and choose Mark Done or Cancel, you now always land back on that page. Before, a busy server could leave you on the finished Task. Another tab that shows the Task still updates to show it Done.
Record a Meeting by hand
You can now record a Meeting on New Event, with Attendees, and count it toward a Meeting Schedule or leave it a One-off. A Meeting session is now a Voice Call: you start it with a title, Stop ends it at once, the call no longer creates a Meeting, and Meetings that earlier sessions created are removed from Events. The microphone button now says Start dictation, because your speech becomes text and no recording is kept.
Training Matrix stays compact
A short Training Matrix now shows at its own height, with the legend directly under it. A longer matrix still scrolls in its own box, and the legend stays on screen under that box. When there are no active People or no Training Courses, the empty panel is only as tall as its sentence, and the link to create a Course stays in it.
Place images in your text
The image button uploads a PNG, JPEG, GIF, or WebP from your computer, and the saved page shows that image. The Assistant can place an image you pasted into text it writes, such as a Policy or a Comment, and that picture stays after you delete the conversation. Only members of your Account can open the image, and a rewrite the Assistant proposes names each image it will add and each image it will remove.
Allowance stays with Commonplace
Closed-license retention now keeps the Assistant allowance while Commonplace still holds the Account's data. It deletes that allowance only when neither Translation Tools nor Commonplace still holds the Account's data.
Rewrites keep your formatting
When the Assistant rewrites a body, such as a Policy or a Task description, it keeps images already in that body, with their size and description, plus nested lists, line breaks, strikethrough, underline, tables, a Mention, and a link that downloads a file. Colour, alignment, merged table cells, and video still drop out. Saving an Edit page keeps underline, and a reply in the Assistant panel shows strikethrough, nested lists, and line breaks without loading a picture.
Empty allowance replaces the message box
When the next Assistant message would be refused for lack of funds, the Assistant panel replaces the message box with one sentence and a way to the Allowance tab, and it keeps what you typed until you reload. An Owner gets a Buy a pack button and is told that funds ran out, or that Auto-topup stopped at the Monthly spending limit, and a member gets a See the allowance link and is told to ask an Owner. Describe your organisation now opens a folded panel, and a Meeting, Voice, Import, Check, or Gap analysis refusal uses the same sentences.
External link replaces the Jira integration
Compliance no longer connects to Jira: the Connections page, the Ticket controls on Finding and Vulnerability Details, and Ticket sync are gone, and the Assistant no longer spends allowance checking Tickets. In their place, a Finding and a Vulnerability each have an optional External link, a web address for the matching item in whatever tracker you use, which you can set when you create or edit the record and which Details shows as a link that opens in a new tab. Your existing Jira Ticket links now show as External links, your own Agent can read and set the link through the REST API, MCP and the CLI, and past Ticket sync conversations stay readable.
Side questions leave Gap analysis sessions
When you ask a question in an open Gap analysis session that has nothing to do with the interview, the Assistant now moves it to a new conversation that only you can see, and takes you there. The other members see only the interview, and the new conversation links back to the session. The Assistant also gets better at telling a short reply, such as "yes" or a name, from a new question, so your answers stay where they belong in every conversation.
Assistant notices follow your language
When something goes wrong in the Assistant panel, the notice now shows in the language you use the app in, for example when the Assistant is still busy with your last message or a message, file, delete or share fails. A failed recording or read-aloud now shows a notice instead of nothing. A browser with no microphone now says the microphone is not available, instead of saying access was denied.
Closed sessions start a new conversation
A message you send in a closed Gap analysis session or Meeting session now starts a new private conversation and takes you there, instead of being refused with "The Assistant is still working on your previous message". A banner at the top says the session was closed and links back to it, and the closed session stays as it was. Voice dictation now works in a closed Gap analysis session, the REST API and MCP clients get the new conversation's id back, and the conversation's admin Details page says it started from a closed session.
Assistant answers about Tickets and Cadences
The Assistant and MCP clients can now answer questions about your Jira Tickets, your Cadence settings, Cadence opt-outs and resumes, and your default text for new records. For example, you can ask which Findings already have a Ticket, who completed one, what Cadence applies to Supplier Reviews at each Criticality, or who opted a target out and why. Answers show only your own Account's data, and the Jira connection's credentials never appear in any answer.
Assistant files documents on Roles
You can now ask the Assistant to attach a file, such as a job description or a training certificate, to a Role. The file shows in the attached-files panel on the Role's Details page, like any other attachment. Before, the Assistant did not know a Role could hold files and would refuse or file the document elsewhere.
Import upload drops Anthropic notice
The Import Upload page no longer shows the notice that your export is processed by Anthropic, in English or Dutch. That notice was out of date. The legal documents you accept before using Compliance now name the AI sub-processors.
Only Owners cancel the License
Only an Owner of the Account can now cancel the License. When a Member asks the Assistant to cancel it, the Assistant says that only an Owner can do that, and the License stays as it is. Owners can still cancel by asking the Assistant, after they confirm, or through the API.
Ticket sync stops for leavers
Automatic Ticket sync no longer completes Tasks or rejects Findings in the name of someone you recorded as Departed on the People page. You do not need to remove their login as well. When another member clicks Sync on that Finding or Vulnerability, or creates or links its Ticket, automatic sync starts again in that member's name.
Schedules replace Evaluations and Tests
Evaluations and Tests are now one Schedules page in Operations: each Schedule is a recurring audit, review, or test with its own Cadence, owner, and reminder, and your existing ones keep their due dates under new `SCH-` codes. New Event now lets you record audits, reviews, tests, and Continuity tests, shows kinds in plain words such as "Internal audit", and has a Schedule field where the Event counts toward a Schedule or stays a One-off that leaves every due date alone. A Continuity Plan now gets a test reminder only when you give it a Schedule (Plans with an active test reminder today got a yearly one), and the Assistant, REST API, and CLI use Schedules in place of Evaluations and Tests.
Comments show while you edit
On the Policy and Procedure Edit pages, every Comment on a phrase now shows as an amber highlight in the text, and clicking it opens the Comment, just as on the detail page. A Comment stays on its words when you reword them, and it moves with a sentence you cut and paste in the same text. You can also write new Comments there, which post when you Save; "Save removes N Comments" beside Save lists the Comments whose words you deleted, and the Comments on the whole Policy or Procedure sit in a strip under the text.
Comments stay on long texts
Saving a long Policy or Procedure no longer deletes every Comment on a phrase in that text. A Comment now stays as long as the words it points at are still there, however long the text is. Only rewriting most of a long text in one save still removes the Comments on it. When the Assistant writes or changes notes in a Meeting, Comments on those notes now follow the same rule.
File evidence link opens the Task
On a Workflow card whose Task needs evidence, "File evidence on the task →" now opens the Task page instead of turning the card into "Content missing". There you can add evidence and mark the Task done, and you return to the page you came from, where the card shows the new measured and due dates. This works on every page with a Workflow card, such as KPIs, Suppliers, and Policies.
Disabled buttons look disabled
A button you cannot use yet, such as Mark done on the Workflow card before the Task has Evidence, now looks faded, shows a not-allowed cursor, and no longer changes when you point at it. Buttons you can use look the same as before.
Agent setup guides move to /agents
The public setup guides for your Agent, the CLI, and the REST API now live at `/agents` instead of `/docs`, and their Markdown copies at `/agents.md` and `/agents/{name}.md`. The old `/docs` addresses no longer work, so update any links you saved. `/llms.txt`, the API reference, and the MCP server now point to the new addresses.
Tidier line breaks in text
Paragraphs no longer end with one word alone on the last line, and a heading that runs to two lines now splits into two lines of about the same length. Boxes where you type keep their usual line breaks, so words do not jump while you type. Browsers that do not support this show text as before.
Setup guides for your Agent
Compliance now has public setup guides at `/docs` that anyone can read without signing in: one each for Claude Code, Claude Cowork, Grok Build, Cursor, VS Code, Gemini CLI, and Codex, one for any other MCP client, and guides for the CLI and the REST API. Each guide shows the date it was last checked against that Agent's own setup docs, and your Agent can read every guide as plain Markdown by adding `.md` to its address or starting from `/llms.txt`. The API reference, the MCP server, and `compliance --help` now point to these guides.
MCP server for your Agent
Your own Agent, such as Claude Code, Cursor, or any other MCP client, can now connect to Compliance at `/mcp`, sign in through your browser, and use the same tools as the Assistant, with the same checks as the pages, and every call shows up in the API call log. It can also switch Account, send files as Evidence, Attachments, or an Import, fetch a file through a download link that lasts 15 minutes, and ask the Assistant a question and follow the reply. Anything you must finish yourself, such as accepting the legal terms or a payment, gives your Agent a link to show you.
API reference lives at /api
The API reference now lives at `/api`. Opening that address shows the reference, and signing in on the page returns to `/api/`.
Install the compliance CLI
The `compliance` command-line tool now installs with one line, `curl -LsSf <Compliance>/cli/install.sh | sh`, or `irm <Compliance>/cli/install.ps1 | iex` in PowerShell, which always fetches the latest release. It signs you in through your browser or a device code, turns every REST API call into a command that prints JSON, uploads Import files in parts and picks up after a dropped connection, and can send a message to the Assistant and print its reply. When something needs a person, such as a payment, it exits with code 3 and prints the link to finish in the browser.
