AI governance tools are bought on a demo and judged on an audit, so a fair comparison asks each candidate to produce the evidence for one of your production models. NIST's framework, voluntary by design, names the first criterion GOVERN 1.6: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." The EU AI Act, Regulation (EU) 2024/1689, adds Article 12(1): "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." After Regulation (EU) 2026/1744, in force since July 27, 2026, that duty applies to Annex III systems from December 2, 2027, not from August 2, 2026.
What AI Governance Tools Do, and What They Leave to You
AI governance tools are the software you buy so that, for every model, agent and third-party AI integration you run, someone can answer four questions with a document instead of a meeting: what it is, who approved it under which policy, how it behaves now, and where the evidence is.
Some work stays with you. The NIST AI RMF 1.0 is explicit: "While the AI RMF can be used to prioritize risk, it does not prescribe risk tolerance." Under Article 17 of the AI Act, the quality management system is the provider's obligation; a tool is one part of it.
Products fall into three types: governance built into a data or cloud platform, dedicated governance, risk and compliance (GRC) suites, and observability.
This guide covers choosing the tool. Where gates sit in the release process is covered in how governance gates run inside a delivery pipeline; whether the Act applies to a system, and in which role, in classifying your AI systems under the AI Act.
Why a Vendor List Will Not Pick Your Platform
The pages that rank for this phrase are mostly lists written by vendors about themselves and their rivals. Of four read for this guide, two put their own product first. They rank GRC suites, registries and observability against each other, and treat "supports the EU AI Act" as a checkbox, with no line between an assessment template and an enforced control. One vendor's product page lists "Planned enforcement integration with CI/CD, CASBs, and API gateways." Two of the four lists still date the high-risk rules to August 2026.
A top-10 list of AI governance tools answers the question the vendor wants asked. The buyer's question is which gap comes first, and no ranking of AI governance software knows that.
Seven Buyer Criteria, and the Document That Proves Each One
Comparing AI governance tools comes down to seven questions, each settled by a document rather than a feature list.
- Inventory: every model, agent, LLM integration and vendor, with an owner. MAP 4 extends mapping to components "including third-party software and data."
- Policies and controls: a versioned policy and a decision with a name and a time. In Collibra's documentation, "the Business Steward for the domain receives a task to approve or reject the Assessment Review asset."
- Monitoring tied to the inventory: an alert that points at a model version, not only at an endpoint (MEASURE 2.1).
- Audit evidence: model card, risk register and logs in one export. Mitchell et al. define model cards as "short documents accompanying trained machine learning models." Article 11(1) wants documentation "kept up-to date," and Microsoft documents an AI report that "can be exported in PDF or SPDX formats."
- Stack integration: the registry, catalog and CI/CD the tool reads, per its docs, not its logo strip.
- Regulatory mapping: the article or subcategory named next to each control, assessed or enforced.
- Cost and licensing: per model, per user or by consumption, plus add-ons. Microsoft's regulations list notes: "The regulatory templates listed below may be purchased by your organization."
| Criterion | Question | Proof | Reference |
|---|---|---|---|
| 1. Inventory | Is everything listed with an owner? | Dated inventory export with third-party flag | NIST GOVERN 1.6, MAP 4; AI Act Article 49 |
| 2. Policies and controls | Who approved what, under which versioned policy? | Policy definition plus approval record | AI Act Articles 9(1) and 17(1) |
| 3. Monitoring | Does an alert point at a model version? | Monitor configuration and one timestamped alert | NIST MEASURE 2.1; AI Act Articles 26(5) and 72(1) |
| 4. Audit evidence | Does the export need no manual assembly? | Evidence export for one production model | AI Act Articles 11(1), 12(1), 26(6) |
| 5. Stack integration | What does it read from, per the docs? | Integrations page listing ingested objects | NIST MAP 4 |
| 6. Mapping | Is the requirement named per control? | Template with article per control | AI Act Article 17 (a) to (m); NIST AI RMF Core |
| 7. Cost and licensing | What costs extra? | Price sheet plus integration estimate | Vendor licensing documentation |
A feature list answers none of these.
Mapping the Criteria to the EU AI Act, NIST AI RMF and ISO/IEC 42001
NIST released AI RMF 1.0 (NIST AI 100-1) on January 26, 2023, and its program page says it "is intended for voluntary use." The core "is composed of four functions: GOVERN, MAP, MEASURE, and MANAGE." Inventory maps to GOVERN 1.6 and 1.7, monitoring to MEASURE 2.1, third-party integration to MAP 4.
In the AI Act, Article 9(1) requires a risk management system "established, implemented, documented and maintained." Article 17(1) requires providers to "put a quality management system in place that ensures compliance with this Regulation," with thirteen elements, (a) to (m), including record-keeping. Article 72(1): "Providers shall establish and document a post-market monitoring system." Under Article 26, deployers "shall monitor the operation of the high-risk AI system on the basis of the instructions for use" and keep the logs it generates for at least six months, longer where other law requires, so criteria 3 and 4 reach buyers who never build a model.
