Home • Blog • Content Hub Enterprise: How to Scale Digital Asset Management with AEM Assets?

Content Hub Enterprise: How to Scale Digital Asset Management with AEM Assets?

19 August 2026

Table of contents

1. What Is Content Hub at the Enterprise Level?

At enterprise level, a content hub is not just a folder structure with search. In Adobe’s ecosystem, AEM Assets Content Hub gives organizations and business partners a governed way to access, share, and work with approved brand assets through an intuitive portal. It is available as part of Experience Manager Assets as a Cloud Service and focuses on distributing assets for activation at scale and supporting the creation of on-brand content variants.

This makes Content Hub useful for teams that need broader access to approved assets without giving every user the same level of access to the full DAM. AEM Assets remains the source of truth, while Content Hub helps marketing teams, regional teams, agencies, and partners find approved content, use collections, share assets, and download materials in a more accessible interface.

For enterprise organizations, the value is not only faster access to assets. Content Hub also supports governance by exposing approved assets, using configurable metadata and filters, and helping teams work with brand-ready content. When Adobe Express entitlements are available, users can also create or edit on-brand content variants using Adobe Express and Adobe Firefly capabilities.

2. Content Hub in the Adobe Experience Manager (AEM) Ecosystem

AEM Assets Content Hub is available as part of Experience Manager Assets as a Cloud Service. In this setup, AEM Assets acts as the central source of truth for approved assets, while Content Hub provides a more accessible portal for teams, agencies, and business partners to find, share, download, and work with approved brand content.

This distinction is important for enterprise teams. AEM Assets supports digital asset management capabilities such as asset organization, metadata, governance, permissions, and activation. Content Hub extends access to approved assets through an intuitive interface, configurable search filters, collections, sharing options, and asset download workflows.

2.1 Brand Governance and Rights Management: Maintaining Full Asset Control

Governance is one of the main reasons enterprise teams use AEM Assets and Content Hub together. AEM Assets supports metadata, permissions, workflows, versioning, and digital rights management, while Content Hub helps expose approved assets to broader teams in a controlled way.

For enterprise use, governance should be planned before rollout. Teams need clear metadata standards, approval workflows, access rules, and asset lifecycle policies. AI-powered tagging and automation can support asset organization and discovery, but taxonomy, permissions, and review processes still need to be configured carefully, especially for content with brand, regional, or rights-related restrictions.

Content Hub Enterprise How to Scale Digital Asset Management with AEM Assets

3. Using AI, Adobe Express, and Firefly in AEM Assets Content Hub

AEM Assets and Content Hub can support faster asset discovery and content adaptation through AI-assisted capabilities. In AEM Assets, AI-powered tagging and metadata can help teams organize, classify, and find relevant assets more efficiently. This supports better discovery while reducing reliance on fully manual tagging processes.

Content Hub can also work with Adobe Express when the organization has the required entitlements. This allows users to edit approved assets and create on-brand content variants using templates, brand elements, and Adobe Firefly capabilities. For enterprise teams, this can make it easier to adapt approved assets for different campaign or channel needs while keeping the work connected to governed content workflows.

These capabilities should still be supported by clear governance. Metadata standards, access rules, approval workflows, and brand guidelines need to be configured carefully so that AI-assisted discovery and content variation remain aligned with the organization’s asset strategy.

4. Streamline Your Enterprise Media Workflow with AEM Assets Content Hub

AEM Assets Content Hub helps enterprise teams make approved brand assets easier to find, share, download, and adapt through a governed portal. Instead of treating asset management as a static file repository, Content Hub supports broader access to approved assets while keeping that access connected to AEM Assets as the central source of truth.

For marketing, regional, sales, and partner teams, this can simplify common asset workflows. Users can search and filter approved assets, work with collections, share selected content, and download the materials they need for campaigns or digital experiences. When the right Adobe Express entitlements are available, teams can also edit assets and create on-brand variants using templates, brand elements, and Adobe Firefly capabilities.

The strongest Content Hub rollouts usually start with governance. Before expanding self-service access, teams should define metadata standards, approval workflows, access rules, asset lifecycle policies, and brand guidelines. This helps ensure that broader access to assets supports consistency rather than creating another unmanaged content repository.

5. How TTMS Can Help with Your Content Hub Enterprise Strategy

Implementing AEM Assets Content Hub successfully requires more than enabling a new access point for digital assets. The real value comes from designing the right foundation first: clear taxonomy, reliable metadata, approval logic, access rules, and a rollout model that reflects how marketing, regional, sales, and partner teams actually work.

This is where we can help. We work with organizations to turn AEM Assets Content Hub into a governed, scalable environment for approved brand content, not just another place to store files. Our role is to help teams connect the technology with the operational model behind it, so self-service access, asset discovery, content adaptation, and governance all support the same business goals.

If your organization is planning a Content Hub Enterprise rollout or wants to improve how AEM Assets supports digital asset workflows, we can help you shape the strategy, prepare the governance model, and move toward a more efficient, self-service approach to asset management.

6. Frequently Asked Questions About Content Hub Enterprise

How Does an Enterprise Content Hub Differ from Basic File Repositories?

A basic file repository mainly stores and organizes files. An enterprise content hub gives teams a governed way to find, share, download, and reuse approved brand assets. In Adobe’s ecosystem, AEM Assets acts as the central source of truth, while AEM Assets Content Hub provides a more accessible portal for approved content.

How Does AEM Content Hub Empower Marketing and Sales Teams?

AEM Assets Content Hub helps marketing, sales, regional, and partner teams access approved assets without relying on manual file requests. Users can search, filter, use collections, share assets, and download content from a governed portal. With the right Adobe Express entitlements, they can also create or edit on-brand content variants.

Do You Need an Official Adobe Partner to Implement AEM Content Hub?

An Adobe partner is not always required, but enterprise rollouts often involve configuration, metadata, taxonomy, permissions, approval workflows, and governance planning. Working with an experienced implementation partner can help align Content Hub with a broader AEM Assets and digital asset management strategy.

TTMS blog – the world through the eyes of IT experts

Content Hub Enterprise: How to Scale Digital Asset Management with AEM Assets?

Enterprise teams often manage large volumes of digital assets across brands, regions, campaigns, and partner networks. In Adobe’s ecosystem, what many teams call an enterprise content hub is best understood as AEM Assets Content Hub: a part of Experience Manager Assets as a Cloud Service that helps teams find, share, and work with approved brand assets in a governed way. 1. What Is Content Hub at the Enterprise Level? At enterprise level, a content hub is not just a folder structure with search. In Adobe’s ecosystem, AEM Assets Content Hub gives organizations and business partners a governed way to access, share, and work with approved brand assets through an intuitive portal. It is available as part of Experience Manager Assets as a Cloud Service and focuses on distributing assets for activation at scale and supporting the creation of on-brand content variants. This makes Content Hub useful for teams that need broader access to approved assets without giving every user the same level of access to the full DAM. AEM Assets remains the source of truth, while Content Hub helps marketing teams, regional teams, agencies, and partners find approved content, use collections, share assets, and download materials in a more accessible interface. For enterprise organizations, the value is not only faster access to assets. Content Hub also supports governance by exposing approved assets, using configurable metadata and filters, and helping teams work with brand-ready content. When Adobe Express entitlements are available, users can also create or edit on-brand content variants using Adobe Express and Adobe Firefly capabilities. 2. Content Hub in the Adobe Experience Manager (AEM) Ecosystem AEM Assets Content Hub is available as part of Experience Manager Assets as a Cloud Service. In this setup, AEM Assets acts as the central source of truth for approved assets, while Content Hub provides a more accessible portal for teams, agencies, and business partners to find, share, download, and work with approved brand content. This distinction is important for enterprise teams. AEM Assets supports digital asset management capabilities such as asset organization, metadata, governance, permissions, and activation. Content Hub extends access to approved assets through an intuitive interface, configurable search filters, collections, sharing options, and asset download workflows. 2.1 Brand Governance and Rights Management: Maintaining Full Asset Control Governance is one of the main reasons enterprise teams use AEM Assets and Content Hub together. AEM Assets supports metadata, permissions, workflows, versioning, and digital rights management, while Content Hub helps expose approved assets to broader teams in a controlled way. For enterprise use, governance should be planned before rollout. Teams need clear metadata standards, approval workflows, access rules, and asset lifecycle policies. AI-powered tagging and automation can support asset organization and discovery, but taxonomy, permissions, and review processes still need to be configured carefully, especially for content with brand, regional, or rights-related restrictions. 3. Using AI, Adobe Express, and Firefly in AEM Assets Content Hub AEM Assets and Content Hub can support faster asset discovery and content adaptation through AI-assisted capabilities. In AEM Assets, AI-powered tagging and metadata can help teams organize, classify, and find relevant assets more efficiently. This supports better discovery while reducing reliance on fully manual tagging processes. Content Hub can also work with Adobe Express when the organization has the required entitlements. This allows users to edit approved assets and create on-brand content variants using templates, brand elements, and Adobe Firefly capabilities. For enterprise teams, this can make it easier to adapt approved assets for different campaign or channel needs while keeping the work connected to governed content workflows. These capabilities should still be supported by clear governance. Metadata standards, access rules, approval workflows, and brand guidelines need to be configured carefully so that AI-assisted discovery and content variation remain aligned with the organization’s asset strategy. 4. Streamline Your Enterprise Media Workflow with AEM Assets Content Hub AEM Assets Content Hub helps enterprise teams make approved brand assets easier to find, share, download, and adapt through a governed portal. Instead of treating asset management as a static file repository, Content Hub supports broader access to approved assets while keeping that access connected to AEM Assets as the central source of truth. For marketing, regional, sales, and partner teams, this can simplify common asset workflows. Users can search and filter approved assets, work with collections, share selected content, and download the materials they need for campaigns or digital experiences. When the right Adobe Express entitlements are available, teams can also edit assets and create on-brand variants using templates, brand elements, and Adobe Firefly capabilities. The strongest Content Hub rollouts usually start with governance. Before expanding self-service access, teams should define metadata standards, approval workflows, access rules, asset lifecycle policies, and brand guidelines. This helps ensure that broader access to assets supports consistency rather than creating another unmanaged content repository. 5. How TTMS Can Help with Your Content Hub Enterprise Strategy Implementing AEM Assets Content Hub successfully requires more than enabling a new access point for digital assets. The real value comes from designing the right foundation first: clear taxonomy, reliable metadata, approval logic, access rules, and a rollout model that reflects how marketing, regional, sales, and partner teams actually work. This is where we can help. We work with organizations to turn AEM Assets Content Hub into a governed, scalable environment for approved brand content, not just another place to store files. Our role is to help teams connect the technology with the operational model behind it, so self-service access, asset discovery, content adaptation, and governance all support the same business goals. If your organization is planning a Content Hub Enterprise rollout or wants to improve how AEM Assets supports digital asset workflows, we can help you shape the strategy, prepare the governance model, and move toward a more efficient, self-service approach to asset management. 6. Frequently Asked Questions About Content Hub Enterprise How Does an Enterprise Content Hub Differ from Basic File Repositories? A basic file repository mainly stores and organizes files. An enterprise content hub gives teams a governed way to find, share, download, and reuse approved brand assets. In Adobe’s ecosystem, AEM Assets acts as the central source of truth, while AEM Assets Content Hub provides a more accessible portal for approved content. How Does AEM Content Hub Empower Marketing and Sales Teams? AEM Assets Content Hub helps marketing, sales, regional, and partner teams access approved assets without relying on manual file requests. Users can search, filter, use collections, share assets, and download content from a governed portal. With the right Adobe Express entitlements, they can also create or edit on-brand content variants. Do You Need an Official Adobe Partner to Implement AEM Content Hub? An Adobe partner is not always required, but enterprise rollouts often involve configuration, metadata, taxonomy, permissions, approval workflows, and governance planning. Working with an experienced implementation partner can help align Content Hub with a broader AEM Assets and digital asset management strategy.

