Worked example: evaluating a governance platform

A financial services firm is buying an AI governance platform. Three vendors are shortlisted. The evaluation team has a requirements matrix with sixty rows, all of which every vendor will claim to satisfy. This is how to find out what is actually there.

Where the demo misleads

Every demonstration shows the same arc: a system is onboarded, a questionnaire is completed, a risk score appears, an approval is routed, a dashboard turns green. It is convincing because each step is real. What the arc hides is that it begins with a system somebody already knew about and ends before anything goes wrong.

The governance work that is hard sits outside both ends of that arc: finding the system in the first place, and the evidence you need on the day of an incident or a decommissioning.

Five demands instead of sixty rows

One: show an incident report the product generated. Not a ticket template. A report with the content an authority would expect, produced by the tool, for a real or realistic incident. Our review of seventeen platforms found none that produced one. Article 73 requires serious incident reporting on deadlines of fifteen days generally, ten where a person has died, and two for a widespread infringement or serious and irreversible disruption of critical infrastructure. If the product cannot produce this artefact, your incident process is manual, which is fine as long as you know it before you buy rather than on the day.

Two: show a Statement of Applicability. If the product is sold as supporting an ISO/IEC 42001 management system, the Statement of Applicability is the central document of that system: which controls apply, which do not, and the justification. None of the seventeen was found to produce one. A vendor who responds by explaining that customers produce it themselves has answered the question honestly, and you should write that answer down.

Three: show a decommissioning record. When a system is retired, what does the product produce? Retirement is where log retention obligations, accountability for past decisions and residual risk all come together, and none of the seventeen was found to produce this record either. A platform whose lifecycle ends at approval is an onboarding tool.

Four: ask how a system enters the register without a human entering it. If the answer is integrations with procurement, expenses, identity or network tooling, ask which are in the base product and which are professional services. If the answer is that users enter systems, then the product does not address shadow AI, and you need to plan discovery separately.

Five: ask the price, and note how long it takes to get one. Of seventeen platforms, one publishes pricing. Sixteen do not, so budget for the comparison effort itself, and expect the number to depend on how many systems you have, which you do not yet know because you have not done discovery.

One question about the vendor rather than the product

Ask whether the vendor holds an ISO 42001 certification for the governance product itself. Across seventeen platforms, none did. This is not disqualifying; the standard is recent and certification takes time. It is informative about the gap between what the category sells and what the category has done, and a vendor's reaction to the question tells you how the rest of the relationship will go.

Reading the results

Suppose all three vendors fail demands one, two and three, one has procurement and identity integrations, and one publishes a price. That is a clear result rather than a disappointing one. It tells you the platform will carry your register, your workflow and your reporting, and that incident reports, the Statement of Applicability and decommissioning records will be produced by your people. You can now budget for that, assign it, and stop expecting the tool to do it.

The failure mode this avoids is the common one: buying the platform, assuming the artefacts are covered, and discovering on day two of an incident that the product has no way to produce what the deadline requires. FINMA's guidance makes the underlying point for regulated firms: responsibility remains with the institution even where AI is bought in or outsourced. The platform does not change who is answerable.

As of 24 September 2026.