Artifact guard shutdown: October 30, 2026 plan and a conflicting date

Read the 2026 and 2025 dates together

The Artifact guard overview says the feature and CI/CD integration will shut down on October 30, 2026. The corresponding deprecation-table row instead lists September 30, 2026 as the deprecated date and on or after October 30, 2025 as the shutdown date. That shutdown year precedes deprecation and contradicts the overview.

The overview is marked updated October 7 and the deprecation page October 9. A later page-update date does not resolve the contradiction in the table. Prepare against the overview's October 30, 2026 planning date while asking Google to reconcile the discrepancy; it is not evidence that action can wait until a later date.

Establish whether your team uses the Preview feature

Google labels Artifact guard as Preview. Its overview lists the Premium and deprecated Enterprise service tiers. It applies centralized container-image vulnerability policies across build-time checks, registry-related admission and GKE runtime monitoring. Teams using those capabilities and CI/CD integration are the relevant audience.

Using Google Cloud, Artifact Registry or GKE alone does not establish an Artifact guard dependency. Identify the actual enabled feature, policies and connections before assigning impact. These notices do not announce the shutdown of all Security Command Center or all Google Cloud security services.

Build scanning: identify which results control publication

The overview describes build-time scanning in pipelines such as Cloud Build, GitHub Actions and Jenkins. When an image violates policy, the build fails before publication. Identify which scans and failure results in your workflows come from Artifact guard and which are supplied by other checks.

Start by recording affected pipelines, responsible maintainers, policies in use and the results consumed from build logs. This is dependency-inventory advice, not a new connector configuration procedure. The two shutdown pages offer no ready-to-run migration commands and do not promise that another product will automatically take over existing checks.

Review image admission and runtime monitoring separately

For registry-related admission, the overview describes evaluating images in Artifact Registry and using Binary Authorization to block non-compliant images from deployment to GKE. Identify where the admission decision relies on an Artifact guard policy. Continued access to the registry does not prove the protection workflow is unaffected.

Runtime monitoring checks GKE containers for newly disclosed vulnerabilities and enriches Security Command Center findings. Separately identify alerts, reports or response workflows that consume those results. The two pages do not say existing images will be deleted, running applications will necessarily stop or other controls will automatically replace these capabilities.

As a hypothetical example, a team's successful GitHub Actions build shows that the checks run for that build passed. It does not establish that its GKE admission or runtime monitoring dependencies on Artifact guard have been replaced. Inventory the dependencies and owners for build scanning, image admission and runtime findings separately. This example illustrates the three stages; it does not report a tested pipeline.

Identify dependencies, then confirm continuity

The overview describes the existing pipeline, registry and runtime scopes and still links to policy configuration. The deprecation page says Artifact guard and CI/CD integration will no longer be available after shutdown. These details help identify dependencies, but they are not a complete retirement migration or replacement plan.

Give your Google support contact or account representative the confirmed dependencies, both conflicting dates and your business requirements. Ask about the applicable shutdown time and subsequent arrangements. Removing policies or connectors solely to clear errors could also remove security checks your team still needs; establish the plan before making those changes.

Keep regions, fees and other retirement dates separate

The two verified pages do not list an exact cutoff hour, time zone, region-by-region differences, fee treatment or universal migration eligibility. A Preview label and service-tier listing do not settle account-specific applicability. They support no promise of free migration, refunds or a universal zero-downtime transition.

The pages separately give May 21, 2027 for retirement of the Security Command Center Enterprise service tier, including a move to Premium. That tier-level arrangement does not extend Artifact guard's October plan. Confirm the features actually in use individually rather than merging different deadlines.