Methodology

This page describes how the tracker is maintained. It is the provenance claim: it says where every statement comes from and what has and has not been checked.

What this site does

It records the published status of regulatory instruments and links to the primary source for each. It states what a document is, who issued it, what status it carries and when that status was last checked.

It does not interpret those documents. There is no assessment of what any instrument requires of any organisation, no recommendation, and nothing addressed to a reader as a course of action. Anyone needing to know what a document requires of them should read the primary source and take their own professional advice.

Sources

Every entry links to a primary source: the issuing authority's own publication. Where a secondary source is used it is listed separately and identified as secondary. Sources are listed in full on the sources page.

Cadence

Each instrument carries a checking cadence based on how quickly its status is likely to move.

What "verified" means

An instrument is verified when a person has opened its primary source, read the status stated there, and recorded the date. The last verified field is that date. It is not the date the page was rebuilt and not the date the document was published.

An entry that has never been verified carries the status not yet verified and is displayed with a notice. That status is never estimated from context. An absent status is recoverable; a wrong one is not.

What each status means

Dates

Every date on the calendar carries a confidence value. Confirmed means the date appears in a published instrument. Expected and estimated dates are displayed with that qualifier visible and must not be treated as fixed.

Observation, normalisation and hashing

Every tracked source is fetched on a daily schedule. The response is normalised — scripts, styles, navigation, headers, footers, session tokens, cache-busting parameters, analytics identifiers, visitor counters, relative timestamps and "retrieved on" strings are removed — and the remaining text is hashed with SHA-256. The hash is compared with the previous observation.

Normalisation exists because of false positives. A page carrying a rotating session token changes its raw bytes every single request, and a change detector that reports a change every day is one nobody reads. Everything the normaliser removes is content that moves without the document moving.

Unchanged observations are recorded. A record is written for every instrument on every run, whether or not anything differed. "This document has been stable for 412 days" is only a fact if all 412 observations exist; skipping the uneventful ones would destroy the signal the archive is for.

What counts as a change

A change is recorded when the SHA-256 of the normalised text differs from the previous observation of the same URL. Changes are classified mechanically:

Classification is mechanical and requires no judgment. A person reviews only the summary wording; whether a change occurred is settled by the digests.

When no hash is recorded

A source that refuses an automated request, or that assembles its content in the browser so the document is absent from the HTML, produces no hash at all. A hash is never invented for a document that could not be read — an invented one would corrupt every finding computed from that series, permanently, with no way to identify which values were affected. Those observations record the fetch method and HTTP status honestly, and the resulting coverage is published at crawlability.

Restricted-licence documents

Change detection needs the hash, not the text. For documents published under a restrictive licence the record is: content changed on a date, N bytes differ, hash before and hash after. No excerpt is shown and no diff is offered. A paywalled standard can therefore be reported as having changed without reproducing a word of it.

Where the text lives

Normalised text is stored locally for diffing and is never published. The repository contains hashes, metadata and — for freely reproducible documents only — short attributed excerpts. Source documents are linked, never rehosted.

Findings

Figures computed from the series carry their method inline, so a reader can redo the computation against the same public data. Findings are counts, medians, durations and gaps. None is a score, index, ranking or weighting: weighting two measures against each other expresses a view about their relative importance, which is a methodology rather than arithmetic.

Quotation and licence

Quotations from tracked documents are the minimum necessary to identify what changed, and are always attributed with the document and section reference.

Copyright terms differ between authorities. Texts published by EUR-Lex, the eCFR, FDA, ICH and NIST are freely reproducible. Standards published by ISO, IEC and CEN/CENELEC — including the prEN series — are paywalled and are cited and linked, never excerpted. Where a difference page shows no quoted text, that is why.

Corrections

Factual claims are never silently edited. When something is wrong it is corrected and the correction is logged, with its date, on the corrections page. A tracker that quietly rewrites its own history cannot be cited.

To report an error: corrections@gxplex.com. Please include the page and the primary source that contradicts it.

Machine access

Every collection is available as JSON with a versioned schema, CORS-open, at /api/instruments.json, /api/calendar.json, /api/precedents.json, /api/archive.json, /api/diffs.json. See llms.txt.

Last updated: 28 July 2026