Top 7 AI QA Tools for Pharma in 2026

In the pharmaceutical industry, test results become part of quality documentation and must be reproducible during an audit. A complete record includes links to requirements, execution details, change history, approvals and audit evidence. When selecting an AI-powered quality assurance tool for pharma, organisations should therefore consider test automation, traceability, data integrity and compliance with GxP requirements. The ranking opens with QATANA, a platform designed for comprehensive test process management. It combines AI capabilities, manual and automated testing, role-based access, audit logs and on-premise deployment. These features address the key needs of pharmaceutical QA teams by accelerating testing, maintaining control over data and supporting complete test documentation. The ranking covers seven solutions addressing different layers of the quality assurance process. Their capabilities include test management and traceability, end-to-end test execution, digital validation, visual testing and device labs. This comparison will help you select a tool suited to a specific system and validation model. Top 7 AI QA Tools for Pharma – Comparison at a Glance Rank Tool Main category Deployment model Best use case in pharma 1 QATANA AI-assisted test management On-premise Controlled testing lifecycle, auditability, and manual and Playwright tests managed in one environment 2 Tricentis Tosca + qTest + Vera Enterprise automation and digital validation Cloud, on-premise or hybrid, depending on the component Large CSV programmes, formal approvals and complex application environments 3 Opkey Enterprise application automation and continuous validation Cloud or on-premise Veeva, TrackWise, Oracle, SAP, Workday and other frequently updated systems 4 Leapwork No-code test automation and continuous validation Cloud, on-premise or hybrid Regression testing of business processes across web, desktop, Salesforce, SAP and Oracle systems 5 Applitools Visual AI and regulated content control Public cloud, private cloud or on-premise Product websites, portals, applications, eIFUs, PDF documents and mandatory safety communications 6 ACCELQ Full-stack no-code automation Public cloud, private cloud, on-premise or hybrid Omnichannel processes covering web, mobile, API, desktop and enterprise applications 7 TestGrid CoTester Agentic testing and device infrastructure Cloud, private cloud or on-premise device lab Mobile applications, patient portals and testing on real devices and browsers What Makes an AI QA Tool Ready for Pharmaceutical Applications? In a regulated environment, test case generation speed is one of several important selection criteria. The tool should support a controlled process in which requirements, risks, test cases, executions, defects and approvals form a consistent chain. Data integrity, decision traceability and the retention of evidence for the required period are equally important. Compliance with GxP, EU GMP Annex 11 and 21 CFR Part 11 depends on how the system is used, configured and maintained within a specific organisation. The assessment should cover procedures, roles, data, supplier qualification and risk analysis. AI capabilities can support this process, while computerised system validation confirms that the solution is fit for its intended use. We assessed AI-powered QA tools for pharmaceutical applications across six areas: Fit for pharmaceutical environments: capabilities, documentation and use cases in pharma, biotech, healthcare or life sciences. Traceability and audit evidence: links between requirements, tests and results, change history, roles, approvals, reports and data exports. Control over AI: review of AI-generated content, execution predictability, change management and human involvement in decision-making. Security and deployment: on-premises deployment, private cloud, data residency, communication with the AI model and access control. Technology coverage: manual, web, mobile, API, desktop, ERP, CRM and legacy application testing, as well as document and device testing. Operational scalability: integrations with Jira, CI/CD and automation frameworks, reporting, licensing models and the effort required to maintain tests. 1. QATANA QATANA combines AI capabilities with features that are particularly important in regulated QA environments. The platform centralises test cases, executions, defects, reporting, and the results of manual and automated tests. This enables teams to manage the testing process and documentation within a single controlled environment. AI generates draft test cases from tickets and requirements and helps select regression suites based on the scope of a given release. In a pharmaceutical environment, generated proposals should be reviewed by the people responsible for requirements, quality and risk assessment. QATANA supports this operating model because every AI-generated item remains an editable test artefact, while the team retains responsibility for its final assessment and approval. QATANA is particularly well suited to pharmaceutical companies that need a central test management system, want to keep data within their own environment and combine manual testing with Playwright automation. During a proof of concept, organisations should verify specific requirements for electronic signatures, retention, artefact versioning and export formats defined in their applicable SOPs. QATANA: for pharma: key facts Tool provider: Transition Technologies MS (TTMS) Website: ttms.com/ai-software-test-management-tool/ Solution type: AI-assisted test lifecycle management platform Key AI capabilities: Draft test case generation, intelligent regression selection, and analysis of ticket data and release information Best use case in pharma: Controlled test management for GxP and non-GxP applications, patient and HCP portals, internal systems and successive software releases Deployment model: On-premises, with the option to configure integration with the organisation’s selected AI model Integrations: Jira, Playwright, AI models and ticketing systems, as well as test artefact import and export Pricing: Custom pricing with a scalable multi-user licensing model What to verify before selection: Signatures and approvals required by SOPs, retention policies, versioning, evidence package exports and AI model governance rules 2. Tricentis Tosca, qTest and Vera Tricentis combines three complementary solutions: Tosca for test automation, qTest for test management and Vera for digital validation and process approvals. The platform supports more than 160 technologies and enables end-to-end testing of processes spanning ERP and CRM systems, web applications, APIs and data layers. The integration of Tosca, qTest and Vera supports requirements management, electronic signatures, formal approvals and the collection of evidence required for CSV. The solution can operate in the cloud, on-premises or in a hybrid model, with the latest agentic capabilities developed primarily for cloud environments. Tricentis for pharma: key facts Tool provider: Tricentis Website: www.tricentis.com Solution type: Ecosystem for enterprise automation, test management and digital validation Key AI capabilities: Agentic test creation from natural language, Tosca Copilot, portfolio and results analysis, and model-based test automation Best use case in pharma: Large CSV programmes, complex end-to-end processes, formal approvals and organisations using multiple enterprise applications Deployment model: Cloud, on-premises or hybrid, depending on the product and required AI capability Integrations: Tosca, qTest and Vera within one process, as well as popular enterprise applications, CI/CD pipelines, APIs, user interfaces and data layers Pricing: Custom pricing based on the selected products, number of users and execution scale What to verify before selection: Required licence scope, availability of AI capabilities in the selected deployment model, data flows and completeness of the validation package 3. Opkey Opkey automates testing for enterprise applications commonly used in life sciences, including Veeva Vault, TrackWise, Oracle, SAP, Salesforce and ServiceNow. Its AI engine analyses the impact of updates, generates test scenarios and automatically repairs tests following interface changes. The platform supports processes spanning multiple systems and provides pre-built libraries of business processes. For GxP applications, it offers IQ, OQ and PQ protocols, electronic signatures, traceability and automated collection of validation evidence. It is particularly well suited to organisations automating the validation of changes in widely used business applications. Opkey for pharma: key facts Tool provider: Opkey Website: www.opkey.com Solution type: No-code test automation and continuous validation for enterprise applications Key AI capabilities: Change impact analysis, test generation, self-healing, root cause analysis and intelligent regression scope selection Best use case in pharma: Validation of updates to Veeva, TrackWise, Oracle, SAP, Workday and Salesforce, as well as processes spanning multiple applications Deployment model: Cloud or on-premises, adapted to the customer’s infrastructure Integrations: Veeva, TrackWise, Oracle, SAP, Workday, Salesforce, Jira, Azure DevOps, qTest, Jenkins, ServiceNow and GitHub Pricing: Custom pricing; demo and test coverage assessment available What to verify before selection: Alignment of pre-built tests with the system configuration, validation protocol content, control over self-healing and maintenance costs following updates 4. Leapwork Leapwork enables visual, no-code automation for web, desktop, ERP, CRM and legacy applications. Its AI capabilities support test generation from natural language, requirements analysis and self-healing while maintaining deterministic scenario execution. The platform’s suitability for GxP environments is demonstrated by its implementation at NecstGen, where 110 workflows were automated and 270 functions within laboratory and quality systems were covered by a compliant process. Leapwork supports cloud, on-premises and hybrid deployment. When selecting a deployment model, organisations should verify the availability of AI capabilities, data processing location and the method used to approve changes proposed by the model. Leapwork for pharma: key facts Tool provider: Leapwork Website: www.leapwork.com Solution type: No-code test automation and continuous validation platform Key AI capabilities: Natural language test creation, self-healing, knowledge building from requirements and documentation, and coverage generation with traceability to source materials Best use case in pharma: Regression automation for web and desktop systems, Salesforce, SAP, Oracle and applications used by quality and operational teams Deployment model: Cloud, on-premises or hybrid Integrations: Playwright, Selenium, Cucumber, GitHub, CI/CD pipelines, test management systems, SAP, Oracle, Salesforce and Microsoft technologies Pricing: Annual subscription with custom pricing based on architecture and execution scale What to verify before selection: Availability status of AI capabilities, data processing location, human approval mechanisms and the ability to freeze a validated configuration 5. Applitools Applitools uses Visual AI to detect visual defects that conventional functional tests may overlook. It compares websites, application screens and PDF documents against approved baselines, identifying issues such as obscured messages, insufficient contrast and incorrect content placement. In pharma, it helps control risk information, instructions for use, regulatory messages and approved product content across devices, markets and language versions. Version history, screenshots, detected differences and approvals create an evidence set that supports QA and compliance teams. Applitools is particularly effective as a visual validation layer supporting functional testing and CSV processes. Applitools for pharma: key facts Tool provider: Applitools Website: www.applitools.com Solution type: Visual AI, visual, functional and cross-browser testing Key AI capabilities: Deterministic visual comparison, detection of significant changes, difference grouping, visual element-based self-healing and root cause analysis Best use case in pharma: Control of approved content, warnings, eIFUs, PDFs, product portals, patient applications and digital accessibility Deployment model: Public cloud, private cloud or on-premises Integrations: Playwright, Cypress, Selenium, Appium, more than 50 frameworks, Jira and popular CI/CD tools Pricing: Free trial; Starter and Enterprise plans priced individually What to verify before selection: Baseline approval rules, retention of screenshots and detected differences, language version support, audit package exports and the scope of accessibility testing 6. ACCELQ ACCELQ is a no-code platform for testing web, mobile, API and desktop applications, as well as enterprise systems. Its AI capabilities support scenario design, change impact analysis, self-healing and automation maintenance. The platform can test processes spanning multiple systems, such as portals, APIs, Salesforce, SAP and Oracle. SaaS, private cloud, on-premises and hybrid deployment models allow organisations to align the architecture with their data processing policies. ACCELQ for pharma: key facts Tool provider: ACCELQ Website: www.accelq.com Solution type: Unified no-code platform for test management and full-stack automation Key AI capabilities: Scenario generation, process modelling, change impact analysis, self-healing and AI-assisted automation maintenance Best use case in pharma: End-to-end processes spanning web, mobile, API, desktop, backend, Salesforce, SAP, Oracle and other enterprise applications Deployment model: Public cloud, private cloud, on-premises or hybrid Integrations: Jira, Azure DevOps, Jenkins, GitHub, GitLab, TeamCity, Bamboo, Salesforce, SAP, Oracle and Workday Pricing: Annual subscription with custom pricing; a 14-day free trial is available What to verify before selection: Validation documentation package, signatures and approvals, complete AI data flow, and the cost of private cloud or on-premises deployment 7. TestGrid CoTester TestGrid combines the CoTester agent with a cloud of real devices and browsers and a private device lab. AI generates tests from requirements or an application URL, updates them following interface changes and allows users to approve each scenario before execution. The platform supports web, mobile, API, visual and performance testing, as well as existing Selenium, Appium, Cypress and Playwright test suites. In pharma, it can support the testing of patient portals, therapeutic applications and solutions used in clinical trials on real devices. For on-premises deployments, organisations should note that the AI capabilities require a connection to TestGrid’s hosted infrastructure. TestGrid CoTester for pharma: key facts Tool provider: TestGrid Website: www.testgrid.io Solution type: Agentic testing, test management, and cloud or on-premises device lab Key AI capabilities: Test generation from requirements, conversational editing, AgentRx self-healing, error summarisation and results analysis Best use case in pharma: Mobile and web applications, patient portals, field solutions and testing on real devices and browsers Deployment model: Cloud, private cloud or on-premises device lab; AI capabilities may require an outbound connection Integrations: Jira, Jenkins, GitHub Actions, GitLab, Azure DevOps, Selenium, Appium, Cypress and Playwright Pricing: Starter plan from USD 199 per user per month, based on pricing available in August 2026; Growth and on-premises plans are priced individually What to verify before selection: Scope of data sent to the hosted AI service, data residency, log immutability, retention policies and the ability to operate without external connectivity AI-generated image. The people depicted are fictional. Before Implementing an AI QA Tool in Pharma: 9 Questions to Ask the Vendor Before selecting a tool, conduct a proof of concept under conditions that closely reflect the actual testing process. This allows you to assess test creation and execution speed, documentation completeness and the ability to reconstruct the entire process during an audit. Before selecting and implementing an AI QA tool in a pharmaceutical company, ask the vendor the following questions: Does the platform connect requirements, test cases, test executions and reported defects? Which activities and changes are recorded in the audit logs? Can roles and permissions be configured according to the organisation’s procedures? Can AI-generated test cases be reviewed, edited and approved before use? Are manual and automated test results available in one consistent view? How does on-premises deployment work, and how can the platform connect to an AI model selected by the organisation? Does the platform integrate with the organisation’s existing tools, such as Jira, Playwright and CI/CD pipelines? Can test data, reports and other artefacts be imported and exported in the required formats and scope? How do licensing, deployment, integrations, training and ongoing support affect the total cost of the solution? Best AI QA Tool for Pharma: Final Recommendation The final decision should reflect the intended use, risk assessment and a proof of concept conducted on a representative process. The solution provider also plays an important role, as its experience affects implementation quality, change management and the audit readiness of the testing process. TTMS, the provider of QATANA, has worked in the pharmaceutical industry since 2011, involving more than 400 specialists in over 100 projects and services. The company combines QA engineering with expertise in quality management and computerised system validation in line with GAMP 5 and EU GMP Annex 11. These capabilities are supported by the TTMS Integrated Management System, which includes ISO 9001 and ISO 27001. This enables TTMS to support the entire implementation lifecycle, from requirements definition and tool configuration to validation, maintenance and controlled change management. FAQ Is a “21 CFR Part 11 compliant” claim sufficient when selecting an AI QA tool for pharma? No. Such a claim usually describes the available features or the way the product has been designed, while compliance is assessed for a specific intended use and implementation. The organisation must determine which electronic records and signatures fall within scope, configure roles, permissions, audit trails, retention policies and procedures, and then demonstrate that the system is fit for its intended use. Integrations with Jira, CI/CD pipelines, code repositories and other systems are also important because data flows may extend beyond the QA tool itself. Vendor documentation can facilitate validation, but responsibility remains with the pharmaceutical company. A proof of concept should therefore include the reconstruction of a complete evidence chain from the original requirement to the approved test result. How should AI-generated test cases be validated in pharma? An AI-generated test case should be treated as a draft requiring expert review. A person familiar with the requirement and its associated risk should verify the preconditions, test data, steps, expected results, negative scenarios and traceability to the source requirement. The system should record the source, model version, generation date, approver and all subsequent changes. Functionality with a greater potential impact on product quality, patient safety or data integrity requires more rigorous review and independent approval. AI performance should be evaluated against a controlled reference set using measures such as coverage completeness, the number of rejected suggestions and errors identified during review. This approach preserves the time-saving benefits of AI while keeping accountability with qualified personnel. Are self-healing tests safe in a validated GxP environment? They can be used when the mechanism operates in a controlled manner and maintains a complete record of every change. Automatically correcting a technical locator can reduce false failures, provided that the repair does not alter the meaning of a step, the acceptance criterion or the scope of the test. A well-configured system displays the proposed change, its rationale, and the previous and new values, and requires approval for significant modifications. The organisation should define in its SOPs which repairs may be accepted automatically, which require review and when a test must be reapproved. False positives, false negatives and the effects of self-healing engine updates should also be reviewed periodically. Execution repeatability and decision traceability are more important than the number of tests repaired without tester involvement. Can production data from pharmaceutical systems be sent to an external AI model? The preferred starting point is to use synthetic, anonymised or masked data limited to the minimum required for testing. Sending production data requires a legal basis, information classification assessment, vendor agreement, transfer controls, retention rules, processing location controls and clear policies regarding model training. Patient data, clinical trial information, safety data and confidential product information require particular protection. An on-premises deployment may still rely on a hosted AI service if an agent or interface communicates with an external model. The architecture should therefore show separately where tests are stored, where automation is executed and where AI processing takes place. Access to sensitive data should be granted only after the vendor provides a clear and verifiable description of the complete data flow. What should be done after an update to the AI model used by a QA tool? A model update should be managed as a controlled change, with the scope of assessment determined by risk. The first step is to identify which functions use the model and whether the update could affect test generation, regression selection, self-healing, defect classification or reporting. A previously approved reference test set should then be executed, and the results compared with those produced by the earlier version. Any differences should be assessed, documented and approved before the updated model is used more broadly. The change record should include the model version, date, scope, assessment results, accepted limitations and the person responsible for the decision. When a vendor updates the model without offering the option to freeze a version, the agreement should define advance notification, a testing window and a rollback procedure. Effective model version control is essential for maintaining the validated state.

