T-NEX
Menu
DEEN
GRC provider register · Category 7 of 11

GRC software for AI governance & model risk:
29 providers with AI classification.

In short: The T-NEX GRC provider register lists 29 providers for AI inventories, model risk and the EU AI Act, as of 18 October 2026. Of these, 27 document specific AI functions (93%), most often for testing model and agent behaviour with a second AI as well as drafting policies, reports and other governance documents. In Germany, Austria or Switzerland, seven have a documented headquarters, three of them in Germany.

By and Published: As of: · Category page of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context

How does software for AI governance and model risk work?

AI governance software inventories an organisation's AI systems, models and agents, classifies them by risk and links them to controls, approvals, tests and evidence across their life cycle. Model risk management (MRM) adds the validation and monitoring of individual models. Vendors also market these tools as AI governance or responsible AI platforms. Here AI is both tool and test subject: at ten of the 29 providers, an AI model evaluates the outputs or behaviour of other models and agents. Only what the tool itself does with AI counts as an AI function, not just an AI inventory.

  • No specific AI function in the sources checked: 2 entries
  • Documented AI use cases by topic, an entry can count more than once: Drafting policies, reports and other governance documents (9) · Assessing and classifying AI systems by risk (6)
  • Documented headquarters in Europe: 18 of 29 providers, headquarters not separately checked: 9

Questions for the demo, derived from the five criteria of the comparison:

  • Is the AI inventory connected to model risks, controls and outsourcing, or is it a separate list?
  • Does a report show the data cut-off date and the assessment on which an AI system's classification rests?

When do the AI Act's high-risk obligations start to apply to banks?

From 2 December 2027 for the high-risk systems listed in Annex III, which include AI used to evaluate the creditworthiness of natural persons or establish their credit score (Annex III point 5(b)), but not AI used to detect financial fraud. The date comes from Article 113, third paragraph, point (c)(i), as amended by Regulation (EU) 2026/1744. It was originally 2 August 2026. High-risk AI systems placed on the market or put into service earlier are covered only if their design changes significantly afterwards (Article 111(2)); the prohibitions in Article 5 apply regardless.

Does a bank need an AI inventory?

In BaFin's view, yes: financial entities should have an overview of the AI systems they use and know how far the AI Act applies to them. As a reference for building it, BaFin points to the inventory of information and ICT assets that DORA already provides for. Under Article 8(1) and (6) DORA, financial entities identify, classify and document their ICT-supported business functions and the information and ICT assets supporting them, and maintain inventories for this purpose. They review the classification at least once a year.

What does the AI Act require on staff AI literacy?

Measures that support the development of AI literacy. That is what Article 4(1) of the AI Act has required of providers and deployers since Regulation (EU) 2026/1744 replaced it, in force since 27 July 2026. It covers staff and other persons who deal with the operation and use of AI systems on the organisation's behalf. Providers and deployers do not have to guarantee a specific level of AI literacy for any individual. BaFin monitors whether financial entities take such measures.

Which providers of GRC software for AI governance & model risk are headquartered in Germany, Austria or Switzerland?

Of the 29 providers, seven have a documented headquarters in Germany, Austria or Switzerland: in Germany QuantPi, UNAIT and Validaitor; in Austria Daiki; in Switzerland Calvin Risk, LatticeFlow AI and Modulos. For nine further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

  • AI Act (Regulation (EU) 2024/1689), Art. 4, 111, 113 and Annex III, consolidated version of 27 July 2026: AI literacy, creditworthiness assessment as high-risk AI, systems already in service and start date of the high-risk obligations (Source: EUR-Lex)
  • Regulation (EU) 2026/1744 (Digital Omnibus on AI): new wording of Art. 4 and Annex III obligations moved to 2 December 2027 (Source: EUR-Lex)
  • BaFin AI market surveillance: what BaFin monitors under Art. 4, 5 and 50 of the AI Act and how financial entities can build their AI overview (Source: BaFin, in German)
  • Art. 8 DORA (Regulation (EU) 2022/2554): identification and classification of information and ICT assets, inventories (Source: EUR-Lex)

Further reading on t-nex.de: EU AI Act for banks, Operating limits for AI agents in banking, and T-NEX for information security leaders and CISOs.

