Change Log

Claude Code's permission, bypass and hook controls now apply on every Claude plan. Organizations whose developers use Claude Pro or Max seats can enforce them through the managed-settings files in their package; Anthropic requires a Team or Enterprise plan only for delivering those settings from its admin console.

The survey now records a procedure to disengage or deactivate the AI systems you use. A new control in the AI Governance Programme section asks whether you keep a documented procedure, and a designated authority, to take an AI system out of service when it behaves outside its intended use. Turned on, your policy gains a section setting out when a system is disengaged, the role with the authority to do it and how it is restored, and your manual configuration procedures gain the identity, admin-console and endpoint steps for each technology you selected.

The survey now asks whether you are a provider or a deployer under the EU AI Act. The question appears when you select the Act. Declaring the provider role also turns on the provider-side controls for the platforms you govern, and your policy then states the obligations of the role you declared rather than treating them as conditional.

Claude Code's sandbox, Claude's HIPAA configuration and model entitlements are now governed. You can require Claude Code's sandbox to refuse network hosts outside your allowlist instead of asking, and record that its filesystem isolation stays on. Selecting HIPAA / HITECH now turns Claude's HIPAA configuration on for you on Claude Enterprise, and model entitlements let you restrict which Claude models and effort levels people use. Controls that change what you spend now carry a cost marker beneath their severity.

Questions 4, 5 and 6 now accept technologies the survey does not list. Add up to five of your own under Other on each question. Your package lists them separately, as technologies this assessment does not cover, and they add no controls and leave your risk score unchanged.

Your package now shows how your controls address the leading threats to AI agents. When you govern an AI platform, an Agentic AI Coverage document maps your applied controls to the ten categories of the OWASP Top 10 for Agentic Applications, marks each category as partly addressed or not addressed, and names the survey controls that would address what remains open.

Governance updates now include only changes for the platforms you selected. Changes that apply to every platform, such as a new regulation, appear under an All platforms heading.

Every document in your package now counts the same controls. For SecureShield365 clients who sign in, the README's active controls, the deployment guides, the manual configuration procedures and the Statement of Work now list the same Microsoft controls as your governance policy and delivery email, including the procedure for Copilot image generation.

The survey now records an AI literacy programme, and turns it on under the EU AI Act. A new AI Governance Programme section asks whether you run role-tailored AI literacy training and keep a record of who completed it. Article 4 of the Act requires AI literacy measures of providers and deployers alike, so selecting the Act now turns this control on whichever platforms you govern, and your package includes the steps to run the programme.

The survey now covers the EU AI Act's new Article 5 prohibitions for image and video generation. A new AI Image & Video Generation section, shown when you govern a platform that can generate images, records whether you provide or deploy image generation, which outside services your people use, and whether each image- or video-generating system has been screened against the two points added to Article 5, on non-consensual intimate material and child sexual abuse material, which apply from 2 December 2026. Selecting the EU AI Act turns all three controls on. SecureShield365 clients who sign in can also record their decision on Copilot image generation.

The Security and Trust page now lists every service that handles your data. The database that stores your saved assessment, and the Microsoft sign-in used by SecureShield365 customers who edit one, have been added to the subprocessor table.

Under the EU AI Act or ISO/IEC 42001, the Claude and Codex autonomous-execution controls are now set to Block for you. That covers scheduled and Dispatch tasks in Cowork, hands-off mode in Claude in Chrome, permission bypass and auto mode in Claude Code, full-auto mode in Codex CLI and unapproved computer control in Codex Desktop, wherever your plan can enforce it, so a person can approve or interrupt the agent. Your risk score reflects the change.

Claude audit controls now appear only when you govern Claude. Cowork activity auditing, the Anthropic Compliance API and a chat history retention limit are required by your compliance selections, and included in your package, only when Anthropic is among the platforms you govern.

Copilot Code and the Copilot Plugin Registry are now governed controls. Microsoft Scout is now Copilot Autopilot throughout the survey, following Microsoft's September rename. Autopilot and Code are billed through Copilot Credits rather than a per-user plan, so the survey now asks for that add-on before either can be configured.

You can now have the link to your saved assessment emailed to you again. On the sign-in page, enter the address you took the survey with and we will send the same link your package email carried.

There is now a way back to a survey you have already taken, from the front page. Existing customer sign-in, beside the main button, opens a page explaining both routes back to your saved answers: the link in your package email, which reopens your assessment without an account, and Microsoft sign-in for SecureShield365 Platinum customers who want to change their answers. If the account you sign in with cannot edit, the page says which account it checked and what to do next, rather than sending you to a Microsoft error message.

Governance digests now name the license plans a change applies to. Where a vendor change is restricted to particular plans or add-ons, the item's Applies to line names them alongside the platforms it affects. An item that lists no plans is one where the restriction could not be established, not one that applies to every plan.

Governance digests now leave out the changes your plans cannot reach. Where a vendor change is restricted to particular plans or add-ons and the plans you hold are on file, items that cannot apply to you are no longer sent. Where your plans are not on file, you continue to receive every change for the platforms you follow, and the digest tells you so.

Your saved survey now says what happened when you sign in. The notice at the top names the account you signed in with and tells you whether editing is enabled for it, whether the survey was taken under a different email address, or whether the check is still running. Each case carries its next step, including a Sign out button so you can switch to the account your subscription is registered to.

Your survey is saved, and every email we send you links back to it. The confirmation page, your package email, and every governance update carry a link that reopens your answers read-only. The link does not expire and is personal to you: anyone you forward it to can see your answers.

