{
 "sym": "Ai",
 "updated": "2026-08-06",
 "verdict": "Classify before you buy: the free EU AI Act Compliance Checker (Future of Life Institute) is the winner for the element's actual job \u2014 a 10-minute readiness scan that tells you whether you're a provider or deployer and which tier you land in, on the site 150k people a month already use. Most AI startups come out limited-risk, owing chatbot disclosure and content marking (Art 50) plus AI literacy \u2014 not a conformity assessment. Vanta wins once you want the checklist automated inside the compliance stack you already run for SOC 2/ISO 27001; Credo AI when enterprise procurement demands a governance platform with a Forrester-Leader logo; Holistic AI when you need risk testing and audit-grade verification (the canon's eval.qa-class audit); Trail when you want an EU-native, SME-priced platform with ISO 42001 built in. The Digital Omnibus (in force Jul 27, 2026) moved high-risk deadlines to Dec 2027/Aug 2028 \u2014 which makes classification cheap and panic-buying premature.",
 "top5": [
  {
   "rank": 1,
   "name": "EU AI Act Compliance Checker + AI Act Explorer",
   "maker": "Future of Life Institute (artificialintelligenceact.eu)",
   "url": "https://artificialintelligenceact.eu/assessment/eu-ai-act-compliance-checker/",
   "docs": "https://artificialintelligenceact.eu/",
   "pricing": "Free",
   "best_for": "The first hour of AI-Act work: classify your system (prohibited / high-risk / limited / minimal), learn your role (provider vs deployer), and read the actual articles in a searchable explorer.",
   "why": "The de-facto standard readiness scan: an interactive questionnaire that maps your product to risk tier and obligations, on the most-used AI Act resource on the internet (150k+ users/month, Aug 2026). Sits beside a full-text Explorer, implementation timeline, small-business guide, and a practical Article 50 transparency guide (May 14, 2026). The European Commission's own AI Act Service Desk now offers an official checker \u2014 but FLI's remains the fastest and most battle-tested entry point.",
   "watch": "Not legal advice and not affiliated with the EU; checker last updated Jul 3, 2025, and the site's timeline page had not yet fully absorbed the Jul 2026 Digital Omnibus date changes when we checked (Aug 2026) \u2014 cross-check deadlines against the Commission's page.",
   "evidence": [
    {
     "stat": "150k+ users/month on artificialintelligenceact.eu (site, Aug 2026)",
     "src": "https://artificialintelligenceact.eu/"
    },
    {
     "stat": "Checker updated Jul 3, 2025: GPAI systemic-risk questions, provider/deployer role logic",
     "src": "https://artificialintelligenceact.eu/assessment/eu-ai-act-compliance-checker/"
    },
    {
     "stat": "Official alternative now live: Commission AI Act Service Desk with Explorer, Compliance Checker, and direct expert Q&A (2026)",
     "src": "https://ai-act-service-desk.ec.europa.eu/en"
    }
   ],
   "tile_note": "the free readiness scan",
   "tile_name": "EU AI Act Checker"
  },
  {
   "rank": 2,
   "name": "Vanta \u2014 EU AI Act framework",
   "maker": "Vanta",
   "url": "https://www.vanta.com/products/eu-ai-act",
   "docs": "https://www.vanta.com/collection/ai",
   "pricing": "Quote-based \u00b7 4 tiers (Essentials / Plus / Professional / Enterprise), AI-Act framework as add-on",
   "best_for": "Startups already running Vanta for SOC 2/ISO 27001 that now need the AI Act turned into tracked controls, policies, and evidence \u2014 without a second GRC vendor.",
   "why": "Converts the regulation into 150+ controls and 16 policies with guided risk classification (provider vs deployer), post-market monitoring, and incident tracking, wired into 400+ integrations you've likely already connected. Cross-framework mapping reuses ISO 42001 / NIST AI RMF evidence \u2014 Vanta pegs the ISO 42001 overlap at roughly 50% of AI-Act requirements \u2014 so the marginal cost of adding the AI Act to an existing compliance program is the lowest in the field.",