All 29 entries: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

AI governance & model risk

29 entries

AI governance & model risk · 29 providers
Provider / productDocumented focusAI functions and classification
2021.AI · Product: GRACE AI Platform (GRACE Governance, GRACE AI Security) · Headquarters: Denmark [1] · The privacy policy gives Ryesgade 3F, 2200 Copenhagen, Denmark as the contact address of 2021.AI; the CVR number 3783 6303 from the website footer has not been checked in the Danish register; no statement on hosting or owners. · 2021.ai; 2021ai; GRACE AI Platform; GRACE Governance; GRACE AI Security; Chat Guardian; nicht Grace Connect; nicht Grace AI von SwissGRCDocumented focus: GRACE Governance keeps AI models, systems and use cases in a register and links them with assessments, controls, attestations and ongoing monitoring of compliance status; ISO 42001 and the EU AI Act are predefined as frameworks. The GRACE AI Security module controls access to AI models, classifies use cases under the EU AI Act and records the use of external AI tools via the integrated Gatekeeper Agent from Velatir.AI functions and classification: Chat Guardian uses smaller AI models, including a small language model, to screen prompts, documents and uploads for GDPR-relevant and sensitive data before they reach a model provided via GRACE. When such data is found, it warns, requires approval, blocks the input or reroutes it to an approved on-premises model; compliance and security teams receive a decision log.[2] [3] [4] [5] [6] [7] · Specific AI functions documented
Detect GDPR-relevant data in prompts and uploads · Classify sensitive data in context · Flag or block sensitive inputs
AI evidence: [4] [3] · Chat Guardian was developed jointly with Safe Online and, according to an announcement of 25 June 2026, is available as part of GRACE AI Security; the pricing page lists it in the Sovereign AI and Full AI suite plans, not in Transparent AI. No product test.
Source check: 2026-10-18
Actify · Product: AI Act compliance · Headquarters: Italy [8] · BD TR S.R.L., Via Santa Tecla 4, Milan; P.IVA 14777710964. · BD TR S.R.L.; Actify AI ActDocumented focus: Specialist software for AI inventory, compliance gaps, training records and documentation with an audit trail. Focus on European AI requirements and Italian companies.AI functions and classification: AI supports the analysis of open compliance gaps. Amazon Nova Pro via AWS Bedrock is explicitly named for generating reports and documents; results are intended for subject-matter review.[9] [8] · Specific AI functions documented
Analyse compliance gaps · Draft compliance documents · Create reports
AI evidence: [9] [8] · Paid SaaS plans and a free initial assessment publicly described. Official content was available via the search index; direct retrievals partly returned errors. Access and current functional scope need to be confirmed.
Source check: 2026-10-15
ai.res · Product: AI risk and governance platform · Headquarters: Italy [10] · AI.RES S.R.L., Viale Gramsci 16, Naples; P.IVA 10605591212. · AI.RES S.R.L.; ai-resDocumented focus: Specialist in inventory, risk assessment and monitoring of AI systems. Combines metrics, tests, remediation measures, policies and exportable audit evidence.AI functions and classification: AI suggests risks suited to the respective system and provides a rationale and confidence level. Business users can adopt suggestions and then assess likelihood and severity.[11] [10] · Specific AI functions documented
Suggest relevant AI system risks · Justify risk suggestions
AI evidence: [11] · Product offered with demo request; AI risk suggestions described on the features page. Licence and deployment scope to be requested.
Source check: 2026-10-15
Asenion · Product: AI Control System · Fairly AI; anch.AIDocumented focus: Combines AI assessment with pre-release testing and operational controls. Requirements are mapped to controls and evidence for models, copilots and agents.AI functions and classification: Asenion describes AI-supported assistance for translating natural-language compliance requirements into structured controls. ControlGen contextualises the controls for the organisation and links them to the underlying clauses; the responsible subject-matter owners approve them before use.[12] [13] [14] [15] · Specific AI functions documented
Translate compliance requirements into draft controls · Adapt controls to organisational context and risk objectives
AI evidence: [14] [15] · Documented by the vendor in the AI Compliance-in-a-Box and ControlGen offering; no product test.
Source check: 2026-10-14
Calvin Risk · Product: AI Testing / AI Governance · Headquarters: Switzerland [16] · The legal notice names Calvin Risk AG, Josefstrasse 219, 8005 Zurich, Switzerland, UID CHE-385.869.120; no statement on hosting or owners. · Calvin Risk AG; Calvin Risk Ltd; calvin-risk.comDocumented focus: Calvin Risk tests AI systems and agents against real-world scenarios, edge cases and adversarial inputs and turns their behaviour into measurable evidence for decisions on deployment, risk and governance. Under AI Governance, the vendor describes a register of AI applications with owners and lifecycle stages, a classification of system risks and records that connect risk assessments, test results and decisions.AI functions and classification: In Conversational Agentic Assessments, DialogueForge uses language models to simulate multi-turn dialogues in order to test chatbots: after a dialogue on the user goal, the simulation introduces disagreement; the assessment covers, for example, whether the agent recognises the goal and whether it agrees with the user despite conflicting evidence. According to the vendor, domain experts set criteria and thresholds, and teams analyse the traces.[17] [18] [19] [20] [21] [16] · Specific AI functions documented
