The Standard is versioned. Every published assessment states the version it was applied under, and a criterion's eligibility for automated determination does not carry across versions: a criterion changed between versions is revalidated against independent human scoring before any automated result under the new version is relied on. Scores assessed under one version are not restated under another.
This page records what changed between published versions and why. It is maintained for the same reason the Standard asks vendors to keep their governing documents stable and their revisions visible: a standard whose text changes without a record cannot be held to.
| Version | Date | Criteria | Critical | Categories | What changed |
|---|---|---|---|---|---|
| 1.3 | 20 August 2026 | 31 | 14 | 7 | First published version |
| 2.4 | 1 September 2026 | 39 | 17 | 8 | Consent category added; applicability predicates introduced |
| 2.5 | 1 September 2026 | 39 | 17 | 8 | Applicability conflicts held for human review |
| 2.6 | 1 September 2026 | 39 | 17 | 8 | One predicate split into three |
| 2.7 | 6 September 2026 | 39 | 17 | 8 | Incorporation by reference governs applicability |
| 2.8 | 8 September 2026 | 39 | 17 | 8 | Two applicability predicates divided; six in total |
| 2.9 | 8 September 2026 | 39 | 17 | 8 | governing_agreement retired and divided into five; ten in total |
Versions 2.0 through 2.3 were working revisions circulated between 25 and 31 August 2026 while the Standard was extended to the populations named in Charter §4A. None was applied to a published assessment and none appeared on this site, which showed 1.3 throughout. The version number moved from 1.3 to 2.0 because the extension of scope changed what the Standard is, not only what it says.
governing_agreement retired. Each of its five criteria now carries the
predicate its own text names.
Version 2.8 clarified governing_agreement rather than dividing it, on the
ground that it had split only once and P-013 reserves division for splits that
recur. Read against the five criteria that shared it, the clarification produced
a wrong result.
The clarification said that a membership instrument counts as a governing agreement and that silence within one is a score of 0. EXT-03 asks whether a customer can escape automatic renewal. Under the clarified predicate, an association with bylaws and no subscription of any kind would satisfy the predicate, EXT-03 would apply, the bylaws would say nothing about renewal, and the score would be 0 — reporting the absence of a renewing relationship as a failure to document one. That is the outcome not applicable exists to prevent.
The five criteria had never rested on the same fact. Their relationship statements, unchanged since 2.4, named five different ones, so the grouping was wrong on its face and no further observation was needed. Precedent P-014 records that a predicate may be divided on inspection as well as on repeated conflict.
| Criterion | Predicate | The fact it rests on |
|---|---|---|
| OWN-03 | organizational_customer_agreement |
the entity supplies a service to a customer organization |
| SEC-02 | liability_allocation |
the entity's instruments allocate liability at all |
| SEC-03 | insurance_allocation |
the entity's instruments address insurance in either direction |
| EXT-02 | amendable_accepted_terms |
the entity can revise terms another party has accepted |
| EXT-03 | recurring_relationship |
something renews without a fresh decision by the other party |
The useful half of the 2.8 clarification is kept and distributed. Each of the five now states in its own terms that silence within an instrument that does evidence the relationship is a score of 0 and not not applicable. What is removed is the inference that a membership instrument evidences all five relationships at once.
Ten predicates now, five of them governing a single criterion. A criterion alone under a predicate cannot conflict with anything, which is not a loss: the conflict check exists to catch criteria that should agree and do not. Applicability is still determined, recorded, and open to review.
No criterion was added, removed, or reworded in what it requires. Weights, tiers and bands are unchanged. As with 2.8, whether the divisions hold is open until the five entities are re-scored.
Two applicability predicates divided, on evidence from the first five-entity assessment.
A predicate names the fact a group of criteria rests on, so that criteria resting on the same fact reach the same answer about whether it is evidenced. Checking five entities under 2.7 found three predicates producing conflicts, and precedent P-013 sets out when a conflict means the text is ambiguous and when it means the criteria are asking different questions: a single split calls for clarification, a split that repeats across entities after a clarification has been tried calls for division.
The Standard now carries six predicates:
| Predicate | Criteria |
|---|---|
processing_for_customer |
DAT-01 |
content_custody |
EXT-01 |
third_party_processing |
DAT-02 |
governing_agreement |
OWN-03, SEC-02, SEC-03, EXT-02, EXT-03 |
signed_instrument |
CON-01, CON-02, CON-07 |
participant_grant |
CON-03, CON-04, CON-05, CON-06, CON-08 |
Processing separated from custody. DAT-01 asks whether an entity processes
data on another's instruction. EXT-01 asks whether it holds content belonging to
a customer that would have to be returned if the relationship ended. An entity
may do either without the other, and under 2.7 the two criteria reached opposite
conclusions on three of the five entities, in both directions. EXT-01 moves to
content_custody, and both criteria now state that neither may be reasoned from
the other.