After the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 27, 2026), high-risk obligations apply from December 2, 2027, for Annex III systems and from August 2, 2028, for Annex I systems, under the amended Article 113. The rest of the Act applies from August 2, 2026. The deadline moved. The list of things to record did not.
ISO/IEC 42001:2023, the AI management system standard, is a template in most AI governance tools that claim regulatory coverage. Microsoft's Compliance Manager lists it, and Holistic AI states "Controls mapped to EU AI Act, NIST AI RMF and ISO/IEC 42001." A template answers criterion 6; enforcement and evidence are criteria 2 and 4, asked separately.
What Each Platform Type Documents, Not What It Promises
Grouped by what their documentation says, AI governance tools fall into three types, and the honest comparison is within a type, not across.
Platform-native first. The Databricks documentation (September 11, 2026) states: "Unity Catalog is the unified governance layer for data and AI built into Databricks." As of the October 2026 documentation, "The activity log is not supported for models in Unity Catalog." Unity Gateway can "Log requests and responses to Unity Catalog Delta tables for monitoring and debugging." Google's Model Registry is documented today under the Gemini Enterprise Agent Platform name, and its monitoring overview says "Model Monitoring v2 is in Preview." Microsoft's Purview documentation says "prompts and responses are captured in the unified audit log."
Dedicated GRC suites speak through product pages. IBM's watsonx.governance page offers to "Continuously monitor AI systems for compliance, operational issues, and emerging risks." OneTrust says it can "Discover and inventory AI systems, models, agents, datasets, vendors, projects, and use cases." Collibra's documentation (October 2026) lists 10 assessment templates and 11 integrations under AI Command Center, which succeeded its AI Governance module.
For observability, Fiddler's documentation covers how to "Monitor production agentic applications, GenAI and LLM applications, and ML models in real time." Arize AX calls itself "an AI engineering platform for improving AI agents and applications." Neither landing page, at the time of writing, treats governance or audit as a topic: both fit criterion 3.
Platform-native tools tend to cover criteria 1 and 5 and leave 6 open; GRC suites cover 4 and 6 but depend on 5. That is why most buyers end up with two.
Running the Comparison: Scoring Sheet and Evidence Test
The sheet has seven rows and three candidates, one per type unless your stack decides. Score 0 when the documentation is silent, 1 for a product-page claim, a "planned" or "Preview" label, or a bare logo, and 2 for a docs page plus a demonstration on your model. Your first gap matters more than the total.
Then ask each candidate to produce, for one production model, an inventory entry with an owner, a dated policy decision, an alert for that version, the model card and risk register in one export, and logs for a set period, at least six months for deployers under Article 26(6). Award one point per item nobody assembled by hand. An AI governance tools comparison that ends at the demo has compared sales teams.
Price the license in three parts: the fee, integration work, and upkeep when the law changes. Microsoft states that "Compliance Manager also updates its regulations when the underlying laws or regulations change." Ask every vendor for the same sentence.
Build on What You Have, Then Buy the Gap
Start with an inventory, even a spreadsheet, before any demo. Count the registry and catalog you already run toward criteria 1 and 5. Buy evidence first, since neither a registry nor observability produces it. Bring in GRC when an auditor asks about mapping, and a gateway once a second LLM provider arrives.
AI governance tools rarely fail on features. They fail when evidence is assembled by hand the week before the audit. If evidence and mapping are what is missing, a governance layer added to the registry and catalog you already run closes the gap without replacing the stack.
At DS Stream we compare tools on the client's criteria and run the evidence test on one production model before recommending anything. To try it on your candidates, bring us your shortlist and one production model.
FAQ
What is an AI governance tool, in one sentence?
AI governance tools are software that keeps, for every model, agent and third-party AI integration, a current inventory record, a dated policy decision, a monitoring signal tied to the model version, and exportable evidence.
Do we need one if we already have a model registry and observability?
Only if one of the seven criteria is a gap. A registry covers versions and part of the inventory, and observability covers monitoring. Neither exports audit evidence or maps controls to regulation.
Which tools map to the EU AI Act, and when do the obligations apply?
According to their own pages, Microsoft Compliance Manager, Collibra, OneTrust, Credo AI and Holistic AI offer EU AI Act templates. A template is criterion 6, not enforcement. After Regulation (EU) 2026/1744, high-risk obligations apply from December 2, 2027, for Annex III systems and from August 2, 2028, for Annex I systems; the rest of the Act applies from August 2, 2026.
What evidence should the tool produce for an audit, and how long must logs be kept?
For one model: an inventory entry, a policy decision, an alert, the model card with the risk register, and logs. Providers log events over the system's lifetime under Article 12. Deployers keep the logs their high-risk system generates for at least six months under Article 26(6), unless Union or national law provides otherwise.