Simulate multi-turn test dialogues with language models · Test agents with simulated user disagreement
AI evidence: [21] · According to the PDF description labelled as product information (© Calvin Risk AG 2026), Conversational Agentic Assessments are available in the Calvin Risk software; no pricing or licensing information in the sources checked, contact via demo or assessment request; no product test.
Source check: 2026-10-18
Collibra · Product: AI Command Center / trail Governance Agents · Headquarters: Belgium [22] · The contact details on Collibra's privacy policy page list Collibra Belgium BV, Picardstraat 11 B 205, 1000 Brussels, Belgium, as global headquarters; the privacy policy linked there (version of 24 September 2026) names the same company and address. According to its legal notice, the acquired trail GmbH is based in Munich (HRB 283398); no statement on hosting or owners. · Collibra Belgium BV; Collibra Inc.; Collibra AI Governance; collibra.com; trail ML; trail GmbH; trail-ml.comDocumented focus: Collibra AI Command Center, which evolved from AI Governance, keeps AI use cases, models and agents in one registry and links them with assessments aligned to the EU AI Act, NIST AI RMF and internal standards, sign-offs and data lineage. Collibra also offers data catalogue, data governance and data privacy functions. The acquired trail platform comprises an asset registry, compliance and risk management and an auditor view for internal and external auditors.AI functions and classification: The trail Governance Agents determine the applicable controls from the control library on the basis of asset and risk context, assess their implementation, map evidence from connected sources to the controls and draft policies. Every output refers to the document passages used and is only adopted after review and approval by users.[23] [24] [25] [26] [22] [27] · Specific AI functions documented
Determine applicable controls based on asset and risk context · Assess the implementation of controls · Map evidence to controls · Draft policies
AI evidence: [25] [26] · According to the vendor, the agents work as an automation layer on top of existing GRC tools or in the trail platform, deployed as SaaS, on-premises or BYOC; the acquisition announcement of 5 October 2026 gives no timeline for combining them with Collibra products. No product test.
Source check: 2026-10-18
Conformami · Product: AI Act compliance for Italian SMEs · Headquarters: Italy [28] · Digital Automations S.r.l., Venezia Mestre; P.IVA 04592170270. Conformami is described as its brand. · Digital Automations S.r.l.Documented focus: Specialist software for AI inventory, risk classification, policies, training records and compliance documentation. Includes approvals and exportable audit logs.AI functions and classification: Generative AI creates context-based drafts of policies, information notices and data protection impact assessments. RAG draws on legal sources and adds article references; users revise and approve the drafts.[29] [28] · Specific AI functions documented
Draft policies · Create information notices · Prepare data protection impact assessments
AI evidence: [29] · Commercial SaaS plans with a 30-day trial period. AI action quotas and mandatory approval workflows depend on the plan; broader standards coverage and parts of the FRIA function are on the roadmap.
Source check: 2026-10-15
Credo AI · Product: Credo AI Governance PlatformDocumented focus: Captures AI applications, models, agents and external AI products. Risks, controls, policies and requirements provide the context for governance decisions and their evidence.AI functions and classification: Credo AI documents GAIA agents that compile evidence, support risk assessments and generate governance plans. This documents the vendor's own use of AI in governance work steps, beyond the mere management of AI systems.[30] [31] · Specific AI functions documented
Compile governance evidence · Support risk assessments · Create governance plans
AI evidence: [31] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
Daiki · Product: Daiki AI Governance Platform · Headquarters: Austria [32] · DAIKI GmbHDocumented focus: Daiki offers a central register for AI applications and systems as well as workflows for risks, requirements and documentation. The platform supports building an AI management system and collaboration among the specialist departments involved. Additional testing tools address bias and security aspects of language models.AI functions and classification: Daiki documents an AI assistant for classifying AI systems into risk classes as well as for answering compliance questions and creating MDR documents. This documents AI support for compliance work in addition to governance of AI.[33] [32] [34] [35] · Specific AI functions documented
Support AI risk classification · Answer compliance questions on ISO 13485 · Draft MDR documentation
AI evidence: [34] [35] · Documented by the vendor; ISO 13485 assistant described in the eQMS product, check the respective module and licence scope; no product test.
Source check: 2026-10-14
