Programmes: a standard as a path, not a list

A programme is what a framework becomes when you switch it on under Organisation → Frameworks. There are three standards: ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF. The GDPR's organisation duties are a programme too, switched on the same way and free on every plan (below). Each is made of steps generated from record templates and arranged in phases — with gates between them for the standards, never for the GDPR — and each has one page, its only home in the product.

Two things work differently:

• The EU AI Act is the spine, never a programme. It runs per system: every registered system walks six gated stages derived by the rules engine from its role and risk tier. Nothing about it is switched on.
• The GDPR is binding law. Its system duties are rows on each system that processes personal data, whatever is switched on; its organisation duties become the GDPR programme under Frameworks when you switch it on, listed on Obligations (Source: GDPR) and free on every plan. During early access it is the only programme that can be switched on; the standards are listed and open afterwards.

Why a path

A standard read as a list is 38 or 93 controls to populate, in no order, all at once. Read as a path it is what to do this week: the steps that are open, the record each one produces, the gate that opens the next phase. That is also how a certification body reads it — a Stage 1 audit asks whether the management system exists on paper, Stage 2 whether it runs.

What a step is

A step is a record template placed in a programme: guidance that paraphrases what the standard asks (never the standard's licensed text), the questions the record answers, and the evidence an auditor would accept. Every template was generated from the owner's verified framework matrix and carries a named reviewer's stamp; the guidance is regenerated from that matrix, never edited by hand.

Each step names three kinds of reference, and the distinction matters:

• Closes — the parts of the standard the step's record answers. The programme's read-only Clauses tab lists them and the step that handles each.
• Also counts toward — the other frameworks the approved record is credited in. That credit is what fills the Statement of Applicability and closes a shared step elsewhere.
• Related — supporting links to neighbouring duties in other frameworks. They are shown so you can find the adjacent duty, and they are never credited: a related link files no evidence and closes nothing.

Some records are genuinely shared. The ISO/IEC 42001 and ISO/IEC 27001 programmes share one record for the clause 4–10 work both standards ask for — context, roles, risk, objectives, competence, internal audit, management review and the rest. The step says Filled once · counted in ISO 27001 too; complete it once and it is complete in both.

Where things live

• Frameworks in the rail — Programmes (the index: the EU AI Act spine card, the GDPR programme card, then one card per standard you switched on), GDPR, one entry per enabled standard, and an Add a standard link when your plan includes a standard that is still off. It goes to Organisation → Frameworks.
• The programme page — /programmes/<standard>: the phase strip and these tabs:

The header's subtitle says where the programme stands in one line — the standard, how many steps on how many phases, how many are done, and how many of those were credited by work already on file.

• Documents — every record a programme produces is a row in the document register while that programme is active, with the standard as its Source, and opens the same step.
• My work — the one view on Obligations that merges: your assigned obligations and your assigned steps of any standard, each tagged with its source.

Re-plan in the programme header (an admin's button) regenerates it — after a template update, say. Regenerating never overwrites a status a person set.

What a programme costs, and what is live

Programmes are not plan tiers. ISO/IEC 42001 and NIST AI RMF are included from the Govern plan up — no per-framework fee; ISO/IEC 27001 is the one programme sold separately, €199 a month on Govern and already part of Manage and Enterprise — there is no bundle. Each standard's row on Organisation → Frameworks carries its price line; a standard your plan does not include says Not on your plan and offers the way to add it.

One honest note on timing: the three standards open with the full launch, planned for late November 2026, not before. During the public beta they are listed under Frameworks and on Programmes as faded, inactive entries marked Available at launch, their programme pages do not open, and their rows on the Frameworks tab read Available at launch too. Programmes and GDPR stay in the rail throughout. The EU AI Act journey and the GDPR programme are live regardless.