Deep dive: AI governance software

AI governance software: what's real

My view as of October 2026: governance software is being folded into platforms companies already own, and what to buy depends on who checks your work. A bank buys for examiners, a B2B AI vendor for its customers' procurement teams, a large enterprise for its board. Most of the money in a program goes to people and outside reviewers, so a tool earns its place by how much an analyst gets through in a week.

What's on offer

• AI governance platforms hold the registry of use cases, run intake and assessments, ship rule packs aligned to NIST and the EU AI Act, and collect evidence. Suites and independents both sell them.
• GRC suites and compliance automation add AI as one more module or framework. AuditBoard, Archer, MetricStream and Diligent added AI governance modules; Vanta and Drata sell ISO 42001 in the same subscription as SOC 2, which one research firm called a natural upsell.
• Existing model risk tools are what most banks use: in Deloitte's 2025 survey, over half governed AI in their existing tools rather than a dedicated platform.
• Security and cloud controls cover discovery and runtime: shadow-AI discovery in web-security products, prompt filters priced in cents, compliance templates in Microsoft Purview.

Consolidation follows the same line. Platforms bought discovery and runtime telemetry (AuditBoard and FairNow, ServiceNow and Traceloop, Veeam and Securiti AI, and the 2025 security deals), and as far as I could find, no standalone AI governance specialist had been bought at scale by early October 2026. No suite publishes AI governance revenue, so the folding shows in products and deals more than in money.

How big the market is

Gartner, an analyst firm, said in February 2026 that spending on dedicated AI governance platforms would reach $492 million in 2026 and pass $1 billion by 2030. Forrester, another analyst firm, counts governance features built into AI software in general and puts its figure more than ten times higher by 2030. The estimates differ because they measure different things, and Gartner's own forecasts don't all agree either. I'd quote one figure only with its definition and wouldn't size a business on any of them. No survey I've seen separates what drives purchases: regulation, customers or insurers.

What the analyst rankings say

Gartner's first Magic Quadrant for AI governance platforms (its chart is dated May 2026) put two suites, IBM and ServiceNow, among the Leaders next to Truyo, an independent with roots in privacy software. Holistic AI was the only Challenger; OneTrust, Credo AI and Airia were among the Visionaries; SAP topped the Niche players. Forrester's 2025 Wave named Credo AI and IBM as Leaders. Banks read Chartis, which rates SAS a leader in model risk and AI governance. Every placement here comes from the vendors' own announcements, because the reports are paywalled.

Who buys what

Standalone platforms sell best where a team has no system of record yet.

What a certificate proves

ISO/IEC 42001 certifies an AI management system: policies, roles, a risk process, impact assessments and a set of controls. It doesn't certify a model's safety or fairness, and it isn't EU AI Act conformity. Many of the companies enterprises buy AI from have one: AWS (Bedrock and other services, November 2024), Google (Google Cloud, Workspace and the Gemini app), Microsoft (365 Copilot in 2025, recertified in 2026 with Copilot Studio added), Anthropic (January 2025), IBM (its Granite models, 2025), KPMG (late 2025, ahead of the rest of the Big Four) and others such as Snowflake. ISO doesn't publish a count of certificates for this standard.

Check three points on any certificate:

• Scope. Certificates cover named services or systems, and AWS says customers aren't certified by association.
• Issuer. The certification body should be accredited (ANAB in the US, UKAS in the UK). ISO/IEC 42006, the rules for certifying to 42001, only came out in July 2025, so earlier certificates were issued without AI-specific rules for the auditors.
• What it replaces. CSA's STAR for AI Level 2 requires 42001, so the certificate can stand in for a long questionnaire. SOC 2 has no AI-specific criteria and says little about AI unless the AI system was scoped in.

Banks barely mention ISO 42001, and it doesn't appear among the drivers in Deloitte's model risk survey, so certification is mostly something vendors buy to sell.

Questions to ask a governance vendor

1. What's your pricing unit (use case, user, evaluation, consumption), and what happens to the bill when we register the vendor features and shadow AI we find?
2. Where does the inventory come from: forms, procurement data, cloud and security connectors? Show us discovery of an AI feature we didn't know about.
3. Do you store the evidence or link to it in our eval, ticketing and logging tools, and can we export the full history if you're acquired?
4. Which rule packs do you maintain, who updates them when dates move, and how long did your EU AI Act pack take to reflect the July 2026 delay?
5. Can a model owner finish a low-tier intake in a day?