Eight questions, in the order they rule a vendor out
In the order that rules vendors out fastest. A tool that cannot model your role cannot produce your obligations, so that comes before dashboards or integrations.
| Ask | Why it decides something | A good answer |
|---|---|---|
| Which frameworks does it actually carry, and at what depth? | Most tools claim several and implement one properly. Look for clause-level records, not a checklist named after the standard. | A named list, with what each one produces. Ask to see the obligation set for one of your systems rather than a feature matrix. |
| Does it model your ROLE, or only your systems? | A provider and a deployer of the same system owe different EU AI Act duties, and one organisation can be both. Recording only the system derives neither. | Role recorded per system, with obligations that change when it changes: Article 16 for a provider, Article 26 for a deployer. |
| What does it produce that you could hand to someone? | The deliverable is the point. An auditor, customer or authority asks for an Annex IV file, a fundamental rights assessment or a Statement of Applicability, not a dashboard. | Named documents you can export, with the data behind each field traceable to who entered it and when. |
| Where does your data live, and who processes it? | Compliance software holds compliance data. Hosting and sub-processors are a GDPR question about your own processing, not a preference. | A published sub-processor register, a data processing agreement you can read before buying, and a straight answer on where the AI features run. |
| Does evidence count once, or once per framework? | One control often satisfies more than one regime. Without reuse across frameworks, you maintain the same evidence several times. | One evidence record linked to every obligation it closes, with the basis for each reuse stated rather than assumed. |
| Is the price published? | An unpublished price is a sales cycle. Under fifty people, it usually also signals you are not the customer the product was built for. | A price list with limits on it. If it is quote-only, ask what the smallest deployment they have sold looks like. |
| What happens when the law changes? | The EU AI Act timetable moved twice in 2026. A tool that hard-codes dates and articles will quietly teach you a superseded rule. | A dated record of what changed and when the content was last reviewed against the consolidated text. |
| Can you get your data out? | Compliance records outlive vendor relationships, and some of them carry statutory retention periods measured in years. | Export in a structured, machine-readable format, available without asking, and a written retention position for after you leave. |
Five categories of AI governance software, and who each one is for
"AI governance software" covers products built for different buyers. Most shortlists go wrong here, not at the feature comparison: an enterprise governance suite and an EU-AI-Act-native tool are not competing for the same organisation.
| Category | Examples | Who it suits | What to watch for |
|---|---|---|---|
| Enterprise GRC suites | OneTrust, TrustArc | Large organisations that already run privacy, security and third-party risk in one place and want AI governance to join it. | Priced and implemented for that scale. The EU AI Act module is one of many, and the buying cycle is a procurement cycle. |
| AI governance platforms | Credo AI, Holistic AI, Saidot | Organisations with a model portfolio and a data-science function, wanting policy, risk and model oversight together. | Strongest where there are models to govern. Less useful if you mostly BUY AI rather than build it, which is most SMEs. |
| Security compliance automation | Vanta, Drata, Scytale | Teams whose first need is SOC 2 or ISO/IEC 27001 and who want the EU AI Act alongside it on one control set. | Built around continuous control monitoring of infrastructure. Depth on the Act itself varies, and evidence of a passing control is not an Annex IV file. |
| EU-AI-Act-native tools | Veritome, Legalithm, EuroComply | European organisations whose driver is the Act specifically, and who need the documents rather than a dashboard. | Younger products with smaller ecosystems. Ask what happens when your scope widens beyond the Act. |
| Consultants and law firms | Advisory engagements | A one-off classification question, a contested Article 6 call, or a board that needs an opinion signed by someone insured. | Advice is not a system of record. The obligations recur; a report does not update itself, and published SME readiness estimates run well into five figures. |
Do these two things before you book a demo
Count your AI systems and write down what each one does. Every vendor asks for it in the first ten minutes, and it often settles the decision: three limited-risk systems and one framework need something different from twenty systems and a high-risk classification.
Establish your role for each one. Provider, deployer, importer or distributor; it can differ per system. The duties, the documents and the tool you need follow from it. Our free obligation check answers both in about five minutes, with no account.
Questions people ask before they buy
Do I need AI governance software at all?
Not necessarily. With a handful of AI systems, none high-risk, and one person holding the whole picture, a spreadsheet and a calendar will do; the EU AI Act does not require a tool. Software earns its place when the register stops fitting in one head: several systems, owners or frameworks, or obligations that recur on a date.
What is the difference between AI governance software and GRC software?
Starting point. A governance, risk and compliance suite starts from the organisation's control set and adds AI as a domain. AI governance software starts from the AI system (what it is, who operates it, what it does to whom) and derives duties from that. The EU AI Act needs the second shape: it attaches obligations to a system's classification and your role, not to your company as a whole.
How much should this cost?
The published end of the market runs from free tiers to a few hundred euro a month for an SME. Enterprise GRC suites and AI governance platforms are typically quote-only, at five figures a year or more. Published practitioner estimates put a consultant-led SME readiness exercise at €5,000 to €25,000, one-off, before anything recurs.
Can any tool make my organisation compliant?
No, and a vendor who says otherwise has told you something about the vendor. Software can hold the register, derive the obligations, keep the evidence and produce the documents. It cannot implement a control, make a classification decision or bind a regulator. Compliance is the work; the tool is where it is recorded and proved.
Should I wait, given the timetable moved?
The parts that already apply do not wait: prohibitions and AI literacy since 02.02.2025, Article 50 transparency since 02.08.2026. Regulation (EU) 2026/1744 deferred standalone Annex III high-risk obligations to 02.12.2027 and Annex I embedded ones to 02.08.2028. That is time to do the high-risk work properly, not to start later. The first step, knowing what you have and how it classifies, is the same either way.
How many frameworks should one tool cover?
As many as you are answerable for, and no more. Breadth only helps where the work really overlaps: one record closing an obligation under two regimes is worth having; a sixth logo on a feature matrix is not. Veritome carries 5: the EU AI Act, the GDPR, ISO/IEC 42001, ISO/IEC 27001 and the NIST AI Risk Management Framework, and shows where a record counts twice and where it does not.
Where to next
- Twelve tools comparedWhat each product actually produces, with sources: the shortlist version of this page.
- Veritome vs the alternativesHead-to-head tables, including where each competitor wins.
- Check what you oweA short set of questions per system, free, no account. The input every vendor will ask you for.
- The five frameworksWhat each one asks, what it does not give you, and where they actually overlap.