Deeploy · Product: Deeploy · Headquarters: Netherlands [36]Documented focus: Deeploy connects the inventory of AI systems with risk classifications, controls, approvals and ongoing monitoring. The platform collects evidence and supports documentation along the life cycle. Technical functions for model monitoring and guardrails complement organisational governance and the mapping to frameworks.AI functions and classification: Deeploy uses language models and document retrieval to extract information from documents for AI vendor assessments and to prepare draft answers for assessments.[37] [36] [38] [39] · Specific AI functions documented
Extract relevant information for AI vendor assessments from documents · Generate suggested answers for assessment templates
AI evidence: [38] [39] · Technical documentation version 1.60: AI support for the AI vendor assessment; activation is required for private cloud operation. No product test.
Source check: 2026-10-14
Enzai · Product: Enzai · Headquarters: United Kingdom [40] · Enzai Technologies Limited; active entry in the official Companies House, registered office Belfast, Northern Ireland. Vendor privacy policy at https://www.enz.ai/policies/privacy-policy confirms the same legal entity.Documented focus: Brings together the capture, assessment and approval of internal and external AI applications. Requirements and evidence support collaboration between business units, legal and technology.AI functions and classification: Enzai documents workflows for the governance of AI systems, inventories and automated assessments. However, no sufficiently specific AI work step of its own in the GRC process was evidenced in the sources checked.[41] [42]Not specifically documented in the source check
Vendor pages and targeted search for proprietary AI support checked. External AI products in the sample inventory, such as Perplexity, are not Enzai AI functions.
Sources checked: [41] [42] · No specific AI function documented in the sources checked.
Source check: 2026-10-14
Fiddler AI · Product: AI Observability and SecurityDocumented focus: Combines the monitoring of models and agents with governance controls. Behaviour, actions and performance metrics provide evidence for risk and compliance work.AI functions and classification: Fiddler uses its own Centor AI models to evaluate model and agent outputs against security, data protection and accuracy requirements. This documents AI-supported control checks, not merely an inventory for the governance of AI.[43] [44] [45] · Specific AI functions documented
Detect data protection violations in inputs and outputs · Check outputs against security requirements · Assess hallucination and accuracy risks
AI evidence: [44] [45] [43] · Evaluation models and guardrails documented by the vendor; configure thresholds and integration. Limited to technical AI risk controls, not a general GRC copilot. No product test.
Source check: 2026-10-14
Holistic AI · Product: Holistic AI Governance PlatformDocumented focus: Combines AI inventory with risk analyses, tests and governance workflows. Security and bias risks as well as controls are documented along the AI life cycle.AI functions and classification: Holistic AI describes Guardian Agents as AI for overseeing other AI: they assess ongoing behaviour against policies, detect risks and can intervene or escalate when limits are breached. This specifically names an AI-supported governance work step.[46] [47] [48] [49] · Specific AI functions documented
Assess agent behaviour against policies · Detect runtime risks and classify them in context · Block or escalate policy violations
AI evidence: [47] [48] · The vendor explicitly describes Guardian Agents as a function in production use; permissions and scope of intervention depend on configuration. No product test. Not all EndLayer functions are AI: sensor and policy functions work partly deterministically.
Source check: 2026-10-14
LatticeFlow AI · Product: LatticeFlow AI Platform (Atlas, Discover, Evaluate, Secure, Govern) · Headquarters: Switzerland [50] · The Swiss UID register lists LatticeFlow AG (CHE-446.584.588) with the registered or domicile address Förrlibuckstrasse 70, 8005 Zurich, which the website also gives as its Switzerland office; no statement on hosting, owners or contracting entity. · LatticeFlow; LatticeFlow AG; LatticeFlow UK Ltd; LF AI Platform; AI Atlas; latticeflow.aiDocumented focus: LatticeFlow AI combines the AI Atlas framework library with ongoing discovery of AI endpoints and data sources as well as technical evaluations and security tests for AI applications and agents. For FINMA Guidance 08/2024, Atlas structures 13 risks and 35 controls and assigns executable evaluations to individual controls; risk scorers convert evaluation metrics into the risk levels low, medium, high or critical.AI functions and classification: Judge models (model-as-a-judge) grade the outputs of the AI system under evaluation against a rubric written by the user; dataset generators with language model calls create test data, reference answers and red-teaming prompts from documents, datasets or production traces. The documentation requires generated data to be reviewed and recommends checking judge labels against human-labelled samples.[51] [52] [53] [54] [55] [50] · Specific AI functions documented
Grade model responses with judge models · Generate test datasets and reference answers · Generate application-specific red-teaming prompts
AI evidence: [53] [54] · Offered as a fully managed SaaS solution or as a managed on-premises/private cloud installation; judge and synthesizer models are configured per task or generator, and the dataset generation example uses an OpenAI model. According to the documentation, risk scorers are in preview status; no product test.
Source check: 2026-10-18
