Guide
AI governance platforms: what they do for EU AI Act and ISO/IEC 42001 work
Executive summary
- What it is
- An AI governance platform is the system of record for the AI an organization builds, buys and uses: an inventory, risk assessments, policies and approvals, and evidence for auditors. It directs other controls and does not filter prompts or scan models itself.
- The risk
- Without a register, nobody can show which AI systems run, who owns each one or which obligations apply. The gap surfaces at an audit, an EU AI Act assessment or a customer security review.
- What to buy or do
- Pick a platform by where its inventory comes from, which framework parts it maps in your plan and what evidence it exports. Ask for a sample export, and pair it with discovery, data and runtime controls that act on the systems.
Short answer
When an auditor or an EU AI Act assessment asks which AI systems you run, who approved each one and what evidence backs the decision, an AI governance platform is where that answer is meant to live: an inventory, risk assessments, policy and approval workflows, and audit evidence. Five of the seven tools here name the EU AI Act, the NIST AI RMF and ISO/IEC 42001 next to a mapping, template, policy pack, library or classification, and IBM shows them as logos on its product page. The open-source AI Verify lists crosswalks to the NIST AI RMF and ISO/IEC 42001 and none to the EU AI Act. A named framework is the maker’s statement, so ask what the product produces for each part.
Not legal advice
This guide compares what vendors say their products do. It is not legal advice and does not say that any product makes an organization compliant with a law or a standard. Ask your counsel and your auditors which obligations apply to you.
What these platforms do
Governance tools sit above the model and the code and answer organizational questions: which AI systems run, who owns each, how risky each use case is, which policy applies, who approved it and what evidence shows the process was followed. From the capabilities the vendors document, the common jobs are these (our analysis):
- Inventory. A registry of AI systems, models, agents, vendors and datasets, often with discovery of AI nobody registered. See AI governance and shadow AI.
- Risk assessment. Questionnaires, risk tiers and risk libraries for each use case.
- Policy and approvals. Policies written once and applied to each use case, with review and sign-off steps.
- Framework mapping. Templates or control libraries tied to the EU AI Act, the NIST AI RMF and ISO/IEC 42001.
- Evidence and reports. Records, audit trails and exports for reviewers.
- Monitoring. Drift, bias, performance or policy violations tracked after launch.
NIST describes its framework as intended for voluntary use and says version 1.0 was released on January 26, 2023. Microsoft’s documentation summarizes ISO/IEC 42001 as an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. The European Commission says the AI Act entered into force on 1 August 2024. A tool that names these frameworks still leaves the organization responsible for its own program.
In our AI Security Layers model these platforms form the governance and risk layer, which decides which AI uses are allowed and keeps the evidence. Bias and fairness tests inside a governance product count toward the testing and red teaming layer, and the people running the program can find AI security courses and certifications in our training guide.
How we picked
We include the tools in our AI governance category with enough sourced facts to compare. We compile from vendor pages and documentation and do not run the products, so nothing here measures how well a platform works. Six of the seven are commercial; AI Verify is open source and has its own section. Fact chips link each source and check date; the methodology explains the Coverage Score.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score |
|---|---|---|---|---|---|
| Credo AI Credo AI | Commercial |
| Not published |
| Coverage Score 54 out of 100 |
| Holistic AI Holistic AI | Commercial |
| Not published |
| Coverage Score 55 out of 100 |
| watsonx.governance IBM | Commercial |
| Paid | None mapped | Coverage Score 36 out of 100 |
| OneTrust AI Governance OneTrust | Commercial |
| Contact sales |
| Coverage Score 46 out of 100 |
| ModelOp Center ModelOp | Commercial |
| Not published |
| Coverage Score 33 out of 100 |
| Saidot Saidot | Commercial |
| Not published |
| Coverage Score 42 out of 100 |
| AI Verify AI Verify Foundation | Open sourceApache-2.0 |
| Free | None mapped | Coverage Score 47 out of 100 |
Coverage Score measures what each vendor documents publicly, within one category. What this measures. Pricing models are as stated on each vendor's page; check the vendor for current pricing.
