Tools · AI governance & compliance
AI governance and compliance tools
AI governance and compliance platforms keep the record of which AI systems and agents a company uses, who owns each one, how risky it is and which rules apply. They run intake and risk reviews, map controls and evidence to frameworks such as the EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001, and a few now also check agent actions against policy before they run, two of them in private preview. A team needs one when it has to show an auditor, a regulator or its own board what AI it runs and how each system was approved.
AI governance & compliance 9
-
Agent Governor (vendor site, opens in a new tab)
private previewResearch preview, available on request, that enforces policy inside the software that runs the agent, checking tool calls and actions before they run, blocking those outside policy and reporting telemetry on each decision. It starts with Claude Code and Credo AI's own regulatory and risk policies; Credo says support for an organization's own goals and policies comes later.
-
AI Command Center (vendor site, opens in a new tab)
generally availableCollibra
Keeps a registry of AI use cases, models and agents, turns policies into machine-readable agent contracts, and uses supervising agents to intervene when an agent crosses defined limits. It scores trust from production signals and ships EU AI Act, NIST AI RMF and AIUC-1 assessment templates.
-
Credo AI (vendor site, opens in a new tab)
generally availableAI governance platform with a registry of internal and third-party AI, including auto-discovery in cloud environments, a policy engine that maps business context to technical controls, risk dashboards and automated evidence for frameworks such as the EU AI Act, NIST and ISO.
-
Drata AI Agent Governance (vendor site, opens in a new tab)
private previewAn inline sensor registers each AI agent at creation with its owner, identity, permissions and scope, policies are enforced before an agent action runs, drift outside approved scope is flagged, and every decision is kept in a tamper-evident audit record. In limited availability, starting with agents on Anthropic.
-
Holistic AI Governance Platform (vendor site, opens in a new tab)
generally availableDiscovers and inventories models, agents, APIs and pipelines, including shadow AI, through read-only integrations. It tests and red-teams AI systems for risk and bias, tracks regulatory compliance, and monitors systems after deployment.
-
IBM watsonx.governance (vendor site, opens in a new tab)
generally availableMaps AI systems with their risks, controls and policies in a governance graph, detects shadow AI, and automates policy enforcement, obligation mapping and compliance evidence capture across the AI lifecycle. It works with IBM OpenPages for enterprise risk and compliance.
-
OneTrust AI Governance (vendor site, opens in a new tab)
generally availableHandles AI intake, risk scoring and approvals, keeps an inventory of models, data, agents and vendors, detects shadow AI, and applies policy-driven controls at runtime with attestations and audit evidence.
-
Trustible (vendor site, opens in a new tab)
generally availableTrustible
AI governance platform that routes AI use-case intake by risk, keeps a single record of AI assets, and builds an audit trail as reviews happen.
-
Vanta AI Governance (vendor site, opens in a new tab)
private previewInventories AI agents on laptops, in code and in vendor platforms, with the models, prompts, data and MCP tools each can reach, and runs AI impact assessments aligned to ISO 42001 and the EU AI Act. Vanta describes controls on what agents may do as a later phase.
Recent launches
- OneTrust CORIE and AI Control Plane · announced
- Salesforce AI Control Plane (Trusted Enterprise AI Harness) · announced
- Enterprise managed permissions for GitHub Copilot agent operations · generally available
- Drata AI Agent Governance · private preview
- AI Governance from Vanta · private preview
Announced in the last 90 days. Each launch on New tools links the vendor's own announcement.
The briefing
New AI agent governance tools, by email
The briefing's New Tools section covers the latest governance launches, each linked to the vendor's announcement, next to the news that decides which ones matter. At least once a week, five-minute read, free.
You confirm by email. Unsubscribe in one click.
Questions to ask vendors
Neutral questions for a request for proposal (RFP) or a security questionnaire. No product here is named as the answer.
-
Does the inventory find AI systems and agents on its own, or does it depend on teams registering them?
-
Which frameworks are mapped today, and what evidence does each control produce for an auditor?
-
Are policies enforced when an agent acts, or recorded for review afterward?
-
Are high-risk actions gated behind human approval, and can we define which actions count as high risk?
-
Does discovery feed an inventory you own and can export, or a dashboard you rent?
-
Which features are generally available today, and which are in preview?
More questions, grouped by topic: Questions to ask AI agent security vendors.
Related incidents
- A Spanish regulator received what may be the first agentic AI breach report
- CERT-In said AI agents under evaluation read personal and confidential records at Indian organizations
- OpenAI disclosed six model misalignment incidents and a framework for reporting them
Every record in the AI agent incident database links the sources that reported it.
Missing a product, or found an entry that is out of date? Write to [email protected]. A submission is read, never paid for, and does not guarantee a listing. The glossary defines the terms used here.