Methodology
50 platforms. 77 public source pages. Field-level evidence collected on 11 November 2026.
Scope and inclusion
The list covers purpose-built AI governance software, AI management system tools, model assurance platforms, data and privacy products with AI governance modules, and the hyperscalers’ own AI governance tooling. Each record carries at least three sourced fields beyond its name, website and summary.
The list covers the market leaders, including IBM, Microsoft, AWS, Google Cloud, OneTrust, ServiceNow, SAP, Collibra, Credo AI, Holistic AI and ModelOp, plus the specialists buyers shortlist next to them.
Where facts come from
Every fact comes from the vendor’s own product pages, documentation, public pricing, trust center or announcements. Each source carries an access date and names the fields it supports. The superscript beside a value opens that field’s source.
Framework evidence
“Documented” means the vendor explicitly describes product templates, assessments, controls, mappings or evidence for that framework. A blog post that only explains a framework does not count. A dash means no public statement was found.
A policy template and technical monitoring can both support a framework while covering different requirements. The workflow and evidence fields on each platform page show where the product puts its weight.
Vendor assurance
The Vendor assurance field records the certificates and audit reports each vendor publishes for itself, kept apart from framework support. SOC 2 is listed as a report, ISO standards as certifications. Ask for the certificate with its scope and issuing body during procurement.
Deployment and prices
Hosting is filled in when the vendor states its deployment options. A self-hosted gateway or guardrail is labelled as exactly that.
Pricing keeps the published billing basis, plan scope and billing period. Trial prices, platform prices and AI module prices stay separate. Taxes, implementation and add-ons come in the quote.
Groups, ordering and related platforms
Platform types group each product by its main focus. Framework lists contain only records marked Documented for that framework. Tables default to alphabetical order. Related platforms match the same type first, then shared frameworks.
Research candidates left out
Fairly AI now sells through Asenion, which is listed. BreezeML and KOSA AI did not publish enough current product detail to reach three sourced fields.
Official framework context
The European Commission sets out the AI Act’s risk-based rules. ISO publishes the AI management system standard. NIST publishes the voluntary AI Risk Management Framework. All three pages were read on 11 November 2026.
Corrections and commercial independence
Send a public source and the field to correct to hello@aicompliancelist.com. A substantive recheck updates that record’s date. Paid featured placement is labelled and leaves the sourced facts and default table order intact. All launch records are unpaid.
Reuse the dataset
Download CSV or JSON with field-level source mappings under CC BY 4.0. Attribute AI Compliance List and link to the relevant platform page.
Field definitions
- Platform type
- Platform type by the product’s main focus; many products span several.
- EU AI Act
- Documented: the vendor’s product pages describe templates, control mappings, assessments or evidence for the EU AI Act.
- ISO 42001
- Documented: the vendor’s product pages describe templates, control mappings, assessments or evidence for ISO/IEC 42001.
- NIST AI RMF
- Documented: the vendor’s product pages describe templates, control mappings, assessments or evidence for the NIST AI RMF.
- Deployment
- Hosting options the vendor publishes for the product.
- Pricing model
- Published billing basis or custom-quote offer. Amounts and plan scope are in the pricing notes.
- AI inventory
- The product keeps a register of AI systems, agents, use cases or models.
- Governance workflow
- A sourced description of review, assessment, policy or validation functionality.
- Evidence output
- Documents, audit records, reports or traceability the product produces or maintains.
- Integrations
- Named supported integrations or interfaces, as stated on the cited product or documentation page.
- Vendor assurance
- Certificates and audit reports the vendor publishes for itself. SOC 2 is an audit report; ISO standards are certifications.
- Scope & pricing notes
- Plan scope, availability and billing details from the vendor’s pricing and product pages.
- Technical monitoring
- Technical monitoring of models and AI workloads, separate from compliance task tracking.