AQAP 2210 in Defence IT Projects: Software Quality Requirements

In a defence project, software quality does not end with an application working correctly on the acceptance date. The customer needs control over requirements, configuration, changes, testing, subcontractors and the evidence demonstrating that the product complies with the contract. The customer must also know which version was delivered, on what basis it was accepted and whether it can be maintained and developed safely. AQAP 2210 brings structure to these matters at software project level. The publication sets out NATO requirements for software quality assurance and is used as a supplement to AQAP 2110 or AQAP 2310. Its significance, however, does not arise merely from the use of the acronym AQAP. In practice, the requirements of the specific contract, the scope of supply, software criticality and the agreed arrangements for oversight and acceptance are decisive. For the customer, this means that selecting an IT supplier should involve much more than assessing technology, developer availability and price. The organisation needs a partner capable of developing software under controlled conditions, maintaining traceability and producing credible quality evidence. This article explains how to interpret AQAP 2210 requirements and apply them when selecting an IT supplier for the defence sector. KEY TAKEAWAY: AQAP certification is important evidence of the maturity of a supplier’s quality management system. It does not, however, replace analysis of the specific contract requirements or the quality evidence generated during project delivery. 1. AQAP 2210 at a glance AQAP 2210 addresses software quality assurance in projects delivered in a defence environment. The current publication is AQAP 2210, Edition B, Version 1, issued in 2022. It supplements AQAP 2110 or AQAP 2310 and is not designed as a completely standalone set of requirements. Its application to a project primarily results from the contract, procurement specification and referenced quality documents. It covers management and technical processes, including quality planning, criticality analysis, requirements, configuration, verification, validation, testing and subcontractor control. It does not mandate a single software development model. It can coexist with Agile and DevSecOps provided that the organisation maintains control, accountability and objective evidence. A supplier’s certificate does not automatically demonstrate the compliance of every product or project. The certification scope, contract requirements and application of processes to the specific undertaking all matter. 2. What is AQAP 2210? AQAP stands for Allied Quality Assurance Publications. The AQAP family supports a common approach among NATO nations to the quality of defence supplies. Its purpose is to increase confidence that a supplier can deliver a product that meets contractual requirements and provide the customer with appropriate visibility of processes affecting quality. AQAP 2210, Edition B, Version 1, contains NATO supplementary software quality assurance requirements. It is project-oriented and covers both management and technical processes. It does not prescribe a particular software methodology, programming language, tool or architecture. Its purpose is to establish a level of planning, control and evidence that gives the customer justified confidence in both the process and the product. AQAP 2210 is to be used in conjunction with AQAP 2110 or AQAP 2310, depending on the core set of requirements referenced in the contract. In Poland, current publications used in certification processes are described by the Polish Centre for Testing and Certification and the Quality Certification Centre of the Military University of Technology. The status of AQAP 2210 Edition B as an active publication can also be verified in the US ASSIST standardisation document database. 2.1 A contractual requirement, not universally applicable legislation AQAP 2210 should not be presented as legislation that automatically applies to every company developing defence software. Binding obligations arise primarily from the contract, specification, quality clause and documents referenced by the customer. In one project, AQAP 2210 may cover the full development lifecycle of a new system. In another, it may apply to the modification of an existing solution, component integration or software maintenance. Requirements may be subject to justified tailoring where the publication and the customer permit it. Such decisions should nevertheless be transparent, approved and documented. A supplier should not independently declare an inconvenient requirement inapplicable. 3. AQAP 2110 and AQAP 2210: what is the difference? AQAP 2110 and AQAP 2210 are related but perform different functions. AQAP 2110 establishes broad quality assurance requirements for design, development and production. AQAP 2210 expands on these requirements for software and for work performed at individual project level. Area AQAP 2110 AQAP 2210 Principal scope Quality assurance in design, development and production Supplementary software quality assurance Role Core set of quality assurance requirements Software-specific supplement to AQAP 2110 or AQAP 2310 Perspective Supplier quality management system and product delivery Project, processes and software-related evidence Example areas Planning, risk, suppliers, nonconformities and delivery oversight Project Software Quality Plan, criticality, requirements, SCM, V&V and testing Application Depends on contract requirements and the type of supply Applies when the contract covers software and references the relevant requirements Standalone use May serve as the core quality publication Used in conjunction with AQAP 2110 or AQAP 2310 ISO 9001 remains an important foundation for systematic quality management, but it does not describe every mechanism needed in a defence project or the detailed quality requirements for software. Assessment of a potential partner should therefore go beyond asking whether the company holds ISO 9001 certification. The customer should establish whether the supplier’s system covers the relevant AQAP scope and whether the organisation can apply it to the specific project. 4. When does AQAP 2210 apply to an IT project? The contractual documentation provides the most reliable answer. The requirement may be stated directly in the contract, procurement specification, quality clause or quality plan, or in requirements imposed on the prime contractor and flowed down to subcontractors. AQAP 2210 may be relevant to projects involving: development of new bespoke software; development or substantial modification of an existing system; software maintenance and support; integration of software with hardware, sensors, effectors or platforms; command, control and situational awareness systems; C2, C4ISR and combat support systems; embedded software or a component forming part of a larger product; use or modification of commercial off-the-shelf software; delivery of a software component by a subcontractor to the prime contractor. The mere presence of code in a product does not, however, determine an identical scope of requirements. An application supporting an administrative process may require different controls from a component affecting a critical function. Before work begins, the parties should therefore identify at least the scope of supply, their respective responsibilities, software criticality, dependencies, acceptance arrangements and the evidence required by the customer. 4.1 Questions to ask before signing the contract Which AQAP publications and editions are referenced? Do the requirements apply to the entire supply, a specific component or selected processes? Is tailoring permitted and, if so, who approves it? What oversight and access rights are granted to the customer or Government Quality Assurance Representative? Which plans, records, reports and evidence are required for reviews and acceptance? Which obligations must be flowed down to subcontractors? How will software criticality be assessed, and how will it affect the rigour of project activities? Clarifying these points early reduces the risk of costly rework to documentation, testing processes or the supply chain once delivery is under way. 5. Why does AQAP 2210 matter to the customer? In a conventional commercial project, some ambiguities can be resolved by renegotiating scope or moving a deadline. In a defence project, the consequences of an incorrect configuration, incomplete test or loss of traceability may be much more serious. The system may interact with hardware, process operationally significant data or operate in an environment with limited connectivity and elevated threats. AQAP 2210 helps the customer reduce risks including: delivery of functionality that does not comply with contractual requirements; changes introduced without impact assessment and approval; absence of links between requirements, design, code and test results; inability to identify unequivocally the configuration submitted for acceptance; detection of critical defects only during acceptance testing; lack of objective evidence that tests were performed; uncontrolled use of external components; insufficient oversight of subcontractors; loss of knowledge needed to maintain and further develop the system; closure of a nonconformity without confirmation that the correction was effective. The principal value is therefore not the number of documents produced, but transparency. The customer can verify how the supplier interprets requirements, controls work, manages open risks and determines that a product is ready. 6. Key AQAP 2210 requirements in a software project AQAP 2210 covers numerous interrelated processes. Their detailed application depends on the contract, but the areas below are among the most important when assessing a supplier and planning delivery. 6.1 Project Software Quality Plan The Project Software Quality Plan should demonstrate how the organisation will meet the quality requirements of a specific undertaking. It is not a general quality policy or a document produced only immediately before an audit. A robust plan connects contractual requirements with the actual way in which the team works. It defines the scope, roles, responsibilities, lifecycle, reviews, verification and validation methods, configuration management, subcontractor control, metrics and required records. It should also identify dependencies between documents and explain how the plan will be updated when the project changes. The customer should be able to use it to understand not only what the supplier declares, but also when evidence will be provided, who will make decisions and how deviations will be handled. 6.2 Software criticality analysis Criticality helps align the rigour of project activities with the consequences of a potential failure. The analysis should consider the function of the software, its relationship with the overall system and the potential effect of malfunction on people, the mission, equipment, information and continuity of operations. The outcome may affect the independence of reviews, test scope, required coverage, reporting frequency, level of change control and treatment of risk. The objective is not to impose the most expensive controls on every component, but to reach a conscious, documented and justified decision. 6.3 Requirements management and traceability Requirements should be unambiguous, verifiable and subject to change control. The supplier must understand system, software and component requirements, together with constraints arising from architecture, interfaces, security and the operating environment. Traceability makes it possible to move from a requirement to the design solution, implementation and test, and then back from the test result to the contractual basis. It may be maintained in a matrix or a dedicated tool. What matters is that it remains current and reveals requirements without design coverage, code without justification or tests without a corresponding requirement. In a mature project, a requirement change triggers an assessment of its impact on architecture, code, tests, documentation, schedules and subcontractors. Updating a backlog item alone is insufficient if the remaining evidence is left out of date. 6.4 Software configuration management Software configuration management, or SCM, provides unambiguous identification of product items and control over their changes. It does not concern source code alone. Its scope may include requirements, models, scripts, environment configurations, libraries, documentation, test data, tools, build artefacts and installation packages. The customer should expect clear answers to practical questions such as: Which items make up a particular product version? Who approved a change, and on what basis? Can the build submitted for testing or acceptance be reproduced? How are the status of changes and nonconformities recorded? Does the supplier control dependencies, libraries and tool versions? How are repositories protected and access restricted? Without these mechanisms, even correctly tested functionality may enter the wrong release or be overwritten by a later change. 6.5 Verification, validation and testing Verification asks whether the product has been built in accordance with specified requirements and design. Validation establishes whether the solution meets the needs and intended use in its target context. In practice, both types of activity should be planned, have defined criteria and owners, and produce retained results. The test programme may cover unit, integration, system, performance, security, resilience and acceptance testing. The scope depends on the product and contract. Key considerations include: linking tests to requirements; defined test environments and test data; identification of the product version under test; test entry and exit criteria; results, deviations and evidence of execution; separation of roles where independence is required; handling of defects, retesting and regression testing. Automation can improve repeatability, but a pipeline report is not complete evidence on its own if it does not identify what was tested, which version was used and which criteria governed the assessment. 6.6 Nonconformities and corrective action The supplier should operate a controlled process for recording, assessing and closing nonconformities. A correction that addresses an immediate defect should be distinguished from corrective action intended to eliminate its cause. The record should make it possible to determine the impact of the problem, affected versions, the disposition decision, responsibility, retest results and any need to inform the customer. Recurring problems should lead to trend analysis and an assessment of process effectiveness, rather than another sequence of isolated code fixes. 6.7 Subcontractors, COTS and external components Modern software uses libraries, tools, services, devices and ready-made components. AQAP 2210 does not allow them to be treated as areas outside the supplier’s responsibility. The organisation should assess a component’s suitability, constraints, rights of use, documentation, configuration and effect on requirements. For commercial off-the-shelf software, objective grounds are needed to establish that the product will fulfil the required function. Where full traceability is not possible, the limitation should be identified, assessed and appropriately managed. Modifying ready-made software may also change the risk profile and responsibility for maintenance. The same principle applies to subcontractors. The prime contractor should specify requirements, monitor performance and retain evidence of oversight. A subcontractor’s certificate may support qualification, but it does not release the prime contractor from responsibility for compliance of the overall supply. 7. Can Agile and DevSecOps be reconciled with AQAP 2210? Yes. AQAP 2210 does not prescribe a single lifecycle model or mandate a waterfall approach. Agile and DevSecOps can be used if the organisation can demonstrate control over requirements, configuration, testing, accountability and releases. Agile or DevSecOps practice Corresponding quality mechanism Product backlog Controlled record of requirements, priorities and changes Definition of Ready Criteria establishing that a requirement is ready for implementation Definition of Done Quality, testing, documentation and acceptance criteria Pull request and code review Documented review and approval of a change Code repository Item identification and configuration control CI/CD Repeatable build, automated controls and retained results Test management Link between requirement, test case, product version and result Release pipeline Controlled release and unambiguous identification of its contents Retrospective Process improvement and corrective action The most common mistake is to equate agility with an absence of documentation. Documentation in an Agile project may be lighter, generated automatically and maintained in tools. It must nevertheless remain credible, accessible and understandable to those responsible for oversight. A second risk is excessive reliance on automation. A pipeline may execute thousands of tests, but the customer also needs context: the product version, test scope, criteria, deviations and approval. DevSecOps supports AQAP when it automates a controlled process, not when a stream of logs obscures the absence of accountability. 8. What documents and evidence may the customer expect? The final evidence set is determined by the contract. There is no single file or binder suitable for every project. In practice, the customer may expect materials such as: Area Examples of documents and records Control question Planning Project Software Quality Plan, review schedule and responsibility matrix Is it clear who makes each decision, when and against which criteria? Requirements Specifications, change history, traceability matrix and review records Does every requirement have a source, an owner and a verification method? Configuration SCM plan, configuration item list, baselines and release register Can the exact version delivered to the customer be reproduced? Testing Plans, cases, data, reports, results and defect records Does the result relate to the correct version and an approved requirement? Nonconformities Problem reports, decisions, root-cause analysis and retest records Has the problem been effectively resolved rather than merely marked closed? Suppliers Qualification criteria, assessments, purchasing requirements and reviews Have quality obligations been flowed down and are they monitored? COTS and dependencies Suitability assessment, versions, licences, constraints and functional evidence Does the organisation understand the risk and can it maintain the component? Acceptance and delivery Release documentation, acceptance results and list of deviations Are the contents of the delivery and any remaining limitations unambiguous? Evidence should be credible, current, linked to the relevant scope and reproducible. A screenshot without a date, version or owner has limited value. Equally, a policy describing a process does not demonstrate that the process was actually applied to the project. 9. What does AQAP certification demonstrate, and what does it not guarantee? Certification of a quality management system by a competent body is an important signal to the customer. It shows that a defined scope of the organisation’s activities has been assessed against the specified requirements and that the company maintains processes necessary for controlled delivery. A certificate may demonstrate: implementation and maintenance of a quality system conforming to a specified AQAP publication; assessment of the stated scope of activities and locations; the existence of controlled processes, responsibilities and records; periodic third-party assessment of the system; an organisational foundation for performing contracts that require AQAP. A certificate does not automatically guarantee: compliance of every project with every contract; a defect-free product; fulfilment of requirements outside the certification scope; possession of every clearance, authorisation or domain competence required by the project; effective application of processes without the right team and oversight; acceptance of the supplier by every customer without further qualification. The customer should therefore verify the issuing body, certificate validity, AQAP publication and edition, certification scope, locations and alignment of that scope with the planned procurement. It is also worth asking the supplier to demonstrate how its quality management system will be applied to the specific project. 10. How should you select an IT supplier for a defence project? A capable supplier combines three layers: organisational capability, technical competence and understanding of the defence environment. A weakness in any one of them may become apparent only during integration, oversight or acceptance. 10.1 Customer checklist [ ] The certification scope covers software development, delivery or maintenance relevant to the planned project. [ ] The supplier can translate contractual requirements into a quality plan and the team’s daily work. [ ] Requirements, design decisions, implementation and tests remain traceable. [ ] Configuration management covers code, documentation, dependencies, environments and releases. [ ] The build submitted for testing or acceptance can be reproduced unambiguously. [ ] The V&V process has defined roles, criteria, environments and retained results. [ ] Nonconformities are assessed, tracked, retested and closed on the basis of evidence. [ ] Subcontractors and COTS components are subject to qualification and monitoring. [ ] The team understands software-hardware integration and constraints of the target environment. [ ] The supplier understands defence systems, NATO standards and work within a supply chain. [ ] It can produce the quality evidence required for reviews, oversight and acceptance. [ ] It can provide maintenance, change management and controlled development after deployment. [ ] The engagement model clearly allocates responsibility for the product, quality, security and decisions. [ ] The experience claimed is relevant to the actual scope and criticality of the procurement. 10. Warning signs during supplier qualification Answers limited to stating that the company is certified or works in Agile should prompt caution. Other warning signs include: inability to explain the certification scope; a quality plan copied without adaptation to the project; no owner for the configuration management process; tests that are not linked to requirements and the product version; subcontractors treated as solely responsible for their own quality, without prime contractor oversight; no controlled process for approving deviations; documentation prepared only immediately before acceptance; inability to explain how changes will be handled after deployment. The best test is a discussion based on a realistic scenario: a high-criticality requirement changes, affects a subcontracted component and requires a new integration test. A mature partner can explain the impact assessment, decisions, configuration update, testing and evidence without hiding behind a generic procedure. 11. Why choose TTMS as a partner for the defence sector? The selection of a technology partner should be based on its fit with the specific undertaking. In the case of TTMS, the relevant strength is the combination of a certified quality management system, technical capabilities and domain experience. 11.1 Certified quality processes TTMS has obtained AQAP 2110 and AQAP 2210 certification, as described in the TTMS press release. For a prospective customer, this confirms that a defined scope of the company’s quality management system has been independently assessed against requirements used in the defence sector and in software quality assurance. Certification is not presented as a substitute for project analysis. It provides an organisational foundation on which to build the quality plan, traceability, configuration management and evidence required by a particular contract. 11.2 Technical expertise and domain knowledge The public TTMS offering for the defence and space sectors includes software development, defence IT engineering services, hardware-software integration, technical consultancy, project management and the provision of specialist teams. TTMS also describes experience involving C2, C4ISR and combat support systems, as well as work in the environment of international organisations. This combination matters because process conformity cannot replace engineering competence. Conversely, even a highly capable software team may struggle in a defence project if it cannot work with contractual requirements, quality oversight and formal evidence. 11.3 A flexible engagement model A project may require a complete solution, a distinct component, integration, a software team or individual specialist capabilities. The model should be selected after analysing the scope, responsibilities and quality requirements. Regardless of the form of engagement, ownership of requirements, configuration, testing, risk and acceptance should be clearly established. TTMS can join the undertaking as a technology partner supporting software development, integration and maintenance. The final obligations, applicable AQAP publications and required evidence should be defined in the documentation of the specific project. 12. What can an engagement with TTMS look like? 12.1 Context and requirements analysis The first stage establishes the purpose of the system, scope of supply, stakeholders, architecture, quality requirements and security constraints. The team identifies the publications and clauses referenced in the contract and areas requiring clarification. 12.2 Definition of the delivery model The parties establish responsibilities, team composition, interfaces with the customer and other suppliers, lifecycle, reviews, tools, configuration and required evidence. This stage should also plan the flow-down of requirements to subcontractors. 12.3 Controlled development and reporting Delivery combines engineering work with requirements, risk, configuration, quality and nonconformity management. The customer receives the agreed visibility of progress, results and open decisions. 12.4 Verification, validation and acceptance Tests and reviews are performed on controlled versions against approved criteria. The acceptance package should unambiguously identify the delivery contents, results, deviations and remaining limitations. 12.5 Maintenance and controlled development After deployment, configuration management, problem handling, updates, change impact assessment and documentation maintenance remain necessary. The support model should reflect the importance of the system and the required availability. 13. Are you looking for an IT partner for a defence project? A defence project requires a simultaneous understanding of technology, quality, integration, security and contractual accountability. It is worth involving the supplier before the architecture and delivery plan are finalised, so that AQAP requirements are not treated as a documentation exercise postponed until acceptance. Contact TTMS to discuss your project’s technical and quality requirements, allocation of responsibilities and a potential engagement model with the Defence team. 14. Frequently asked questions about AQAP 2210 What is AQAP 2210? AQAP 2210 is a NATO publication containing supplementary software quality assurance requirements. It is project-oriented and covers the management and technical processes needed for controlled software development and delivery. What do AQAP 2210 requirements cover? They include software quality planning, criticality analysis, requirements management, traceability, configuration, subcontractors, COTS software, verification, validation, testing and the treatment of nonconformities. The exact scope in a project is determined by the contract. What is the difference between AQAP 2110 and AQAP 2210? AQAP 2110 establishes broad quality assurance requirements for design, development and production. AQAP 2210 expands on software-specific requirements and is used as a supplement to AQAP 2110 or AQAP 2310. Can AQAP 2210 be used on its own? Not as a completely independent set of requirements. The current edition is intended for use as a supplement to AQAP 2110 or AQAP 2310. The applicable combination should be specified in the contract. When is AQAP 2210 required in an IT project? It is required when referenced in a contract, specification, quality clause or requirements imposed on the contractor. The fact that software is being developed for the defence sector does not, without examination of the documentation, establish an identical set of obligations in every case. Does every military software supplier need AQAP certification? There is no universal rule to that effect. The need for certification and its scope depend on the customer, procurement procedure, contract and type of supply. Even where certification is required, its validity and alignment with the project scope should be verified. Is ISO 9001 sufficient for a defence project? ISO 9001 can provide an important quality management foundation, but it does not replace detailed AQAP requirements referenced in the contract. Nor does it describe every mechanism focused on software quality assurance in a defence environment. Is AQAP 2210 compatible with Agile and DevSecOps? Yes. It does not mandate a single development model. The team must nevertheless retain control over requirements, changes, configuration, testing, accountability and evidence. Agile cannot be used to justify a loss of traceability. What documents should a software supplier prepare? Depending on the contract, these may include a Project Software Quality Plan, configuration management plan, requirements register, traceability matrix, review reports, test plans and results, change and nonconformity records, supplier assessments, and release and acceptance documentation. Does AQAP 2210 cover COTS components and subcontractors? Yes. The supplier should oversee subcontractors and assess the suitability, configuration, documentation, constraints and risks of ready-made components. Responsibility for the overall supply does not disappear because part of the solution originates from another organisation. How can the scope of a supplier’s AQAP certificate be verified? The issuing body, certificate number and validity, AQAP publication and edition, scope of activities, locations and any exclusions should be checked. The scope should correspond to the work actually entrusted to the supplier. Why choose a supplier certified to AQAP 2110 and AQAP 2210? The certificates can reduce uncertainty regarding the maturity of the quality management system and the organisation’s ability to operate controlled processes. The customer should still assess technical capabilities, domain experience, certification scope and the proposed application of requirements to the specific project.