   "watch": "No public pricing \u2014 everything is a sales conversation. A GRC checklist is not a legal determination: high-risk classification edge cases still need counsel. Depth of AI-specific risk testing trails the dedicated governance platforms (Credo, Holistic).",
   "evidence": [
    {
     "stat": "150+ controls, 16 policies, adaptive risk-classification scoping (vendor page, Aug 2026)",
     "src": "https://www.vanta.com/products/eu-ai-act"
    },
    {
     "stat": "ISO 42001 covers ~50% of EU AI Act requirements \u2014 evidence reuse via framework mapping (vendor claim, Aug 2026)",
     "src": "https://www.vanta.com/products/eu-ai-act"
    },
    {
     "stat": "Vanta customers report ~50% faster audit completion; 400+ integrations (vendor claims, Aug 2026)",
     "src": "https://www.vanta.com/products/eu-ai-act"
    }
   ],
   "tile_note": "ai act in your grc"
  },
  {
   "rank": 3,
   "name": "Credo AI",
   "maker": "Credo AI",
   "url": "https://www.credo.ai/",
   "docs": "https://www.credo.ai/blog",
   "pricing": "Enterprise quote-based",
   "best_for": "Scale-ups and enterprises that need a full AI governance platform \u2014 inventory, shadow-AI discovery, policy packs, audit-ready evidence \u2014 with the analyst validation procurement asks for.",
   "why": "The name-brand of AI governance: Leader in the Forrester Wave for AI Governance Solutions (Q3 2025), #6 in Applied AI on Fast Company's Most Innovative Companies 2026, with Mastercard, Autodesk, and Databricks as reference customers. Pre-built EU AI Act policy packs alongside NIST AI RMF and ISO 42001; one customer credits it with accelerating AI-Act compliance '10x'.",
   "watch": "Enterprise product at enterprise prices \u2014 overkill for a limited-risk seed-stage deployer. Its own framing stat (60% of enterprises scaling AI, 4% governing it) cuts both ways: the category's urgency is still ahead of its adoption.",
   "evidence": [
    {
     "stat": "Leader, Forrester Wave: AI Governance Solutions, Q3 2025",
     "src": "https://www.credo.ai/"
    },
    {
     "stat": "#6 Applied AI, Fast Company World's Most Innovative Companies 2026",
     "src": "https://www.credo.ai/"
    },
    {
     "stat": "Customers include Mastercard, Autodesk, Databricks, McKinsey (vendor site, Aug 2026)",
     "src": "https://www.credo.ai/"
    }
   ],
   "tile_note": "enterprise governance leader"
  },
  {
   "rank": 4,
   "name": "Holistic AI",
   "maker": "Holistic AI",
   "url": "https://www.holisticai.com/",
   "docs": "https://www.holisticai.com/papers",
   "pricing": "Enterprise quote-based",
   "best_for": "Teams that need verification, not just tracking \u2014 40+ risk tests (bias, safety, security, performance) mapped to AI-Act requirements, plus AI discovery across cloud and repos.",
   "why": "The closest thing to the canon's eval.qa-class audit as a product: automated control mapping and gap analysis for the EU AI Act with quantitative risk testing behind it, a lineage in independent bias audits (NYC Local Law 144), and top marks where it counts \u2014 #1 for the AI Risk and Compliance use case in Gartner's evaluation and a place in the inaugural Gartner Magic Quadrant for AI Governance Platforms (Jul 2026).",
   "watch": "Quote-only pricing and an enterprise sales motion; startup fit is limited. Gartner positioning is cited from the vendor's own announcement \u2014 the full MQ is paywalled.",
   "evidence": [
    {
     "stat": "#1 for AI Risk and Compliance use case (Gartner critical-capabilities evaluation, per vendor, 2026)",
     "src": "https://www.holisticai.com/"
    },
    {
     "stat": "Recognized in first-ever Gartner Magic Quadrant for AI Governance Platforms (Jul 2026)",
     "src": "https://www.holisticai.com/"
    },
    {