REST API for your own Agent
Your own Agent or script can now do anything the Compliance pages offer through the REST API at `/api/v1/`, signed in with an Agent connection or a Personal token, and the API reference at `/scalar` lets you sign in and try calls. Anything that charges money, and every call before you accept the legal terms, gives back a link that you finish in the browser. An Agent can also share an upload link, so a person can pick a file in the browser, and the Assistant can now set review cadences and connect, configure, or disconnect Jira.
Assistant does every page action
You can now ask the Assistant to do anything a Compliance page offers, such as adopting a Framework, starting a Gap analysis, running an Import, declining a Check result, accepting, closing or reopening a Risk, or cancelling the Compliance License. Framework adoption, Import controls, Auto-topup, and License cancellation always wait for your yes, and anything that would charge money gives you a link so an Owner finishes it in the browser. The Import Upload page no longer asks you to tick the Anthropic processing box, and the Risk Edit page now shows an error instead of quietly ignoring a move into or out of Accepted or Closed; use Accept, Close, or Reopen on Details instead.
ISO 9001:2026 edition arrives
ISO 9001:2026 can now be adopted next to ISO 9001:2015, in English and Dutch, and holding both editions is billed as one ISO 9001 subscription; work on 2015 shows up as Proposed coverage on 2026. A Gap analysis session now starts from the work on the account's other adopted Frameworks: each batch offers Coverage proposals, draft narratives, and suggested owners, and saves them to the new Framework only after members confirm. Proposed coverage, the redirect after adopting a Framework, and the Framework home callout now follow the Framework selection in the header, and the Assistant says so when that selection hides Frameworks.
Risk template, status, and category
A new Risk's description now starts with Asset, Threat, and Measures headings from a Risk description template that admins can edit or restore under Settings → Default content, and the separate treatment option and rationale are gone: existing rationale text now sits under Measures in each description. Risk status is now Open, Treating, Mitigated, Accepted, or Closed; Mitigated needs a residual likelihood and impact, and the Accept action on Details records an Accepted-on date while keeping the Risk on the Matrix and under Risk Review. Category is now an optional choice from a fixed list, shown on Details and as a column and filter in the Risk list, and old category text that clearly matched a list entry was moved to it.
Admin Conversations sorts by header
A Platform Administrator on Admin Conversations now sorts by clicking the Last activity, Created, Tokens, or Spend header, and clicks again to reverse the order, in place of the Sort dropdown. The list pages 25 at a time like Admin Logs, and clicking anywhere on a row opens the conversation. The Account, Owner, and activity-date filters stay, and changing one goes back to page 1.
Import page list matches other tables
The list of pages on the Import control screen now looks and behaves like the other tables in Compliance, and a wide list scrolls sideways inside the table. It keeps the same columns and order, and ticking a page's Mark box still saves the mark straight away. Run marked and Continue stay above the list.
Applicability list becomes a table
The Applicability page, called the Statement of Applicability on standards, now looks like the Requirements register. Click anywhere on a row to open that Requirement, or to open Materialise-from-catalog when the Requirement is not on your Account yet. The columns are unchanged, and Show excluded requirements still filters the list.
Asset review lists become tables
On an asset review Task, Assets in this review and Not in this complete now look like the related lists on other Details pages. Click anywhere on a row to open that asset, and Not in this complete lines up Code, Name and Reason in columns. The row menu still offers Retire asset and Change custodian without opening the asset.
Frameworks now read in Dutch
Every Framework, its Requirements, categories and Crosswalk Hub topics now show in Dutch when your UI language is Dutch, and in English otherwise. BIO2 government measures carry the official Staatscourant text with the product's own note as a separate paragraph, EU GDPR shows as AVG (2016) with the official EUR-Lex articles, and the EU AI Act and Dutch Arbo show as AI-verordening (2024) and Arbowet (1998). The Assistant quotes Requirements in the conversation's language, and Search finds a Requirement by its English or Dutch title.
Settings tabs become their own pages
The System section of the left menu now lists Assistant, Default content, Cadence and Email as pages in their own right, so you can see each setting by name and reach it in one click. The Assistant page keeps a tab bar and holds its Allowance, Grounding and Settings together, so Assistant grounding is no longer a separate menu item. Every link you already have still works, and Global Search still answers to "settings" and to "grounding".
Ticket block leads with Create
Finding Details and Vulnerability Details now share one Ticket block, led by a single Create Ticket button, with a small "or link an existing issue" link under it for the rare case. A linked Ticket shows its key as a Jira link on its own line, with Sync next to a quiet Unlink, and Sync turns into a disabled "Syncing…" while a Ticket sync runs. When Jira is not connected, a short note explains why Sync is missing.
Assistant panel drops summary notes
The Assistant panel no longer shows the grey note saying that earlier turns or tool results were summarised to fit the conversation. The note stays hidden in English and Dutch, both when the page loads and while a reply comes in. A Platform Administrator still sees it in Conversation Details and in the Markdown export.
Copy link on every shared conversation
The Assistant panel's menu now offers Copy link on every shared conversation, not only on one you shared yourself. That includes Gap analysis, Meeting and Automatic Ticket sync conversations, and a colleague's shared conversation you are reading. Share and Delete still show only to the member who started a conversation.
Assistant allowance back in Settings
The Assistant tab of Settings shows remaining included and remaining extra again. Owners can buy an Allowance pack and set Auto-topup there, right above Content language. Old Assistant allowance links now open that tab, and so does the Monthly spending limit notice.
Assistant opens what you started
Start gap analysis, Resume gap analysis, Start over, Create ticket, a Check's Start, and an Event's View transcript now open their conversation in the Assistant panel straight away, and the conversation picker lists it. The panel opens from the rail and goes wide just as it does when you load the page fresh. Moving between pages or going Back keeps the conversation you were in.
Legal has its own menu entry
The System section of the menu now ends with Legal, which opens the Legal page for every Account User. On the Legal page, the menu shows Legal as the page you are on. The Assistant tab in Settings no longer holds the Legal link.
Task mail can be switched off
Settings has a new Email tab. There you switch Task mail off for the whole Account, and each Member sets their own choice — follow the Account, always on, or always off. Nothing piles up while mail is off, so switching it back on sends no backlog for the days that passed.
Ticket creation shows progress
On Finding Details and Vulnerability Details, Create Ticket shows that a Ticket is being created as soon as you start it, and a second Create or Link does not start another Ticket. When the Ticket is linked, Details shows it. When the create ends with no Ticket, Create Ticket and Link come back without a reload.
One shared Assistant allowance
Compliance and Translation Tools now spend one Assistant allowance. Remaining included, remaining extra, Allowance packs, and Auto-topup live on Assistant allowance, and Assistant settings keeps Content language and links there. Included funds show as zero when the Compliance License is missing or closed, and Compliance cleanup keeps the balance while Translation Tools still holds the Account's data.
Judgments on Conversation Details
A Platform Administrator on Conversation Details now sees each Member turn's Judgment beside that turn, under the turn on a narrow page, with each answer, its outcome, how sure as a whole percent, the duration, and the toolkit families that turn carried. A failed call is stored with a short reason and the model, the turn continues with the full toolkit, and Assistant allowance is spent only for usage the call reports. The Markdown export lists the same facts.
Dutch Arbo is now adoptable
Dutch Arbo (1998) appears on the Frameworks list. You Adopt it like any other Framework and work its Requirements on the same screens, and an optional Requirement says when to decide it in. On a paid License, adding the Dutch Arbo line costs the same as EU GDPR and includes the same Assistant allowance.
Assistant search shows the mention
Assistant search now finds a phrase in the text on the record itself, including a Policy or Procedure body, Scope, the Organisation Profile, and a Requirement narrative. You get one short quote of the first mention, in the record's own words, and the name of that field. A title, code, or name match still comes first, and each record appears once.
Account User on People
On People, a Person who is an Account User of this Account now shows Account User next to their name. You can filter the list to Account User, Not an Account User, or All. Invite still skips people who already have access and names them.
Email Owners at spending limit
Every current Account Owner receives a Monthly spending limit notice when Auto-topup is on and the Monthly spending limit is newly reached. The mail matches Settings, points at the Assistant tab, and does not go to Members. Auto-topup stays on.
Invite People from More actions
On People, More actions now holds Merge and, for an Owner, Invite. Tick rows, confirm who will receive an Invitation as a Member, and stay on People with a summary of who was invited and who was skipped. The Assistant can send the same People Invitations after you confirm the set.
Role Details lists holdings
Accountable for on Role Details now lists each live record this Role owns or is assigned, with search, sort, and paging. Click a row to open that record. When the Role holds nothing, you still see the italic sentence and no table; the Vacant Role warning still shows counts.
Packs show excl. tax
The $10, $25, and $100 Allowance pack buttons and Auto-topup pack sizes on Settings now say excl. tax. A pack Checkout requires a billing address and offers a Tax ID. Stripe charges tax for a Netherlands address, including later Auto-topup charges on the saved card.
Opportunity Event Targets and Objectives
On Event Details, Add target now offers Opportunity, so a Member can name an Opportunity this Event touched. On Opportunity Edit, a Member can tick which Objectives relate to that Opportunity, and Opportunity Details and Objective Details both list the set. The Assistant can add the same Event Target and replace the linked Objectives.
Automatic Ticket sync follows Jira
When a linked Jira issue's summary, description, status, or comments change, Compliance starts Automatic Ticket sync on that Finding or Vulnerability without a click. The Assistant judges the Ticket the same way as Sync, and Completer is the member who last created, linked, or synced that Ticket. The conversation is Shared, does not open the Assistant panel, and is closed when it ends so you can read it and cannot send.
