Roadmap
What is planned next for the framework. Updated 2026-11-15. Follow progress on the roadmap board.
Have an idea? Suggest it in GitHub Discussions. For what the framework does not cover today, see what this framework does not cover.
Now
Independent review of the mappings
A qualified reviewer is sampling the high-impact cross-references to check the controls and strengths assigned. Findings will be folded into a release, with the mapping files' reviewer and date updated. The site and the README will then say what was reviewed, how, and by whom.
AACF MCP server
A public, read-only MCP server at https://aacf.adriansaxton.com/mcp, so any AI assistant that supports MCP can look up controls, criteria and cross-references directly, for example "which controls cover ISO/IEC 42001 clause 6.1.2". It serves the published release data, needs no sign-in and stores nothing. How to connect: https://aacf.adriansaxton.com/connect/
Cross-reference: OWASP Top 10 for LLM Applications
Map the OWASP Top 10 for LLM Applications to the security and technology controls, by risk ID, as a source for the detail the framework leaves to specialist security frameworks.
Cross-reference: OWASP Top 10 for Agentic Applications
Map the OWASP Top 10 for Agentic Applications to the agentic AI overlay criteria and the security controls, giving the agentic criteria a dedicated security source.
OSCAL export
Publish the controls and criteria in OSCAL, NIST's open format for control catalogues, alongside the JSON and CSV, so compliance tools that read OSCAL can import the framework without custom work.
Next
Lite version
A short baseline of about twenty foundation controls with a quick self-assessment and a simple result, as a front door to the full framework. It will include a guide for small teams showing how the eight owner roles combine when two or three people share them.
Later
Cross-reference: CSA AI Controls Matrix
A cross-reference to the CSA AI Controls Matrix by control ID. Prepared, and waiting on permission from the Cloud Security Alliance to publish.
Agentic AI: identity, delegation and limits
Further agentic criteria on the identity and credentials an agent holds, least privilege for the tools it can use, running agents in a contained environment, undoing an agent's actions, agents acting for other agents, and spending and resource limits. Theme A1 in what the framework does not cover.
Intellectual property beyond contracts
Criteria on using content the organisation does not own when prompting or grounding AI, and on the licence terms of open models and datasets it adopts. Theme A2.
Red-teaming in live use
Adversarial testing repeated while a system is live and after model or supplier changes, covering harms beyond security. Theme A3.
Effects on jobs and work design
Assessing how a use of AI changes roles before it is deployed, and planning redeployment or reskilling. Theme A4.
Environmental sustainability targets
An organisation-level target for AI's energy, compute and water use, reported to leadership, and supplier disclosure of footprint. Theme A5.
People at higher risk of harm
Specific care where AI affects children or other people at higher risk of harm, such as stricter approval or a person in the loop by default. Theme A6.
Assessor consistency trial
Two assessors score the worked example separately and compare results. Where their scores differ, the rulebook and criteria wording are tightened so that different assessors reach the same result.
Meeting criteria through supplier assurance
For AI obtained from suppliers, show which criteria can be met with supplier evidence, contract terms or independent evaluations, and which always need the organisation's own practice.