Lumenova AI · Product: Lumenova AIDocumented focus: Combines AI risk assessments with monitoring, policy controls and audit trails. Guardrails and the tracking of actions complement the control of generative and agentic applications.AI functions and classification: Lumenova documents LLM and agent judges for evaluating AI agents before release and in operation. AI-supported evaluations are compared with human reviewers' judgements and examined on the basis of execution traces.[56] [57] · Specific AI functions documented
Validate model and agent behaviour with AI support · Evaluate production agent execution traces
AI evidence: [57] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
ModelOp · Product: Enterprise AI Command CenterDocumented focus: Central inventory and control system for AI applications and models. Life-cycle processes and governance include classic models, generative AI, agents and external offerings.AI functions and classification: ModelOp documents inventory, control workflows, model cards and monitoring of AI systems. A proprietary AI assistant for these governance tasks is not specifically documented in the sources checked.[58] [59] [60]Not specifically documented in the source check
AI as the subject of governance, automated documentation and the Governance Score are not evidence of the use of AI to perform tasks. Targeted search for a proprietary assistant without clear evidence.
Sources checked: [59] [60] · No specific AI availability can be derived from the sources checked.
Source check: 2026-10-14
Modulos · Product: Modulos AI Governance Platform · Headquarters: Switzerland [61] · The terms and conditions name Modulos AG, registered in Switzerland under CHE-233.391.866, with its registered office at Hottingerstrasse 10, 8032 Zurich; no statement on hosting or ownership. · Modulos AG; modulos.ai; Modulos AI Governance PlatformDocumented focus: Modulos maintains a register of AI systems and agents with owners and an approval review, maps each control to every framework that requires it and puts a monetary value on AI risks. The framework library includes the EU AI Act, ISO/IEC 42001, NIST AI RMF, DORA, GDPR, FINMA AI and MAS FEAT, among others; if a runtime test against production systems fails, the associated control is reopened.AI functions and classification: Agents suggest control mappings for uploaded documents, assess the readiness of controls with cited gaps, check plain-language criteria against connected sources and, in the Risk Agent (preview), estimate the annual loss per risk threat. Scout answers questions with links to the records used. Evidence is created by a person, and control owners set the control status.[62] [63] [64] [65] [66] [61] · Specific AI functions documented
Map evidence to controls · Assess control readiness with cited gaps · Run plain-language tests against sources · Quantify AI risks in monetary terms (preview) · Analyse governance data via dialogue
AI evidence: [63] [65] [66] · According to the documentation, AI features are gated by the organisation configuration and their usage is recorded per feature against a monthly quota; the Risk Agent is labelled as a preview and its estimates update on their own; no product test.
Source check: 2026-10-18
Monitaur · Product: MonitaurDocumented focus: Organises governance and evidence for statistical models, generative AI and agents. One industry focus is on insurance models for underwriting, claims handling and risk management.AI functions and classification: For selected FlightSim tests, Monitaur describes the use of language models as reviewers; results from several models are combined in order to limit individual evaluation bias.[67] [68] [69] · Specific AI functions documented
Evaluate selected AI assurance tests with language models · Aggregate evaluations from several language models for test results
AI evidence: [69] · Documented by the vendor for selected FlightSim tests; statistical and simulation-based test procedures are also described. No product test.
Source check: 2026-10-14
Naaia · Product: Naaia for AI · Headquarters: France [70] · The legal notice names naaia, a société par actions simplifiée, with registered office at 6 Impasse de la Briqueterie, 78430 Louveciennes, Versailles Trade and Companies Register 913 352 688; no statement on hosting or owners. · naaia SAS; naaia.aiDocumented focus: Naaia for AI maintains a central registry of AI systems, models and components, determines the operator role and regulatory risk level for each AI asset and integrates the organisation's internal risk methodologies. Requirements from the EU AI Act, ISO/IEC 42001, NIST AI RMF, the Cyber Resilience Act and other frameworks are converted into executable actions, supplemented by automated remediation workflows and audit-ready reports. A portal for post-market monitoring involves suppliers, distributors and users.AI functions and classification: According to the vendor, the compliance engine uses structured templates and AI-powered justification agents to generate audit-ready documentation; the agents supplement the documentation of each compliance action. The vendor pages checked do not describe how the agents work or who reviews and approves the generated justifications.[71] [72] [73] [74] [70] [75] · Specific AI functions documented
Draft compliance documents · Justify compliance actions
AI evidence: [72] [73] · According to the vendor, can be delivered as SaaS or on-premise, demo on request; licensing scope of the AI justification agents not stated on the pages checked, vendor pages in French and English, no product test.
Source check: 2026-10-18