Details pages load Tickets
Members can open Vulnerability Details and Finding Details. A missing Ticket shows the empty Ticket area, not an error. Create and Link still attach one Ticket to a Finding or a Vulnerability.
Jira Tickets for Vulnerabilities
On Vulnerability Details a Member can Create, Link, Sync, or Unlink a Ticket, the same way Finding Details already does. Ticket sync may complete remaining Remediation and Verification, mark false positive, or Accept as risk by naming an existing Risk, and does not copy Jira status onto the Vulnerability. A Ticket belongs to one Finding or one Vulnerability, never both, and Source reference stays free text.
Assistant decides faster before replying
Topic Split on a Member message now runs as a Judgment with a two-second limit instead of a five-second model check, and each Member turn carries only the Tool families the Toolkit judgment picks, so a reply starts sooner and costs less. An import now skips fluff pages and picks each page's likely record kind the same way, and Import Diagnostics shows Kind probability and Fluff probability where the old rationale was. Every Judgment debits Assistant allowance at a fraction of a cent, and a Judgment that fails or is unsure leaves behaviour exactly as before.
Cached prompts billed once
A later round of an Assistant conversation now spends remaining Assistant allowance once for the reused part of the prompt. Remaining on Settings falls more slowly. Spend already recorded stays as it was.
Titles name what you asked
A new conversation's title names what you asked, including a conversation started by Topic Split. A title that still answers the question, or still has stars or similar marks, is replaced with your first line. Titles already stored stay as they are.
Jira connect stays when unset
When Jira sign-in is not set up on this server, Connect with Atlassian and Sign in at Atlassian again stay on Jira Connection Details and say an administrator has to finish it. They no longer send you to an Atlassian error page.
Admin Conversations show Spend
A Platform Administrator on Admin Conversations now sees Spend for each Assistant Conversation. Spend is billed Assistant allowance for that conversation, including model calls, Voice, and Meeting session audio. Large token counts now read as 3m, with a tooltip of the exact number.
Connect Jira by signing in
An Owner connects Jira Cloud by signing in at Atlassian and then picking the site, project, and issue type from lists. Change and Sign in at Atlassian again keep the current connection until the new pick is saved. A Member still sees only Connected or Not connected.
Share a Member conversation
The starter of a private Member conversation can Share it from the Assistant panel overflow, next to Delete. A dialog confirms that everyone at the name in the identity menu will be able to read this conversation and send messages, and that you cannot make it private again. After Share, everyone in the Account can list it, read it, and send.
Connections hosts Jira setup
System now has Connections next to Settings, listing Jira as connected or not. An Owner connects, replaces, or disconnects Jira Cloud on Jira Connection Details; a Member sees status only. Settings dropped the Jira tab, and the old tab address opens those details.
Event Details lists stay live
When a Vulnerability names an Event as Discovered during, or a Finding is raised from that Event, every open Event Details page updates those lists at once. Changing or clearing the Event moves the row to the right page. A write still waiting for confirm, or a failed save, leaves the page as it is.
Auto-topup buys Allowance packs
An Owner on Settings turns Auto-topup on with a pack size and a Monthly spending limit. When remaining Assistant allowance is at or below 1.00 USD, the Account buys one pack and that same work continues. Settings shows when a charge failed or the Monthly spending limit is reached.
Jira Tickets for Findings
An Owner connects Jira Cloud on Settings with the Site URL, Project key, Atlassian email, API token, and Issue type. A Member sees whether Jira is connected, and on Finding Details they can Create, Link, Sync, or Unlink a Ticket. Create, Link, and Sync from Finding Details write in the Assistant without waiting for confirm, ordinary Assistant chat still waits for confirm, and Disconnect keeps Ticket links.
Vulnerabilities name Discovered during
A Vulnerability can name at most one Event as Discovered during. Event Details lists those Vulnerabilities and lets you create one pinned to that Event. You can set, change, or clear the Event on New, Edit, and from the Assistant.
Task mail is not repeated
When the evening Task mail run reaches you, the product records that it mailed you then. A later delivery failure does not send you the same bundle the next day. A brief mail-provider outage does not skip later people in the same run, and does not fail a Comment save.
Clear filters empties Table search
On a list with Table search, Clear filters now empties that search as well as the filters, forgets the search, and returns you to the first page. Sort and page size stay. The link also shows when Table search is the only thing narrowing the list.
Pack buttons open checkout
An Owner who presses $10, $25, or $100 on Settings now opens checkout for that Allowance pack. Those buttons used to do nothing. Cancel still returns you to Settings.
Send names exhausted allowance
Sending in the Assistant with no remaining Assistant allowance now tells you funds are gone, instead of asking you to try again. An Owner is told to buy more on Settings. A Member is told to ask an Owner.
Left icon bar no longer shaded
The narrow bar of icons down the left side showed a dark band over its right half, dimming the icons, the section names and the highlighted section. The band is gone, and the bar is a little wider so the longest section name fits.
Failed sign-in tries again
If Auth finishes but Compliance cannot match your login cookie, you get a new sign-in attempt instead of an error page. Normal sign-in still works and keeps your account, the same way as the other mvdmio products.
Pack buys look like buttons
The $10, $25, and $100 Allowance pack controls on Settings now have a white fill and a thin border, like the other in-page buttons. An Owner can see they are something to press. Buying a pack still starts the same checkout.
Asset access review per Asset
An Asset carries Asset access review only when you turn it on from New or Details. The Custodian completes a judgement that access is still appropriate, from Details or from the Task, and that does not complete Asset Review. The first Review is due in 30 days; later Reviews follow the Cadence setting, and Planning lists one item per Asset that carries it.
Instants use your Timezone
Instants you see now use your Timezone, including completed Policy reviews and the reviewed-on date on the Policy list. An Instant shown as a date uses your local day, and a due date you typed stays that date. Settings in the identity menu opens User settings on Auth.
Planning keeps finished work
Planning now keeps finished cadence work on the calendar in the month it was due, marked Done and quieter than open work. Conducted Evaluations stay as Event cards for that year. A repeating course that everyone finished stays as one done row with the class size; the Tasks inbox still hides Done.
Approval is one kind
On Policy New and Edit, Approval is now one row: Person or Role, then a list of that kind. You can still name several of one kind, or leave it empty. A mix of Persons and Roles is no longer possible, including from the Assistant.
Procedures has its own icon
In Registers, Policies and Procedures sat next to each other with the same document icon. Procedures now uses a numbered list icon, so you can tell the two pages apart.
Framework context in the header
You pick adopted Frameworks in the header, immediately left of Find anything, or leave All frameworks to see the whole account. Lists, pickers, Planning, Health, Find anything, the Assistant, and Checks then hide work that belongs only to other Frameworks, and keep work that belongs to a selected Framework or to none — People, Assets, and other un-tied records stay. Your choice is remembered, Planning and Requirements no longer have a Framework dropdown, and a copied record link opens in the recipient's own Framework context.
Policies name their own approvers
Each Policy now carries its own Approval audience of Persons, Roles, or both, and a new Policy starts with its Owner. You can change or clear that list later; changing Owner does not change who approves, and empty means nobody is asked. The account-wide Policy Approver flag is gone from People, and changing who approves does not count as a word change.
Assignees get daily Task mail
If a Task is assigned to you, or to a Role you hold, you now get Task mail at your primary Person identity at the end of the day. One message lists the Tasks still yours that were assigned that day, due soon, or overdue, and each line opens that Task. You do not get mail for work you assigned to yourself, for Import or unattended Assistant creates, or for owning a Task you are not assigned to; Comments still mail immediately and Notifications stay Comment-only.
Allowance packs sold in dollars
Owners buy extra Assistant allowance as $10, $25, or $100 packs, and a pack adds that many dollars of extra. Settings pack buttons show those dollar amounts, and the help no longer mentions a euro rate. Ten dollars of Assistant use now takes eleven dollars of remaining, and the Terms of Service name that ten percent.
Opportunities sit after Risks
Registers now has Opportunities, immediately after Risks. You add a title, a description, and the date you identified it; you review it each year, cover Requirements with it, and name it as a response on a Business Issue or Interested Party. The Dutch menu says Kansen, not Verbeterkans, and Findings stay as they were.
Linked items sit in columns
On Details, linked items now sit in a table so codes, titles, and Mandatory or Status line up in columns. Policy, Procedure, and Scope coverage now show Mandatory too. An empty list keeps the table and the same empty wording, and Link and Remove stay as they were.
Requirement Edit keeps columns
When you click Edit on a Requirement, the Catalog reference and the Narrative stay on the left, and Owner and Status stay on the right, the way they sit on Details. The sheet no longer swaps those columns. On a narrow pane they stack as Catalog reference, Narrative, Owner, then Status.
Play reply sits top-right
Play reply now sits in the top-right of a finished Assistant reply, and the reply text wraps around it. The empty row under the reply is gone. Play, stop, Listening, and who sees the control stay as they were.
Task Edit keeps the right column
When you click Edit on a Task, Owner, Assignee, and Due date stay on the right, the way they sit on Details. Title, description, and Related to stay on the left. The form no longer squeezes those facts into one narrow column.
Add comment keeps its outline
Add comment on Interested Party details now shows its outline on every side, including the left. Other outlined buttons in that same spot keep the full line too.