Framework support as stated by vendors
The table shows which of the three frameworks each vendor names on a page we read. “Named” means the vendor names the framework next to a template, mapping, classification or library. It does not mean the product certifies or guarantees anything. For AI Verify, “Named (crosswalk)” means the AI Verify Foundation’s site lists a crosswalk from its testing framework to that framework. The last column shows our summary of what the vendor states about its regulatory feature, with its source.
| Platform | EU AI Act | NIST AI RMF | ISO/IEC 42001 | What the vendor states |
|---|---|---|---|---|
| Credo AI | Named | Named | Named | policy packs for the EU AI Act, NIST AI RMF and ISO 42001 with automated controls mapping Source, checked October 21, 2026: credo.ai (opens in a new tab) |
| Holistic AI | Named | Named | Named | maps controls to the EU AI Act, NIST AI RMF, ISO 42001 and NYC Local Law 144 Source, checked October 21, 2026: holisticai.com (opens in a new tab) |
| watsonx.governance | Named in an example | Logo only | Logo only | manages AI regulations for models and use cases, with an applicability assessment such as EU AI Act scope Source, checked October 21, 2026: ibm.com (opens in a new tab) |
| ModelOp Center | Named | Named | Named | maps controls to the EU AI Act, NIST AI RMF, OCC SR 11-7 and ISO 42001 Source, checked October 21, 2026: modelop.com (opens in a new tab) |
| OneTrust AI Governance | Named | Named | Named (templates) | seeded AI policies and GenAI guardrails aligned to the NIST AI RMF and the EU AI Act Source, checked October 21, 2026: onetrust.com (opens in a new tab) |
| Saidot | Named | Named | Named | automatic EU AI Act classification, with libraries covering ISO/IEC 42001 and the NIST AI RMF Source, checked October 21, 2026: saidot.ai (opens in a new tab) |
| AI Verify | Not named | Named (crosswalk) | Named (crosswalk) | crosswalks from the AI Verify testing framework to the US NIST AI RMF and to ISO/IEC 42001:2023 Source, checked October 21, 2026: aiverifyfoundation.sg (opens in a new tab) |
IBM’s product page names the EU AI Act, NIST and ISO 42001 only as logos in its specifications section. Its regulatory compliance use case reads “Align AI initiatives with leading regulations and governance frameworks”, and its documentation uses the EU AI Act as the example in an applicability assessment. The other five describe a mapping, template, policy pack, library or classification for the framework. OneTrust names ISO 42001 for its assessment templates, and its seeded policies are aligned to the NIST AI RMF and the EU AI Act. AI Verify is a different case: the Foundation’s page presents its crosswalks as mappings of its testing framework, so check the crosswalk documents before you treat them as product coverage. The wording differs, so read each source before you compare them. Some vendors also name other rules, which the vendor wording column shows.
Platforms
Credo AI
Credo AI · AI governance platform
Credo AI has a registry that catalogs AI systems, agents, vendors and models, with shadow AI detection Source, checked October 21, 2026: credo.ai (opens in a new tab) . It also provides a policy engine with pre-built policy packs and automated workflows Source, checked October 21, 2026: credo.ai (opens in a new tab) , and it offers vendor registry and vendor risk assessment Source, checked October 21, 2026: credo.ai (opens in a new tab) . Its deployment is listed as saas, self-hosted Source, checked October 21, 2026: credo.ai (opens in a new tab) . Best for enterprises that want one system of record for AI use cases, vendors and policy packs, with a self-hosted option for private environments.
Holistic AI
Holistic AI · AI governance and testing platform
Holistic AI documents shadow AI discovery and a centralized AI inventory with classification and mapping Source, checked October 21, 2026: holisticai.com (opens in a new tab) . It also documents automated tests for bias, robustness, privacy and transparency Source, checked October 21, 2026: holisticai.com (opens in a new tab) , and it detects model drift in production and monitors agent behavior with Sentinel agents Source, checked October 21, 2026: holisticai.com (opens in a new tab) . Its deployment is listed as saas Source, checked October 21, 2026: holisticai.com (opens in a new tab) . Best for enterprises that want AI discovery, automated testing and regulation mapping in one governance platform, including a private single-tenant cloud option.
IBM watsonx.governance
IBM · AI governance and model monitoring product
IBM watsonx.governance has a governance graph of AI systems, risks, controls and policies, plus shadow AI detection Source, checked October 21, 2026: ibm.com (opens in a new tab) . It also states that factsheets automatically log model facts and can be exported for stakeholders and auditors Source, checked October 21, 2026: ibm.com (opens in a new tab) , and it evaluates machine learning models for quality, fairness and accuracy Source, checked October 21, 2026: ibm.com (opens in a new tab) . Its deployment is listed as saas, self-hosted Source, checked October 21, 2026: ibm.com (opens in a new tab) . Best for teams that want model factsheets, fairness and drift evaluation and use case approvals in one governance product, with cloud plans or licensed software.