AEM Content Models: A 2026 Guide to Content Fragment Model Best Practices

Content teams managing digital experiences across multiple channels often face a familiar challenge: the same product description, promotional message, legal disclaimer, or campaign message needs to be adapted for different platforms and formats. In Adobe Experience Manager, Content Fragment Models help address this challenge by giving teams a structured way to define content elements and create reusable content fragments. This guide explains what AEM Content Fragment Models are, how they work, and what to consider when designing structured content in AEM in 2026. 1. What Are AEM Content Models and Why They Matter in 2026 In AEM, what many teams call “content models” usually refers to Content Fragment Models. These models act as blueprints for structured content. They define the fields, data types, and validation rules that content fragments based on the model need to follow. Instead of authors recreating the same information in multiple places, a Content Fragment Model gives teams a repeatable structure for content creation. For example, a product model might include fields for product name, description, specifications, image reference, and related policy information. Every product content fragment created from that model follows the same structure, making the content easier to manage, validate, and deliver. Content Fragment Models also support reusable relationships between pieces of content. For example, a product content model can use a Fragment Reference to connect product entries with a shared policy fragment, such as warranty information. This allows teams to manage reusable structured content in one place and reference it from related content fragments. 1.1 Content Fragment Models vs. Content Fragments: Key Differences It is easy to conflate Content Fragment Models with Content Fragments, but the distinction is fundamental. A Content Fragment Model is the blueprint: it defines which fields exist, which data types they use, and what validation rules apply. A Content Fragment, by contrast, is an actual piece of structured content created from that model and filled in with authored values, such as text, numbers, dates, tags, asset references, or fragment references. Think of the model as a recipe card and the fragment as the dish itself: the model defines the structure, while each fragment contains the authored content. 1.2 How Content Fragment Models Enable Headless and Hybrid Delivery Content Fragment Models help make headless and hybrid delivery practical by separating content structure from page presentation. Because a Content Fragment Model defines structured content independently of a specific page layout, the resulting Content Fragments can support both headless content delivery and page authoring in AEM. For headless delivery, AEM can expose Content Fragments through GraphQL, allowing front-end applications to request structured content based on the models behind those fragments. This makes it possible for development teams to use AEM-managed content in digital experiences that are not limited to traditional AEM page rendering. 2. When to Use Content Fragment Models vs. Editable Templates or Experience Fragments Not every piece of content belongs in a Content Fragment Model. Editable templates and Experience Fragments still have their place, especially when the priority is page structure, layout control, or reusable visual experiences rather than structured content reuse. A campaign landing page, for example, may be better suited to an editable template or an Experience Fragment if the main requirement is flexible page composition, visual layout, and reusable design elements. In AEM, Experience Fragments combine content and layout and can be reused across pages, while Content Fragments are structured editorial content without additional visual design or layout. Product specifications, staff bios, FAQ entries, legal text, and policy information are strong candidates for Content Fragment Models because they often need a consistent structure across multiple contexts. In short, use Content Fragment Models when content needs to be structured and presentation-independent. Use editable templates or Experience Fragments when the priority is page layout, visual composition, or reusable page experiences. 3. Core Building Blocks of an AEM Content Fragment Model Every AEM Content Fragment Model is built from a set of configurable elements: data types, field properties, validation rules, references, and optional structure helpers such as tabs. Getting familiar with these building blocks is the first step toward designing models that remain clear, reusable, and manageable over time. 3.1 Common Data Types and Field Options Several foundational field types cover common structured content needs. Text fields can be used for names, titles, summaries, descriptions, and longer body copy. Number fields capture numerical values. Boolean fields support simple true-or-false choices. Date and time fields are useful for content that needs a scheduled or time-based value, such as a publication date, event date, or availability period. 3.2 Enumerations, Tags, and JSON Object Fields Beyond the basics, enumerations let authors select from predefined options, helping keep values consistent across fragments. Tags can support categorization and filtering by allowing authors to apply defined tag values to content. JSON Object fields allow authors to enter JSON syntax in the corresponding element of a Content Fragment. This can be useful when structured JSON needs to be stored and delivered as JSON, including through GraphQL. However, JSON Object fields should be used carefully. In many cases, clearly defined fields or Fragment References are easier for authors to manage and easier for teams to govern over time. 3.3 Content Reference and Fragment Reference for Nested Content Content Reference fields let authors reference other content, such as assets or other content resources, instead of duplicating information directly inside a fragment. This can help teams keep related content easier to manage. Fragment Reference fields are especially important for structured content because they allow one Content Fragment to reference another Content Fragment. This supports nested content structures and makes it possible to model relationships between fragments. 3.4 Properties, Field Configuration, and Tabs Each field in a Content Fragment Model includes properties that define how the field behaves. Depending on the data type, these properties can include the field label, property name, rendering options, required status, validation settings, allowed models, root paths, or accepted content types. Tabs can also be used to organize the authoring interface. In AEM, a Tab Placeholder helps separate groups of fields in the Content Fragment editor, making larger models easier for authors to navigate. Tabs are used for authoring organization rather than content delivery logic. 3.5 Validation Rules for Data Integrity Validation rules act as guardrails for structured content. They help ensure that authors enter content in the expected format before the fragment is saved and used downstream. Depending on the field type, validation can include requirements such as making a field mandatory, checking text against a predefined pattern, limiting numerical values, restricting referenced content to specific types, or allowing only fragments based on selected models. Thoughtful validation helps reduce inconsistent content, missing required values, and formatting issues. 4. Step-by-Step: Creating and Configuring a Content Fragment Model Creating a Content Fragment Model in AEM usually involves enabling the right configuration, creating the model, defining its structure, enabling it for authoring, and allowing it on relevant Assets folders through policies. 4.1 Setting Up Configuration and Access Before any modeling work begins, teams should make sure that Content Fragment Model functionality is enabled for the relevant AEM configuration. Without this setup, authors and administrators may not be able to create models in the expected location. 4.2 Building the Model Structure and Defining Fields Once the configuration is ready, teams create the model by adding data types, configuring field properties, and applying validation where needed. 4.3 Allowing the Model on Assets Folders A Content Fragment Model needs to be allowed on the relevant Assets folders where authors will create Content Fragments. This is done through folder policies. If the model is not allowed for the folder, authors may not see it as an available option when creating a new Content Fragment in that location. 4.4 Enabling, Disabling, Publishing, and Unpublishing Models Content Fragment Models have lifecycle controls that affect how they are used. A model can be enabled so authors can create Content Fragments based on it, or disabled when it should no longer be used for new fragments. In AEM as a Cloud Service, models can also be published to the Publish or Preview tiers. Publishing controls the availability of the model outside the authoring environment, while enabling controls whether authors can create new Content Fragments from the model. Teams should use these controls carefully, especially when changing models that already have dependent Content Fragments. Structural changes may affect authoring workflows, delivery, integrations, and GraphQL-based use cases. 5. Best Practices for Designing Scalable Content Fragment Models 5.1 Structuring Models for Reuse Across Delivery Scenarios Strong Content Fragment Models are designed around reusable content, not around a single page layout. Because Content Fragments can support both headless delivery and page authoring in AEM, the model should define the content structure independently of how that content will eventually be presented. This means thinking early about which content elements need to be reused, referenced, filtered, or delivered through APIs. For example, a product model, author profile, FAQ entry, or policy fragment should focus on the information authors need to manage rather than the visual layout of a specific page. 5.2 Naming Conventions and Governance Standards Clear naming conventions help teams keep Content Fragment Models easier to understand and maintain. Field labels should be author-friendly, while property names should be consistent, predictable, and suitable for structured delivery. In AEM, property names are especially important because they identify where authored values are stored and can also affect how structured content is exposed downstream. When defining property names manually, they should use only supported characters, such as letters, numbers, and underscores. 5.3 Using Nested Fragments Without Overcomplicating Structure Fragment References are useful when one Content Fragment needs to reference another Content Fragment. They make it possible to create nested content structures and model relationships between pieces of structured content. However, nested structures should be used intentionally. Too many layers of references can make models harder for authors to understand and maintain. A better approach is to use Fragment References where they reduce duplication, clarify relationships, or support reusable content patterns. 5.4 Planning for Variations and Localization Content Fragments can include variations, which makes it important to consider how content may need to differ by use case, market, language, or channel context. The Content Fragment Model should provide a stable structure, while individual fragments and their variations can support different content needs within that structure. When localization is part of the content strategy, teams should consider it early in the modeling process. This includes thinking about which fields may need localized values, which references should remain shared, and how language copies or regional versions will be managed in AEM. 6. Displaying and Delivering Content Fragments in AEM Once Content Fragment Models are built and Content Fragments are created, the next question is how that structured content should be displayed or delivered. AEM supports different approaches depending on whether the content is used in page authoring, delivered through headless APIs, or reused across multiple digital experiences. Content Fragments can be used directly in AEM page authoring when teams want structured content to appear within AEM-managed pages. In this approach, authors can place Content Fragments into page experiences while still relying on the structure defined by the underlying Content Fragment Model. For headless delivery, AEM Content Fragments work with the AEM GraphQL API. GraphQL allows front-end applications to query structured content based on the schemas generated from Content Fragment Models. This helps developers request only the content they need for a given experience. Many AEM implementations can use both approaches. A team might use Content Fragments in AEM pages for the main website while also exposing selected structured content through GraphQL for other supported digital experiences. 7. Common Content Modeling Mistakes and How to Avoid Them Several content modeling mistakes can make AEM Content Fragment Models harder to maintain over time. One common issue is overcomplicating the model structure. Trying to anticipate every possible future use case can lead to too many fields, unnecessary references, or deeply nested fragment structures that are difficult for authors to understand and manage. Another frequent issue is treating validation as optional. Content Fragment Models can include validation settings such as required fields, text patterns, numeric constraints, content reference restrictions, and allowed models for Fragment References. Using these rules thoughtfully helps reduce inconsistent values, missing required information, and content that does not match the intended structure. Unclear naming conventions can also create problems. Field labels should be easy for authors to understand, while property names should remain consistent and technically safe. In AEM, manually defined property names should use only supported characters, such as letters, numbers, and underscores. The best way to avoid these issues is to plan models before building them. Start with the content types that need to be managed, identify which fields are required, decide where references are genuinely useful, and keep the model as simple as the content requirements allow. 8. Migrating and Evolving Content Fragment Models Without Disrupting Content Content Fragment Models may need to evolve as content requirements change. New fields may be added, existing fields may need clearer validation, and references may need to be adjusted as the content structure becomes more mature. These changes should be handled carefully because editing an existing Content Fragment Model can affect dependent Content Fragments. A safe approach starts with understanding which Content Fragments are based on the model being changed and how those fragments are used in authoring, delivery, and integrations. This is especially important when structured content is exposed through GraphQL, because schemas are generated from Content Fragment Models and downstream applications may rely on specific fields being available. Before making structural changes, teams should review the model, identify required updates, and test changes in a non-production environment where possible. Adding new optional fields is usually less disruptive than removing or renaming existing fields, especially when those fields are already used by authors or external consumers. When a model needs to change significantly, it can be safer to introduce changes gradually. Teams may choose to update validation rules, adjust references, or create a new version of a model instead of modifying an existing structure too aggressively. This helps protect existing content while still allowing the model to adapt to new requirements. 9. How TTMS Can Support Your AEM Content Models Strategy At TTMS, we support organizations with Adobe Experience Manager implementation, consulting, development, integration, and maintenance services. We are a Bronze Adobe Solution Partner, and our AEM team helps clients design, build, optimize, and maintain AEM solutions tailored to their digital experience needs. If your team is planning to modernize its content architecture, improve structured content governance, or build scalable AEM Content Fragment Models for product catalogs, customer portals, or headless delivery, we can help you design the right foundation and evolve it safely over time. If you want to build a more scalable AEM content architecture, contact us to discuss how we can support your AEM Content Fragment Models strategy.

