What a governance platform does, and what it does not

AI governance platforms are now a recognised software category. Gartner published its first Magic Quadrant for AI Governance Platforms on 16 June 2026, screening more than a hundred vendors and assessing thirteen, with IBM, ServiceNow and Truyo named as Leaders. A category with a Magic Quadrant is a category with budget attached, so it is worth being precise about what these products do.

What they genuinely do well

They hold the register. A structured inventory of AI systems with owners, classifications, linked evidence and a change history is real work, and a database designed for it beats a spreadsheet that four people edit.

They run workflow. Assessment questionnaires, approval routing, review dates, reminders when something is overdue. Governance fails more often through things not happening on time than through wrong answers, and workflow addresses exactly that failure.

They map controls across frameworks. One control answering to several frameworks at once, so an organisation subject to the EU AI Act, a management-system standard and a sector expectation records the evidence once.

They produce reports. A view of the estate for a board or a regulator, generated rather than assembled by hand the week before.

That is a useful product. It removes coordination effort, which is the largest hidden cost in governance.

What they do not do

They do not make judgements. Whether a use case is high-risk, whether a residual risk is acceptable, whether an oversight arrangement is real: none of these is computable from register fields. The platform records the conclusion; a person reaches it.

They do not see your AI. The register contains what someone entered. A platform has no way of knowing about the summarisation feature a vendor switched on last week, or the model a team built in a notebook. Discovery is a different capability, and it is usually a different product.

They do not perform oversight. Article 14 requires a natural person able to understand, interpret, override and interrupt. No platform occupies that position.

They do not carry your liability. This is worth stating plainly because the sales conversation tends to imply otherwise. FINMA's guidance on the use of AI is explicit on the parallel point for outsourcing: responsibility remains with the institution even where AI is bought in or outsourced. A governance tool is bought in.

Four findings from our own market research

We examined seventeen governance platforms. Four findings are worth carrying into any procurement conversation.

Only one publishes pricing. Sixteen of seventeen require a sales conversation to learn what the product costs. That tells you something about how the category is sold, and it means comparison requires effort the buyer has to fund.

None holds an ISO 42001 certification for the governance product itself. Many of these products help you build an AI management system. None of them has been certified as operating one for the product you are buying. It is a fair question to put to a vendor, and the answer is informative regardless of what it is.

No platform was found to produce a Statement of Applicability. That document is the central artefact of a management system built to ISO/IEC 42001: the record of which controls apply, which do not, and why. A platform that cannot produce it is not producing the management system, whatever the dashboard suggests.

No platform was found to produce an AI incident report or a decommissioning record. The first is an explicit duty under the EU AI Act, where Article 73 sets deadlines of fifteen days generally, ten where a person has died, and two for a widespread infringement or serious and irreversible disruption of critical infrastructure. A category of product sold for AI compliance that does not produce the one document the regulation demands on a two-day clock is a gap worth naming out loud. The second, the decommissioning record, is the evidence that a system was retired, its logs preserved and its decisions accounted for. Its absence across the field suggests the category is built around onboarding rather than the full lifecycle.

Questions to ask a vendor

• Show me an incident report this product generated, with the fields the regulation requires.
• Show me a Statement of Applicability produced by the product.
• Show me the decommissioning record for a retired system.
• How does a system get into the register if nobody enters it?
• What is the price?

As of 24 September 2026.