Vendor list · AI governance & GRC
AI governance and GRC platforms, scored on the published rubric.
How we score
Four stages, evidence-graded throughout.
-
Inclusion criteria
Public pricing. Integrations doc. Ten or more customers. Self-serve path.
-
Weighted rubric
Each dimension scored zero to four. Every cell tagged MEASURED, CITED, or ESTIMATED.
-
Total score
Weighted sum out of one hundred. Seven-day right-of-reply window before publishing.
-
Ranked and published
Updated when new vendors qualify or when fact-check replies land corrections.
This cohort's rubric
- Regulatory-framework coverage20%
- Model + shadow-AI discovery15%
- Model-risk, bias + explainability depth18%
- Continuous monitoring + runtime guardrails15%
- Evidence + audit automation14%
- Integration breadth (AI/data stack)10%
- Regulatory currency8%
Inclusion criteria
- AI governance & policy: framework mapping (NIST AI RMF, EU AI Act, ISO 42001), policy enforcement, and an AI use-case register.
- Model risk & assurance: bias, fairness, explainability, and stress testing with a documented model-risk methodology.
- Discovery & monitoring: model and shadow-AI inventory, drift and policy monitoring, and runtime guardrails.
- Compliance automation: automated control-evidence collection and audit-ready reporting across connected systems.
This set spans dedicated AI-governance platforms, AI-extended GRC suites, and AI-usage analytics with a governance angle. Each vendor is scored on its actual coverage of every dimension - a dimension a vendor's product category structurally does not address scores zero, not a penalty for missing evidence.
A quick read on the top of the rubric. Each card links into the full scorecard in the next tab.
No platforms match. Try a different term, or clear the search.
01 Credo AI Purpose-built enterprise AI governance platform: framework mapping, model risk, and runtime guardrails Cross-industry 95 /100
Top strength Cohort-leading breadth: pre-built policy packs for EU AI Act, NIST AI RMF, ISO 42001 and SOC 2, automated model and shadow-AI discovery, quantitative risk testing with red-teaming, continuous trace evaluation, and automated audit-ready evidence, validated by Forrester Wave Leader status and Fortune 500 references (Mastercard, Principal, IBM).
Top gap No public pricing (demo-only; pricing page returns 404) and no exact funding/headcount/HQ disclosed on the public surface; contact email not exposed.
Best for Enterprise teams (Fortune 500, regulated industries) needing mapped controls for EU AI Act, NIST AI RMF and ISO 42001 together with production monitoring and audit automation.
02 ModelOp Enterprise AI lifecycle management and governance platform (AI system of record) Cross-industry 80 /100
Top strength Cohort-leading model-risk testing (bias/drift/performance), real-time runtime monitoring, and 50+ MLOps/cloud/data/GRC integrations as a neutral enterprise AI control tower.
Top gap No automated shadow-AI discovery (inventory is intake/registration-based); pricing is quote-only with no public tier; SOC 2/ISO certification status not on the public surface.
Best for Large regulated enterprises (banks, F500) needing continuous model-risk monitoring, automated audit-evidence collection, and integration with existing MLOps and GRC stacks.
03 OneTrust Privacy/GRC incumbent extending into AI governance: AI inventory, framework-aligned risk tiering, runtime monitoring and audit-evidence... Cross-industry 76 /100
Top strength Broad maintained compliance-framework library (EU AI Act, NIST, ISO 42001 plus 25+ data/security regs) backed by a dedicated regulatory-intelligence function (40+ in-house researchers, 500+ lawyers, 300 jurisdictions); recognized by Gartner as an AI Governance Platform (2025 Market Report, 2026 Magic Quadrant Visionary); continuous monitoring and runtime guardrails across models and agents.
Top gap No public evidence of quantitative bias/fairness or explainability/red-team testing depth; pricing is quote-only across all packages; automated shadow-AI discovery breadth un-evidenced on the public surface.
Best for Enterprise teams already using OneTrust privacy or GRC modules that need to extend existing controls to AI inventory, EU AI Act mapping, and runtime oversight.
04 Scrut Automation Security-first GRC platform with continuous control monitoring and automated audit evidence, extending into AI governance via ISO 42001 and... Cross-industry 51 /100
Top strength Automated control-evidence collection and 24/7 continuous control monitoring across 60+ frameworks, the cohort calibration anchor for evidence/audit automation.
Top gap No model inventory/shadow-AI discovery and no quantitative model-risk (bias/explainability) testing; AI governance is via ISO 42001 + NIST AI RMF mapping, not model-level testing.
Best for Security-first startup-to-enterprise teams needing automated GRC evidence workflows plus ISO 42001/NIST AI RMF coverage, without dedicated model-risk tooling.
05 Oximy AI adoption and shadow-AI discovery engine for the enterprise Cross-industry 48 /100
Top strength Automated network-layer discovery of 6,500+ AI tools and shadow-AI usage with no browser extensions or API keys, plus a continuous detect-intervene-measure loop and broad identity/network/HRIS connectors.
Top gap No model-risk, bias or explainability testing and no maintained framework control library or crosswalks; framework coverage is alignment-claim only.
Best for Enterprises that need automated discovery of shadow AI, usage analytics and employee-behavior policy enforcement, without requiring model-registry or MLOps integrations.
06 AlignAI AI Operating Model platform for refining, approving and orchestrating enterprise AI initiatives across the governance lifecycle Cross-industry 39 /100
Top strength Connective intake-to-impact governance layer: use-case manager, playbook studio and approval routing that sits on top of an existing stack (SharePoint, ServiceNow, Jira, Power BI) with bidirectional sync, a documented REST/OAuth 2.0 API and SOC 2 Type II certification.
Top gap Process-governance tool, not a model-testing one: no quantitative bias/explainability/red-team testing; framework coverage is a single ISO 27001 reference with no maintained crosswalk library; several flagship GRC/MLOps connectors (Archer, Databricks, OneTrust) are roadmap; pricing is quote-only.
Best for Mid-to-large enterprises and AI COEs standardizing intake, prioritization and approval of AI initiatives on a Microsoft/Jira stack.
Request a platform we should evaluate.
The vendor list is intentionally constrained. We only score vendors that meet the inclusion criteria documented above. If you use a platform that fits and isn't here, send it our way. We evaluate on the same rubric and email you when the score is published.
Don't see a platform?
Tell us what to score next.
The vendor list grows from buyer requests. If you use a platform that fits the inclusion criteria and isn't here, send it our way through the Request a platform tab above. We evaluate on the same rubric and email you when the score is published.
Or read more about how we score / take the audit
Take the free 4-minute readiness audit.
Get your score, peer benchmarks, and three tailored vendor recommendations. No email required to see your results.