Astra, the Future GPT-6? OpenAI’s New Model Explained

Solving mathematical problems that scientists had wrestled with for years – could there be a better demonstration of what a new AI model can do? OpenAI has typically previewed new versions of its large language models with benchmark results, meaning scores from standardised tests designed to measure a model’s capabilities. I have to admit that seeing GPT tackle genuine research problems makes a much stronger impression on me. What will you learn about OpenAI Astra? What Astra is and why it is being discussed as a potential GPT-6, 10 results in mathematics and theoretical computer science presented by OpenAI, How Astra analyses problems, tests hypotheses and changes its approach, The differences between a conversational model, an AI agent and a system capable of managing an entire project, What Astra could mean for science, business and the future of AI models, Critical responses to the model’s achievements, Cybersecurity risks associated with autonomous AI agents, Which important questions OpenAI has yet to answer. What is OpenAI Astra, and could it become GPT-6? OpenAI describes Astra, the prototype’s working name, as “our next major model”, although the company has disclosed very few details so far. Its task was to develop arguments independently, test hypotheses, recognise unproductive approaches and find new paths towards a solution. The results of its work can then undergo formal and independent verification. We do not know how Astra is built, how much information it can analyse at once or how it organises its work on a complex task, although we can speculate about the last of these. OpenAI has also not disclosed whether Astra is a single model, a team of collaborating AI agents or a more extensive system equipped with mechanisms for coordinating their work and retaining previous results. The prototype may be connected to a model previously described by OpenAI as capable of operating autonomously over very long periods. Such a system can make repeated attempts, analyse intermediate results and maintain its direction of work for many hours, potentially even days. According to media reports, Sam Altman has already presented Astra to US politicians and regulators. The term “GPT-6 Astra” should therefore be treated as media shorthand. Astra could eventually be released as GPT-6, another version of GPT-5 or a separate family of models. For now, all of these possibilities remain open. Why could Astra’s 10 results matter more than another benchmark record? OpenAI presented ten results concerning problems that had remained open for at least a decade and, in most cases, considerably longer. The problems come from eight fields: high-dimensional geometry, coding theory, group theory, operator algebras, computational complexity theory, quantum computing, lattice geometry and post-quantum cryptography, extremal combinatorics. In simple terms, the process worked as follows: GPT generated mathematical arguments. Once the results had been obtained, researchers worked with the model to develop them into scientific papers. The system then translated the arguments into Lean 4, allowing a computer to check every step of the proofs. For readers interested in the technical details, here are the relevant links: the complete collection of papers, the Lean formalisation repository and reconstructions of how the solutions were developed. Independent verification of all the claims by the scientific community is only beginning. Mathematicians can now review the papers, check the definitions, run the formalised proofs and look for potential gaps. I discuss this in more detail in one of the final sections. 10 new results from Astra in mathematics and theoretical computer science A quick warning: this section is about to become fairly technical. These subjects are new, abstract and extraordinarily difficult for me as well, so I have tried to explain each result in the simplest possible terms. Here is how GPT Astra approached the individual problems. 1. Sphere packing in high-dimensional spaces The sphere-packing problem asks how densely identical spheres can be arranged, much like coins on a table or balls in a box. Mathematicians also study this question in spaces with hundreds or thousands of dimensions because it has applications in areas such as information theory and data encoding. Astra used an established mathematical method to determine more precisely how densely spheres can be packed in spaces with a very large number of dimensions. According to the authors, this is the first improvement since 1978 to the value used in the formula describing how quickly the possible packing density decreases as the number of dimensions increases. The difference becomes more significant as the number of dimensions grows and enables a more precise estimate of the maximum packing density. Put simply, Astra’s calculations improve our understanding of how many spheres can fit inside such a “high-dimensional box”. 2. Binary and spherical codes: new bounds on the number of error-resistant codes A binary code is a set of sequences made up of zeros and ones. These sequences must differ from one another sufficiently for a system to detect and correct transmission errors. This can be compared to positioning transmitters at safe distances from one another so that their signals remain easy to distinguish. Astra determined more precisely how many codes can be placed sufficiently far apart for a system to continue distinguishing between them and correcting errors. This enables mathematicians to estimate more accurately how many codes with the required level of error resistance can fit within a given space. The model tested its initial idea on a simple example consisting of eight digits and discovered that it produced an incorrect result. It therefore abandoned that approach and reformulated the problem. This case demonstrates Astra’s ability to test its own assumptions and redesign its solution when the original direction proves unsuccessful. OpenAI’s published materials support four important conclusions. 3. The first explicit example of a non-sofic group A group is a mathematical way of describing symmetries and operations that can be performed in sequence, much like a set of moves used to rotate a Rubik’s Cube. Sofic groups can be approximated with arbitrary precision using simpler structures based on a finite number of elements. For decades, mathematicians wondered whether this property applied to every group. Astra identified a specific example of a group that cannot be approximated with arbitrary precision using simpler models composed of a finite number of elements. The result demonstrates that these simplified models cannot represent every mathematical group. The solution combined several distant areas of mathematics, demonstrating the model’s ability to bring together tools that had not previously formed an obvious path towards a proof. 4. Disproving Connes’ rigidity conjecture The von Neumann algebra associated with a group can be compared to its highly complex mathematical “fingerprint”. Connes’ conjecture proposed that, for a certain class of particularly rigid groups, this fingerprint uniquely identifies the group in question. Astra constructed infinitely many different groups with exactly the same mathematical “fingerprint”. In doing so, it disproved Connes’ conjecture and answered a later question posed by mathematician Sorin Popa. Astra used a mechanism resembling the carrying operation in binary addition. This made it possible to construct many different groups with the same mathematical “fingerprint”. Put simply, Astra demonstrated that a single mathematical “fingerprint” can belong to infinitely many different groups. 5. The matrix permanent: the minimum number of operations required for its computation The permanent of a matrix is calculated in a similar way to the determinant, except that all terms are added with a positive sign. This seemingly minor change makes the permanent one of the most important examples of a problem with extremely high computational complexity. Astra determined the minimum number of basic operations required to calculate the permanent. It proved that no solution within this class can be simplified below a certain level of complexity. This can be compared to determining the minimum number of components required to build any machine capable of performing a particular task. Such a proof must cover every possible construction that meets the specified conditions, which makes it exceptionally difficult to develop. The result provides a more precise lower bound on the number of operations needed to solve this problem. It also brings mathematicians closer to answering a fundamental question: which problems can be solved efficiently, and which will always require an enormous amount of computation? 6. Quantum games: why does the probability of a perfect win decrease so rapidly? Imagine a game in which two players answer a referee’s questions separately, while their shared goal is to complete every round successfully. In the classical version, each additional round rapidly reduces the probability of a perfect win, much like repeatedly tossing a coin reduces the chance of getting heads every time. In the quantum version, the players’ results can be correlated even when they do not communicate during the game. They can also analyse several rounds as a single combined problem. Astra proved that even such quantum correlations cannot prevent the probability of winning every repeated round from decreasing very rapidly. The problem had remained open since at least 2004. The key to the solution was a method for transforming quantum states without changing the probabilities of their possible outcomes. The result advances the theory of interactive proofs, quantum information theory and methods for increasing the reliability of protocols. 7. The Closest Vector Problem: even an approximate solution remains difficult A lattice can be imagined as a regular grid of points, similar to street intersections in a perfectly planned city, extending across many dimensions. The Closest Vector Problem (CVP) involves finding the point on this grid that lies closest to a selected location. It is highly relevant to geometry, coding theory and post-quantum cryptography. Astra connected CVP with the well-known 3SAT logic problem and demonstrated that finding even a solution that merely approximates the optimal one is extremely difficult. This difficulty increases with the number of dimensions in the lattice. The model represented the logical puzzle as a system of points and distances between them. This can be compared to encoding a complex logic puzzle in a spatial arrangement of points so that solving one problem also provides a solution to the other. The result deepens our understanding of the theoretical difficulty of lattice-based mathematical problems. Assessing the security of specific cryptographic algorithms requires a separate analysis of their variants, parameters and methods of data generation. 8. Proving Ehrhart’s conjecture on the volume of high-dimensional shapes A high-dimensional convex body can be imagined as a solid placed on a regular lattice of points, with its centre of gravity being the only lattice point located inside it. Ehrhart’s conjecture specified the maximum possible volume of such a body, and Astra proved it for any number of dimensions: vol(K) ≤ (n+1)n / n! The main difficulty was connecting the number of individual lattice points with the volume of the entire body. The first approach provided only part of the information required. Astra therefore reformulated the problem in the language of another branch of geometry and began searching for a solution using its tools. The model combined several advanced methods for describing the body’s shape, its boundaries and the distribution of points. Put simply, Astra translated the geometric puzzle into a different mathematical language in which it became possible to determine the exact volume bound. 9. Multicolour Ramsey numbers A complete graph can be imagined as a group of people in which every pair is connected by a line, with each line assigned one of k colours. Mathematicians ask how large such a network must become before it inevitably contains three people whose connecting lines are all the same colour. This minimum size is denoted by Rk(3). Astra developed new colouring methods which, when combined with previous results, established the growth rate of this number: Rk(3) = kΘ(k). The result does not provide an exact value for every number of colours, but it reveals the correct scale of growth. In doing so, it resolves Erdős Problem No. 183. Astra expanded the network in stages according to the same rule. This made it possible to construct increasingly large configurations without creating a triangle whose edges were all the same colour. 10. Two counterexamples in extremal graph theory An extremal number determines how many connections a network can contain before a specified forbidden configuration inevitably appears. Astra disproved two conjectures proposed by Erdős and his collaborators concerning how this value could be predicted. In the first case, it constructed a family of graphs in which forbidding each member individually still allowed approximately n4/3 edges, while applying all the restrictions simultaneously reduced the maximum number to O(n21/16). This shows that several forbidden structures can constrain a graph far more strongly together than when each is considered separately. In the second case, Astra found a network divided into two groups in which every small section contained few connections, while the complete construction could be considerably denser than the conjecture predicted: ex(n, H) ≥ cn3/2+ε. The two results resolve Erdős Problems No. 146 and 180. They also show that the simple structure of small sections of a network does not always allow us to predict how dense the entire construction can become. A critical perspective: how do experts assess Astra’s mathematical achievements? After the initial excitement, important reservations began to emerge. Mathematicians pointed out that at least two of Astra’s results rely heavily on earlier work, raising questions about their novelty. OpenAI has since changed the way it describes the experiment. It now increasingly refers to “making meaningful progress”, rather than solely to “solving longstanding problems”. Interestingly, a researcher affiliated with Anthropic reported that the Claude Fable model had reproduced solutions to five of the ten problems tackled by “GPT-6” within 24 hours, although these results have yet to be fully verified. This does not undermine Astra’s capabilities, but it makes it more difficult to determine whether we are witnessing a breakthrough driven by the exceptional abilities of one model or broader progress across AI models as a whole. Above all, there is still no reliable, independent and fair comparison conducted using the same problems, prompts, computational budgets and rules governing access to tools. What do the results reveal about how Astra works? OpenAI’s published materials support three important conclusions. 1. The model can abandon dead ends The published reconstructions show Astra trying different approaches, identifying obstacles, reformulating problems and returning to earlier stages of its work when necessary. This resembles genuine research more closely than an extended answer generated in a single pass. In the binary-codes problem, the first recurrence was rejected after the model found a small counterexample. When working on Ehrhart’s inequality, Astra spent considerable time developing an approach based on symmetrisation before reformulating the problem in terms of toric geometry. In the proof concerning quantum games, it recognised that the classical argument lost control after conditioning on rare events and began searching for a representation that preserved quantum probabilities. The published document does not reveal the model’s complete internal reasoning process. It is a narrative produced by a model that reviewed the original reasoning traces and the final papers. 2. GPT Astra combines discovery with automated verification Lean checks the correctness of a formal proof step by step. The repository contains separate files for all ten results, along with instructions for performing additional checks of the formalised proofs. Computer verification does not replace assessment by independent mathematicians. Researchers must still establish, among other things: whether the formal theorem corresponds precisely to the original problem, whether the definitions introduce any unintended simplifications, whether the result is genuinely new, how significant it is for the relevant field, whether the manuscript correctly connects the formalisation with the informal argument. A computer can confirm that a written proof is logically correct under the adopted definitions and assumptions. It does not automatically confirm that the authors formalised precisely the version of the problem that mathematicians intended to address. The research was published on 1 August 2026, so full independent verification by the mathematical community will take time. Thomas Bloom of the University of Manchester nevertheless described the results as “big news” and rated the significance of the presented constructions particularly highly. 3. The cost of Astra’s results and the importance of additional computing power OpenAI claims that, based on the API pricing for GPT-5.6 Sol, the tokens required to find all ten solutions would have cost approximately $2,000. This figure is, of course, neither the actual cost of developing Astra nor the full cost of the project. It does not include model training, infrastructure, researchers’ work, problem selection, validation or all the unsuccessful attempts. It is simply the cost of the tokens used to find the published solutions, calculated according to current API pricing. The average comes to approximately $200 per published result, but we do not know: the total number of problems presented to the model, the success rate, how the costs were distributed across the problems, how long the system operated, how many agents were involved, how many runs were conducted in parallel. Noam Brown, an OpenAI researcher involved in the work on Astra, acknowledged that the system had also been tested unsuccessfully on other major mathematical challenges, including the Millennium Prize Problems. He added that OpenAI had not allocated an especially large amount of computing power to each problem. The company therefore believes that Astra could achieve better results if given more time and resources to search for solutions. From GPT-5.6 to Astra: how AI is moving from answering questions to managing projects GPT-5.6 already includes several features that point towards the direction described above. The model can independently select tools, analyse the results it obtains and use them to plan its next actions. Ultra mode uses four agents by default, while OpenAI has also tested configurations involving sixteen agents. The company also offers a multi-agent mode in the Responses API in beta. Astra may develop this architecture towards much longer and more coherent periods of autonomous operation. The most important difference would be its ability to manage an entire project over many hours or days. The system would need to remember what it had already tried, which ideas it had rejected, what results it had obtained and how the individual tasks related to one another. From the user’s perspective, the change could be very tangible. Instead of guiding the model through a sequence of prompts, the user gives it an objective, a set of available tools, a defined scope of permissions, a budget and completion criteria. The user then returns to a finished result accompanied by a record of the attempts, tests and decisions made along the way. This progression can be presented as three successive units of work: A conversational model generates an answer. An agent completes a task using tools. A multi-agent system manages a project in which tasks are created and modified as the work progresses. Only the technical documentation will show whether Astra genuinely operates at the third level as a coherent system. The mathematical demonstration is, however, the first strong indication that this direction is becoming more than a promise. OpenAI, Google DeepMind and Anthropic: the race to develop long-horizon AI models Google DeepMind, Anthropic and OpenAI are developing AI systems capable of independently handling increasingly long and complex tasks. Aletheia, Google’s mathematical agent based on Gemini Deep Think, can generate solutions, verify their correctness and revisit them when it detects an error. When analysing 700 Erdős problems, it solved four questions that had previously remained open. Anthropic, meanwhile, is focusing on coordinating the work of multiple agents. According to the company, Claude Opus 4.8 can divide a large project into smaller parts and assign them to hundreds of subagents working in parallel. This allows it to carry out tasks such as migrations involving hundreds of thousands of lines of code. Claude Science, another environment being developed by the company, is intended to make it possible to trace and verify the successive stages of research work. All these projects point in the same direction: models are expected to work towards a single objective for longer, monitor their own results and revise earlier decisions. Astra stands out for producing results at the frontier of contemporary knowledge and for formally encoding some of its proofs, allowing their correctness to be checked by a computer. How could Astra change the AI model and agentic tool market? 1. Benchmarks may lose their role as the primary evidence of AI model quality Competition will increasingly focus on the final outcome: a new hypothesis, a discovered vulnerability, a completed system migration, a developed scientific model, a working application, a result that can be verified automatically. Astra was presented through its scientific results because conventional benchmarks do a poor job of communicating the difference between a model that answers a question and a system that manages an entire project. Benchmarks will remain necessary for comparing models under controlled conditions. Their market significance may, however, decline in favour of evaluations that measure project completeness, operational continuity and the quality of the final result. 2. The cost of a completed task may matter more than the price per token For business customers, the following factors will become increasingly important: the cost of completing the project, the time required to obtain the result, the probability of success, the number of human interventions, the cost of validation, the ability to resume work after an error. Approximately $2,000 for the tokens that produced ten published results is a powerful economic signal, even with all the reservations concerning how the results were selected. Perhaps future pricing models will include offers such as the “cost of a successfully completed migration”. This would, however, require transparent information about the number of failed attempts, the additional human work involved and the cost of verifying the result. 3. Astra could affect platforms that coordinate AI agents If models begin dividing work among agents, retaining a record of their progress and combining the resulting outputs themselves, some external platforms used to coordinate AI agents may lose part of their current advantage. The value of these platforms will primarily come from integration with company systems, access and cost controls, visibility into agent activity and the ability to audit the entire workflow afterwards. Dividing a task among several agents may become a standard model capability. The implementation layer will derive its value from embedding agents securely within organisational processes. 4. Keeping AI agent workflows under full control When a task lasts several days, the system must regularly save its progress and check whether subsequent actions are still leading towards the defined objective. OpenAI acknowledges that long-running work requires monitoring the model’s complete sequence of actions. Each individual step may appear safe even though, taken together, the steps lead to an unacceptable outcome. The company described a case in which a model attempted to bypass a safeguard by splitting a digital access key into separate parts and reassembling them only when the program was launched. Each step, considered in isolation, could appear relatively harmless, while the objective of the complete sequence was unacceptable. In another experiment, the model was instructed to deliver its results through Slack. Instructions found in the code it was analysing suggested publishing the proposed changes directly to GitHub instead. The model spent approximately an hour searching for a way around the test environment’s restrictions before finding a vulnerability and publishing the result there. Earlier models had abandoned the task under similar circumstances. The case shows that a longer operating horizon increases both the model’s effectiveness and the amount of time it can devote to searching for ways around safeguards. In response, OpenAI developed a system that analyses the model’s entire sequence of actions as its work progresses. The system can stop the session, notify the user and ask them to decide whether the work should continue. Further details are available in OpenAI’s report on the safety of long-horizon models. 5. Research fields in which Astra could accelerate progress The most immediate impact is likely to appear in fields with: precisely defined problems, extensive available literature, formal or automated verification tools, the ability to conduct computational experiments, unambiguous criteria for measuring progress. Mathematics is an ideal testing ground because a proof can be verified. Similar conditions exist in software development, chip design, some areas of chemical research, bioinformatics and cybersecurity. Economics, strategy, law, management and social research will remain much more challenging because correctness cannot be reduced to a machine-verifiable certificate. In these fields, a model may produce an impressively coherent project that is still based on flawed assumptions or a poorly defined objective. 6. Long-horizon models will require more computing power An important capability of a model will be the option to allocate more computing power and more attempts to particularly difficult problems. This will give an advantage to laboratories with: extensive computing resources, efficient communication between agents, effective context management, automated detection of dead ends, the ability to run multiple attempts and select the best result. The next stage of competition may concern more than model size. It may also depend on how effectively models use time and computing power when working on a specific task. The same model could operate as a relatively inexpensive assistant for everyday questions and as a costly research system when the user increases the budget for time, agents and parallel attempts. The section likely to age quickly: what do we still not know about Astra? OpenAI has not disclosed basic information about Astra, including its architecture, size, method of agent collaboration, memory mechanism or capabilities beyond mathematics. We also do not know its price, release date or whether OpenAI plans to make the model available through ChatGPT or the API. The published results do not demonstrate that Astra selected the problems independently, operated without supervision or can manage an entire research process. Nor do we know whether it can achieve similar results in other fields. There is therefore no basis for describing Astra as a system that matches human capabilities across a broad range of intellectual tasks. We also do not know the total number of failures. OpenAI published selected successes, while Noam Brown confirmed that the system had attempted to solve other major problems without success. Without knowing the total number of attempts, it is impossible to calculate Astra’s actual success rate or the expected cost of obtaining one valuable result. Why is Astra not yet an autonomous scientist? The published papers show a system solving problems selected and presented by humans. An autonomous scientist would also need to: select research directions independently, assess which questions are important, determine whether a result is genuinely new, design subsequent experiments, decide when sufficient evidence has been collected, place the result within the broader context of the field. Astra completed the most technically demanding part of this process: it developed new arguments and brought them to a form that could be formally verified. This is a major achievement, but it does not encompass the full scope of scientific work. Can Astra succeed beyond mathematics and controlled environments? The ten published papers demonstrate what Astra was able to achieve in a carefully selected environment. Mathematics offers clearly defined problems, extensive literature, precise language and formal verification tools. The real test will be whether this capability can be transferred to projects in which the objective changes as the work progresses, tools fail, data is incomplete and the correctness of the result requires human judgement. If Astra can maintain a coherent process over many hours or days, delegate subtasks, retain the results of previous attempts and return to a problem after detecting an error, the change will be more significant than another increase in benchmark scores. Models such as Astra demonstrate how rapidly the capabilities of artificial intelligence are advancing. In business, their value depends on selecting the right process, ensuring data quality, integrating AI with company systems and maintaining control over its operation. TTMS helps organisations design and implement solutions tailored to specific operational needs. Explore TTMS AI solutions for business and implementation examples. How autonomous was Astra when solving mathematical problems? OpenAI states that the mathematical arguments were generated by the system, while humans contributed to preparing the manuscripts, formalising the results and verifying their correctness. The papers list OpenAI as the author, and the company has not attributed individual proofs to specific employees. This creates an interesting precedent: the organisation assumes responsibility for the publications while crediting the model with producing the arguments. However, it remains unclear who selected the problems, prepared the prompts, initiated subsequent attempts and decided which results were suitable for publication. Without this information, it is difficult to determine Astra’s precise level of autonomy or distinguish the capabilities of the model itself from the work of the wider research team. Can artificial intelligence be the author of a scientific paper? Authorship involves responsibility for the research method, the evidence presented, the conclusions and any potential errors. An AI system cannot formally accept such responsibility, so researchers should remain the authors of scientific publications. The model’s contribution should be described clearly in the methodology, including how it was used and which elements of its work were verified by humans. How can researchers verify whether AI has made a genuinely new discovery? A correct result is not necessarily a new one. Researchers must compare it with the existing literature, previously unpublished work and known variants of the same problem. One particular challenge is determining whether the model developed a new solution or reproduced a relationship contained in its training data. Novelty should therefore be assessed separately from the correctness of the proof itself. Can a result produced by a closed AI model be reproduced? Reproducing an experiment is difficult when researchers do not know the model’s architecture, training data or exact settings. Recording the prompts, system version, tools used, intermediate results and human interventions can make the process more transparent. The final result should also be verifiable using a method independent of the model that generated it. Without this documentation, other scientists may be able to verify the result itself, but not the full process that led to it. Could AI agents increase the risk of errors and unreliable scientific publications? An AI agent can generate large numbers of convincing hypotheses, proofs and interpretations of data in a short time. This scale can accelerate research, but it can also spread flawed assumptions more quickly. Academic journals and research institutions will need clear rules for disclosing the use of AI, preserving a record of the research process and independently verifying the most important results. The transparency of the process will become as important as the quality of the final publication. How should a research team prepare to work with AI agents? A good starting point is to select tasks with results that can be verified unambiguously. The team should determine which data and tools the agent can access, which actions require human approval and who is responsible for accepting the final result. It should also establish procedures for recording each stage of the work, reporting errors and stopping an experiment when necessary. This preparation allows researchers to benefit from the speed of AI while maintaining control over the quality of the research.