Comments no longer add bullets
A Comment on text that ran across several bullet points used to add empty bullets to the list, and more appeared every time the page redrew. Lists now keep their own bullets, whether the Comment is saved or still being selected. The highlight, its drag handles, and the Comment card still cover the whole selection.
Long Source stays readable
On Interested Party Details, Party Requirements now sit in a table: Requirement, Source, Mandatory, Last updated, and the row actions. A long Source, including a URL with no spaces, wraps in its column so the wording, badge, and Edit and Delete stay usable. A party with no Party Requirements still shows the heading and the add form only.
Overview hides others' assigned work
Overview no longer shows a Task you own when it is assigned to someone else, or to a Role you do not hold. Next action and follow-ups are work assigned to you, work for a Role you hold, or work you own that nobody holds. The Tasks page still lists owned work and names the assignee.
Other open tasks includes undated work
Other open tasks on Details now lists leftover work that has no due date, as well as leftover work that is overdue or due within 31 days. Work due later than that stays off the list.
Party Requirements sit higher
On Interested Party Details, Party Requirements now sit after Comments and before Covered requirements. You no longer scroll past coverage, Responses, Workflow, and Other open tasks to see what the party imposes. Add, edit, and delete stay on the same rows.
Tool activity is one sentence
When the Assistant reads, writes, or runs a Web Search, the conversation now shows one quiet Tool activity sentence between messages, for example `3 reads, 1 write`. The numbers rise as soon as a call starts, a failed call still counts, and a kind that did not run is left off. A Platform Administrator still sees each stored call on conversation Details.
Archive cancels live attestation
Archiving a Policy or Procedure now cancels open Approval and Awareness for that document. Done stays as proof. Bringing it back asks again only people not already covered for the current words, without treating unarchive as a word change.
Other open tasks stays residual
Other open tasks on Details now lists only leftover work that page does not already host. Policy no longer repeats Approval or Awareness there; Procedure drops Awareness; Continuity Plan drops test execution. Person Details still shows that person's Approval and Awareness.
Closed-license clean-up completes
The clean-up that removes an Account's Compliance data a year after its license closed deleted parent records before the records that point at them, so it stopped at the first Requirement with an owner. It now removes dependent records first and finishes.
Meetings and gap analyses open wide
Starting a Meeting session, starting or resuming a gap analysis, and opening an Event's transcript now open the conversation in a wide Assistant panel on the page you were already on, instead of taking you to a separate page. Accepting a Check result or following a link back to an earlier conversation opens it at your current width. The chevron tab still tucks the panel down to a rail, and a panel you set wide is wide again when you bring it back.
Assistant lookups list valid names
When the Assistant looks up a stored record and names a field or relationship that kind does not have, the refusal now lists the names that kind actually has, so the next call can copy them. A filter that uses a value the field does not accept lists the valid values, or names the field's type. In a Meeting session and in a typed turn, it loads the Entity catalog before the first lookup, and it does not look up in the same step as that load.
Resume no longer starts lookups
When you resume a Meeting after wrap-up, the Assistant no longer starts looking up records and talking on its own. If a lookup is refused, it is not tried again in that same answer. After six lookups in one answer, it speaks from what it has.
Edit keeps the right column
When you click Edit on a Supplier, Risk, Asset, Person, or other ordinary register, the short facts stay on the right, the way they sit on Details. Name and description stay on the left. Policy, Procedure, and Scope editors already worked this way.
Meeting session hears the room
The Assistant now hears what is said in a Meeting session. It used to hear nothing, so it never answered while the meeting ran. When it looks something up mid-answer it now replies once instead of talking over itself, and resuming a meeting no longer makes it speak before anyone addresses it.
Account choice is at Auth
You no longer pick an Account inside Compliance. The Account you chose at Auth Sign-in is the one you work in here. Switching Account from the identity menu goes to Auth and brings you back in the new Account.
Voice follows spoken language
Voice is now on Dutch Member and Gap analysis conversations, same as English. Dictation, read-back, and Meeting speech follow the words in the room, not a language you pick. Start meeting no longer asks for a language; announcement, notes, and wrap-up stay in Content language from when that Meeting started.
Meeting sessions with the Assistant
From the Assistant panel you can now start a Meeting session: name the meeting, pick English or Dutch, list who is in the room, and confirm that everyone present has been told. While it runs the Assistant listens through your microphone, keeps live notes, answers when addressed, opens the record the room is talking about on your screen, and every account member can read the session and type into it. When you stop, the Assistant proposes the final notes, Findings, and Tasks as one list, and nothing is saved until someone confirms by typing; the meeting itself is kept as an Event of kind Meeting.
Checks moved under System
Checks now sits in System, after Import and before Assistant Grounding. It is no longer listed under Operations next to Tasks and Planning. The page is still `/Checks`, and Accept, Decline, and starting a Check work the same way.
Planning filters and stacked months
Planning now has a filter bar with Framework, Who and Kind dropdowns, and it remembers your choices between visits. Pick a Framework to see only the work that demonstrates it, or pick a Person or a Role to see the year as they see it. Two or more items of one kind due in the same month now fold into one line with the count and the date range, and a click opens them in place.
People selection survives a refresh
On the People page, the people you ticked for a Merge stay ticked while you search, sort or change a filter. The Merge button follows your selection after the list refreshes. Before, the selection was lost as soon as the list updated.
Assistant panel gives back space
The collapse control is now a small tab on the Assistant panel's edge, so your conversation starts at the panel's border and the column that button used to take goes back to the page. Collapsed, the panel shows the Assistant mark and the name of your current conversation running down it, instead of only an icon. Clicking that name reopens the panel with your conversation list already open.
BIO2 is now adoptable
BIO2 (2026) appears on the Frameworks list. You can Adopt it with or without ISO 27001, work its Requirements on the same screens as every other Framework, and accept Proposed coverage from work you already did on matching ISO 27001 Requirements. On a paid License, adding the BIO2 line costs the same as ISO 27001.
Draft expand opens the conversation
Expanding a new, empty Assistant conversation from the panel now opens the full-page conversation. It used to show a missing page. A conversation that already has messages still expands as before.
Compliance fits narrower screens
The Assistant panel now collapses to a slim strip at the right edge and reopens with one click; your choice is remembered on that device, and it starts collapsed on a narrow window. A Comment on a Phrase no longer takes a column beside the text — the Phrase is highlighted, and clicking it opens the Comment with its edit and delete actions. Pages, the comment editor, and the edit forms now fit the space they actually have, so Compliance stays usable on a laptop at 150% or 200% display scaling.
Comment notification emails get a design
The mail a Comment sends now reads like a designed email instead of a centred block of text: a heading names the author and the record, the Comment sits in its own bordered card with its paragraphs, lists, links, and Mentions intact, a line says when you were mentioned, and a button opens the Comment. Nothing about who gets mailed changed.
Review covers Awareness
Completing a Review of a Policy or Procedure now covers Awareness for the Person who completed it. Pending awareness shows them as acknowledged and drops the Awareness task from their inbox. People who already completed a Review of the current words are now Covered too.
Requirement pages stay live
A Requirement detail page now updates when another person saves it, or when the Assistant or an Import writes. Catalog codes with a period, such as 5.2, used to drop the live connection, so you had to reload. Other register pages still update as before.
Pages keep loading during updates
Opening a page no longer fails just because a License column is still being added. You still see the page, or a prompt to buy or extend a License.
Admin refusals answer 403
If you open an admin page without being a Platform Administrator, Compliance answers 403 and signs you out. That used to look like a server crash.
Asset Review per Custodian
A live Asset must name a Custodian, who then has one open Asset Review for all those Assets instead of one Task each. Completing that Task records the Review for the list you still see — you can Retire or change Custodian from a row, and opting out on Asset Details leaves that Asset out without moving the due date. Planning shows one Asset Review per Custodian and opens that Task; existing per-Asset Reviews are replaced by it, due on the earliest date they carried.
Continuity Plans with tests cannot be removed
Continuity Plan Details now has a remove action in the ⋮ menu, for a plan created by mistake. A plan that already has Continuity Tests cannot be removed — the refusal says those exercises have to be dealt with deliberately. A never-tested plan still removes cleanly. The Assistant's `delete_entity` can remove a Continuity Plan the same way.
Edit forms keep their dates
Opening Evidence, an Incident, or a Person no longer blanks the dates already on the record. Saving without touching those fields leaves collected-on, expires-on, detection time, breach-awareness time, and start date as they were. Creating a Person still fills start date with today, and that date is the one that is stored.
Title band spans the Sheet
On a wide screen the Title band on Settings, the Risk Matrix, Applicability, and several other pages used to stop in the middle of the Sheet, leaving a white strip. It now runs to the Sheet's right edge on those pages, the same way it already does on Policies. The text and forms still wrap at the same width as before.
Dock and Rail follow your language
The Dock and the Rail now show their names in the language of the page you have open. Switch to Dutch, and both columns change on that page. Switch back to English, and they change back.
Your agreement on the Legal page
Compliance's new Legal page shows who on your Account accepted the Terms of Service and the Data Processing Agreement, and on what date, so you can answer an auditor without asking a colleague. It also links the five documents and offers them as one download. Settings no longer lists those documents itself — it points at the Legal page, so there is only one list to keep current.
