AI governance platforms for the EU AI Act

2021.AI sells GRACE, a platform for organizations that want AI chat, registration and monitoring together. Its registry covers internally built systems and purchased AI tools, with documentation against the EU AI Act and GDPR. The platform supports cloud, private cloud and premises deployment, and its governance module covers risk, controls and assessments.

The Transparent AI package costs €2,675 a month under a campaign for the rest of 2026, against a listed regular price of €3,345. It includes chat, the automatic registry and monitoring. Sovereign AI adds local models and integrations for data protection; the Full AI suite adds development tools and an AI gateway on a custom quote.

Asenion provides an AI Control System for governance teams overseeing models, copilots and agents. It converts regulatory requirements and company policies into controls, then connects lifecycle assessments, checks before deployment and runtime enforcement to the same evidence record. Its policy coverage includes the EU AI Act and ISO 42001.

The company emerged when Fairly AI acquired anch.AI in June 2025 and adopted the Asenion name. It offers Compliance-in-a-Box for new programs, with policies, controls and expert guidance, alongside the AI Control System for organizations that already have governance, risk and compliance teams and systems.

Credo AI provides enterprise AI inventories and assessments for teams governing agents, models, applications and vendors. Its registry records risk classifications and dependencies, while its policy engine maps requirements to controls and captures evidence. EU AI Act policy packs sit alongside NIST AI RMF and ISO 42001 content.

The company raised $21 million in 2024 in a round led by CrimsoNox Capital, Mozilla Ventures and FPV Ventures. Its platform connects to existing monitoring tools for continuous risk signals, drift detection and alerts. Listed integrations include Databricks, Snowflake, AWS, Azure, ServiceNow and Jira, so monitoring evidence can feed the governance record.

Daiki gives legal, compliance and product teams an AI registry and governance workspace for documenting systems, risks and requirements. Its EU AI Act software includes risk dashboards and an AI management system. Daiki hosts its infrastructure in Europe and also offers an LLM bias and safety checker.

Enzai provides AI discovery, intake and risk reviews for enterprise legal, risk and security teams. It maps systems to the EU AI Act, ISO 42001, NIST AI RMF and GDPR, and blocks unsanctioned agent tool calls. The company raised a $4 million seed in September 2023, led by Cavalry Ventures.

Holistic AI combines AI discovery, testing and policy enforcement for enterprises overseeing models, agents and applications. Its inventory records owners, purposes and risk levels, with discovery across cloud services, code and software applications. The platform connects to AWS and Azure, as well as GitHub and Databricks, and covers EU AI Act, ISO 42001 and NIST AI RMF governance.

The vendor names Unilever and Starling Bank among the organizations using its platform. Mozilla Ventures invested in 2024. Holistic AI began at UCL in 2020, and has US headquarters.

Lumenova AI supplies agent inventories and policy controls for engineering, security and risk teams. It records owners, approvers, risk tiers and agent decisions, and exports evidence as CSV or JSON. Its adversarial tests can feed new policies. The conformity assessment remains with customers or their assessor.

ModelOp provides an enterprise AI system of record for technology executives and governance teams managing machine learning, generative AI and agents. Its Enterprise AI Command Center combines AI asset oversight with delivery lifecycle automation. The company also shows Prudential's governance work through a customer discussion about building a responsible AI framework.

Fidelity Investments, FINRA and BMS are named users of its software, covering oversight of risk, performance and model health. ModelOp raised $10 million Series B financing in August 2024, led by Baird Capital with existing investors participating. ModelOp has its headquarters in Chicago.

Modulos connects AI systems, controls and evidence for organizations governing AI they build, buy or use. Its Governance Graph links those records to risk, while discovery agents scan cloud accounts, code and connected tools. Runtime inspections check live systems against policies and preserve the results; owners review findings and recommended actions.

The company names JobCloud and Beyond Gravity among its customers. It raised CHF 8.7 million in a pre Series A round in July 2025, supported by existing investors. Its platform supports EU AI Act and ISO 42001 work alongside NIST AI RMF, with shared controls across frameworks.

