AI governance tool categories

These platforms treat AI governance as an organisational discipline rather than a machine-learning problem. They maintain an inventory of AI use cases, route them through intake and risk assessment, attach policies and controls drawn from regulations like the EU AI Act, and collect the evidence an auditor will eventually ask for. The centre of gravity is workflow and documentation: who approved this system, against which policy, on what evidence, and when it was last reviewed.

Buy here when your problem is proving oversight to a regulator, board, or customer — not when your problem is model performance.

Observability tools answer the question governance documentation cannot: is the model actually behaving in production the way it was approved to behave? They track drift, data quality, bias and performance degradation over time, and increasingly extend to LLM-specific concerns like hallucination rates, prompt/response logging and token-level tracing. Their output is the empirical evidence that feeds a governance program's monitoring obligations.

Buy here when you already know which models you run and need continuous proof they still work as intended.

Guardrail systems sit in the request path between users and models, enforcing policy at inference time. They filter prompts and responses for prompt injection, PII leakage, toxicity, off-topic use and ungrounded claims, and can block, redact or rewrite before content reaches a user. Unlike governance documentation, these controls are preventive and measured in milliseconds.

Buy here when you are shipping a customer-facing LLM application and need controls that act, not just record.

This category attacks your AI before someone else does. Vendors here run automated adversarial testing against models, agents and applications — jailbreaks, prompt injection, data extraction, agent hijacking — and map findings to frameworks like the OWASP LLM Top 10 and MITRE ATLAS. Several also cover the ML supply chain, scanning model artefacts and dependencies for tampering.

Buy here when security, not compliance, owns the risk — and you need evidence of testing rather than evidence of policy.

Large data, cloud and ML platform vendors have extended existing catalogues, MLOps suites and GRC modules to cover AI. Their advantage is gravity: the inventory, lineage, identity and access controls already exist, and AI governance becomes another surface on infrastructure you have already bought. The trade-off is that governance depth often trails the pure-play specialists, and coverage can be strongest inside the vendor's own ecosystem.

Buy here when consolidation and existing enterprise agreements matter more than best-of-breed governance depth.