A clearer legal agreement page
The page where your Account accepts our terms has a new look: a short introduction on the left, the documents on the right. The Terms of Service and the Data Processing Agreement — the two documents your tick agrees to — now stand apart from the Privacy Notice, the Subprocessor list, and the Company details, which are there to read but not part of the agreement. Every document opens in a new tab, and on a narrower window the two halves stack.
Agree before using Compliance
Someone on your Account must tick the Terms of Service and the Data Processing Agreement before anyone can open the ISMS. After that, Settings lists those Legal pages so you can read them again. When a License ends we keep the ISMS for 365 days, then we delete it; a new License in that window keeps it.
Onboarding starts on Overview
Until Onboarding is finished, Overview's Next action is adopt a Framework, then write the Organisation Profile in the Assistant. Import sits beside that step, and any Person can dismiss Onboarding for everyone after a confirm that cannot be undone. Doing the two steps, or dismissing, ends the springboard and Overview ranks Tasks as it did before.
Last updated opens history
A member opening a Policy, a Risk, or any other Snapshot history page now sees **Last updated** as a relative time. That stamp opens this record's history. Policy, Procedure, Scope, and Training Course no longer repeat the date in the sidebar.
Owner asked on one row everywhere
On every register that asks who is responsible — Assets, Risks, Tasks, KPIs, Objectives, Policies, Procedures and the rest — Owner now sits on one row: a small dropdown on the left saying whether a Person or a Role owns it, and the picker for that choice beside it on the same line. Switching the dropdown swaps the picker at once, in your browser, so nothing is saved and nothing you already typed is lost, and the register saves the pair in one go. Where an owner is optional the dropdown also offers none, and it reads in your own language now instead of showing the raw English word.
Awareness audience matches Owner
On Policy and Procedure New and Edit, the Awareness audience question now looks like the Owner row above it: a dropdown offering Everyone or These Roles, with the role picker beside it on the same line instead of two radio rows below. Choosing Everyone leaves no empty picker — the dropdown fills the row. Choosing These Roles without naming a Role is still refused, with your choice and the picker still there to fix.
Search the requirement and link pickers
On Policy, Procedure, and Scope Edit, requirement coverage is now a single line you click open and type into, instead of a scrolling list of every requirement your account has adopted; the Policy–Procedure link pickers work the same way. Type part of a code or a title to narrow the list, tick as many as you want, and click away to keep them. Mandatory requirements say so in the list, and the right-hand column no longer scrolls inside itself.
Title and Body on the left
On Policy, Procedure, and Scope Edit, and on Policy and Procedure New, Title and Body sit on the left. Owner and who must complete Awareness sit on the right; Edit still keeps requirement coverage and Policy–Procedure links there, and New now lets you choose the Awareness audience before the first save. Everyone remains the default, and Edit no longer asks for Code because the title already names it.
Wide tables stay on Edit
On Policy, Procedure, and Scope Edit, a wide table in Current content now scrolls inside the editor instead of stretching the page past the screen. Requirement coverage and Procedure implementation link pickers stay on the right. Save and Cancel stay in the Title band.
Panels use your browser's scrollbar
A panel that holds more than it shows now shows a normal scrollbar — the same one every other
application on your machine draws, tinted violet so it reads against the panel behind it. Drag it, or
click the empty part of the track to page towards where you clicked; hovering highlights it the way
your browser already does. The content still fades out at any edge that has more beyond it, and that
fade now stops right where the scrollbar starts instead of washing across it.
Owner and Audience on the document lists
On Policies and Procedures, each row now shows who owns the document and who must read it. Review status is gone. Archived sits next to the title; Edited since last review sits next to the last Review date on live rows only.
Select all on People
On People, the box above the row ticks is now Select all, not a white square. It matches the rest of the header. Tick it to select everyone on this page; Merge still needs two or more People.
Choose an Account on first open
When you open Compliance without an Account chosen, you now see the list of Accounts you can open. Confirm still takes you into the app.
Next action outline is complete
On Overview, the Next action card now shows a full coloured outline on every side, sitting on the card rather than clipped on the left. The outline is still red when overdue, amber when due soon, and green when nothing is outstanding.
Set Awareness on Edit
You set who must complete Awareness on Policy and Procedure Edit, and Save writes it with the rest of the document. Details still shows the current audience under Owner, without a Save of its own.
Awareness names who must read
On Policy and Procedure Details, under Owner, you choose who must complete Awareness: everyone, or the holders of named Roles. People outside that audience drop from the inbox at once, and a finished Awareness stays as proof. Approval is still the account-wide Policy Approver flag.
Evaluations and Tests hold clocks
Adopting a Framework now creates Internal Audit, External Audit, and Management Review Evaluations for it, each with its own Cadence. A Test is a named pentest or backup restore you add yourself. Recording through that parent writes the Event and moves Next occurrence, and New Event offers only Gap Analysis and Regulatory Inspection.
Planning shows the year's work
Operations now has a Planning page. It shows one calendar year of the account's open Events, Reviews, Continuity tests, KPI measurements, and repeating training. Leftover work from before 1 January sits at the top; filter by kind or change year, and a click opens the record, not the Task.
Title first; actions stay right
On a Details page the record name now sits first in the Title band, with the code and status under it. Edit, Save, and the other actions stay on the far right even when the title is long; a title longer than two lines stops there and shows the rest when you hover. A little space sits above the title so it is not flush against the breadcrumbs.
Title band stays put; Save lives there
On every page with a Title band, the band stays at the top of the sheet while the content below it scrolls. On Edit and New, Save (or Create, Log, and the other create labels) and Cancel sit in that band next to the title — including Policy, Procedure, and Scope, where the body editor still fills the pane under the band. You no longer scroll to the bottom of a long form to save.
Frameworks catalog is a table
The Frameworks page lists every shipped Framework in a table, with adopted ones first. Each row shows the name, an Adopted badge or a blank, a short description you can hover to finish, and Adopt or Unadopt. Click the row to open that Framework, or use Adopt or Unadopt on the row.
Find anything from the header
Every page now has a search box in the top bar — click it or press Ctrl+K and type at least two characters. It finds pages, records in every register, and framework requirements, matching names, codes, email addresses, and the text in a record's body. Arrow keys and Enter open a result, and matches on a name or code rank above matches found only in body text.
One header identity menu
The header now has one menu instead of two. It shows your initials, the Account you are in, the other Accounts you can open, Manage account, and Log out. The actions menu on a record uses the same raised panel and compact rows.
Long conversations stop moving the page
When you open a conversation long enough to scroll, the page itself no longer moves. The header, the left dock and both sheets stay where they are, and there is no empty space below the app to scroll into. The conversation still scrolls inside the panel, and the box you type in stays at the bottom.
Scrolling panels show they scroll
A panel that holds more than it shows now carries a slim violet bar down its edge, tinted to this app, and its content fades out at any edge that still has more beyond it. You can drag the bar, or click the empty part of it to page towards where you clicked. On the Policy and Procedure edit pages the whole right column carries one too, not just the pick lists inside it.
Accept starts a working conversation
When you Accept a Check result, the Assistant now starts on a live product, the same one a new draft would use. If your Preferred Assistant model is still offered, Accept uses that; otherwise it uses Grok 4.6. A conversation that already failed stays readable and still refuses a new send; Accept the same result again to get a working one.
Checks sit next to Tasks
Operations now has a Checks page. You pick one named Check — Uncovered Risk, Policy coverage adequacy, Procedure implementation adequacy, Document merge, or Document split — confirm the unit count and that it spends Assistant allowance, and the results land in that inbox. Accept opens the Assistant to apply the suggestion; Decline quiets it for everyone until the words, the links, or which records are live change.
You can speak to the Assistant
On a Member conversation or a Gap analysis session you can click the microphone, talk, and see the words appear in the draft so you can edit them before you send. Turn Listening on if you want each new Assistant reply read aloud when it finishes; you can also play one reply. Voice does not run in Dutch yet, and it is not on Import.
Settings save as you change them
The Settings page is now three tabs — Assistant, Default content, and Cadence — so each concern has its own screen. Save buttons are gone: a dropdown saves the moment you pick a value, and a default text saves when you click away from the editor. Choices that take something away — setting a cadence to None, or restoring a text you customised to the product default — ask you to confirm first.
The left dock names its sections
Each of the six section icons in the left column now prints its section name underneath, so you can read where a button leads instead of hovering it to find out. The column is a little wider so the longest name fits on one line in both English and Dutch, and the violet marker for the section you are in now covers the icon and its name as one block.
Title bands drop their description
Every page's title band now shows the page title alone. The line of grey text that used to sit
under it is gone, so tables, forms and registers all start higher up the screen.
Evidence download is a button
On an evidence record, Download now sits next to Edit at the top of the page instead of in the
small line of text under the title. It works the same for images, PDFs and files you cannot
preview.
A new look and navigation
Every page now sits as a white sheet on a gray canvas, opens with a tinted title band, and uses a new typeface with calmer colors. The long left menu is gone: a slim dock of six section icons sits on the left, and the icons open a rail listing that section's pages. Framework pages, admin pages, and Assistant conversations share the same shell, so the header and navigation stay put wherever you go.
You can buy Compliance
Start a 30-day Trial with no card, then Subscribe for each Framework line you have adopted. Fourteen days before the License ends you see a notice and Owners get email. Settings shows remaining Assistant allowance in USD; Owners can buy extra packs, and new Assistant work stops at zero remaining.
You can edit Comments
You and the Assistant can edit any Comment. You can `@` Mention a Person in the editor, and a Mention notifies that Person only from a Comment. Phrase Comments stay faintly marked, and you can drag the ends of a selected Phrase to cover different words.