Monitaur sells AI model governance software for regulated enterprises, including insurers. It connects company policies and controls with model management, performance monitoring and validation. Its workflows cover underwriting, claims and risk models, and include documentation and reporting for internal teams and auditors.

The company names Progressive Insurance and Nayya among its customers, alongside CAPE Analytics. It raised $6 million Series A financing in May 2024, led by Cultivation Capital. Monitaur's third-party AI inventory workflows also connect governance of purchased models with existing vendor risk management processes, as described in its insurance customer material.

Naaia provides AI inventories, risk assessments and controls for large enterprises and mid-market companies. It assigns responsibilities and action plans across EU AI Act and other frameworks. Founded in 2022, it raised €6 million Series A financing in July 2026, led by Ventech, to expand in France and Europe.

Optro acquired FairNow in October 2025 and sells its AI governance capabilities within a risk management platform. Enterprise teams can inventory models, agents and applications, assign owners and run intake reviews. Its 25-plus mapped governance frameworks include the EU AI Act, ISO 42001 and NIST AI RMF, with evidence linked to controls.

Saidot links AI systems to risks and controls for enterprise and government governance teams. Its knowledge graph connects systems, models, agents and datasets, so risks and controls attached to a shared component can flow to the systems using it. The platform recommends requirements from registered system information.

Its subscriptions can be cancelled before renewal, and customers can change plans. Built-in Azure Foundry and Bedrock integrations sit alongside REST APIs, webhooks and MCP servers. Saidot names Deloitte and Scotland's government as customers. Its 2023 financing comprised €1.5 million from investors Crowberry Capital and Ventic, plus €250,000 from Business Finland.

Trustible provides AI intake, inventory and risk workflows for enterprises managing internally developed and purchased AI. It records use cases, models, agents and vendors, routes reviews by risk and retains approvals and evidence. Its EU AI Act framework coverage sits alongside NIST AI RMF and ISO 42001.

The company raised $4.6 million seed financing in June 2025, led by Lookout Ventures. Its platform also monitors incidents and user feedback, plus vendor and regulatory signals after deployment. A Leidos governance executive describes using Trustible to increase use case throughput in a customer spotlight on the vendor's homepage.

TrustWorks combines privacy operations and AI governance for privacy, legal, IT and governance teams. Its AI Act Compliance package covers AI use case discovery, risk level recommendations and workflows for controls and risks. It also includes IT integrations and supply-chain monitoring.

The company sells three packages through sales: Privacy Governance, AI Act Compliance, and the combined Privacy & AI Governance suite. Its investor names Randstad and Westinghouse Electric as platform users, alongside VTEX, Fenergo and Fexco. TrustWorks, previously QueryLayer, announced Elkstone-led funding in 2025; Nauta Capital identifies 2020 as its founding year.

BigID connects AI discovery and data governance for enterprise governance, privacy and security teams preparing EU AI Act evidence. It inventories models, agents, datasets and owners, then adds business and technical context for risk classification. Its documentation and monitoring records cover policies, access, lineage, incidents and remediation across cloud, software applications and enterprise environments.

Collibra's AI Command Center gives enterprise data and AI teams a shared registry for AI assets. It links use cases, models and agents to their data and policies, and provides EU AI Act assessment templates for documenting controls, evidence and approvals. Developers can register systems from code using its command line interface.

The product also provides agent contracts and guardian agents to turn policies into machine-readable rules and supervise production behavior. Its dashboards track risk concentrations, lifecycle status and trust signals across the portfolio. Collibra was founded in Belgium in 2008 and has joint headquarters in New York and Brussels.

Dataiku's Govern module gives data science, risk and compliance teams a central record of AI initiatives. It tracks stakeholders, notes and supporting documents through approval workflows. Registries cover bundles, models and LLMs, and signoff rules can block deployment until requirements are met.

Its EU AI Act Readiness solution adds pre-assessment, project, model version and system documentation workflows. It requires access to Advanced Govern, on cloud or self-managed installations. The supplied templates focus on high-risk systems; organizations develop templates for limited and minimal risk tiers themselves. Installation is arranged through the customer's account team.