     "stat": "40+ specialized risk tests; AI discovery across cloud, repos, SaaS (vendor site, Aug 2026)",
     "src": "https://www.holisticai.com/"
    }
   ],
   "tile_note": "audits and risk testing"
  },
  {
   "rank": 5,
   "name": "Trail",
   "maker": "trail (Munich)",
   "url": "https://www.trail-ml.com/",
   "docs": "https://www.trail-ml.com/eu-ai-act",
   "pricing": "Quote-based \u00b7 SaaS (EU data centers) or on-prem",
   "best_for": "EU-based startups and Mittelstand teams that want an EU-native platform: AI registry, risk libraries, automated technical documentation, and ISO 42001 certification support.",
   "why": "Purpose-built for exactly this element by a German team: EU AI Act self-assessment checker, risk libraries mapped to project characteristics, auto-generated compliance documentation, and GRC agents that work inside Confluence/Jira/GitHub rather than replacing them. Proven in regulated European organizations \u2014 Deutsche Bahn, PwC, Sparda-Bank, Atruvia \u2014 with a claimed 4x faster AI deployment for governed projects.",
   "watch": "Small vendor next to OneTrust/Credo \u2014 diligence the roadmap; funding undisclosed. The 4x deployment claim is vendor-reported and unaudited.",
   "evidence": [
    {
     "stat": "Customers: Deutsche Bahn, PwC, Sparda-Bank, Atruvia, Valantic (vendor site, Aug 2026)",
     "src": "https://www.trail-ml.com/"
    },
    {
     "stat": "EU AI Act checker + ISO/IEC 42001 support; EU-hosted SaaS or on-prem (Aug 2026)",
     "src": "https://www.trail-ml.com/"
    },
    {
     "stat": "Claimed 4x faster deployment of governed AI solutions (vendor claim, Aug 2026)",
     "src": "https://www.trail-ml.com/"
    }
   ],
   "tile_note": "eu-native, sme-friendly"
  }
 ],
 "matrix": {
  "cols": [
   "What it is",
   "Risk classification",
   "Full framework + evidence",
   "ISO 42001 crosswalk",
   "Pricing",
   "Best size",
   "Analyst recognition"
  ],
  "rows": [
   [
    "FLI Compliance Checker",
    "Free questionnaire + full-text explorer",
    "Yes (10 min)",
    "No",
    "No",
    "Free",
    "Anyone",
    "150k users/mo (de-facto standard)"
   ],
   [
    "Vanta (EU AI Act)",
    "GRC module in compliance platform",
    "Yes (adaptive scoping)",
    "Yes \u2014 150+ controls, 16 policies",
    "Yes (~50% overlap reuse)",
    "Quote",
    "Startup \u2192 mid-market",
    "\u2014"
   ],
   [
    "Credo AI",
    "AI governance platform",
    "Yes",
    "Yes \u2014 policy packs",
    "Yes",
    "Quote",
    "Enterprise",
    "Forrester Wave Leader Q3 2025"
   ],
   [
    "Holistic AI",
    "Governance + risk testing platform",
    "Yes",
    "Yes + 40+ risk tests",
    "Yes",
    "Quote",
    "Enterprise",
    "Gartner MQ 2026; #1 risk/compliance use case"
   ],
   [
    "Trail",
    "EU-native governance platform",
    "Yes (self-assessment)",
    "Yes \u2014 auto documentation",
    "Yes (cert support)",
    "Quote",
    "SME / startup",
    "\u2014"
   ],
   [
    "OneTrust AI Governance",
    "Governance module of privacy suite",
    "Yes (auto risk tiering)",
    "Yes \u2014 templates + runtime guardrails",
    "Yes",
    "Quote",
    "Enterprise",
    "Gartner MQ 2026 Visionary"
   ],
   [
    "Saidot",
    "Governance knowledge-graph platform",
    "Yes (AI Act Classifier)",
    "Yes \u2014 620+ controls, API-first",
    "Yes",
    "Quote",
    "Mid \u2192 enterprise",
    "Gartner MQ 2026"
   ],
   [
    "Modulos",
    "ISO-42001-certified governance platform",
    "Yes",
    "Yes \u2014 894 controls / 21 frameworks",
    "Yes (certified itself)",
    "Quote",
    "Mid-market",
    "Gartner MQ 2026"
   ]
  ]
 },
 "rules": [
  {
   "if": "You just need to know your tier (and whether the panic applies to you at all)",
   "then": "Run the free FLI Compliance Checker, then confirm against the Commission's AI Act Service Desk. Most AI SaaS lands limited-risk: Art 50 disclosure + content marking + AI literacy, not a conformity assessment."
