Home · The record
The record: stage 40.20, and what it does not say
The official record is short. It gives the designation, the stage, the page count, the committee and an abstract. It does not give a publication date, and it does not publish the body of the draft. Everything below is quoted from that record or labelled as our estimate.
What ISO records
- Designation
- ISO/IEC DIS 27566-3
- Title
- Information security, cybersecurity and privacy protection: Age assurance systems: Part 3: Approaches to analysis or comparison
- Edition
- 1
- Committee
- ISO/IEC JTC 1/SC 27, Information security, cybersecurity and privacy protection
- ICS
- 35.030
- Status
- Under development
- Stage
- 40.20 DIS ballot initiated: 12 weeks, dated 11 September 2026
- Pages
- 60
- Price
- CHF 67 from ISO
- Official page
- https://www.iso.org/standard/88147.html
ISO records the draft at stage 40.20, the start of the twelve week enquiry ballot, dated 11 September 2026. On a twelve week ballot the vote closes on 4 December 2026. The sequence after that is the ballot report, comment resolution, a possible final draft ballot, approval and publication. ISO has announced no publication date.
The British Standards Institution lists the same draft as 26/30482273 DC. Its published project timeline puts public comments from 15 October to 16 December 2026, comment resolution from 17 June 2027 and approval from 19 August 2027. Those are one national body's planning dates, not ISO's publication date, and this site labels them as such.
The lifecycle, as ISO records it
| Stage | Date | What happened |
|---|---|---|
| 10.99 | 2023-10-27 | New project approved |
| 20.00 | 2023-10-27 | New project registered in the TC work programme |
| 20.20 | 2023-12-06 | Working draft study initiated |
| 20.60 | 2024-01-31 | Close of comment period |
| 20.20 | 2024-07-04 | Working draft study initiated |
| 20.60 | 2024-09-01 | Close of comment period |
| 20.20 | 2025-04-15 | Working draft study initiated |
| 20.60 | 2025-07-22 | Close of comment period |
| 30.00 | 2025-10-28 | Committee draft registered |
| 30.20 | 2025-11-03 | Committee draft consultation initiated |
| 30.60 | 2025-12-25 | Close of comment period |
| 30.92 | 2026-04-02 | Committee draft referred back to the working group |
| 30.00 | 2026-04-02 | Committee draft registered |
| 30.20 | 2026-04-03 | Committee draft consultation initiated |
| 30.60 | 2026-05-30 | Close of comment period |
| 30.99 | 2026-07-15 | Committee draft approved for registration as a DIS |
| 40.00 | 2026-07-15 | Draft International Standard registered |
| 40.20 | 2026-09-11 | DIS ballot initiated, twelve weeks |
The planning date is ours
Our planning estimate, not an ISO date. The ballot closes on 4 December 2026. The BSI project timeline then allows six months for comment resolution and two for approval, which reaches 19 August 2027; a month later is 14 September 2027. We use that date so a comparison programme has a date to plan against, and every page labels it as our estimate.
How to read it. A planning date is not a deadline and it is not a transition audit. The draft creates no certificate and no obligation. The date exists so a comparison programme has a point to schedule against, and so the paid watch has a date to check.
What the abstract says, in our words
ISO's public abstract describes the document as setting out what to weigh when systems or components are analysed, compared or told apart, and as covering measures, elements and effectiveness indicators. This site states that scope in its own words.
What the draft is, and is not
It is
- A draft International Standard at the enquiry stage, prepared by ISO/IEC JTC 1/SC 27.
- Guidance for anyone who has to analyse, compare or differentiate age assurance systems or components.
- A source of metrics, elements and indicators of effectiveness, according to the public abstract.
- The third part of a series whose first part, the framework, is published and freely available.
- A voluntary document, written for regulators, procurement teams, test houses, conformity assessment bodies and the providers they assess.
It is not
- Not a published International Standard: the ballot is open and the text can change.
- Not a certifiable requirement standard, and not a management system standard.
- Not law in any jurisdiction, and not a regulator's rule.
- Not a vendor ranking, a product endorsement or a score of any named company.
- Not a replacement for ISO/IEC 27566-1:2025, ISO/IEC 29155 or the measurement work of a test laboratory.
What to do before the planning date
- Fix the object of comparison. Write down whether you are comparing whole age assurance systems, single components, or a component inside a system, and give each object a version and a date. A comparison of unlike objects produces a number that cannot be defended. The object register, dated, with each system or component identified and versioned.
- Name the decision the comparison feeds. A procurement shortlist, a regulator's market review, a certification scope and a board paper need different indicators and different evidence. Record the decision, the decision maker and the date. The comparison brief, one page, naming the decision, the audience and the date.
- Collect the practice statements first. Ask every provider for its age assurance practice statement before you design the test. The published framework makes the practice statement the business layer against which the analysis is run. A folder per system with the current practice statement and its version date.
- Choose the indicator and the threshold before testing. Decide which indicator of confidence the decision needs, and which accuracy threshold counts as a pass. Write both down before a single test result is seen. The test plan, signed and dated, with the indicator, threshold and sampling rule.
- Put the review date in the calendar. The draft's own subject matter moves: the text, the thresholds and the public record can all change before publication. Set a review date and a trigger to re-run the comparison. The calendar entry and the change trigger note.
What to do after publication
- Read the published text against this record. Check every analysis unit and every framework clause against the published edition. Where the text moved, correct the record and the changelog. The marked-up comparison and the changelog entry.
- Re-issue the kit. Re-issue the register and the plan against the published text. Kit buyers receive the re-issued set at no extra charge. The new register version and the covering note.
- Re-run the comparison. A comparison run against a draft is a planning comparison. Re-run the tests that the decision depends on against the published text, and date the new result. The new test report and the decision record.
- Keep the old result. Keep the draft comparison beside the published one. The difference between them is the evidence that the programme responds to change, and it is what an auditor will ask to see. The archive folder with both results and the reason for each change.