DataRobot gives AI project teams risk assessments within Use Cases. Each assessment records identified risks, mitigation plans and evidence that measures have been implemented. The workflow covers legal, operational, security, bias and fairness risks, with governance policy templates providing the structure for each review.

Teams can create their own policy templates, including risk levels and explanatory links. Access depends on role-based risk management permissions: read access allows viewing, while write access permits creation. Default templates cannot be modified by users, and evidence can link to compliance documentation or a model deployment report.

IBM's watsonx.governance gives enterprise risk and AI teams inventories, controls and compliance evidence across their AI systems. Its governance graph connects systems, risks, policies and controls, with discovery of unapproved AI and continuous monitoring. Its framework content includes the EU AI Act and ISO 42001.

Risk & Compliance Basic starts at $3,500 monthly on IBM Cloud. Advanced starts at $6,450 monthly as enterprise software. Both base offers include one instance, one module and only one concurrent user; additional instances, modules and users are add-ons. IBM describes these as indicative prices that vary by country and exclude applicable taxes and duties.

The separate Model Management pay-as-you-go offer starts at $0.64 and includes a 30-day trial. A general trial provides 14 days in shared infrastructure. IBM also sells an AWS package with five AI use cases and 25 concurrent users. Its pricing page distinguishes SaaS and software features, so feature availability depends on the chosen deployment. Its software licensing uses processor cores, while the Risk & Compliance listings specify instances and modules, and the AWS package includes use case and evaluation allowances.

Microsoft's Purview includes Compliance Manager, which gives compliance teams assessments, controls and improvement actions for tracking regulatory work. Assessments can cover several services, and their detail pages show progress by service. The dashboard distinguishes completed assessments from incomplete, untested and partly completed work.

The EU AI Act template sits alongside ISO 42001, ISO 23894 and NIST AI RMF under Premium AI templates. Using an AI regulation counts toward premium licenses. Availability depends on the organization's licensing agreement, and the AI templates apply to supported generative AI applications, including Microsoft 365 Copilot and ChatGPT Enterprise.

Compliance Manager can also sync Microsoft Foundry evaluation results into automated assessments for models and agents. Microsoft documents six months of included assessments with Copilot or Agent licenses for this integration. Administrators need specified Foundry role assignments, such as Azure AI Project Manager or Azure AI User, to use the automatic assessment workflow and add agents from those accounts. Assessment records also separate customer and Microsoft actions, identify the regulatory template in use, and allow filtering or grouping by service, regulation and other assessment details.

OneTrust provides AI inventory and risk workflows for enterprise security and governance teams managing homegrown and purchased systems. It records owners, dependencies and lifecycle status, with EU AI Act assessment templates alongside NIST AI RMF and ISO 42001. Intake, approvals, exceptions and signoffs form an audit trail.

Its runtime functions connect to Bedrock and Foundry to bring evaluation signals and activity into governance reviews. The AI Guard Python SDK checks prompts and responses for sensitive data and can block or redact it. Coverage varies by integration: the vendor distinguishes Bedrock usage and log analysis from Foundry evaluation visibility and guardrail enforcement.

Veeam completed its Securiti acquisition in December 2025 for $1.725 billion. Securiti's DataAI Command Platform combines AI governance and data controls for enterprise security, privacy and data teams. Its broader suite includes discovery, classification, access governance, data lineage and assessment automation.

The platform's AI security and governance product provides controls for adopting AI alongside the vendor's data management tools. Securiti also offers LLM firewalls and data sanitization for teams building AI applications, plus privacy workflows for assessments and data mapping. Veeam describes the acquisition as combining data resilience with governance, privacy and AI trust capabilities.

ServiceNow's AI Control Tower provides AI lifecycle management and oversight for organizations using its enterprise platform. It connects governance committees with implementation teams and follows agents and models from intake and evaluation through deployment and optimization. Policy decisions can feed technical configurations and operational controls.

