# Primary-source register

Last checked: **21 August 2026**. Source status can change. Open the primary
source and verify its current version before making a decision.

The playbook summarizes and links these resources. It does not reproduce the
protected text of standards.

## Governance, lifecycle, and risk

- [ISO/IEC 42001:2023, AI management systems](https://www.iso.org/standard/42001), published management-system standard.
- [ISO/IEC 5338:2023, AI system life cycle processes](https://www.iso.org/standard/81118.html), published lifecycle standard.
- [ISO/IEC 23894:2023, guidance on AI risk management](https://www.iso.org/standard/77304.html), published risk-management guidance.
- [ISO/IEC JTC 1/SC 42 catalogue](https://www.iso.org/committee/6794475/x/catalogue/), including the 5259 data-quality series and 2026 work items.
- [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), voluntary AI RMF 1.0; revision work was in progress on 18 August 2026.
- [NIST AI 600-1, Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf), cross-sector profile published in 2024.
- [OECD Framework for the Classification of AI Systems](https://www.oecd.org/en/publications/oecd-framework-for-the-classification-of-ai-systems_cb6d9eca-en.html), an orientation framework, not a legal classification.

## Security

- [OWASP Top 10 for LLM and GenAI](https://genai.owasp.org/llm-top-10/), currently published 2025 edition.
- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), community guidance to adapt to the actual architecture.
- [NIST AI 100-2e2025, Adversarial Machine Learning](https://csrc.nist.gov/pubs/ai/100/2/e2025/final), predictive and generative AI taxonomy; check the official errata.
- [NIST AI 100-4, Reducing Risks Posed by Synthetic Content](https://airc.nist.gov/technical-reports/), methods and limitations for detection, authentication, marking, and provenance.
- [C2PA 2.4, Content Credentials](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html), a provenance specification that alone proves neither authenticity nor legal compliance.
- [MITRE ATLAS](https://atlas.mitre.org/), a living knowledge base of AI tactics, techniques, mitigations, and cases.

## Law and public policy

### Switzerland

- [FDPIC, AI and data protection](https://www.edoeb.admin.ch/en/ai-and-data-protection), confirming that the FADP applies to AI-supported processing.
- [FDPIC, duty to provide information](https://www.edoeb.admin.ch/en/duty-to-provide-information), including rights related to automated individual decisions under Article 21 FADP, subject to qualification and exceptions.
- [FDPIC, joint statement on AI-generated imagery](https://www.edoeb.admin.ch/en/joint-statement-on-ai-generated-images), orientation from 61 authorities, not a substitute for case analysis.
- [FDPIC, data protection impact assessment](https://www.edoeb.admin.ch/en/data-protection-impact-assessment), required when processing is likely to result in high risk.
- [FDPIC, outsourcing of data processing](https://www.edoeb.admin.ch/en/outsourcing-of-data-processing), on controller responsibility and processor controls.
- [Federal Chancellery, AI regulation](https://www.bk.admin.ch/en/regulation), a consultation project expected by the end of 2026, not a general law currently in force.

### European Union

- [Regulation (EU) 2024/1689, official AI Act text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), whose consolidated text and scope must be checked before qualification.
- [European Commission, AI Omnibus enters into force](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force), 27 July 2026, including updated high-risk timelines.
- [European Commission, transparency guidelines](https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems), for Article 50 obligations applicable from 2 August 2026.
- [European Commission, Article 50 quick facts](https://digital-strategy.ec.europa.eu/en/factpages/quick-facts-transparency-rules-ai-systems), an official summary whose underlying text and exceptions still require qualification.
- [European Commission, AI literacy questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers), post-Omnibus status of Article 4 and 2026 supervision.
- [European Commission, updated AI model contractual clauses](https://public-buyers-community.ec.europa.eu/communities/procurement-ai/resources/updated-eu-ai-model-contractual-clauses), templates to adapt to the procurement and legal context.

## Sector extensions

These sources help formulate questions and decision conditions. They do not
turn the playbook into medical, legal, prudential, educational, or safety
advice.

### Healthcare

- [Swissmedic, medical-device FAQs](https://www.swissmedic.ch/swissmedic/fr/home/dispositifs-medicaux/reglementation-des-dispositifs-medicaux/faq.html).
- [Swissmedic, framework conditions for AI in drug development](https://www.swissmedic.ch/swissmedic/en/home/humanarzneimittel/authorisations/artificiel-intelligence.html).
- [European Commission, MDCG 2025-6 on MDR/IVDR and the AI Act](https://health.ec.europa.eu/latest-updates/mdcg-2025-6-faq-interplay-between-medical-devices-regulation-vitro-diagnostic-medical-devices-2025-06-19_en).
- [WHO, regulatory considerations on AI for health](https://www.who.int/publications/i/item/9789240078871).
- [WHO, governance of large multimodal models for health](https://www.who.int/publications/i/item/9789240084759).

### Education, finance, critical infrastructure, and accessibility

- [European Commission, 2026 ethical AI and data guidelines for educators](https://education.ec.europa.eu/focus-topics/digital-education/actions/plan/ethical-guidelines-for-educators-on-using-artificial-intelligence).
- [FINMA Supervisory Communication 08/2024 on AI governance and risk](https://www.finma.ch/en/news/2024/12/20241218-mm-finma-am-08-24/).
- [FINMA Circular 2023/1, operational risks and resilience](https://www.finma.ch/en/news/2022/12/20221213-mm-anh-rs-op-risks/).
- [Regulation (EU) 2022/2554, DORA](https://eur-lex.europa.eu/eli/reg/2022/2554/oj).
- [Directive (EU) 2022/2555, NIS2](https://eur-lex.europa.eu/eli/dir/2022/2555/oj).
- [Directive (EU) 2022/2557, resilience of critical entities](https://eur-lex.europa.eu/eli/dir/2022/2557/oj).
- [W3C, Web Content Accessibility Guidelines 2.2](https://www.w3.org/TR/WCAG22/).
- [eCH-0059 v3.0, Swiss accessibility standard](https://ech.ch/sites/default/files/dosvers/hauptdokument/STAN_f_DEF_2020-05-19_eCH-0059_V3.0_Accessibility%20Standard.pdf).

## Published cases and field evidence

- [Task-time evidence and transfer rules](../docs/task-time-evidence.md), including evidence grades A to E and the net human-time calculation. [French version](../docs/task-time-evidence.fr.md).
- [2026 public-evidence review](field-evidence-review-2026.md), covering studies and deployments by evidence strength, work mode, measured outcome, and transfer limit. [French version](field-evidence-review-2026.fr.md).
- [AI-assisted small-business customer support](tpe-customer-support-cases.md).
- [AI-assisted independent knowledge work](independent-knowledge-work-cases.md).
- [Copilot, business agent, and orchestrated agency](agentic-integration-levels.md).
- [From copilot to an A2 business agent](../examples/en/independent-business-agent-follow-up.md), a synthetic comparative case.
- [A3 orchestrated diagnostic agency](../examples/en/independent-orchestrated-agency-diagnostic.md), a synthetic manual/A1/A2/A3 comparison.

## Repository citation rule

For every claim that can change:

1. link the most precise official page;
2. state when it was checked;
3. distinguish current law, proposal, recommendation, and internal choice;
4. never present a consultation, draft, or developing standard as binding law.

The [control catalogue](../controls/README.md) also records a version and check
date for each source. These links are thematic, not article-by-article
equivalences and not evidence of certification or legal compliance.

- [Recent cases and transferable mechanisms](recent-implementation-cases.md): sources added on 5 September 2026, with result type and explicit limits.