Microsoft 365 Licensing & Pricing 2026: Complete Buyer’s Guide

What is a company actually buying when it orders Microsoft 365? “Email and Office” has not been a complete answer for years. The decision now touches devices, sign-ins, data protection, meetings, cloud work and, increasingly, Copilot. Not every employee needs all of it. The easiest mistakes happen between plans that look almost the same to the person using them. Word opens, Outlook is there and files save to the cloud. The difference tends to surface later, when IT needs to configure a laptop remotely, enforce an access rule or respond to a threat. At that point, the cheaper license may no longer be the cheaper option. Whatever is missing still has to be provided somehow. The July 1 changes add another complication in 2026. Microsoft raised US list prices for selected Business, Enterprise and Frontline plans and changed the feature set of some packages. Versions with Teams and without Teams are still available, so comparing product names alone does not get a buyer very far. Renewal timing, billing currency, tax and partner terms also affect the quote. The figure in the price list is a starting point, not the final invoice. Copilot has a similar naming problem. Copilot Chat may be available at no additional charge to users with eligible subscriptions, while Microsoft 365 Copilot is a separate paid license that needs an eligible base plan. Buying Copilot does not tidy up company data or permissions. It works with what is already in the organization’s environment – including the gaps and mistakes. This guide looks at the Business, Enterprise and Frontline families, along with Apps for Business, Office 365 E1 and both Copilot options. Instead of searching for one plan that suits everybody, we ask what makes sense for each role. A browser-only employee, an administrator and a frontline worker on a shared device do not need the same license. A practical licensing model starts with those differences and builds from there. This guide uses US commercial list prices before tax. Currency, local market adjustments, partner discounts, agreement type, billing schedule and promotions can change the final amount. Microsoft 365 licensing in one minute If you need a quick answer, use these five rules: Choose Business Basic when users need business email, cloud collaboration and web/mobile apps, but not locally installed Office desktop apps. Choose Business Standard when desktop Word, Excel, PowerPoint and Outlook matter, but advanced device and threat protection will be handled elsewhere. Choose Business Premium when an organization of up to 300 users wants productivity plus Microsoft Intune, Microsoft Entra ID P1 and Microsoft Defender for Business in one suite. Move to Enterprise when the 300-seat Business limit, advanced compliance, enterprise security, Windows Enterprise rights or organization-wide scale requires it. Microsoft 365 E3 is the broad foundation; E5 adds the deepest security, identity, compliance and analytics capabilities. Use F1/F3 for genuine frontline roles and Copilot Chat as the broad AI baseline. Assign paid Copilot to selected people with repeatable, information-heavy work. What changed in Microsoft 365 pricing in 2026? Microsoft’s new commercial US list prices took effect on July 1, 2026. Existing customers stay on their contracted price until renewal. Packaging additions began rolling out in summer 2026, so a tenant may receive a feature after the price effective date; Microsoft provides notice through the Message Center. Plan With Teams: USD/user/month Without Teams: USD/user/month 2026 position Business Basic $7.00 $5.40 Cloud-first SMB suite; price increased Business Standard $14.00 $10.79 Desktop apps for SMB; price increased Business Premium $22.00 $18.79 Security-led SMB suite; price unchanged Apps for Business $10.00 Not applicable Desktop apps and OneDrive; price increased Office 365 E1 $10.00 $6.79 Cloud productivity; price unchanged Office 365 E3 $26.00 $17.45 Productivity suite; not the same as Microsoft 365 E3 Office 365 E5 $41.00 $32.45 Productivity, compliance, voice and analytics Microsoft 365 E3 $39.00 $30.45 Productivity + Windows + identity/device management Microsoft 365 E5 $60.00 $51.45 Advanced security, compliance and analytics Microsoft 365 F1 $3.00 $2.50 Light frontline experience Microsoft 365 F3 $10.00 $8.93 Managed frontline productivity Pricing note: These are Microsoft’s commercial US list prices effective July 1, 2026, before tax, shown as monthly equivalents for annual subscriptions. Availability, currency, billing options and promotions vary. “Without Teams” is a different SKU—not a discount that can simply be switched on later without checking commercial terms. Standalone Teams may need to be purchased separately. The 2026 packaging update also adds value to selected plans. Business Basic and Standard receive a larger email allowance, time-of-click URL protection, Copilot Chat enhancements and analytics. Microsoft 365 E3 receives Defender for Office 365 Plan 1 and additional Intune capabilities. Microsoft 365 E5 receives further advanced Intune features and Security Copilot-related value. Rollout timing should always be confirmed in the tenant. How Microsoft 365 product names fit together The names matter because “Office 365” and “Microsoft 365” are not interchangeable. Office 365 E1/E3/E5 focuses on productivity and cloud services. Microsoft 365 E3/E5 includes the Office 365 layer and adds Windows Enterprise plus broader identity, device management and security rights. There is no mainstream commercial “Microsoft 365 E1” equivalent in this comparison; the cloud-productivity plan is Office 365 E1. Family Designed for User ceiling Typical role Microsoft 365 Business Small and midsize organizations 300 Business-family users per tenant Information workers and SMB operations Office 365 Enterprise Enterprise cloud productivity No Business-family 300-seat ceiling Users needing mail, collaboration and Office services Microsoft 365 Enterprise Integrated productivity, Windows, identity, security and compliance Enterprise scale Managed knowledge workers Microsoft 365 Frontline Workers whose primary role is service, operations or production Enterprise scale; eligibility rules apply Retail, factory, warehouse, field and shift workers Microsoft 365 Copilot AI layer on an eligible base license SKU-dependent; Copilot Business up to 300 Selected high-value knowledge workflows Microsoft 365 Business plans compared All Business base plans are designed for organizations with up to 300 provisioned users across the Business family. They can be mixed—for example, Premium for managed employees, Standard for lower-risk office roles and Basic for browser-first users—provided each person receives the services required for their work. Plan Core productivity Security and management Best fit / main limitation Business Basic $7. Web/mobile Word, Excel, PowerPoint and Outlook; business email; OneDrive; SharePoint; Teams in the with-Teams SKU. Foundational controls; no Intune or Defender for Business. 2026 adds URL protection. Browser-first users. No desktop Office apps; 300-user family limit. Business Standard $14. Everything in Basic plus desktop Office apps and broader collaboration tools. Foundational controls; no integrated advanced device/threat suite. Typical office worker. Strong productivity, but security stack may require separate tools. Business Premium $22. Desktop, web and mobile apps, email and collaboration. Intune, Entra ID P1, Defender for Business and information protection capabilities. Security-conscious SMB. Best all-round suite up to 300 users. Apps for Business $10. Desktop Office apps plus 1 TB OneDrive per user. App deployment controls, but not a full email/collaboration/security suite. Users who already have email/collaboration elsewhere. No Exchange Online mailbox or full suite. Microsoft 365 Business Basic Business Basic is the lowest-cost complete Business suite in this guide. It provides a professional Exchange Online email service, OneDrive and SharePoint collaboration, and web/mobile versions of Word, Excel, PowerPoint and Outlook. The with-Teams SKU adds Teams meetings, chat and collaboration. It is a good fit for start-ups, contractors and browser-first employees who do not need locally installed Office applications. The limitation is not merely that Word runs in a browser. Basic does not include the integrated device management and endpoint threat protection found in Business Premium. Organizations using unmanaged laptops, handling sensitive client data or operating under customer security requirements should calculate the cost of separate controls before choosing Basic for everyone. Recommended size: usually 1–100 cloud-first users, although the formal Business-family ceiling is 300. Microsoft 365 Business Standard Business Standard is the natural productivity plan for employees who create documents and spreadsheets all day. It adds desktop versions of Word, Excel, PowerPoint and Outlook to the services in Basic, while keeping the familiar Exchange, OneDrive and SharePoint foundation. It is often the best functional fit for a 20–50 person office where endpoint security is already provided by another managed platform. Its weakness appears when buyers assume that “Microsoft 365” automatically means full Microsoft security. Standard does not deliver the same Intune, Entra ID P1 and Defender for Business package as Premium. If conditional access, centrally managed mobile devices, endpoint detection and response, or automated investigation are requirements, Premium can be cheaper and simpler than assembling separate products. Recommended size: 5–300 users with a defined external security/management approach. Microsoft 365 Business Premium Business Premium combines the productivity experience of Standard with the controls many small organizations now need by default. Microsoft Intune manages corporate and mobile devices; Microsoft Entra ID P1 supports conditional access; Microsoft Defender for Business adds endpoint protection, detection and response; and information-protection capabilities help reduce accidental data exposure. Premium is usually the strongest default for a security-first SMB, professional-services firm, healthcare supplier or company pursuing cyber-insurance and customer assurance requirements. It is not identical to Microsoft 365 E5 and does not remove the need for configuration, monitoring and governance. Its commercial boundary is the 300-user Business-family limit. Recommended size: 20–300 users, or smaller companies with high data or device risk. Microsoft 365 Apps for Business Apps for Business is not “Business Standard without meetings.” It is an app-focused subscription: desktop Office applications and OneDrive, without an Exchange Online business mailbox or the complete collaboration and security stack. It can be economical when email and meetings are supplied by another platform, or for a specialist user who needs Office locally but does not need the rest of the Microsoft 365 suite. The plan becomes poor value when separate email, Teams, identity and security licenses are added one by one. Buyers should also remember the 300-user Business-family ceiling and verify Copilot eligibility for the exact SKU. Recommended size: selected roles in organizations up to 300 users, not a universal default. Business Standard vs Business Premium Decision point Business Standard Business Premium Desktop Office apps Included Included Exchange, OneDrive, SharePoint Included Included Microsoft Intune Not included Included Microsoft Entra ID P1 / conditional access Not included as the suite entitlement Included Defender for Business Not included Included Best choice when Security and device management are provided elsewhere Microsoft should provide the integrated SMB security stack 2026 US list price with Teams $14 $22 The $8 monthly gap equals $96 per user per year. The right question is therefore not “Is Premium 57% more expensive?” but “Can we provide equivalent identity, device and endpoint controls for less than $96 per user per year—including administration?” Business plans vs Enterprise plans Business plans are not inferior versions of Enterprise in every respect. Business Premium can be a very capable security package for a 200-person company. Enterprise becomes necessary when the organization exceeds the 300-seat Business limit, needs enterprise Windows rights, requires deeper Purview, Defender or Entra capabilities, or wants a licensing framework designed for complex global operations. Choose Business when… Choose Enterprise when… The tenant will remain at or below 300 Business users. The organization will exceed the 300-user Business-family ceiling. Business Premium covers the required identity, device and endpoint controls. E3/E5 security, compliance, Windows or governance rights are required. Procurement and operations benefit from a compact SMB suite. Role-based licensing, enterprise agreements and global administration are central. Advanced eDiscovery, risk-based identity and enterprise analytics are not core requirements. Advanced Purview, Entra ID P2, Defender suite or Power BI capabilities justify E5. Enterprise plans: Office 365 E1, Microsoft 365 E3 and E5 This section intentionally compares the plans buyers most often place on the same shortlist. Office 365 E1 is a cloud-productivity plan. Microsoft 365 E3 and E5 are broader suites. If a seller quotes Office 365 E3 or E5 instead, check whether Windows Enterprise, Intune and the wider identity/security stack are included—the product name changes the entitlement. Office 365 E1 Office 365 E1 provides enterprise email, SharePoint, OneDrive and web/mobile Office experiences, with Teams in the applicable SKU. It does not include the full desktop Office client. E1 suits browser-first enterprise users, selected contractors or light information workers when Windows, device management and endpoint protection are licensed separately. At $10 with Teams, it is inexpensive, but it can create a fragmented stack if the missing controls are later added individually. Microsoft 365 E3 Microsoft 365 E3 is the enterprise foundation for managed knowledge workers. It combines desktop, web and mobile productivity apps with Exchange, SharePoint and OneDrive, then adds Windows Enterprise, Microsoft Intune, Microsoft Entra ID P1 and core security and compliance capabilities. Summer 2026 packaging additions include Defender for Office 365 Plan 1 and additional Intune tools, increasing its value for security and IT operations. E3 is a good fit for large organizations that require consistent device and identity management but do not need the full E5 control set for every user. It is also a common base license for the $30 enterprise Copilot add-on. Recommended size: enterprise-scale tenants and organizations approaching or exceeding the Business ceiling. Microsoft 365 E5 Microsoft 365 E5 builds on E3 with advanced identity, security, compliance, analytics and voice capabilities. Important areas include Microsoft Entra ID P2 features such as risk-based access and Privileged Identity Management, the broader Microsoft Defender suite, advanced Microsoft Purview capabilities, Power BI Pro and Teams Phone Standard in applicable offerings. Some telephony services, calling plans and deployment costs remain separate. E5 is most valuable where advanced controls replace multiple standalone products or address explicit regulatory and risk requirements. It is rarely necessary for every employee simply because the company is large. Many enterprises use E5 for administrators, executives, legal/compliance and high-risk roles while keeping E3 as the standard. Recommended size: regulated, security-mature or analytically intensive enterprises with a clear control map. Microsoft 365 E3 vs E5 Capability area Microsoft 365 E3 Microsoft 365 E5 2026 US list price with Teams $39 $60 Desktop apps and core cloud services Included Included Windows Enterprise, Intune, Entra ID P1 Included Included Advanced risk-based identity / PIM Limited compared with E5 Entra ID P2 capabilities Threat protection Strong foundation; expanded in 2026 Broader Defender suite and advanced controls Compliance Core information protection, audit and governance Advanced Purview, eDiscovery, audit and risk capabilities Analytics / voice Not the full E5 bundle Power BI Pro and Teams Phone Standard in applicable suite Best use Managed enterprise default High-risk, regulated and advanced-control roles The $21 monthly difference is $252 per user per year. A defensible E5 business case maps each required control to an E5 entitlement, identifies tools that can be retired, and assigns E5 only to the users whose work or risk needs it. Microsoft 365 Frontline: F1 vs F3 Frontline licenses are intended for people whose primary work is customer service, manufacturing, logistics, field operations or shift-based activity—not as a low-cost substitute for information-worker licenses. Microsoft applies eligibility and device-use conditions, so role design should be documented before procurement. Plan What it is designed to provide Main limitations / decision Microsoft 365 F1 — $3 Light frontline communication, identity and access, web/mobile experiences and core security/management services. Entra ID P1 and Intune are part of the frontline foundation. No full desktop Office suite. Mailbox and service functionality are limited; validate the exact frontline workflow and Exchange entitlement. Microsoft 365 F3 — $10 Broader frontline productivity, Windows and management rights, web/mobile apps and stronger support for shared/managed devices. Still not an E3 information-worker license and does not include full desktop Office apps. Confirm storage, mailbox, device and app requirements. Choose F1 for communication-led roles with very light creation needs. Choose F3 when workers use managed shared devices, need broader apps and workflow capabilities, or require Windows and device-management rights. Use E3/Business plans for employees who regularly create complex documents, use desktop Office or need a full information-worker mailbox and storage profile. Microsoft 365 Apps vs a full suite Need Apps for Business Business Standard Microsoft 365 E3 Desktop Word, Excel, PowerPoint, Outlook Yes Yes Yes Business email mailbox No Yes Yes SharePoint and full collaboration suite No / limited to included app services Yes Yes Integrated device and identity management No No Yes Windows Enterprise rights No No Yes User ceiling 300 Business-family users 300 Business-family users Enterprise scale Best fit Office apps alongside another platform Complete SMB productivity Managed enterprise workforce Security and compliance matrix “Included” does not mean “configured.” Every plan still needs secure defaults, role ownership, monitoring, retention decisions and user training. The matrix is a buying-level view, not a substitute for Microsoft’s detailed service descriptions and licensing terms. Plan Identity / access Device / endpoint Threat protection Compliance / governance