QuantPi · Product: QuantPi · Headquarters: Germany [76] · QuantPi GmbH, Saarbrücken, Germany; HRB 106305.Documented focus: Specialises in the technical validation of AI systems across their life cycle. Quality and risk checks provide evidence for approvals and ongoing controls.AI functions and classification: QuantPi uses AI tools such as CLIP and LLMs for missing annotations in test data and AI evaluators for checking model outputs. The platform describes calibration of the evaluators against reference data and taking their error rates into account.[77] [78] · Specific AI functions documented
AI-supported annotation of test data · Calibrated AI evaluation of model outputs
AI evidence: [78] · Documented by the vendor; no product test.
Source check: 2026-10-14
Saidot · Product: Saidot · Headquarters: Finland [79] · Saidot Ltd., Helsinki, Finland; provider of the Saidot platform and contractual data processor according to the privacy policy.Documented focus: Combines an AI inventory with a knowledge base on risks, controls, policies and external AI products. Risks, measures and responsibilities can be documented across the life cycle.AI functions and classification: Saidot's AI assistant fills in EU AI Act classification questions from system data with labelled suggestions that can be overwritten. Via MCP, connected assistants can additionally prepare risk assessments, treatment plans and governance reports.[80] [81] [82] [83] · Specific AI functions documented
Pre-fill classification questions from system data · Prepare risk analyses and treatment plans · Create governance and transparency reports
AI evidence: [82] [83] · Classification assistant documented by the vendor; MCP workflow skills as a functional preview on request, with customer-specific adaptation and human review. No product test.
Source check: 2026-10-14
Trusenta · Product: TRUSENTA.IO / Smart Voice · Headquarters: Australia [84] · Trusenta Pty Ltd according to the contract terms; Australian business orientation and Queensland jurisdiction. Privacy policy confirms the same legal entity. · Trusenta Pty Ltd; TRUSENTA.IODocumented focus: Modular platform for AI inventory, risk assessments, control evidence, compliance gaps and governance assessments; consulting services are also offered.AI functions and classification: The Smart Voice module conducts structured stakeholder interviews with AI voice agents. It transcribes conversations, identifies speakers and condenses statements into topics, decisions and actions for governance assessments.[85] [86] [87] [84] · Specific AI functions documented
Conduct governance interviews in a structured way · Transcribe assessment conversations · Consolidate findings and actions from interviews
AI evidence: [86] · Offered as a named module of the TRUSENTA.IO platform with a demo. Contractual scope and combination with consulting are to be clarified individually.
Source check: 2026-10-15
Truyo · Product: Truyo AI Governance Platform / Truyo Platform · Headquarters: USA [88] · The privacy policy names IntraEdge, Inc. as the provider of the Truyo Platform, gives its postal address as 5660 W. Chandler Blvd., Suite 1, Chandler, AZ 85226, and places IntraEdge and its operating company in the USA; no statement on hosting. · IntraEdge, Inc.; Truyo, an IntraEdge Company; Truyo Platform; truyo.comDocumented focus: Truyo records an organisation's AI usage in an AI inventory via website, source code and content scans, employee surveys and vendor assessments. Assessment responses form a risk register; AI risks are classified as unacceptable, high, medium or low and treated via workflows. The platform also covers the handling of data subject requests, consent and preference management and the de-identification of data sets.AI functions and classification: For the AI inventory, Truyo scans content, according to the release notes for example documents in Salesforce and HubSpot, for indications of generative AI use; version 7.9.0 of 23 December 2024 names the default model GPT-2-small, the option Truyo Cl and a confidence level for this. Detected instances are isolated as AI use cases and can be reviewed by the AI governance board.[89] [90] [91] [92] [88] [93] · Specific AI functions documented
Detect AI-generated content in documents · Submit detected instances as AI use cases for governance review
AI evidence: [89] [91] [92] · According to the release notes, controllable via the AI governance configuration page (confidence level, model selection, enabling and disabling AI usage); the release notes list SharePoint scans only as an announced feature up to version 8.5.0; demo and pricing information on request; no product test.
Source check: 2026-10-18
UNAIT · Product: UNAIT Compliance / Risikotool · Headquarters: Germany [94] · UNAIT GmbH, Berlin, Amtsgericht Charlottenburg HRB 290532 B. · UNAIT GmbH; UNAIT Risikotool; UNAIT ComplianceDocumented focus: Platform for AI inventory, risk classification, approvals and documentation under the EU AI Act. Assessments and associated evidence can be exported as an audit report.AI functions and classification: The AI assistant explains questions in the assessment questionnaire and gives guidance on classification. The actual risk classification explicitly follows fixed decision logic; it is not counted as an AI decision.[95] [94] · Specific AI functions documented
Explain assessment questions · Support the classification of AI applications
AI evidence: [95] · AI assistant described as a new product function; full version can be tested on request. GWDG AI models are named as the basis. No independent legal assessment by the assistant.
Source check: 2026-10-15