  },
  {
   "if": "You already run Vanta (or any GRC tool) for SOC 2/ISO 27001",
   "then": "Add the EU AI Act framework there \u2014 ISO 42001 evidence reuse (~50% overlap per Vanta) makes it the cheapest marginal path. Note Drata had no dedicated AI-Act framework as of Aug 2026, only ISO 42001."
  },
  {
   "if": "You classify as high-risk (Annex III) or expect to",
   "then": "The deadline moved to Dec 2, 2027 (Omnibus, in force Jul 27, 2026) \u2014 but conformity assessment plus ISO 42001 realistically takes 12\u201318 months. Start the registry and technical documentation now on Trail, Credo, or Holistic; don't bank on a second deferral."
  },
  {
   "if": "You train or heavily fine-tune general-purpose models",
   "then": "GPAI obligations have applied since Aug 2, 2025 and the Commission's fining powers (Art 101, up to 3% of global turnover) went live Aug 2, 2026 \u2014 the GPAI Code of Practice plus specialist counsel, not a checklist tool, is your path."
  },
  {
   "if": "Enterprise buyers are sending AI-governance questionnaires before they'll sign",
   "then": "That's a sales problem wearing a compliance hat: Credo AI or Holistic AI for the platform + analyst logos, or an ISO 42001 certification via your GRC tool as the exportable proof."
  }
 ],
 "field": [
  {
   "name": "AI Act Service Desk",
   "maker": "European Commission",
   "note": "The official answer: AI Act Explorer, Compliance Checker, and direct multilingual Q&A with AI Office-backed staff \u2014 the authoritative readiness scan, free",
   "url": "https://ai-act-service-desk.ec.europa.eu/en",
   "oss": false,
   "entry": "free",
   "status": "active"
  },
  {
   "name": "OneTrust AI Governance",
   "maker": "OneTrust",
   "note": "AI governance module on the privacy-suite installed base; EU AI Act templates + runtime guardrails; Visionary in the inaugural Gartner MQ (2026)",
   "url": "https://www.onetrust.com/products/ai-governance/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Saidot",
   "maker": "Saidot (Helsinki)",
   "note": "Governance knowledge graph (260+ risks, 620+ controls, 110+ policies), EU AI Act Classifier, MCP-based agentic workflows; Gartner MQ 2026",
   "url": "https://www.saidot.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Naaia",
   "maker": "Naaia (Paris)",
   "note": "Europe's first ISO 42001-built AI management system; \u20ac6M Series A (2026); Bouygues, Idemia, \u00cele-de-France region",
   "url": "https://naaia.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Modulos",
   "maker": "Modulos (Zurich)",
   "note": "ISO 42001-certified platform mapping 894 controls across 21 frameworks (48% serve 2+); EU AI Pact signatory; Gartner MQ 2026",
   "url": "https://www.modulos.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Trustible",
   "maker": "Trustible",
   "note": "AI governance for regulated enterprises \u2014 intake/triage, EU AI Act + NIST + ISO 42001 mapping; Leidos, Molson Coors, Kroll",
   "url": "https://www.trustible.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Lumenova AI",
   "maker": "Lumenova",
   "note": "Governance + evals + guardrails hybrid with EU AI Act mapping \u2014 overlaps elements Ev and Gd",
   "url": "https://www.lumenova.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Optro (ex-FairNow)",
   "maker": "Optro",
   "note": "fairnow.ai now redirects to optro.ai (Aug 2026); 25+ frameworks incl. EU AI Act and ISO 42001, claims 50%+ of Fortune 500",
   "url": "https://optro.ai/product/ai-governance",
   "oss": false,
   "entry": "quote",
   "status": "renamed"
  },
  {
   "name": "Fairly AI",
