AI Assurance DirectoryTools for EU AI Act
Listed tools whose cited public page names this framework. Read the EU AI Act explainer first. Related reading is on the articles index.
-
6clicks (ISO 42001)
GRC with a pre-configured ISO/IEC 42001:2023 AIMS, Hailey AI mapping, SoA and Hub & Spoke. Cross-maps ISO 27001 and the EU AI Act. Homepage names SaaS, sovereign cloud or on-prem, and cloud, on-premises, air-gapped or hybrid.
-
Arthur (Agent Security & Governance)
Discovers agents across endpoints, cloud and private data centers; traces tool calls; enforces policies and guardrails. Official page names fully hosted SaaS, on-prem, or hybrid. An Arthur column maps product evidence to ISO 42001, the EU AI Act and NIST AI RMF.
-
Asenion AI Control System
Asenion AI Control System turns EU AI Act, ISO/IEC 42001 and NIST AI RMF requirements into Assess, Verify and Witness controls with audit-grade evidence. Asenion is ISO/IEC 42001 certified for the Control System. A homepage quote names the former Fairly brand.
-
Collibra AI Command Center
Collibra AI Command Center (evolved from AI Governance; docs dated 7 October 2026): unified registry for AI agents, models and use cases, AI Trust Score, guardian agents and agent contracts. Out-of-the-box EU AI Act, NIST AI RMF and AI UC-1 assessment templates.
-
Credo AI
Enterprise AI governance with GAIA assistant, Agent Registry, 300+ integrations and ready-to-deploy policy packs for the EU AI Act, NIST AI RMF and ISO 42001. Named sectors: insurance, financial services, federal and healthcare.
-
CycloneDX (AI/ML-BOM)
OWASP/Ecma TC54 BOM standard (CycloneDX 1.7, released 21 October 2025) published as ECMA-424 2nd edition (10 December 2025). Homepage names 260+ tools, the defense industrial base, satellite and space systems, and medical-device HBOM/SBOM. The ML-BOM guide names the EU AI Act and NIST AI RMF.
-
EU AI Act Service Desk
Official Commission Service Desk and Single Information Platform for the AI Act (in force 1 August 2024). Explorer and Compliance Checker. Annex I civil-aviation entry is unmanned-aircraft-limited. Consolidated text as at 27 July 2026.
-
Giskard
LLM-agent testing (Python SDK and Hub UI), red-teaming and runtime Guards with an EU AI Act Policy Pack (OPA/Rego). On-premise Hub for public-sector and defense workloads. Named sectors: banking and insurance.
-
Holistic AI
Identify, Protect and Enforce platform: shadow-AI discovery, agentic red-teaming and framework assessments for the EU AI Act, NIST AI RMF and ISO 42001. Guardian Agents (Sentinel watch/detect; Operative act/enforce) via the HAI Guardian SDK. 15+ read-only integrations.
-
IBM watsonx.governance
IBM AI governance product: enterprise inventory, shadow-AI detection, policy enforcement, and Compliance Accelerators that name the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Sold for cloud and on-prem. Infosys 2,700+ use cases; US Open court-fairness case.
-
ModelOp
Enterprise AI Command Center (Center 3.3) that maps each use case to the EU AI Act, NIST AI RMF and ISO 42001, orchestrates reviews, generates model cards, and adds inline agent prompt-injection blocking. MADE integrates 50+ technologies.
-
Monitaur
AI governance for inventory, a 33-control library, FlightSim pre-deployment simulation (vendor: AI pen test) and Automate Record production logging mapped to NIST AI RMF, ISO 42001 and the EU AI Act.
-
OneTrust AI Governance
AI governance that inventories systems, agents, models, datasets and vendors; applies EU AI Act, NIST AI RMF and ISO 42001 templates; and describes runtime guardrails plus a Python AI Guard SDK on Amazon Bedrock, Microsoft Foundry, Databricks and Gemini.