The form of consent separated from the scope of the grant. CON-01, CON-02 and
CON-07 ask how consent was presented and whether it could be refused: whether it
was separately presented, whether a participant could decline and still take
part, whether privacy expectations are waived. Answering those requires a
discrete instrument the person signed. CON-03 to CON-06 and CON-08 ask what the
grant permits — purpose, duration, withdrawal, recipients, commercial use — and
those can be answered from a document reached by incorporation. The first three
move to signed_instrument.
This is also why the incorporation rule added in 2.7 did not settle the question. That rule holds that a grant reached by incorporation counts as evidence of the relationship, which remains correct for the criteria about what a grant permits. It cannot answer a question about presentation: asking whether a grant carried in an incorporated privacy policy was separately presented is incoherent, because there was no discrete act of consent to it. One consequence now follows on the face of the Standard — where a signed instrument exists and the grant sits only in a document it incorporates, that fact is itself evidence for CON-01, since a grant reached only by reference is by definition not separately presented.
governing_agreement clarified rather than divided. It split once, on one
entity, which under P-013 is a sign of ambiguous text rather than of criteria
asking different questions. The evidence text now states that a membership
instrument — bylaws or a constitution — counts as a governing agreement, and that
silence within such an instrument on a criterion's subject is a score of 0 rather
than not applicable. If the split recurs, division follows.
No criterion was added, removed, or reworded in what it requires. Weights, tiers and bands are unchanged. Whether the divisions hold is an open question until the five entities are re-scored under 2.8.
Incorporation by reference determines applicability, not only score.
Sixteen criteria carry an applicability predicate: a statement of the relationship the criterion governs and what in the documents evidences it. Under 2.6, two assessments (Hudl and US Club Soccer) split the same way on whether a participant grant was evidenced, because one reading stopped at the signed form and the other followed the documents the form incorporated. Precedent P-012 resolved it: a relationship evidenced only in an incorporated document is evidenced, and reading a signed form in isolation and finding nothing does not establish absence.
Changes to the text:
No criterion was added or removed. Weights, tiers, and bands are unchanged.
A predicate must define its own subject matter.
Under 2.5, eight criteria shared one predicate, customer_relationship. Two
scoring runs of the same entity against an identical corpus reached opposite
conclusions on whether that relationship existed, and the disagreement traced
not to either run but to the predicate bundling three distinct facts. Precedent
P-011 split it:
governing_agreement — a commercial agreement with a customer organization
(OWN-03, SEC-02, SEC-03, EXT-02, EXT-03)processing_for_customer — processing or holding footage or participant data
on another entity's behalf (DAT-01, EXT-01)third_party_processing — engaging third parties to process footage or
participant data (DAT-02)A third run under the split predicates removed the divergence. The applicability convention records the rule: where criteria sharing a predicate diverge on applicability across runs, the first question is whether the predicate is bundling distinct facts, not which run was right.
Applicability conflicts are held for human review.
Criteria sharing a predicate rest on the same underlying fact about the entity. They need not reach identical scores, but they must not reach opposite conclusions about whether the relationship exists. From 2.5, where they do, the determination is held for human review and the resolution is recorded as a precedent. It is never resolved automatically. The applicability text of all sixteen predicated criteria was revised to state the relationship, the evidence, and what its absence means, in parallel form.
The Standard extends beyond platforms, and says when a criterion does not reach an entity.
Version 1.3 assessed video platforms against the organization-facing agreement. On 23 August 2026 the Certification Charter gained §4A, Scope: the Standard governs the handling of footage of minors, not a category of company, and any entity that determines whether recording occurs, holds or grants rights in the footage, determines who may access it, or determines its retention is within scope. That brought national governing bodies, state and regional associations, leagues and clubs that take likeness rights at registration, and venue operators alongside the platforms. 2.4 is the Standard rewritten to assess those populations. Three things followed:
applies_when block. Where the assessed documents
show no evidence of the relationship, the criterion is marked not applicable
and removed from the score, not counted as a failure; where the relationship
is evidenced and no document governs it, that is a failing score. The
relationship must be evidenced in the documents, never inferred from what kind
of organization the entity appears to be.Two conventions were added. Applicability is described above. Coverage disclosure requires every published assessment to state the number of criteria in the version applied, the number applicable, the number not applicable, and the number not published, so that a strong result on a small number of applicable criteria cannot read as a strong result overall. The audience convention was expanded to say which agreement is assessed when a criterion identifies another relationship.
Criteria rose from 31 to 39, Critical Criteria from 14 to 17, categories from 7 to 8.
First published version. 31 criteria in seven categories (documents, ownership, data, security, biometrics, operations, exit), 14 of them Critical. A single Critical Criterion scoring 0 produces an overall failing result whatever the weighted percentage. Five scoring conventions: silence, partial credit, audience, scope, and incorporated documents.
Precedents P-001 to P-009 were decided under versions 1.2 and 1.3 and remain in force; P-009 (a criterion must define its own subject matter) was applied to OWN-03 and DOC-02 in 1.3 after both fell to 25 percent agreement in blind validation.