How the analysis is conducted

Structural incompatibilities move to the Full Map, on the same ground as rework time. The element already stated that it is the only finding requiring a view from above; the Baseline, whose single source is the director looking from one position, does not have one, so the list was asking it to contain what it cannot establish. Where the Baseline glimpses an incompatibility it is now recorded as an open question, a status the report already carries. Consequence: the Full Map no longer sells what the Baseline announces delivering. Eight elements still, none removed — this one now carries its tier in its title.

What the Baseline promises is narrowed to what it can establish. It states a position, it does not diagnose: what the director cannot know from where they stand, and what it costs to keep deciding without it. It does not return the teams’ uses and does not make visible what the director does not see — it measures the distance separating them from it. The ground is not commercial: Star and Strauss, CSCW 1999, establish that the invisibility of work is an organisational process, so making it visible is an operation nobody can run from inside the organisation. Consequence for the Full Map: its central deliverable is the gap document, that is the gap between the measurement taken with the director alone and the one taken with the three or four people who run the work. Without a delivered Baseline there is no term of comparison, so requiring it is a methodological constraint before it is a commercial one, and the Baseline report is sealed before the first Full Map interview — revised after hearing the teams it would no longer be a comparison but a reconstruction. The gap is not one quantity: it is attributed line by line by the date of the element. An element predating the close of the Baseline collection is a blind spot, established; one postdating it is drift, a finding in its own right; a line carried by a statement alone stays unattributed and is marked as such. The close of the collection is therefore dated in the report, distinctly from the readout. No validity window is published, and no variation of the deliverable is indexed on a triggering delay, for the same reason no price is.

The unit of analysis changes. The Baseline no longer describes a workflow, it measures the distance between what a director describes and what the elements they provide establish. The single source is the director: what escapes them does not become visible through better questioning, and that limit now sits in the first principle rather than in a closing section. The workflow examined is the one the director designates, not one we select by comparing several, which would require the overview we have just said we do not have. Consequence for the deliverable: first-pass acceptance rate and rework minutes move to the Full Map, where the estimate comes from the people who do the work rather than from the person who decides. The sentence “without those two numbers the report stays a description” remains exact — the Baseline is a dated, situated description of a distance, and the move to the Full Map is what turns it into an arbitration. Report structure: still seven parts, but not the same seven. “What the workflow takes” disappears, its substance being the two numbers that just moved, and what remains of it — subscriptions and direct costs, which an invoice establishes — joins the findings. “Workflow map” becomes “declared map”. “Priorities” becomes “what must be decided”, with the owner observed rather than proposed and the deadline drawn from a dated fact of the client’s own. A new part records the director’s corrections and objections verbatim, including those we did not retain. Same release, GDPR section: the claim that a survey of AI chains produces the article 30 record is withdrawn. The record is the controller’s obligation and its completeness is their liability; a survey documents a chain the record probably ignores and shows what is missing from it. Two legal qualifications move to the conditional, and whether these articles apply to a given use is stated as belonging to the client’s counsel.

Post-Digital Omnibus alignment (provisional trilogue agreement of 7 May 2026, EP press release IPR42011). Annex III standalone high-risk binding date moved from 2 August 2026 to 2 December 2027 (EP enumeration: biometrics, critical infrastructure, education, employment, law enforcement, border management; non-exhaustive). Annex I product-embedded safety components binding date moved from 2 August 2027 to 2 August 2028. Article 50 transparency unchanged (2 August 2026 baseline preserved). GenAI watermarking advanced from 2 February 2027 to 2 December 2026. Safety-component definition narrowed (verbatim: AI functions that only assist users or optimise performance no longer automatically face high-risk obligations, if their failure or malfunction does not create health or safety risks). Art. 5§1(i) added (provisional, applicable 2 December 2026 pending formal adoption): prohibition of AI systems generating CSAM/NCII content, three-branch architecture (designed-for / placed-without-safeguards / deployer-use). Art. 50§1-§4 obligations in scoring engine enriched with explicit application timeline (2 August 2026 new systems · 2 December 2026 transitional for §2 watermarking + §4 deepfake disclosure on systems already on EU market). Temporal indicators in score reports updated. Sleeper segments mapped: PWD × §4 employment platforms, CRA × AI Act IoT-AI.

Art. 5(1) split into absolute (§1(e)/(f)/(g)) vs conditional (§1(a)/(b)/(c)/(d)/(h)) prohibitions. Conditional triggers HIGH non-terminal with legal-verification flag instead of CRITICAL terminal. Art. 5§1(a) deceptive wording aligned with regulation: "causing or likely to cause significant harm". Annex III scoring now weighted by domain (structural vs operational). GPAI standard = LIMITED 35; GPAI systemic risk = HIGH 80 (smoother thresholds). Diagnostic scope clarified: screening, not legal qualification. Full report performs article-by-article qualification. Regulatory observation period: April–May 2026 (Digital Omnibus trilogue ongoing post 28 April stall, MDCG 2021-24 Rev.1 of 20 April integrated).

Art. 5§1(d) added: criminal risk profiling. Art. 5§1(h) reference corrected: real-time biometric. Art. 6(1) vs 6(2) reference corrected. Art. 50§2 content marking activated. All 8 prohibited practice checks (a-h) now covered. HIGH RISK obligations enriched with Art. 9-15 details. International standards alignment section added (NIST AI RMF, ISO 42001). Methodology card expanded to 23 pages.

Methodology versioned and published. GPAI systemic risk gate (Art. 55). Art. 6(3) exemption logic. AI Office guidance on Annex III. Regulatory freeze date: March 2026.

Initial release. 6 regulatory gates based on Art. 5, 6, 50, 51, 53. Article mapping for all Annex III domains.