Validaitor · Product: Trustworthy AI Platform · Headquarters: Germany [96] · The legal notice names Validaitor GmbH, Roonstr. 23a, 76137 Karlsruhe, Germany (Mannheim Local Court, HRB 750606); no statement on hosting or owners. · Validaitor GmbH; validaitor.com; Validaitor Trustworthy AI Platform; nicht ValidMindDocumented focus: Validaitor combines an AI inventory with automated discovery of AI agents, models and embedded AI functions, AI risk management with a risk library drawing on the NIST AI RMF, the MIT AI Risk Database and its own scenarios, and controls for the EU AI Act and ISO/IEC 42001. Tests check language model applications for fairness, robustness, privacy and security, among other things; auditors see results and compliance documents with immutable audit trails.AI functions and classification: According to the product documentation, Validaitor's own referee models assess free-text responses of tested language model applications for toxicity, fairness and truthfulness, for example; human confirmation is not described, but human assessment can be selected. For reference datasets, an agent derives a generation plan from system context and documents, which users can review against preview entries before the full run.[97] [98] [99] [100] [101] [96] · Specific AI functions documented
Check model responses with evaluator models · Generate test datasets from system context
AI evidence: [100] · Free registration after a check of the company and business email address, currently only for organisations; operation described as SaaS or on-premises. The documentation is marked as a work in progress, and custom example data and instructions for reference datasets as “Coming Soon”; no product test.
Source check: 2026-10-18
ValidMind · Product: ValidMindDocumented focus: Combines model testing, independent validation, documentation and audit trails. The offering is aimed particularly at regulated companies such as banks and insurers, as well as generative and agentic AI.AI functions and classification: ValidMind uses language models to create test descriptions and summaries for model validation documentation. The drafts support traceable model risk and audit documentation.[102] · Specific AI functions documented
Draft descriptions of model validation tests · Summarise validation results for audit documentation
AI evidence: [102] · Documented by the vendor; not tested in practice.
Source check: 2026-10-14
VerifyWise · Product: VerifyWiseDocumented focus: Brings together AI inventory, supplier oversight, risk registers, frameworks and policies. Self-hosting and a cloud offering support structured AI governance.AI functions and classification: The VerifyWise AI Advisor queries governance data on risks, suppliers, incidents and policies in natural language and generates summaries and analyses. Aids for policy drafts and gap analyses are also documented.[103] [104] [105] · Specific AI functions documented
Analyse governance data via dialogue · Create risk reports and summaries · Support policy drafts and gap analyses
AI evidence: [105] · Documented by the vendor; own API key for Anthropic, OpenAI or OpenRouter and configuration in the organisation account required. No product test.
Source check: 2026-10-14
Vidimus · Product: Vidimus AI Compliance Testing · Headquarters: France [106] · VIDIMUS SASU, RCS Nanterre, SIREN 106772619; Colombes, France. · VIDIMUS SASUDocumented focus: Testing platform for AI agents with regulatory tests, traceable results and human approval.AI functions and classification: An LLM evaluates responses of tested AI systems against defined requirements and cites relevant passages. Critical errors are checked with a second model; borderline cases are decided by humans.[107] [108] [106] · Specific AI functions documented
Check AI responses for compliance · Create test evidence · Submit critical test results for review
AI evidence: [107] [108] · Paid two-week pilot and annual offering; not an independent certification body.
Source check: 2026-10-15
Yields · Product: Model Risk Management Software / AI Governance Software · Headquarters: Belgium [109] · The privacy policy names Yields NV, Oktrooiplein 1, bus 201, 9000 Ghent, Belgium; company number BE 0674.499.495, RPR Ghent. Headquarters documented; no statement on hosting or owners. · Yields NV; yields.ioDocumented focus: Yields combines a central inventory of models and AI systems with risk tiering, validation and lifecycle workflows, ongoing performance monitoring and template-based generation of development documentation as well as validation and monitoring reports. The AI governance product maps use cases to a selected regulatory framework such as the EU AI Act and shows risk and compliance scores together with items that are still missing.AI functions and classification: An AI assistant builds the inventory of AI use cases from uploaded documentation; the product page does not describe review or approval steps for this. Via the MCP server, users with their own AI client query model profiles, findings and tasks, create findings and tasks and update statuses, each with their own permissions and logged under their name.[110] [111] [112] [113] [114] [109] · Specific AI functions documented
Build the AI inventory from uploaded documentation · Analyse governance data via dialogue · Create and update findings and tasks via dialogue
AI evidence: [111] [112] [110] · According to the vendor, the MCP server is included in the Yields platform and requires the user's own AI client. A risk management agent with a conversational interface is in development according to the announcement of 17 July 2026; no product test.
Source check: 2026-10-18
Publisher's own offering