Supplier Review follows Criticality
Each Supplier now has a Criticality of Critical, Important, or Low-risk, and a new Supplier starts as Important. Supplier Review uses a Cadence setting per Criticality: yearly for Critical and Important, every two years for Low-risk, or none. Recording a Review copies Default content into the editor, and after Complete you can still change the body, outcome, and performed date from Supplier Details or the completed Task.
Overview names your next action
The Overview now opens with the one task most urgently waiting on you, the five due after it, and a line counting active work nobody holds. Beside it a health rail states where you stand on Tasks, Objectives and each adopted Framework: a band named in words over a bar of the counts behind it, never a percentage. The fifteen register cards are gone, since the left nav already links every register, and the Tasks page gains a Held by nobody assignee filter so that count reaches exactly the work it counted.
Comments notify owners and Mentions
Leaving a Comment notifies each accountable Person and anyone you Mention with `@`. You get a Notifications page and a top-bar unread badge. Opening a Notification jumps to the Comment and marks it read. Each notice is also emailed to that Person's primary email when they have one, with the Comment body. Merging People moves their Notifications onto the survivor.
Event Comments return to Event Details
When you leave or delete a Comment on an Event, you stay on Event Details. You are no longer sent to a URL that has no page.
Party Requirements have no Comments
A Party Requirement on Interested Party Details shows its wording and row actions only. Remarks about what a party imposes go on the Interested Party itself — Phrase on the description, or a Comment on the party as a whole.
Comments on a Phrase
You can leave a Comment on selected words in a Procedure, Policy, or any other register Details page, or on the row as a whole. The Task list you already know is that same Comment store. The Assistant can leave or delete a Comment, and a Phrase Comment leaves when those words are gone.
Assistant reads whole documents
When the Assistant reads a Policy, Procedure, Finding, or other document, it gets the whole text. It can read at most five such documents in one query. Asking for a sixth is an error so it can narrow the query instead of guessing the rest.
Send stays on screen
The Assistant's message box, file attach, model picker, and Send sit at the bottom of the window on every Compliance page. The window itself does not scroll. When the left menu is longer than the window, you scroll that menu.
Assistant answers after reading
When you ask a factual question, the Assistant reads the records you named, finishes any list those reads return, and then answers. It does not keep researching after that one read. A new conversation's title is a short topic, not the name of a compliance assistant.
Pages keep their full height
Register lists, details, and forms keep their headings and filters at full size. You scroll the main area when a page is taller than the window. The left menu and the Assistant stay as tall as the window.
Create follows Cadence holds
When you create a row that has a Cadence, the first Review follows the same Cadence holds that already stop a running Review. Account none leaves no first Review and no later obligation until you reactivate an Interested Party, mark a Requirement applicable, or resume a Cadence opt-out. Adopting a Framework while Requirement Review is none no longer records a Review on the new Requirements.
Conversation titles stay short
A new Assistant conversation still gets a short topic title of at most six words. That title step now uses a fast non-reasoning model, so a long opening message is less likely to keep the first-line clip instead of a generated title. Topic Split on a follow-up uses the same non-reasoning model, so a new topic is less likely to be missed because the classifier thought past its deadline.
Assistant finds phrases
The Assistant can find Findings whose title contains a phrase you mention. Letter case does not matter.
History stays readable
When you open History with the Assistant still open, you can read every field of the selected Snapshot or of Current content as whole words. If a label and its value cannot share a row, the label sits above the value. When the selected row has no document body, the fields use the full width of the page.
Record pages stay live
When anyone saves a record you have open — you, a colleague, the Assistant, an Import, or a job — that Details page updates without a reload. A failed save or a blocked Delete does not move anyone else's page. Delete still takes you to the register list; a missing Details or Edit URL is a Gone page that names the kind and links to the list. Scope and Assistant Grounding keep their empty state when nothing is written yet.
Changelog lists every Changelog Entry
When you open Changelog, the right side shows every Changelog Entry in one list, newest first. Click or arrow a table row to jump to that Changelog Entry. As you scroll, the table highlights the Changelog Entry whose heading sits at the top.
Assistant runs only on xAI
The Assistant picker lists Grok 4.6 then Grok 4.5. New drafts start on Grok 4.6 unless you already prefer Grok 4.5. Gap analysis, Import turns, titles, and topic split all use Grok 4.6. Conversations locked to Sonnet 5 stay readable; send and attach on those threads are refused so you start a new conversation instead. Web Search on Member chats stays on xAI.
Grok chats finish after tools
A Grok 4.5 Assistant Conversation that needs tools now finishes with a reply. The conversation no longer goes Idle after the first tool. You still never see Thinking.
Archive and exclude stop Review
Archiving a Policy or Procedure, or excluding a Requirement, is a Cadence hold: the open Review is cancelled and there is no Next review due. Unarchiving, marking applicable again, or lifting any other hold does not record a Review; Next review due is Last reviewed at plus one Cadence, or today plus one Cadence when never reviewed. Rows already archived or excluded lose any leftover open Review.
Evidence stays editable after Done
You can attach, upload, or detach Evidence on a Done or Cancelled Task. The Task page, the Evidence details page, and the Assistant all allow it. Complete still refuses when the Task requires evidence and none is filed.
Pages look and work again
Pages look right again. Tables sort and page, menus and dialogs open, and the editor starts. Snapshot history matches the rest of the product.
Continuity test dates follow the record
Last tested is the latest Continuity Test date. Next test due is the open test Task. Those dates are no longer stored on the plan, so a Cadence change cannot leave a stale next due.
A Person identity needs an email
Every Person identity must have an email. A login is only the cache for that email, not a second identity.
Reopen starts the walk again
Reopening a closed Incident or a false positive leaves only the detection date. Later steps read as not reached, so the old containment cannot sit in front of a new triage.
Stop on an idle chat does nothing
If you hit Stop when the Assistant is not running a turn, nothing changes and the next message still runs. Stop only applies while a turn is Running. Close stays a Gap analysis act.
Skipped Import pages stay unmarked
A structurally empty Import page is Skipped and cannot be marked for the next run. Only Pending, Failed, and Completed pages accept a mark. A last error shows only on a Failed page.
Import Continue follows failed pages
An Import session no longer stores Halted or Completed as its own outcome. Continue appears only when a page failed. Retry of a failed prepare no longer wipes pages that already exist.
Scope is only there when you wrote it
Related-to on an ad-hoc Task no longer offers Scope until the account has a Scope statement. The Assistant also answers that Scope does not exist in that account, instead of inventing a fallback title.
Event targets stay on four kinds
An Event can only target a Policy, Requirement, Risk, or Asset. Coverage and response links refuse kinds they do not accept.
Coverage cannot attach to an excluded Requirement
You can no longer link coverage to an optional Requirement the account has decided out. Those codes stay off the Link Requirements lists, and the Assistant cannot add them. An undecided optional Requirement still stays off those lists, but Accept of a Coverage proposal and the Assistant can still cover it.
Requirement status is maturity only
Excluding an optional Requirement no longer stores a NotApplicable status. You give a justification, the owner is cleared, and status stays Planned, Implemented, or Operating. Marking it applicable again still brings it back as Planned with you as owner.
Finding and Vulnerability state is the live step
A Finding that loops back after Not Effective, or that you reject and reopen, shows the step you are on — Action in Progress or Root Cause in Progress — not Reopened. A Vulnerability after Incomplete Remediation is Remediation in Progress. Saved filters that said Reopened list those same rows.
A spawned Task is about one record
A Finding Root Cause Task can no longer be about a Policy, or about two things at once. Auto-spawned work carries exactly one Related-to link of the kind that source is about. Ad-hoc Tasks can still mention several records, or none. New Training assignments include a link to the Course.
Return needs a real owner
You cannot mark an Asset as returned to owner while the organisation owns it. There is no party to return it to.
Gap analysis names a Framework
A Gap analysis Event must name a Framework. You can no longer clear that Framework on Edit.
Chat files stay put
Files you attach in an Assistant conversation no longer live in the Evidence file tree. A nightly Evidence cleanup cannot delete them. Promote to Evidence still makes a separate copy.
Interrupted chat can continue
If a restart cuts an Assistant turn while a tool is still running, the conversation goes idle with the restart error and the unfinished tool is marked failed. You can send again. The Assistant sees that the previous tool did not finish.
Assistant can search the web
When you chat with the Assistant about this account's compliance work, it can look up a current public fact on the web if your records and the Catalog cannot answer. The reply shows numbered citations and a Sources list you can open. Gap analysis and Import do not search, and questions that are not about this work get a short refusal.
Five more Details pages match
Continuity Plan, Critical Activity, Business Issue, Interested Party, and Training Course Details now look like the other registers: code above the title, Edit and View History in the header, facts in a sidebar, lists and their actions in the main column. Archive, Reactivate, and Delete sit in the ⋮ menu on Business Issue and Interested Party. The Edit, link, Record a test, and New assignment forms you open from those pages use the same header.
Cadence settings and opt-out
Every repeating Review, measurement, test, assignment, and next-event now uses one account Cadence setting on Settings: a Cadence period or none, yearly by default except Gap Analysis and Regulatory Inspection. Changing a setting moves or pauses open work; a live row can record a Cadence opt-out with a required reason, and earlier reasons stay listed after Resume. Training Courses use a yes/no repeats choice instead of months, and Supplier tier no longer changes the Review due date.