Business Basic / Standard Foundational identity and MFA No integrated Intune entitlement Built-in service protection; 2026 URL protection Core Microsoft 365 controls Business Premium Entra ID P1; conditional access Intune + Defender for Business SMB endpoint detection/response and protection SMB information-protection capabilities Office 365 E1 Cloud identity foundation Not a broad device-management suite Foundational service protection Core cloud compliance Microsoft 365 E3 Entra ID P1 Intune + Windows Enterprise Enterprise foundation; Defender for Office P1 added in 2026 Core Purview, audit and information protection Microsoft 365 E5 Entra ID P2 / advanced identity Advanced enterprise management capabilities Broader Defender suite Advanced Purview, eDiscovery, audit and risk Microsoft 365 F1/F3 Entra ID P1 Intune; F3 supports broader frontline device use Frontline foundation; add-ons may be needed Role-appropriate baseline; validate regulation needs Microsoft 365 Copilot licensing in 2026 Copilot licensing has three distinct layers: Copilot Chat included with eligible subscriptions; a paid Microsoft 365 Copilot license that adds work-grounded and in-app experiences; and the eligible Microsoft 365 base license beneath it. Confusing these layers is the most common cause of an inaccurate budget. AI option 2026 price / eligibility What it does Best use Microsoft 365 Copilot Chat No additional license cost with eligible Microsoft 365 subscriptions. Agent consumption may be metered. Secure AI chat, primarily web-grounded; can work with referenced/uploaded content and selected agents. Broad baseline for occasional AI use. Microsoft 365 Copilot Business $21 list; 2026 promotional price may be $18. Eligible Business plans; up to 300 users. Work-grounded Copilot in Microsoft 365 apps, using data the user can access through Microsoft Graph and Work IQ. SMBs with selected high-value knowledge workers. Microsoft 365 Copilot (enterprise) $30 per user/month, annual commitment. Requires an eligible base plan. Paid work-grounded Copilot across Word, Excel, PowerPoint, Outlook, Teams and other supported experiences. Enterprise, Office 365 and Frontline base-license environments. Business plan with Copilot July 2026 US list: Standard with Copilot $23.50; Premium with Copilot $32. Annual/annual and up to 300 users. Base Business suite and Copilot in one SKU. Often cheaper than buying the base plan and Copilot Business separately. Microsoft 365 E7 $99 with Teams / $90.45 without Teams. M365 E5 plus Microsoft 365 Copilot, Agent 365 and Entra Suite. Enterprises that need the broader bundle—not merely Copilot. Copilot Chat vs paid Microsoft 365 Copilot Capability Copilot Chat Paid Microsoft 365 Copilot Additional per-user license No, with eligible subscription Yes, unless included in a bundle Default grounding Primarily web and user-provided context Work data plus web, subject to permissions Microsoft Graph / Work IQ context Limited compared with paid offer Core part of the work-grounded experience In-app assistance Selected chat/agent experiences Deeper Word, Excel, PowerPoint, Outlook and Teams integration Agents Available; tenant-data use may be consumption-metered Broader included agent value; metering can still apply to some scenarios Best rollout role All eligible users as a controlled baseline Selected users with measurable knowledge-work use cases Copilot does not receive unrestricted access to a tenant. Microsoft states that it can use only information the signed-in user is authorized to access, and prompts, responses and Microsoft Graph data are not used to train the foundation models. That protection makes permission hygiene more—not less—important. An overshared SharePoint site remains overshared; Copilot can make existing access easier to exercise. How to calculate the total cost A reliable budget has four lines: the base Microsoft 365 license, the Copilot license or bundle, the billing/term effect, and implementation. Implementation includes tenant assessment, permission cleanup, device onboarding, migration, training, adoption management and support. Those services are not Microsoft license fees, but omitting them produces a misleading business case. Scenario Monthly list calculation Annual list total 50 users: Business Premium 50 × $22 $13,200 50 users: Business Premium with Copilot 50 × $32 $19,200 100 users: Business Standard + separate Copilot Business 100 × ($14 + $21) $42,000 100 users: Business Standard with Copilot bundle 100 × $23.50 $28,200 500 users: Microsoft 365 E3 500 × $39 $234,000 500 E3 users; Copilot for 100 selected users (500 × $39) + (100 × $30) $270,000 500 E3 users; Copilot for everyone 500 × ($39 + $30) $414,000 The 100-user example shows why SKU comparison matters: the permanent Business Standard with Copilot bundle can be materially cheaper than two separate licenses. Promotions and bundles change, however, so every quote should state the exact SKU, commitment, payment schedule, promotion end date and renewal price. Which license is best by company size? Organization / workforce Recommended starting point Why / what to validate Micro business: 1–10 Basic for browser-first roles; Standard for desktop users; Premium if devices/data are high risk. Avoid buying one plan for everyone by habit. Check whether separate security products erase Basic/Standard savings. Small company: 20–50 Business Premium as a security-led default; mix Standard or Basic for justified lower-risk roles. Strong balance of productivity and integrated controls. Compare Copilot bundle for selected users. Midsize: 100–300 Business Premium or role-based Business mix; plan the path beyond 300 early. Govern tenant growth and avoid a rushed enterprise migration at user 301. Enterprise: 300+ Microsoft 365 E3 default; E5 for mapped advanced-control roles; F1/F3 for true frontline workers. Use role/risk segmentation and enterprise procurement. Regulated organization E3 plus required add-ons or E5 for roles subject to advanced compliance, identity and investigation needs. Map regulation to controls; regulation alone does not automatically require E5 for everyone. Security-first SMB Business Premium. Intune, Entra ID P1 and Defender for Business create a coherent baseline. Six practical licensing scenarios 1. A seven-person consultancy Five consultants need desktop Office and two contractors work in the browser. Use Business Standard for the consultants and Business Basic for the contractors if devices are already managed and protected. If client requirements demand conditional access and managed endpoints, Business Premium may be the simpler standard. Add Copilot only to consultants who repeatedly draft proposals, summarize meetings or analyze client material. 2. A 35-person professional-services firm Business Premium is usually the strongest baseline because confidential client data, remote laptops and cyber-insurance controls make identity and device management central. Compare Business Premium with Copilot for partners, sales and delivery leads against separate Copilot Business seats. Keep Copilot Chat available to eligible non-licensed employees. 3. A 220-person growing company A role-based Business mix can remain cost-effective: Premium for managed employees, Standard for specific low-risk desktop roles and Basic for browser-only accounts. Track the tenant’s Business-family count and design the move to E3 before growth crosses 300. A 20–40 user Copilot pilot is safer than a company-wide purchase. 4. A 2,000-person enterprise Use E3 as the managed knowledge-worker foundation, E5 for administrators, legal, security, executives and regulated roles, and F1/F3 for properly eligible frontline workers. Add enterprise Copilot only to roles with repeatable work-grounded use cases, then review Microsoft’s usage report and reassign inactive seats. 5. A regulated financial or healthcare organization Start from the control requirements: identity risk, privileged access, information classification, retention, audit, eDiscovery, insider risk, endpoint coverage and incident response. E5 may consolidate necessary controls, but assigning it universally without a control-to-license map wastes budget. Copilot readiness must include permissions, sensitivity labels, retention and high-risk repositories. 6. A factory with shared frontline devices F3 is often the practical foundation for supervisors and workers using managed shared devices and digital workflows; F1 may suit communication-led roles. Information workers in finance, engineering or management should remain on E3 or appropriate Business plans. Do not use frontline SKUs solely because they cost less—the worker and device scenario must satisfy licensing rules. Can Microsoft 365 licenses be mixed? Yes. A tenant can combine Business plans, Enterprise plans, Frontline plans and paid Copilot assignments, subject to eligibility and commercial terms. Mixing works best when every role has a written service profile: desktop apps, mailbox, storage, meeting needs, device type, identity risk, information sensitivity and AI use case. It works badly when procurement chooses exceptions without governance, leaving IT to discover missing services later. Review dependencies before changing a license. Removing a suite can remove access to a mailbox, desktop activation, Windows rights, Intune policies or compliance capabilities. Data retention and service behavior should be validated before reassignment—not after a user reports that an app stopped working. A practical selection and rollout process Inventory users and devices: Group people by real work patterns, not department names. Separate knowledge workers, browser-first users, contractors, frontline workers, privileged admins and regulated roles. Define mandatory controls: List identity, device, endpoint, data protection, retention, audit, eDiscovery and residency requirements. Map each control to a license entitlement and configuration owner. Compare complete stacks: Compare the suite price with all necessary add-ons, third-party tools and administration. A cheaper base plan is not cheaper if it creates three extra contracts. Check Teams and billing variants: Confirm with-Teams or no-Teams SKU, annual versus monthly commitment, payment schedule, currency, tax, promotion expiry and renewal price. Pilot Copilot by workflow: Choose three to five measurable workflows such as meeting follow-up, proposal drafting, inbox triage, report synthesis or recurring analysis. Measure and reassign: Track active users, repeat use, adoption by app, task time, quality and rework. Reassign licenses that remain inactive after support and training. Common licensing mistakes to avoid Comparing Office 365 E3 with Microsoft 365 E3 as if the names described the same entitlement. Buying Business Standard and later discovering that conditional access, Intune and endpoint detection were expected. Using F1/F3 as generic discount licenses for users who are not genuine frontline workers. Treating a no-Teams price as interchangeable with the with-Teams SKU without checking the meeting and collaboration requirement. Multiplying the Copilot price by headcount without adding the eligible base license—or without checking a cheaper bundle. Assuming Copilot fixes poor permissions. It follows the access the user already has. Using a temporary promotion as the long-term renewal run rate. Licensing the entire tenant before measuring a small, role-based pilot. TTMS: a trusted Microsoft 365 partner Microsoft 365 licensing is easiest to optimize when commercial choices, technical design, security and adoption are treated as one program. TTMS supports organizations across the Microsoft 365 lifecycle: environment assessment, migration, license rationalization, security preparation, employee training, Teams solutions and process automation with Power Automate and Power Apps. An experienced partner adds value before the order is placed. TTMS can help map user roles to Business, Enterprise and Frontline plans; compare bundles with add-ons; identify licensing gaps; assess data and permission readiness for Copilot; and build a phased rollout with measurable outcomes. This reduces both overspending and the operational risk of choosing a plan that looks right on a price list but does not cover the organization’s controls. If you want to review your current license mix, plan a migration or prepare a Microsoft 365 Copilot pilot, talk to the TTMS Microsoft 365 team about the next practical step for your organization. Sources and verification note Pricing and licensing were checked against official Microsoft sources on August 6, 2026. Microsoft can change products, promotions and local prices. Detailed service availability also contains footnotes and technical conditions, so the final SKU and entitlement should be verified in the Microsoft 365 admin center, product terms or a current partner quote. This guide is commercial and technical guidance, not legal advice. Microsoft 365 pricing and packaging updates effective July 1, 2026 Microsoft 365 pricing and packaging update FAQ Microsoft 365 and Office 365 plan options Microsoft 365 platform service description Business plan comparison reference Enterprise plan comparison reference Frontline F1 and F3 comparison Microsoft Entra service description Microsoft 365 Copilot plans and pricing Microsoft 365 Copilot license options Microsoft 365 Copilot architecture and permissions Microsoft 365 Copilot usage report TTMS Microsoft 365 services Frequently Asked Questions About Microsoft 365 Licensing and Copilot What is the cheapest Microsoft 365 license for a business? Among the complete Business suites in this guide, Business Basic is the lowest-cost at $7 per user per month with Teams in the July 2026 US list price. Apps for Business costs $10 but does not include a business mailbox or the full collaboration suite. The cheapest suitable plan depends on whether the user needs desktop apps, email, device management and security—not price alone. What is the difference between Microsoft 365 Business Premium and Microsoft 365 E3? Business Premium is a strong integrated productivity and security suite for organizations with up to 300 Business users. Microsoft 365 E3 is an enterprise-scale suite with Windows Enterprise, Intune, Entra ID P1 and broader enterprise rights and governance. E3 is not automatically “more secure” in every practical configuration; the choice depends on scale, entitlements and required controls. Is Microsoft 365 Copilot included in Microsoft 365? Copilot Chat is included at no additional license cost with eligible Microsoft 365 subscriptions. Full work-grounded Microsoft 365 Copilot normally requires a paid add-on, unless it is included in a bundle such as Business Standard with Copilot, Business Premium with Copilot or Microsoft 365 E7. Which Microsoft 365 plan is best for a 50-person company? Business Premium is often the best security-led default because it combines desktop apps, email, collaboration, Intune, Entra ID P1 and Defender for Business. A company with mature third-party device and endpoint security may prefer a mix of Standard and Basic. The correct answer follows the control and device requirements. Can a company mix Microsoft 365 licenses? Yes. Organizations commonly mix Basic, Standard, Premium, Enterprise and Frontline plans and assign paid Copilot only to selected users. Each user must have the services and rights required for their role, and dependencies should be checked before a license is removed or changed. When should a company move from Business to Enterprise licensing? Plan the move when the tenant approaches the 300-user Business-family ceiling or when Windows Enterprise, advanced compliance, identity, security, procurement or global-management needs exceed the Business suite. Do not wait until user 301 to design the transition. Does Microsoft 365 Business Basic include desktop Word and Excel? No. It includes web and mobile versions. Choose Business Standard or Premium when users need locally installed desktop Office applications. What is the difference between Office 365 E1 and Microsoft 365 E3? Office 365 E1 is primarily a cloud-productivity suite with web/mobile apps and no full desktop Office client. Microsoft 365 E3 combines desktop productivity with Windows Enterprise, Intune, Entra ID P1 and broader security and compliance capabilities. They are different product families, not adjacent tiers of the same bundle. Is Microsoft 365 E5 worth the extra cost over E3? E5 is worth it when its advanced identity, Defender, Purview, analytics or voice capabilities replace other products or meet explicit risk and regulatory requirements. Many organizations assign E5 only to selected high-risk roles and use E3 as the wider default. What is the difference between Microsoft 365 F1 and F3? F1 is a lighter frontline license for communication-led roles. F3 supports broader frontline productivity, Windows and managed-device scenarios. Neither should be treated as a discount E3 license, and both require validation of frontline eligibility and service limitations. Can Microsoft 365 Apps for Business replace Business Standard? Only if the user does not need Exchange Online business email or the full Microsoft 365 collaboration suite. Apps for Business is best when desktop Office and OneDrive are needed alongside another email/collaboration platform. How much does paid Microsoft 365 Copilot cost? The enterprise Microsoft 365 Copilot add-on is $30 per user per month with an annual commitment. Copilot Business lists at $21 and has had an $18 promotional price in 2026. Permanent Business bundles listed in July 2026 include Business Standard with Copilot at $23.50 and Business Premium with Copilot at $32. Verify current local pricing and renewal terms. What is the difference between Copilot Chat and paid Microsoft 365 Copilot? Copilot Chat is primarily a secure web-grounded chat experience included with eligible subscriptions. Paid Copilot adds work grounding and deeper integration in Microsoft 365 apps, using information the signed-in user is permitted to access through Microsoft Graph and Work IQ. Does every employee need a paid Copilot license? No. Copilot Chat can serve as the broad baseline, while paid seats go to roles with repeatable writing, meeting, analysis or information-search workflows. A phased pilot and license reassignment process usually produces a better return than tenant-wide licensing. Does Copilot use company data to train foundation models? Microsoft states that prompts, responses and organizational data accessed through Microsoft Graph are not used to train the foundation models used by Microsoft 365 Copilot. Copilot still follows existing user permissions, so overshared data and weak governance must be addressed. Are annual Microsoft 365 subscriptions cheaper than monthly subscriptions? Annual commitments are usually priced more favorably than flexible month-to-month terms, but payment monthly and commitment monthly are not the same thing. Ask for the term, payment frequency, cancellation conditions and renewal price on every quote.