-
Optro AI Governance
Enterprise AI governance that inventories models, agents and third-party apps and automates 25+ frameworks including the EU AI Act, ISO 42001 and NIST AI RMF. Shadow AI; agents draft and recommend, the team decides. fairnow.ai currently serves this product.
-
Promptfoo
Open-source gen-AI red-teaming tool that scans 50+ vulnerability types and maps plugins to the NIST AI RMF, ISO/IEC 42001 and EU AI Act. Runs locally against HTTP APIs, browsers or models. MIT-licensed.
-
Saidot
Graph-based AI governance platform: 260+ risks, 620+ controls, 110+ policies and 170+ third-party models. Product page: meet 110+ policies including ISO/IEC 42001 and NIST AI RMF, plus the EU AI Act workflow. Homepage names Azure Marketplace; ISO 27001 is the vendor ISMS.
-
Saimple
Static analyzer that uses abstract interpretation to assess neural-network robustness, citing ISO/IEC 24029. Sold as SaaS and on-premises. Numalis names Article 15 explainability reports and EASA MLEAP work.
-
ServiceNow AI Control Tower
ServiceNow AI Control Tower inventories agents, models, copilots, MCP servers and datasets against the CMDB. Out-of-the-box content packs named for the EU AI Act and NIST AI RMF. Built on the ServiceNow AI Platform. Not an airborne runtime.
-
Trustible
AI governance platform for regulated enterprises: intake, inventory, risk triaging and continuous monitoring. Maps controls to the EU AI Act, NIST AI RMF and ISO 42001. Official 10 April 2026 Leidos story covers defense, intelligence, civil and health programs.
-
Vanta
Compliance automation covering ISO 42001, NIST AI RMF and CMMC (mapped to NIST SP 800-171/172). The ISO 42001 product page also maps evidence to the EU AI Act. Not an AI-model assurance tool.
Official documents and working-group pages
These are the primary public pages we cite for EU AI Act. They are not directory listings and are not endorsements.
- Regulation (EU) 2024/1689 - consolidated text (27.07.2026) - EUR-Lex
- Regulation (EU) 2026/1744 (amending Regulation (EU) 2024/1689) - EUR-Lex
- Regulation (EU) 2024/1689 - Official Journal text (recitals) - EUR-Lex
- AI Act Service Desk: Article 2 (Scope) - European Commission
- AI Act Service Desk: Annex I - European Commission
- AI Act Service Desk: Article 108 - European Commission
- AI Act Service Desk: Article 113 - European Commission
Related articles
- EU AI Act Article 4 AI literacy: what the Commission Q&A and the amended text say
- EU AI Act Article 6 high-risk classification: Annex I products, Annex III uses and the safety-component rule
- EU AI Act Articles 14 and 26: human oversight, who builds it and who staffs it
- EU AI Act Articles 9 and 15: risk management, accuracy, robustness and cybersecurity for high-risk AI
- Motor-vehicle AI under the AI Act — Annex I Section B and Article 2(2)
- EASA AI Concept Paper Issue 2 explained for suppliers
- Machinery Regulation 2023/1230 in AI Act Annex I Section B — what the official pages say
- An AI assurance glossary for aerospace and defense
- An AI audit evidence checklist for regulated programs
- AI incident reporting: EU AI Act Article 73 vs DoD guidance
- Data provenance and supply-chain security for ML models (SBOM/AIBOM)
- EASA AI Concept Paper levels explained
- EU AI Act general-purpose AI model obligations
- EU AI Act obligations for aerospace suppliers outside the EU
- EU AI Act scope for defense and aviation: what is in, what is out, and the new dates
- FAA and EASA AI certification timelines compared
Questions
Why are there so few commercial tools tagged for EU AI Act?
We only tag a tool when the cited public page names this framework (or, for SAE G-34, EUROCAE WG-114, ED-324 or ARP6983). We do not infer support from a related aviation standard.
Where are the official EU AI Act documents?
The official documents and working-group pages are listed on this page and on the EU AI Act explainer.