The independent directory of AI governance platforms

These platforms treat AI governance as an organisational discipline rather than a machine-learning problem. They maintain an inventory of AI use cases, route them through intake and risk assessment, attach policies and controls drawn from regulations like the EU AI Act, and collect the evidence an auditor will eventually ask for. The centre of gravity is workflow and documentation: who approved this system, against which policy, on what evidence, and when it was last reviewed.

Observability tools answer the question governance documentation cannot: is the model actually behaving in production the way it was approved to behave? They track drift, data quality, bias and performance degradation over time, and increasingly extend to LLM-specific concerns like hallucination rates, prompt/response logging and token-level tracing. Their output is the empirical evidence that feeds a governance program's monitoring obligations.

Guardrail systems sit in the request path between users and models, enforcing policy at inference time. They filter prompts and responses for prompt injection, PII leakage, toxicity, off-topic use and ungrounded claims, and can block, redact or rewrite before content reaches a user. Unlike governance documentation, these controls are preventive and measured in milliseconds.

This category attacks your AI before someone else does. Vendors here run automated adversarial testing against models, agents and applications — jailbreaks, prompt injection, data extraction, agent hijacking — and map findings to frameworks like the OWASP LLM Top 10 and MITRE ATLAS. Several also cover the ML supply chain, scanning model artefacts and dependencies for tampering.

Large data, cloud and ML platform vendors have extended existing catalogues, MLOps suites and GRC modules to cover AI. Their advantage is gravity: the inventory, lineage, identity and access controls already exist, and AI governance becomes another surface on infrastructure you have already bought. The trade-off is that governance depth often trails the pure-play specialists, and coverage can be strongest inside the vendor's own ecosystem.