Every version of CTS-1, and the rules for changing it.
CTS-1 · Version 1.0
Versions
CTS-1 version 1.0
First version
First publication of the standard: three risks, 12 domains and 36 requirements.
Crosswalks to the EU AI Act, ISO/IEC 42001, NIST AI RMF, the OWASP Top 10 for LLM Applications (2025), the OWASP Top 10 for Agentic Applications (2026), MITRE ATLAS (v2026.10), SOC 2, the GDPR, SR 26-2, ISO/IEC 27001 and DORA.
Minor versions, such as 1.1, clarify wording, add guidance or update crosswalks. They do not change what a certified system must do.
Major versions, such as 2.0, add, change or retire requirements. They are announced at least 90 days before they take effect.
Identifiers are never reused. A retired requirement keeps its identifier and is marked as retired.
Certificates name their version. A certificate stays valid against the version it was issued for until it expires. Recertification uses the version in force at that time.
Crosswalks are reviewed every quarter, because laws, standards and threat catalogues change.
Proposing a change
Send comments, corrections and proposals to [email protected]. We read all of them, and those that lead to a change are credited in the changelog if the author agrees.