Dutch too-large conversation
When your browser asks for Dutch and an Assistant conversation is too large to process, Compliance now shows that error in Dutch instead of English.
Account picker Confirm works
When you have more than one Account, Confirm on the account picker now selects the Account that is already showing. You do not have to open the list first.
Type to find growing lists
You can type in a Person, Role, Supplier, or other list that grows with the account to find a row instead of scrolling. Short fixed lists such as Status and Severity stay the compact dropdown you already have. The Assistant conversation list works the same way; choosing a model does not.
Dutch reads as native domain Dutch
When your browser asks for Dutch, Compliance addresses you as *je*, action buttons use the infinitive (*Opslaan*, *Verwijderen*), and the HTML language is `nl`. Register names match auditor Dutch: *eisen*, *belanghebbenden*, *gebeurtenissen*, *bedrijfsmiddelen*, *personen*, *toepasselijkheid*, *kennisname*, *beoordeling*. Product-coined names stay English.
Assistant plans before acting
The Assistant now plans before it calls tools, so a turn spends fewer extra model rounds. You still see only the reply and tool activity — never the scratch pad, including in a Shared conversation. A Platform Administrator can read a Thinking summary on an Anthropic turn (and in the Markdown export); Grok notes stay encrypted and blank.
Depart date starts today
When you mark a Person as departed or terminate a Supplier, the confirmation date starts as today and the page no longer shows a blank red error bar before you submit. You can still pick another day. An empty date is still refused.
Attach CSV in Assistant
You can attach a **.csv** file in an Assistant conversation the same way as other Conversation Attachments — file picker, drag-and-drop, and the usual chip before send. The Assistant reads the raw CSV text (including comma or semicolon exports and common Excel encodings) so it can answer about the rows and, when that is clearly what you asked, propose creates or updates you still confirm. Download and promotion keep the original file bytes.
Changelog list uses table rows
The Changelog entry list is a selectable table with date and title columns, normal row height, and the same row chrome as other lists in the product. The megaphone control in the top bar lines up with the account and user menus beside it.
Tasks return after complete
When you finish or cancel a Task from its full page, the product sends you back to the page you came from — inbox filters included — so you are not left on a Done or Cancelled Task. If you opened the Task from a bookmark or link with no origin, you land on the single related register when there is one, otherwise the Tasks inbox.
Choose Assistant model per chat
On a new Member Assistant conversation you can pick **Sonnet 5** or **Grok 4.5** next to attach and send when this environment offers them. The first message or attachment locks that product for the thread; the control stays visible but disabled so you can see which product ran. Your last locked choice becomes the default for the next empty draft in this account. Platform Administrator conversation detail and Markdown export show the locked Conversation model as their own field.
Approvers skip Policy Awareness
A **Policy Approver** no longer gets a separate **Awareness** task on a Policy: create, word change, and return-to-work ask them only for **Approval**. Completing Approval for the current words is enough proof that they read them; the Awareness panel and counts list only people who still owe Awareness. Turning the Policy Approver flag on or off moves open tasks to the right kind in the same save, and existing dual asks for current approvers are cleared on heal after deploy.
Changelog layout fills the screen
The Changelog control in the top bar is a full circle. On the Changelog page, the entry list and the selected note share the full height of the main area and each scroll on their own, so the page no longer leaves a large empty band under a short list.
Changelog in the app
When you are signed in, a Changelog control sits at the far right of the top bar. Open it to read this app's product notes, newest first, with the list on the left and the full note on the right. A small red mark appears on the control when this browser has not yet opened the newest note; opening Changelog clears the mark until something newer ships.
Assistant composes one stored-record query
The Assistant no longer picks from a fixed menu of list, get, summary, and organisation-profile reads for your account records. It loads a catalog of what it may query, then asks for one entity kind with the conditions, fields, sort, and page it needs — including filters on related rows — so bulk work such as “tasks on findings raised before a date” is one request instead of many. Text search, framework catalog wording, gap state, compliance overview, conversation attachments, and conversation lists stay on their own tools; writes still list the exact rows you confirm.
Creating or reworking a register records a Review
Adding a Policy, Risk, Asset, or other included reviewable row no longer leaves it showing **Never reviewed** when you create it yourself: last reviewed is the create day and the next review is due one full cadence later. Editing the substance later (outside a 24-hour window from last reviewed) also moves last reviewed and next due the same way. Import and other unattended creates still ask for a first human review in 30 days. Supplier reviews and KPI measurements are unchanged — those still need their own complete form. Approval stays separate from Review.
Tasks can be edited
You can correct a task's title, description, due date, evidence requirement, owner and assignee from an Edit page on the task, or by asking the Assistant - without cancelling and recreating it. Every task now has a history that records each version and who made it, including edits after the task is done. Approval and awareness tasks that are already finished keep their assignee frozen so the record of who attested stays true.
History names who made each change
Every register's history now shows **Committed by** with a name on versions a person caused, where sixteen of the twenty used to say the author was unknown. It names that person whether they typed the change into a form, asked the Assistant to make it, or uploaded a document an import read. Versions nobody caused — a scheduled spawn, a background job — still say plainly that no person is recorded, and versions from before this change stay unattributed.
Tables you write line up with their headers
A table in a Policy, Procedure, Scope or any other rich-text body now puts each header directly above its own column, both on the page and while you are editing it. A table too wide for the space beside it scrolls sideways inside its own bordered box, so the page itself never scrolls sideways. The look is the same as before: rounded bordered box, a line between rows, compact cells, and the row under your pointer highlighted.
History shows what each Snapshot changed
A register's history now shows the record as it stood at each Snapshot, laid out the way its own Details page lays it out. Pick a version from the list on the left and the page marks what changed against the version before it — removed wording struck through with the new wording beside it, each changed field showing its old value and its new one, and a summary counting the paragraphs and words that changed and naming the headings they sit under. Owners and other linked records now read as a code and a name that links to that record, instead of a raw id.
Record rows that already ended
You can now add a person who has left, a supplier whose contract ended, an asset that was disposed of or returned to its owner, or a risk, business issue, interested party or measure that is finished — pick that state as you add it and give the date it happened, instead of adding it as live and ending it straight afterwards. A row added this way asks for no review and leaves no task behind. Closing a Risk, or archiving a Business Issue or Interested Party, now stops its review task as well, and reopening one starts its reviews again.
Retired assets stop asking reviews
Retiring an asset, or returning it to its owner, now stops its yearly review: the open review task closes and no new one is scheduled, so the Tasks inbox no longer chases equipment that has left the inventory. Reactivating the asset starts its reviews again, with the next one due a year out. Assets that were already retired or returned before this change have had their reviews stopped too.
Search keeps your cursor
When you type in a table's search box, the list reloads without taking the cursor out of the box, so you can keep typing where you left off. Sorting a column or changing a filter beside a table also keeps focus on the control you just used. Paging buttons do not keep focus yet; that is tracked separately.
Linked records show names
On Event Details, Targets list each Policy, Requirement, Risk, or Asset by code and name as a link to its Details page, not by a raw id. When you open New Task with a pre-linked record, the banner uses the same code and name link so you can see what the task will relate to before you create it.
Finding Source names the record
On a Finding raised from an Event or Incident, Details, the Findings list, and Edit now show that source as its code and title (for example `EVT-003 — Server room flood`), not only the word Event or Incident. On Details the Source field is still a link to that record; on the list and Edit it is plain text, and an ad-hoc Finding keeps plain type text with no link.
Approval stays across ordinary edits
Open Approval and Awareness tasks no longer cancel when someone only changes the owner or other non-word fields, and you can keep approving without waiting for Snapshot history. A new task appears only when the title or body actually changes; people who already finished keep their earlier proof, and coverage counts only completions from the latest words.
Requirement Details open again
Opening a Requirement under a Framework no longer fails when a Review form is due. You get the same Workflow card with Save and Complete that other registers already show.
Role-owned docs open attestation
When a Policy or Procedure is owned by a Role, the nightly job opens Approval and Awareness rounds after the content settles, the same way Person-owned documents already do. Each round still has a named Person as Owner — the person who last committed the words, or an Active holder of the Role.
Result fields keep the caret
On Task details, and on Finding reject and Vulnerability accept or false-positive forms, a click in the rich-text result or rationale field keeps the caret there so you can type. Focus no longer jumps to the editor’s Undo button on that first click. Toolbar Undo still works when you choose it.
Details tables look consistent
On Event Details, Targets and Findings use the same table look as other related lists in Compliance, with headers, empty messages, and remove or open actions unchanged. Free-form tables in Event Description and other rich-text bodies match that look. Attached Files and Attached Evidence panels on every host Details page are tables too, with upload, title links, and remove still in place.
Workflow card and near-due tasks
On register Details, **Workflow** shows the current Review or chain step in a calm, due-soon, or overdue card, with Save and Complete on the page even when the Review is far away. **Other open tasks** lists only linked work due within 31 days or already late, and never the task already on the card; Findings and Vulnerabilities use a step pill strip instead of tabs. Task pages share the same look and stay about that one task.
History shows Current content
On any snapshotable history page (Policy, Procedure, Risk, Supplier, and the rest), you always see what is live now, not only settled Snapshots. When live content has moved on, a **Current** line sits at the top with a short what-changed summary and opens the live record; when it already matches the latest Snapshot, that version is labelled **(current)** instead of showing a duplicate card.
