Regulatory news and changes · No. 08 / 13
Which standards and platform-policy changes should influence procurement?
Last updated
Separate legislation, voluntary standards and platform access rules in the statement of work. They answer different questions: what is legally required, how risks are managed, and what an engine permits.
What did Google change in May 2026?
On 15 May 2026, Google clarified that its spam policies apply to generative AI responses in Search and published an updated optimisation resource. Its guidance rejects the need for special AI text files or special schema as prerequisites for inclusion, and cautions against pursuing inauthentic mentions. (developers.google.com)
Procurement implication: reject a proposal that sells a supposedly mandatory Google AI-compliance file without identifying the actual requirement. A technical deliverable may still have a legitimate purpose, but that purpose should be explained and tested rather than presented as a compulsory route to citations.
Google also states that automated queries—including scraping for rank checking without express permission—violate its policies and terms. A vendor’s ability to collect a result is therefore not sufficient evidence that the collection arrangement is permitted. (developers.google.com)
Ask the monitoring supplier to document its access route for each surface, permission or licence basis, dependencies, and response to an access change. Label API observations separately from consumer-interface observations as a contractual measurement requirement.
What can standards substantiate—and what can they not?
| Framework or standard | Status and purpose | How we recommend using it |
|---|---|---|
| NIST AI RMF and Generative AI Profile | Voluntary risk-management resources; the generative-AI profile was released on 26 July 2024. Established baseline, not a new GEO rule. (nist.gov) | Ask for mapped controls, named owners and evidence of use rather than an unsupported “NIST certified” label |
| ISO/IEC 42001:2023 | AI management-system standard covering organisational processes. (iso.org) | Inspect any certificate’s scope and covered service; do not treat it as proof of citation lift or measurement validity |
| C2PA Technical Specification 2.4, April 2026 | A versioned specification for content provenance and credentials. (spec.c2pa.org) | Test whether provenance information survives the proposed asset workflow; assess it separately from factual accuracy and search performance |
Our procurement conclusion is deliberately narrow: a management-system certificate, a provenance credential and an AI visibility benchmark are different evidence objects. None should be accepted as a substitute for the others.
Sources cited on this page
- developers.google.com developers.google.com/search/updates
- developers.google.com developers.google.com/search/docs/essentials/spam-policies
- nist.gov www.nist.gov/itl/ai-risk-management-framework
- iso.org www.iso.org/standard/42001
- spec.c2pa.org spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html?ut