   "maker": "Fairly AI",
   "note": "AI readiness planner + expert-led validation engine; EU-AI-Act positioning thin on current site \u2014 verify fit before shortlisting",
   "url": "https://www.fairly.ai/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "anch.AI",
   "maker": "anch.AI (Stockholm)",
   "note": "Ethical-AI screening pioneer (methodology since 2016, ~200 use cases assessed); site live but undated \u2014 momentum unclear in 2026",
   "url": "https://anch.ai/",
   "oss": false,
   "entry": "quote",
   "status": "fading"
  },
  {
   "name": "Enzai",
   "maker": "Enzai (Belfast)",
   "note": "Early AI-governance startup; enzai.co no longer resolves (Aug 2026) \u2014 presumed wound down or absorbed; re-verify before citing",
   "url": "https://www.enzai.co/",
   "oss": false,
   "entry": "\u2014",
   "status": "dead"
  },
  {
   "name": "IBM watsonx.governance",
   "maker": "IBM",
   "note": "Incumbent enterprise AI governance with EU AI Act accelerators; the default inside IBM-standard shops \u2014 not startup-shaped (not independently re-verified this cycle)",
   "url": "https://www.ibm.com/products/watsonx-governance",
   "oss": false,
   "entry": "SaaS per-model/usage",
   "status": "active"
  },
  {
   "name": "Vanta ISO 42001",
   "maker": "Vanta",
   "note": "The certification route: ISO 42001 as exportable AI-governance proof, ~50% overlapping AI-Act requirements per Vanta's mapping",
   "url": "https://www.vanta.com/products/eu-ai-act",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "Drata",
   "maker": "Drata",
   "note": "Supports ISO 42001 and AI-agent governance, but no dedicated EU AI Act framework page found (Aug 2026) \u2014 general compliance automation belongs to element Cm",
   "url": "https://drata.com/",
   "oss": false,
   "entry": "quote",
   "status": "active"
  },
  {
   "name": "AI Watch: Global Regulatory Tracker",
   "maker": "White & Case",
   "note": "Free law-firm navigator covering 38+ jurisdictions \u2014 the multi-jurisdiction context layer around the AI Act",
   "url": "https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker",
   "oss": false,
   "entry": "free",
   "status": "active"
  },
  {
   "name": "IAPP AI Governance Center / AIGP",
   "maker": "IAPP",
   "note": "The people-side of readiness: AIGP certification for AI-governance professionals + conference/resource hub",
   "url": "https://iapp.org/certify/aigp/",
   "oss": false,
   "entry": "exam + training fees",
   "status": "active"
  },
  {
   "name": "Covington Inside Privacy (AI)",
   "maker": "Covington & Burling",
   "note": "Free, fast law-firm analysis \u2014 their May 18, 2026 Omnibus breakdown is the clearest public account of the final amendments",
   "url": "https://www.insideprivacy.com/category/artificial-intelligence/",
   "oss": false,
   "entry": "free",
   "status": "active"
  }
 ],
 "signals": [
  {
   "fact": "Digital Omnibus AI amendments in force Jul 27, 2026: Annex III high-risk deferred Aug 2026 \u2192 Dec 2, 2027; Annex I embedded high-risk Aug 2027 \u2192 Aug 2, 2028; Art 50(2) marking for existing systems \u2192 Dec 2, 2026 (new systems comply at market entry); sandboxes \u2192 Aug 2027",
   "src": "https://www.insideprivacy.com/artificial-intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new-prohibitions/"
  },
  {
   "fact": "Aug 2, 2026 still matters: general application date, national enforcement live, and Commission GPAI fining powers (Art 101, up to 3% global turnover) begin \u2014 GPAI obligations themselves applied Aug 2, 2025 (Art 113)",
   "src": "https://artificialintelligenceact.eu/article/113/"