Filter selects stay open
On Requirements and other list filters, a Framework, State, or similar dropdown stays open on the first click so you can pick a value without fighting the control. Background work (such as the assistant panel loading) no longer snaps the list shut.
Edit side column uses full form height
On Edit Procedure and Edit Policy, the requirements and policy/procedure pickers sit in a right-hand column that starts next to Code, Title, and Owner — not only beside the body editor. The column uses the full form height and still scrolls when both panels need more space.
Procedure and Policy Edit side panels
On Edit Procedure and Edit Policy, the right-hand panels stack from the top of the column without overlapping titles or hints. When both panels need more height than the body editor row, that column scrolls as a whole. Capped lists inside each panel still scroll on their own.
Readable capped choice lists
On edit and attach forms, long choice lists (requirements, policies, procedures, KPIs, roles, people, and similar) keep each row at a normal height and scroll when the list is full. Labels no longer crush together on shorter screens.
Roles as owners
You can define Roles, assign People as holders, and name a Role as Owner or assignee on work across the product. Vacant Roles stay legal but show a warning and a flag on the Roles list so work with nobody behind it is visible. Job Title on a Person is only a free-text label and no longer drives accountability.
Interested Party register
Interested Parties are a first-class register with IPY- codes, yearly review tasks, Requirement coverage, and links to how the organisation responds. You manage parties the same way as other registers instead of burying them only inside Context.
Coverage proposals after adopt
When you adopt a Framework, the product proposes Requirement coverage from the catalog Crosswalk and shows a standing review list plus a home callout. Accepting a proposal creates ordinary coverage links; you are guided back into that list after adopt.
Correctable register dates
Identification, closure, departure, acquisition, and similar recorded dates can be corrected on the records that own them. Departure asks when the person left, and the Assistant can record the source’s date when it writes.
Incident response timeline
Incident Edit draws the response timeline as a walked path of timestamps you can correct. The path matches the order of real response steps instead of a flat list of fields.
Requirement Edit layout
Requirement Edit uses the shared Details layout and keeps a clear Catalog Reference block. Editing a Requirement matches the pattern of other register Details pages.
Task state stays independent
A Task’s state no longer flips just because its assignment changed. Completing or cancelling work still moves state; reassigning alone does not.
Asset owner and custodian
An Asset’s Owner can be the organisation, a Person, or a Supplier; the Custodian carries accountability as a Person or Role. Retire, reactivate, return to owner, departure, and supplier termination move ownership and custody in line with that model.
Safer deletes for findings
You cannot delete an Event or Incident while a Finding still points at it as source. Task templates tied to a record leave with that record so orphaned templates do not remain.
Snapshot history everywhere
Registers keep Snapshot history, and Policy, Procedure, and Scope attestations bind to a Snapshot rather than a bare timestamp. One history view covers every snapshotable record so past versions stay reviewable.
Mark Departed for people
Departing a Person is one Mark Departed action with an optional Successor, instead of a multi-step offboarding ceremony. The separate Offboarding status is gone; Active and Departed are the lifecycle you manage.
Simpler People and Suppliers
People no longer carry Screening and NDA fields that nothing read. Supplier forms drop unused contract and reference columns so the registers show only fields the product uses.
Form errors stay on page
When a save fails validation, the form re-renders with the errors instead of a dead-end response. Members see what to fix without losing the page context.
Departure transfers work
Marking someone Departed cancels their open attestations and can transfer ongoing obligations to a Successor. Recorded history of who did what is not rewritten.
Event sign-off removed
Events no longer have a separate sign-off capability. Closing out oversight work runs through Findings and Tasks instead.
Assistant historical dates
The Assistant can write historical backfill with honest dates on the write surface. Past-dated work no longer has to pretend it happened today.
Reviews from review tasks
Review state is derived from review Tasks rather than a stored review status field. What you see on a record matches the open and completed review work.
Assistant bulk-friendly tools
Assistant reads and writes are shaped for bulk work with fewer round trips. Long conversations keep useful tool results without wiping the whole thread when the token budget is tight.
Reject or reopen Findings
You can Reject a Finding with a reason, or Reopen a rejected one, as first-class lifecycle actions. Rejection is not the same as closing the chain through normal corrective steps.
Assistant accepts Word files
You can attach `.docx` files in the Assistant for document ingest. Guidance covers ordinary document drop-in the same way as other supported file types.
Person merge and identities
A Person can hold several login identities, and you can merge duplicate People into one survivor. Email-less People remain valid; merge is irreversible like delete.
Smarter Assistant conversations
A new topic can start a fresh conversation automatically, attachments stay transient in context, and you can paste files into the composer. Spreadsheet attachments and gap-analysis Events are supported without overloading one thread.
Tasks Related to filter
The Task overview can filter by Related to, matching the links already shown on Task Details. Deleting a Finding, Risk, Vulnerability, or Event cancels linked Tasks and templates.
Import keeps history
Import reconstructs historical workflow state and no longer collapses Confluence page revisions into one. Policy and Procedure attestation jobs are scheduled so approvals and awareness keep spawning.
Workflow as locked tabs
Multi-step workflows present as sequential locked tabs on Details. Completing a step unlocks the next and refreshes the whole page when a chain finishes.
Richer Tasks register
The Tasks register has search, filters, pagination, and results you can edit from the parent record when the source requires one. Every display code uses a three-letter prefix so codes read consistently.
Faster Assistant send
Sending a message in the Assistant is optimistic so the UI does not wait on the full model turn. Workflow steps show a legible steps strip on the records that use them.
Assistant matches the UI
The Assistant can perform the same register and lifecycle acts the pages support, across the main entity kinds. Search and list tools page results and cover more kinds.
Full-page Assistant chat
Long Assistant conversations open in a full-page view. Conversations persist when needed and can be deleted permanently; gap analysis starts in that full-page view.
Framework gap analysis
You can run a gap-analysis session against a target Framework with a five-state view and shared conversations. The Assistant is told which Framework the session is for.
Procedures first-class
Procedure is its own register, linkable from Policies. SoA is renamed Applicability in the product language.
More regulation catalogs
EU GDPR, UK GDPR, and the EU AI Act are available as Framework catalogs. UK GDPR is a distinct Framework from EU GDPR.
Cyber Essentials catalog
Cyber Essentials is available as a Framework catalog to adopt. Import can recover after a restart instead of staying stuck mid-run.
Business Issue register
Context Issue is renamed Business Issue and lives as a first-class register. Person classification becomes Affiliation, with External instead of Vendor.
Policy approval and awareness
Policy acknowledgement splits into Approval and Awareness tasks. The unused Policy label field is gone; Requirement and Evidence Details match the Risk Details pattern.
Filters you keep
List-page filters persist per user so returning to a register restores your last filter set. Mandatory Requirements get eager implementation records; Tasks show Related to links on overview and Details.
Objectives and KPIs
Objectives and KPIs are narrative registers under a Business menu with Context. The Assistant can create across registers, allow optional Person email, and delete when you confirm.
Import v2 control surface
Import prepare, control, and process orchestration replace the old staging and review flow. You can re-run a completed page, recover from partial batches, and enrol review as soon as content lands.
Live Policy and Scope
Policy and Scope save live; review means approval rather than a separate draft publish dance. Evidence is proof-of-action and registers carry Attachments for files that are not Evidence.
Policy and Scope replace Document
Documents become Policy and Scope as separate concepts. Coverage and import language follow that split.
Details and menu redesign
Detail pages use a two-column layout with status colour and an overflow menu. The left menu groups Compliance, Registers, and Operations; Import moves under System; the Assistant panel stays open.
Assistant admin oversight
Platform admins can oversee Assistant conversations. The Assistant pauses before Delegated writes so a human can confirm sensitive changes.
Multilingual Assistant
Assistant conversations and content language can differ so the model writes in the language you need. Organisation Profile is available as an Assistant read; the app UI is localized.
Compliance Assistant
An in-app Assistant with tools can create and update Compliance records from chat. Conversations get AI-summarised titles; Organisation Profile grounds onboarding and answers.
Unified Requirements page
Adopted Frameworks share one Requirements page instead of per-framework silos. ISO 14001:2026 is available in the catalog; user-facing ISMS wording becomes Compliance.
App renamed Compliance
The product formerly branded ISMS is Compliance throughout the suite. Sign-in, licenses, and links use the new name.
Import review redesign
Import Review is an overview-plus-details flow with tabs. Sessions can be deleted; large uploads use chunked transfer; failures show clearer messages and one-click retry.
Events and Findings model
Oversight work consolidates around Events, Findings, and Documents (later Policy and Scope). Separate audit-only and nonconformity-only registers fold into that model.
Central Tasks system
Reviews, acknowledgements, training, findings, vulnerabilities, continuity tests, and risk treatments run as Tasks with templates and chains. Work shows up in one Tasks system instead of many one-off trackers.
Multi-framework navigation
Each adopted Framework has its own routes and sidebar context. SOC 2 (TSC 2017, rev 2022) is available as a catalog.
Operations registers
People, Assets, Suppliers, Incidents, Vulnerabilities, Continuity, Training, Audits, and Context registers land with their core flows. The sidebar groups areas in certification-aligned buckets.
Risks and Evidence
Risks support scoring, treatment, and a matrix view. Evidence upload, attachment to controls, and Review Cycles give the first proof and cadence surfaces.
Policies and Controls
Compliance launches with Policies, Controls, license gating, and account selection. The app is available for Accounts that hold a Compliance license.