OneTrust AI Governance
OneTrust · AI governance product
OneTrust AI Governance discovers and inventories AI systems, models, agents, datasets, vendors and use cases, with owners and dependencies Source, checked October 21, 2026: onetrust.com (opens in a new tab) . It also offers risk assessment templates for the EU AI Act, NIST AI RMF and ISO 42001 with automated risk tiering Source, checked October 21, 2026: onetrust.com (opens in a new tab) , and it generates audit-ready evidence and documentation from assessments, approvals and telemetry Source, checked October 21, 2026: onetrust.com (opens in a new tab) . Its deployment is listed as saas Source, checked October 21, 2026: my.onetrust.com (opens in a new tab) . Best for organizations that want AI governance workflows alongside other OneTrust privacy and risk products.
ModelOp Center
ModelOp · AI governance and lifecycle platform
ModelOp Center has a searchable registry of ML, GenAI, agent, vendor and SaaS-embedded AI, with discovery of unregistered tools Source, checked October 21, 2026: modelop.com (opens in a new tab) . It also automatically generates a risk tier for each use case and initial controls based on risk Source, checked October 21, 2026: modelop.com (opens in a new tab) , and it enforces policies on production deployment, including runtime enforcement through AI gateways Source, checked October 21, 2026: modelop.com (opens in a new tab) . Its deployment is listed as on-prem, self-hosted Source, checked October 21, 2026: modelop.com (opens in a new tab) . Best for regulated enterprises that want an AI system of record they install in their own environment instead of a shared SaaS service.
Saidot
Saidot · AI governance platform
Saidot has a centralized inventory of AI systems, models, agents and datasets, with an Agent Catalogue recording purpose, lineage and autonomy level Source, checked October 21, 2026: saidot.ai (opens in a new tab) . It also evaluates each risk on likelihood and impact using a library of 260+ risks Source, checked October 21, 2026: saidot.ai (opens in a new tab) , and it exports audit-ready AI transparency reports Source, checked October 21, 2026: saidot.ai (opens in a new tab) . Its deployment is listed as saas Source, checked October 21, 2026: saidot.ai (opens in a new tab) . Best for teams that want a hosted governance platform with ready-made risk, control and policy libraries and EU AI Act classification.
Open-source option
Every platform above is commercial. If you want to read the code and run the tests yourself, AI Verify is the open-source option in this category. It is a testing toolkit, so it covers the evidence side of governance more than the inventory or approval side.
AI Verify
AI Verify Foundation · open-source AI governance testing toolkit
AI Verify runs technical tests for fairness, explainability and robustness from a portal or the command line Source, checked October 21, 2026: aiverify-foundation.github.io (opens in a new tab) . It also builds assessment reports from templates by dragging widgets onto a canvas, with PDF export Source, checked October 21, 2026: aiverify-foundation.github.io (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com (opens in a new tab) , and its deployment is listed as self-hosted Source, checked October 21, 2026: aiverify-foundation.github.io (opens in a new tab) . Best for teams that want a free, self-hosted toolkit to test tabular or image classification and regression models and produce an assessment report.
How to evaluate a platform
Work through these questions with each vendor. The list is our analysis.
- Where does the inventory come from? Ask whether it discovers AI through connected accounts and tools, or relies on people to register systems.
- Which framework parts are covered, and in which plan? Ask for a written list per framework, and what the product produces for each part.
- Can you edit the templates and policies? Your own policies and sector rules rarely match a vendor’s default pack.
- What evidence does it produce, and can an auditor read it without a login? Ask for a sample export.
- How does it connect to your stack? Check the integration list for the model platforms, ticketing and data tools you use.
- How is monitoring done? Some products collect metrics from tools you already run, and some run their own tests.
- Where does it run? Several here list a self-hosted or private option, and others are hosted only.
- What does the vendor hold itself? Read the vendor’s own security and certification claims on its tool page, and ask for the reports.
Choose a hosted platform if
Our analysis- You want to start quickly with ready-made risk, control and policy libraries.
- You already use the vendor’s other products, as with OneTrust privacy tools.
- You accept that pricing is not published.
Choose a self-hosted option if
Our analysis- Your rules require AI governance records to stay in your own environment.
- You want a vendor that lists a self-hosted, on-premises or licensed software option.
- You have the team to run it and keep it current.
Choose open source if
Our analysis- You want free, self-hosted tests and assessment reports for supported model types.
- You can pair it with your own process for inventory, policy and approvals.
- You do not need a vendor to map controls to a regulation for you.
See AI Verify.
Related controls
A governance platform records and directs. It does not scan or filter by itself, so pair it with controls that act on the AI system:
- Posture management finds AI assets and exposure in your cloud accounts. See what is AI-SPM.
- Data controls keep sensitive data out of models. See GenAI data loss prevention.
- Guardrails screen prompts and answers at runtime. See the best LLM guardrails.
Frequently asked questions
What does an AI governance platform do?