SecureShield365 Platinum clients can now sign in to edit their saved survey. Open your survey link and sign in with your Microsoft account to change your answers. Saved changes apply to your governance updates immediately, and your package is rebuilt only when you choose Regenerate my package. The link on its own remains read-only.

Manage your notification preferences straight from your saved survey. Opening your saved assessment gives you a direct route to change how often you hear from us, or to unsubscribe, without going back to an update email.

Signed-in SecureShield365 clients now see their account in the top right of every page, with a Sign out button.

Sign in to keep up to ten posture profiles. The free plan includes two. When you reach that limit, the profile switcher now offers a Microsoft sign-in, and AIShield365 customers who sign in can hold up to ten profiles and switch between them.

Governance digests now lead each change with what to do about it. Every item in the email and the attached PDF opens with a plain verdict — action needed, action if you use this, or awareness only — followed by its severity where one has been graded, and the changes within each platform are ordered by that verdict rather than by severity. The platform is named once, at the head of its group, and a change that spans several vendors lists them all on its own line. Critical and High changes are still lifted into the "Act now" strip at the top, which is where urgency gets answered.

The results page no longer makes you wait for your package. Submitting your email now returns immediately; the governance package is generated in the background and the download email arrives when it's ready. Previously the button held you on the page for the whole build, which could take minutes for a large posture.

SecureShield365 clients can unlock the Microsoft governance controls by signing in. The Microsoft section's subscriber-only controls now unlock with a Microsoft Entra sign-in against the Patriot tenant instead of remaining display-only.

Where your code lives and where it's hosted are now their own questions. Source-code platforms (GitHub, GitLab, Azure DevOps) and cloud hosting (Microsoft Azure, AWS, Google Cloud, Vercel) moved out of the general technology list into dedicated questions — so a team that only wants chat governance isn't asked about repositories, and hosting choices get their own governance context.

Microsoft Azure hosting now carries its licensing shape, including where the app runs and the relevant Microsoft Defender for Cloud add-ons.

The EU AI Act is now a selectable compliance framework. Choosing it maps your posture against the Act's obligations and enforces the controls it requires, alongside the existing NIST AI RMF, NIST CSF, and ISO/IEC 42001 alignments.

Named posture profiles. Keep more than one posture — for example a permissive developer profile and a locked-down default — switch between them, and edit without losing unsaved changes.

Locally hosted and open-source AI is now governable. Organizations running their own models get survey coverage and generated guidance for that deployment shape.

GitLab and Azure DevOps join GitHub as governed source-code platforms, including GitLab Duo coverage.

Amazon (Bedrock and Amazon Q) and xAI (Grok) are now governed technology options.

Cursor is now a governed technology, with license tiers from Hobby through Enterprise.

Governance update and package delivery emails have a new design.

Security audit scripts now ship in your package. The ZIP includes read-only audit scripts (Bash and PowerShell) that inspect a machine's deployed Codex configuration and report PASS, FAIL, or ABSENT for each control, mapped to the same control IDs as your policy.

Every control now carries a severity — Critical, High, Medium, or Low. Severity badges appear on the survey, the results page orders accepted risks most-severe-first, and the policy preview gains a Severity column.

Governance digests now match your posture. Subscribers only receive changes touching the vendors they actually selected, and every governance email includes a link to widen or narrow that vendor list without redoing the survey.

Digest emails now open with a short executive summary, with the full per-change detail attached as a PDF.

Survey answers now survive a browser refresh.

Governance update emails now carry Patriot's take. Each vendor change a subscriber receives is now labelled with what it asks of them — Action needed, Action if you use this, or Awareness only — followed by why it bears on their posture and Patriot's recommendation, in the same voice as the survey's consultant notes.

Notification preferences page. Change how often you hear from us, or opt out entirely, from the link in every governance email.

ChatGPT Computer History is now a governed control.

The release monitor now covers every governed vendor, including OpenAI's ChatGPT and Codex release notes, GitHub, Vercel, and Google Gemini.

ISO/IEC 42001:2023 alignment. Every survey control now carries its ISO/IEC 42001 Annex A mapping alongside its NIST AI RMF and NIST CSF references, and the generated policy gains an Annex A alignment appendix written as a Statement of Applicability extract. ISO 42001 is also selectable as a compliance obligation in the CISO Persona Selector. AIShield now says explicitly on the Security page that ISO/IEC 42001 is a *certifiable* standard and that an alignment mapping is not a certification.

Claude Memory is now governed — org-wide availability, the sensitive-topics setting, and memory's reach across Claude surfaces are covered by survey controls and consultant guidance.

Your package now includes a Statement of Work. The ZIP carries an AIShield365 Statement of Work document tailored to your selections, sized to the controls you chose — a starting point for scoping implementation help.

Choose to be notified when governed AI settings change. Survey completion now offers an optional, unticked-by-default subscription: pick a cadence — as changes happen, or a daily, weekly, or monthly summary — and AIShield emails you when a vendor changes something your governance posture depends on. Every email carries a manage/unsubscribe link.

Automated release monitoring (foundation). AIShield now monitors the AI vendors it governs — Claude, OpenAI, and Microsoft — for product and release-notes changes that affect its governance recommendations, with a human review step before any detected change informs guidance. Subscriber-facing alerts are planned as a follow-on.

Free policy preview. A watermarked preview of your generated NIST AI RMF policy now appears on the results page before you download the full package.

Security & Trust page. A dedicated page covering how AIShield handles your data, the third-party services involved, and how to report a security concern.

Google Gemini is now a governed technology option in the survey.

Improved the survey experience on mobile — a more compact risk gauge and better use of available screen width.

SEC Regulation S-P added as a compliance option for organizations governed under GLBA.