AI governance platforms

The strongest technical evaluation layer of the Leaders: bias, drift and explainability monitoring with published red-teaming notebooks, wrapped in GRC workflow through OpenPages. Governs non-IBM models, including OpenAI, AWS and Meta.

Reviewers on Gartner Peer Insights describe integration effort and user experience as weak points. IBM's documentation features a bank called Golden Bank, which is a fictional tutorial company rather than a customer.

The broadest discovery reach of any platform here: 30 connectors spanning AWS, Google Cloud, Azure, SAP, Oracle and Workday, so the inventory extends well beyond ServiceNow's own environment.

CIO's independent analysis criticises cost visibility, describing a 'hazy view of spend'. Several 2026 governance enhancements only reached general availability around August 2026.

By far the smallest of the three Leaders. Combines data-privacy tooling with AI governance, and delivers AI governance training through its own LMS. Offers up to $1M in financial protection for qualified customers under its Truyo Trust programme.

Almost the entire capability picture is self-described; no independent technical review was found, which makes the Leader placement its main independent signal.

Process and inventory breadth, built on the privacy programme organisations already run — an existing GDPR and DPIA practice carries over directly. Continuous discovery of models, datasets and agents was extended in March 2026.

Evidence of native bias or robustness testing is thin; the platform assesses and documents rather than testing. TitanOS appears alongside OneTrust in search results as a consent-management reference, not an AI Governance customer.

Policy-pack architecture: laws and standards translated into structured requirements and controls that drive approval workflows. Pairs with Credo AI Lens, an open-source assessment library independently catalogued by the OECD — a rare piece of corroboration that is not vendor-owned.

Named customers: Booz Allen Hamilton, Mastercard independently corroborated

Booz Allen Hamilton is confirmed on Booz Allen's own site, making it one of the few independently corroborated customer relationships in this market. Claims elsewhere that Microsoft, Amazon and Databricks are customers trace to a competitor's blog and are not supportable.

Governs by enforcement at runtime rather than by documentation after the fact: requests from AI applications and agents route through Airia, so policy is applied inline. Architecturally distinct from the assessment-workflow tools it shares a quadrant with.

The $100M is not a venture round but capital from a co-founder, so it carries no external investor diligence or valuation signal. Founded in 2024, and Gartner did not score market track record in this first edition, so the placement rests on product and vision alone.

The deepest audit trail found in this market: versioned point-in-time policy snapshots, so a reviewer can reconstruct which policy applied to which AI system on which date. Auto-generates model cards and audit artefacts.

Named customers: RBC Capital Markets, Fidelity Investments

Its Gartner Peer Insights rating of 4.9 rests on only three reviews. Heritage is model operations rather than rights-based compliance.

Built for examiner-facing proof rather than dashboards, across four modules covering policy, decision records, monitoring and audit evidence. Its control library maps to the NAIC AI model bulletin, giving it US insurance depth that generalist platforms lack.

A third-party review flags that EU AI Act and non-US framework mapping is not clearly documented and should be checked during procurement. Narrow sector focus outside insurance and financial services.

The deepest technical testing layer in this market — 40+ test types spanning robustness, explainability, toxicity, prompt injection, jailbreak and adversarial testing — and the only platform with a dedicated NYC Local Law 144 bias-audit product.

Named customers: Unilever

The sole Challenger in the quadrant. Claims that Adidas is a customer are not supportable. No evidence was found of third-party or vendor AI assessment, unlike several peers.

Security-led rather than policy-led. Builds an AI Bill of Materials, scans for exposed model and inference endpoints, and runs adversarial red-teaming that extends into the third-party AI supply chain — something most policy-first platforms do not attempt.

Impact assessments, human oversight workflow and bias testing produced no evidence, which plausibly explains the placement. KPMG retains a minority stake, giving an advisory channel most startups lack.

The most data-native platform here. Its Data Journeys mechanism tracks data in motion rather than static lineage, and impact assessments are pre-filled from observed data flows instead of questionnaires — a materially different approach to DPIAs.

Model-level governance is thin: no evidence of bias, robustness or red-team testing. Holds its own SOC 2 Type II, which is the vendor's compliance posture rather than a customer-facing feature.

Knowledge-graph architecture: risks, controls, policies and models are linked, so a registered system inherits its obligations automatically and they update as the system changes. The strongest public-transparency story here — it has built and operated public AI registers with government.

Named customers: Scottish Government, Deloitte independently corroborated

The Scottish Government relationship is corroborated by a Scottish Government FOI release rather than a vendor case study, making it the best-evidenced customer claim in this market. Saidot's own marketing figures are internally inconsistent between pages, so they are not quoted here.

SAP markets no standalone AI governance product. Governance sits as a layer inside the SAP Business AI Platform, which makes it hard to buy for a non-SAP organisation — the structural reason for the placement.

Which product Gartner assessed could not be determined. SAP AI Agent Hub, the closest functional match, was slated for general availability in Q3 2026, while the Magic Quadrant required availability by 1 April 2026. SAP's framework coverage — EU AI Act, NIST, ISO 42001 and ISO 42005 — describes how SAP governs its own AI, not a customer-facing capability, and the two should not be conflated.

Runtime observability and inline guardrails rather than governance paperwork. Scores prompts and responses for hallucination, toxicity, PII, prompt injection and jailbreak using purpose-built low-latency evaluator models.

Named customers: Integral Ad Science

The only vendor across this entire market that publishes a price. Independent reviewers praise the LLM monitoring and criticise the learning curve. No AI inventory of record and no risk tiering, so it does not stand alone against EU AI Act documentation duties.

Model risk discipline for regulated finance, through SAS Model Risk Management and SAS AI Governance Manager. Chartis named SAS a category leader in AI governance and placed it second overall in RiskTech100 2026.

A notable negative finding: SAS markets around model-risk practice rather than named regulatory regimes, and no SAS page was found enumerating EU AI Act, NIST or ISO 42001 control mappings — unlike its competitors. Product boundaries between its several AI governance offerings are unclear.

Cross-framework control mapping — document a control once and map it across regimes — aimed at legal and compliance teams rather than ML engineers. Names Colorado SB 205 explicitly, and sells role-based AI literacy training delivered as SCORM into an existing LMS, which speaks directly to the EU AI Act's AI literacy duty.

Mentioned in the Magic Quadrant but not one of the 13 assessed vendors. No evidence it runs bias, fairness or robustness tests itself; these appear as mitigations it recommends others perform.

Adversarial testing wired into the build pipeline: simulated attacks run in CI so a build fails when too many succeed. Also operates as an independent external auditor for NYC Local Law 144 bias audits, which is a service rather than software.

Fairly AI acquired Sweden's anch.AI on 18 June 2025 and the combined company rebranded as Asenion; anyone researching the old name will find two identities. Least independently verified vendor covered here — almost every capability claim traces to the vendor or a partner.