  },
  {
   "fact": "AI governance software market: $0.89B (2024) \u2192 $5.78B (2029), 45.3% CAGR (MarketsandMarkets)",
   "src": "https://www.marketsandmarkets.com/Market-Reports/ai-governance-market-176187291.html"
  },
  {
   "fact": "Category institutionalized: first-ever Gartner Magic Quadrant for AI Governance Platforms published Jul 2026 (Holistic AI, OneTrust, Saidot, Modulos all announce placement)",
   "src": "https://www.holisticai.com/"
  },
  {
   "fact": "New prohibition from Dec 2, 2026: AI systems for non-consensual intimate imagery / CSAM added to Art 5 by the Omnibus; Art 25 breaches now fined up to 3% / \u20ac15M",
   "src": "https://www.insideprivacy.com/artificial-intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new-prohibitions/"
  },
  {
   "fact": "Governance gap persists: 60% of enterprises scaling AI, only ~4% actively governing it (Credo AI, 2026); OneTrust reports AI-risk workload up 37% YoY (2025)",
   "src": "https://www.credo.ai/"
  }
 ],
 "notes": "Timeline conflict resolved: artificialintelligenceact.eu's timeline page had not fully absorbed the Digital Omnibus when checked (Aug 2026); we follow the European Commission's regulatory-framework page (Omnibus political agreement May 7, 2026; in force Jul 27, 2026) corroborated by Covington's May 18, 2026 analysis. Gartner MQ positions are cited from vendor announcements \u2014 the full MQ is paywalled; treat exact placements as vendor-reported. Drata: repeated 404s on any dedicated EU-AI-Act framework page (Aug 2026); it supports ISO 42001, so it stays a Cm-element tool here. Canon mapping: 'readiness scan' = FLI/Commission checkers (rank 1); 'eval.qa-class audit' = external verification, closest products Holistic AI (rank 4) and ISO 42001 certification via GRC platforms. Adjacent elements: general compliance automation (SOC 2, ISO 27001) \u2192 Cm; runtime safety filters \u2192 Gd \u00b7 Guardrails; model testing/monitoring \u2192 Ev \u00b7 Evals & Observability; bespoke legal advice \u2192 Lg \u00b7 Legal. Most vendor stats in this thin category are single-source vendor claims (Vanta's 50% ISO-42001 overlap, Trail's 4x, Trustible's 10x intake) \u2014 flagged as such in entries. Pricing is quote-based across every commercial vendor; no public price list existed anywhere in this category as of Aug 2026.",
 "sources": [
  "https://www.insideprivacy.com/artificial-intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new-prohibitions/",
  "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai",
  "https://artificialintelligenceact.eu/article/113/",
  "https://artificialintelligenceact.eu/assessment/eu-ai-act-compliance-checker/",
  "https://artificialintelligenceact.eu/",
  "https://ai-act-service-desk.ec.europa.eu/en",
  "https://digital-strategy.ec.europa.eu/en/policies/ai-office",
  "https://www.vanta.com/products/eu-ai-act",
  "https://www.credo.ai/",
  "https://www.holisticai.com/",
  "https://www.trail-ml.com/",
  "https://www.saidot.ai/",
  "https://naaia.ai/",
  "https://www.modulos.ai/",
  "https://www.onetrust.com/products/ai-governance/",
  "https://www.trustible.ai/",
  "https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker",
  "https://iapp.org/certify/aigp/",
  "https://www.marketsandmarkets.com/Market-Reports/ai-governance-market-176187291.html",
  "https://optro.ai/product/ai-governance"
 ],
 "element": {
  "number": 49,
  "name": "AI-Act Readiness",
  "group": "Trust & Compliance",
  "essential": false,
  "edition": "v2026.Q3",
  "revision": "r7",
  "license": "CC BY 4.0 \u2014 cite elems.ai",
  "url": "https://elems.ai/e/ai.html"
 }
}