It keeps a record of the AI your organization builds, buys and uses, and manages the work around it: risk assessment, policies, approvals and evidence. Most of the tools here also document some form of monitoring. This is our summary of the vendor pages we read, and each tool page lists what its vendor documents.
Does a governance platform make us compliant with the EU AI Act?
No tool can promise that. Most vendors here describe templates, classification or control mapping for the EU AI Act, which helps you organize your work. What your organization must do depends on its role and its AI systems, so ask counsel. The European Commission says the Act entered into force on 1 August 2024 and uses risk levels.
What is the difference between the NIST AI RMF and ISO/IEC 42001?
NIST describes its AI Risk Management Framework as intended for voluntary use, with version 1.0 released on January 26, 2023. ISO/IEC 42001, as Microsoft's documentation summarizes it, is an international standard that specifies requirements for an AI management system. One is a framework you can adopt, and the other is a standard an organization can be assessed against.
Do these platforms filter prompts at runtime?
Mostly not. Their core job is inventory, assessment, policy and evidence. A few document runtime features, such as ModelOp describing enforcement through AI gateways and OneTrust describing blocking, redacting or routing actions. For dedicated input and output screening, see our guide to the best LLM guardrails.
What should I ask a vendor about framework support?
Ask which parts of each framework the product covers, in writing, and what the product produces for each part: a template, a control mapping, a classification or an evidence package. Ask which of those are included in your plan, and whether the vendor itself holds any certification it mentions. A framework named on a page is a statement of intent to support it, not an outcome.
Key facts you can cite
-
Credo AI is offered as: SaaS, Self-hosted.
Source Source, checked October 21, 2026: credo.ai (opens in a new tab) Checked
-
Holistic AI is offered as: SaaS.
Source Source, checked October 21, 2026: holisticai.com (opens in a new tab) Checked
-
watsonx.governance is offered as: SaaS, Self-hosted.
Source Source, checked October 21, 2026: ibm.com (opens in a new tab) Checked
-
OneTrust AI Governance is offered as: SaaS.
Source Source, checked October 21, 2026: my.onetrust.com (opens in a new tab) Checked
-
ModelOp Center is offered as: On-prem, Self-hosted.
Source Source, checked October 21, 2026: modelop.com (opens in a new tab) Checked
Sources & last reviewed
Standards and references (4 sources)
Credo AI (8 sources)
- credo.ai checked
- credo.ai/legal/credo-ai-design-partnership-brief-ai-powered-governa... checked
- credo.ai/platform checked
- docs.sdk.credo.ai checked
- docs.sdk.credo.ai/api-reference checked
- docs.sdk.credo.ai/getting-started/quickstart checked
- trust.credo.ai checked
- credo.ai/legal/soc-2-type-ii-compliance checked
Holistic AI (4 sources)
- holisticai.com checked
- holisticai.com/holistic-ai-vs-other-ai-governance-vendors checked
- holisticai.com/ai-governance-platform checked
- holisticai.com/trust-center checked
IBM watsonx.governance (7 sources)
- ibm.com/products/watsonx-governance checked
- ibm.com/products/watsonx-governance/pricing checked
- ibm.com/products/watsonx-governance/ai-governance-platform checked
- ibm.com/docs/en/watsonx/w-and-w/2.4.x checked
- ibm.com/products/watsonx-governance/model-governance checked
- ibm.com/docs/en/watsonx/w-and-w/2.3.x checked
- ibm.com/docs/en/software-hub/5.3.x checked
OneTrust AI Governance (4 sources)
ModelOp Center (4 sources)
- modelop.com checked
- modelop.com/enterprise-ai-command-center checked
- modelop.com/modelop-center checked
- modelop.com/ai-governance-software/integrations checked
Saidot (6 sources)
- saidot.ai/about-us checked
- saidot.ai checked
- saidot.ai/insights/microsoft-and-saidot-collaboration checked
- saidot.ai/product checked
- saidot.ai/pricing checked
- help.saidot.ai checked
AI Verify (9 sources)
- github.com/aiverify-foundation/aiverify checked
- api.github.com/repos/aiverify-foundation/aiverify checked
- aiverify-foundation.github.io/aiverify/getting-started checked
- github.com/aiverify-foundation/aiverify/blob/main/LICENSE checked
- aiverify-foundation.github.io/aiverify checked
- aiverifyfoundation.sg/what-is-ai-verify checked
- aiverify-foundation.github.io/aiverify/quick-start-guide checked
- github.com/aiverify-foundation/aiverify/blob/main/SECURITY.md checked
- api.github.com/repos/aiverify-foundation/aiverify/releases/latest checked