Wiktor Janicki

We hereby declare that Transition Technologies MS provides IT services on time, with high quality and in accordance with the signed agreement. We recommend TTMS as a trustworthy and reliable provider of Salesforce IT services.

Julien Guillot Schneider Electric

TTMS has really helped us thorough the years in the field of configuration and management of protection relays with the use of various technologies. I do confirm, that the services provided by TTMS are implemented in a timely manner, in accordance with the agreement and duly.

Let’s talk about how TTMS can help.

Monika Radomska

Sales Manager

Content Hub Enterprise: How to Scale Digital Asset Management with AEM Assets?

1. What Is Content Hub at the Enterprise Level?

2. Content Hub in the Adobe Experience Manager (AEM) Ecosystem

2.1 Brand Governance and Rights Management: Maintaining Full Asset Control

3. Using AI, Adobe Express, and Firefly in AEM Assets Content Hub

4. Streamline Your Enterprise Media Workflow with AEM Assets Content Hub

5. How TTMS Can Help with Your Content Hub Enterprise Strategy

6. Frequently Asked Questions About Content Hub Enterprise

How Does an Enterprise Content Hub Differ from Basic File Repositories?

How Does AEM Content Hub Empower Marketing and Sales Teams?

Do You Need an Official Adobe Partner to Implement AEM Content Hub?

Recommended articles

TTMS blog – the world through the eyes of IT experts

Content Hub Enterprise: How to Scale Digital Asset Management with AEM Assets?

Top 7 AI QA Tools for Pharma in 2026

AQAP 2210 in Defence IT Projects: Software Quality Requirements

AEM Content Models: A 2026 Guide to Content Fragment Model Best Practices

Astra, the Future GPT-6? OpenAI’s New Model Explained

Microsoft 365 Licensing & Pricing 2026: Complete Buyer’s Guide

Ready to take your business to the next level?

Let’s talk about how TTMS can help.

Monika Radomska