T-NEX as publisher.

Register entry: T-NEX Banking Platform (DE, AI evidenced)

In the Banking Platform's application management, AI applications sit in the same inventory as all other applications and stay linked to processes, contracts and risks. When an application is recorded, the AI proposes a classification under the EU AI Act, and the responsible person confirms it. The strategy module sets out principles and risk limits for the use of AI. For the AI in the T-NEX modules themselves, model access, permitted data and what the assistants may do are configured centrally. The AI triage in T-NEX Fraud Detection records the model and prompt version, and an analyst decision that departs from the triage is kept in the audit trail with its rationale.

Register entry of the T-NEX Banking Platform (data as of 18 October 2026) · T-NEX Banking Platform · T-NEX Fraud Detection

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. 2021.AI: headquarters evidence checked 18.10.2026
  2. 2021.AI: main source checked 18.10.2026
  3. 2021.AI: vendor source, AI evidence checked 18.10.2026
  4. 2021.AI: vendor source, AI evidence checked 18.10.2026
  5. 2021.AI: vendor source checked 18.10.2026
  6. 2021.AI: vendor source checked 18.10.2026
  7. 2021.AI: vendor source checked 18.10.2026
  8. Actify: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  9. Actify: main source, AI evidence checked 15.10.2026
  10. ai.res: vendor source, headquarters evidence checked 15.10.2026
  11. ai.res: main source, AI evidence checked 15.10.2026
  12. Asenion: main source checked 14.10.2026
  13. Asenion: vendor source checked 14.10.2026
  14. Asenion: vendor source, AI evidence checked 14.10.2026
  15. Asenion: vendor source, AI evidence checked 14.10.2026
  16. Calvin Risk: vendor source, headquarters evidence checked 18.10.2026
  17. Calvin Risk: main source checked 18.10.2026
  18. Calvin Risk: vendor source checked 18.10.2026
  19. Calvin Risk: vendor source checked 18.10.2026
  20. Calvin Risk: vendor source checked 18.10.2026
  21. Calvin Risk: vendor source, AI evidence checked 18.10.2026
  22. Collibra: vendor source, headquarters evidence checked 18.10.2026
  23. Collibra: main source checked 18.10.2026
  24. Collibra: vendor source checked 18.10.2026
  25. Collibra: vendor source, AI evidence checked 18.10.2026
  26. Collibra: vendor source, AI evidence checked 18.10.2026
  27. Collibra: vendor source checked 18.10.2026
  28. Conformami: vendor source, headquarters evidence checked 15.10.2026
  29. Conformami: main source, AI evidence checked 15.10.2026
  30. Credo AI: main source checked 14.10.2026
  31. Credo AI: vendor source, AI evidence checked 14.10.2026
  32. Daiki: vendor source, headquarters evidence checked 14.10.2026
  33. Daiki: main source checked 14.10.2026
  34. Daiki: vendor source, AI evidence checked 14.10.2026
  35. Daiki: vendor source, AI evidence checked 14.10.2026
  36. Deeploy: vendor source, headquarters evidence checked 14.10.2026
  37. Deeploy: main source checked 14.10.2026
  38. Deeploy: vendor source, AI evidence checked 14.10.2026
  39. Deeploy: vendor source, AI evidence checked 14.10.2026
  40. Enzai: headquarters evidence checked 14.10.2026
  41. Enzai: main source checked 14.10.2026
  42. Enzai: vendor source checked 14.10.2026
  43. Fiddler AI: main source, AI evidence checked 14.10.2026
  44. Fiddler AI: vendor source, AI evidence checked 14.10.2026
  45. Fiddler AI: vendor source, AI evidence checked 14.10.2026
  46. Holistic AI: main source checked 14.10.2026
  47. Holistic AI: vendor source, AI evidence checked 14.10.2026
  48. Holistic AI: vendor source, AI evidence checked 14.10.2026
  49. Holistic AI: vendor source checked 14.10.2026
  50. LatticeFlow AI: vendor source, headquarters evidence checked 18.10.2026
  51. LatticeFlow AI: main source checked 18.10.2026
  52. LatticeFlow AI: vendor source checked 18.10.2026
  53. LatticeFlow AI: vendor source, AI evidence checked 18.10.2026
  54. LatticeFlow AI: vendor source, AI evidence checked 18.10.2026
  55. LatticeFlow AI: vendor source checked 18.10.2026
  56. Lumenova AI: main source checked 14.10.2026
  57. Lumenova AI: vendor source, AI evidence checked 14.10.2026
  58. ModelOp: main source checked 14.10.2026
  59. ModelOp: vendor source checked 14.10.2026
  60. ModelOp: vendor source checked 14.10.2026
  61. Modulos: vendor source, headquarters evidence checked 18.10.2026
  62. Modulos: main source checked 18.10.2026
  63. Modulos: vendor source, AI evidence checked 18.10.2026
  64. Modulos: vendor source checked 18.10.2026
  65. Modulos: vendor source, AI evidence checked 18.10.2026
  66. Modulos: vendor source, AI evidence checked 18.10.2026
  67. Monitaur: main source checked 14.10.2026
  68. Monitaur: vendor source checked 14.10.2026
  69. Monitaur: vendor source, AI evidence checked 14.10.2026
  70. Naaia: vendor source, headquarters evidence checked 18.10.2026
  71. Naaia: main source checked 18.10.2026
  72. Naaia: vendor source, AI evidence checked 18.10.2026
  73. Naaia: vendor source, AI evidence checked 18.10.2026
  74. Naaia: vendor source checked 18.10.2026
  75. Naaia: vendor source checked 18.10.2026
  76. QuantPi: headquarters evidence checked 14.10.2026
  77. QuantPi: main source checked 14.10.2026
  78. QuantPi: vendor source, AI evidence checked 14.10.2026
  79. Saidot: headquarters evidence checked 14.10.2026
  80. Saidot: main source checked 14.10.2026
  81. Saidot: vendor source checked 14.10.2026
  82. Saidot: vendor source, AI evidence checked 14.10.2026
  83. Saidot: vendor source, AI evidence checked 14.10.2026
  84. Trusenta: vendor source, headquarters evidence checked 15.10.2026
  85. Trusenta: main source checked 15.10.2026
  86. Trusenta: vendor source, AI evidence checked 15.10.2026
  87. Trusenta: vendor source checked 15.10.2026
  88. Truyo: vendor source, headquarters evidence checked 18.10.2026
  89. Truyo: main source, AI evidence checked 18.10.2026
  90. Truyo: vendor source checked 18.10.2026
  91. Truyo: vendor source, AI evidence checked 18.10.2026
  92. Truyo: vendor source, AI evidence checked 18.10.2026
  93. Truyo: vendor source checked 18.10.2026
  94. UNAIT: vendor source, headquarters evidence checked 15.10.2026
  95. UNAIT: main source, AI evidence checked 15.10.2026
  96. Validaitor: vendor source, headquarters evidence checked 18.10.2026
  97. Validaitor: main source checked 18.10.2026
  98. Validaitor: vendor source checked 18.10.2026
  99. Validaitor: vendor source checked 18.10.2026
  100. Validaitor: vendor source, AI evidence checked 18.10.2026
  101. Validaitor: vendor source checked 18.10.2026
  102. ValidMind: main source, AI evidence checked 14.10.2026
  103. VerifyWise: main source checked 14.10.2026
  104. VerifyWise: vendor source checked 14.10.2026
  105. VerifyWise: vendor source, AI evidence checked 14.10.2026
  106. Vidimus: vendor source, headquarters evidence checked 15.10.2026
  107. Vidimus: main source, AI evidence checked 15.10.2026
  108. Vidimus: vendor source, AI evidence checked 15.10.2026
  109. Yields: vendor source, headquarters evidence checked 18.10.2026
  110. Yields: main source, AI evidence checked 18.10.2026
  111. Yields: vendor source, AI evidence checked 18.10.2026
  112. Yields: vendor source, AI evidence checked 18.10.2026
  113. Yields: vendor source checked 18.10.2026
  114. Yields: vendor source checked 18.10.2026
Back to top