Changelog — v2.1.0 (3 Oct 2026)
October regulatory cycle: five skills deep-updated (primary-source verified).
- CSRD: the revised ESRS are now law (Reg. (EU) 2026/1563 in the OJ, in force Nov 10, corrected >60%/>70% datapoint figures; Reg. 2026/1560 voluntary standard with the value-chain cap; CEAOB assurance track).
- GDPR: the Google €403M DPC location-data fine, EDPB fining-methodology Guidelines 04/2026, DSA-GDPR interplay, and C-798/24.
- CCPA: California's 2026 session (SB 923 "from or about" deletion expansion, the children's package, the AB 1542 veto, the data-broker enforcement blitz, ADMT countdown).
- LGPD: ANPD as a regulatory agency, the sanctioning-rewrite consultation closing Oct 26, the TikTok R$153.7M benchmark, mandatory SCCs.
- TISAX: the definitive ISA2027 date chain (catalogue July 1, redline Aug 7, ISA2027.1 current), PTS Basic/Facilities labels, and the March 2027 open-by rule.
Freshness sweep: all 36 skills now verified within 120 days, clearing the Oct 31 cliff. Material inserts for ISO 27001 (ISO/IEC 27017:2026), WCAG (the 3.0 six-tier draft), Section 508 (ADA Title II extension to 2027/2028), and DPDPA (Nov 13 brings the Consent Manager rule only), plus TSA and ISO 27701 notes, ITAR's Cyprus §126.1 suspension, and FedRAMP's mandate flipped to in-force.
Benchmark: 50 fresh runs. CSRD 100% vs 60%, TISAX 100% vs 16% (+84, a collection record), GDPR 92/48, CCPA 88/48, LGPD 84/44 (delta flipped from ±0 to +40). Suite: 89% vs 55% on 902 assertions (+34 points, +304), the widest published skill advantage. Zero grading amendments; one with-skill hallucination caught and documented; one independent re-grade matched within a point.
Fixes: October whats-new corrected from primary sources (the California veto was AB 1542, not SB 435; ISA2027's catalogue published July 1; C-798/24 is a company-register ruling).