Its AI Risk and Compliance application includes prebuilt EU AI Act content alongside NIST AI RMF material. Runtime guardrails use AI Guardian, which is a distinct application for monitoring generative AI outputs for offensive content, sensitive topics and security threats. Administrators configure those controls in AI Admin Hub, with logs supporting blocking and escalation decisions.

Main Capital Partners acquired TrustArc in October 2025. Its software combines privacy and AI governance workflows for enterprise legal, compliance and data teams. AI risk scoring, templates and data mapping sit within a broader suite that also covers consent and privacy program management.

The AI governance solution provides risk visibility and reporting and guidance on comparing relevant legal obligations. TrustArc also offers TRUSTe Responsible AI certification, alongside its software products. The buyer names HPE, Salesforce and Oracle among TrustArc's broader customer base, with Samsung and Mattel also listed.

CitrusX provides model validation and monitoring for data scientists, model risk managers and executives. Technical teams use its web interface and SDK to investigate performance, while risk officers use reports to assess model validity. Its live model drift alerts support ongoing oversight, and its product covers model development, compliance and risk, and retrieval-augmented generation.

Fiddler AI combines monitoring, evaluations and governance records for enterprises running predictive models and AI agents. It records decisions, actions and evaluation outcomes, with controls for sensitive decisions and alerts for drift, bias and data leakage. Integral Ad Science uses Fiddler for monitoring and audit evidence.

Its Developer plan costs $0.002 per trace, with SaaS deployment, custom evaluators, access controls and SSO. Enterprise adds private cloud and premises deployment through a sales quote; the Free tier focuses on guardrails. Fiddler raised $30 million Series C financing in January 2026, led by RPS Ventures, and the release names Nielsen as a customer.

Giskard provides AI security and quality testing for teams developing and operating AI agents. Its commercial Professional offer combines automated vulnerability scans, audit reports and quality evaluations. It includes more than 50 adversarial probes, including attacks across multiple conversation turns, plus customizable scenarios and retrieval-augmented generation quality metrics.

The open-source Python option runs locally with the customer's own language models. It covers seven security risk categories and five quality generation scenarios, but reporting is limited to code. Maintenance is best effort and support comes from the community.

Professional adds human review and audit trails, SSO, role-based access controls, scheduled alerts and SDK integration with delivery pipelines. Its deployment options include SaaS, private cloud and premises, with data residency and isolation options. The commercial package also includes dedicated support with service level agreements and optional advice on fixing vulnerabilities and configuring AI agent guardrails. Professional also includes task prioritization and tag management, dataset interoperability with other platforms, and customizable evaluation checks, with collaborative interfaces for people reviewing generated test cases and results.

LatticeFlow AI connects technical evaluations to governance decisions for AI practitioners and risk leaders. Its platform runs repeatable tests, produces risk reports and links governance decisions to technical evidence. The vendor describes work with PastaHR on accuracy, robustness and security evidence for EU AI Act requirements.

Its public Atlas includes an Article 15 control framework with mapped candidate screening evaluations, including accuracy and robustness tests. It also publishes Article 50 transparency controls. That framework currently has no evaluation mappings; its published content consists of control definitions without linked pass or fail tests.

QuantPi provides AI validation and risk evidence for enterprises testing models, retrieval pipelines and agent workflows before and after deployment. It runs system and component tests and reports results with statistical confidence intervals. Teams can map frameworks to test suites and package results for their governance, risk and compliance tools.

The platform integrates through MCP with delivery pipelines, model registries and reporting systems, including validation triggered by a model version change. It supports public cloud and premises deployment through HPE Private Cloud AI, including isolated environments. QuantPi was founded in 2020 as a spinout from CISPA and Saarland University.

ValidMind provides AI governance and model risk software for regulated organizations, including banks and insurers. Its product range separates AI Governance, AI & Model Risk Management, Validation Automation and Development Automation. The model risk offer includes a centralized record and support for existing risk management frameworks.

The vendor sells custom plans through sales, tailored to deployment and operational requirements. Validation Automation works alongside an existing inventory and includes human review of AI-assisted work, making that package distinct from the broader governance offer. AI Governance provides modular capabilities across AI and generative AI use cases, with enterprise security and controls.