COMPLIANCE INTELLIGENCE / REQUIREMENTS BEFORE REASSURANCE
The right requirements. The evidence to decide.
Start with the rules and assurances that matter to your work. Find the published evidence, understand its limits and know what to ask before you commit.
01 / FIND THE EVIDENCE
Your requirements. A more precise shortlist.
Find published claims that discuss your framework. A matching mention can describe a capability, condition or limitation. Read the statement before drawing a conclusion.
Purpose labels are curated against exact current evidence. Workflow support does not establish supplier assurance. Unclassified mentions remain available under “All published mentions”.
Credo AI describes a platform for AI inventories, risk assessment, governance workflows and policy mapping.
Customer compliance workflow support
Inspect the current policy-pack version, control mappings, evidence exports and reviewer responsibilities; do not infer assurance from a supported framework.
vendor asserted · Reviewed 11/2/2026
Credo AI's product page describes pre-built EU AI Act policy packs, automated governance workflows and evidence generation. This is a vendor-described support capability, not evidence that Credo AI or a customer has passed a EU AI Act assessment.
Credo AI presents policy packs and controls mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001 and SOC 2. Scope: vendor-described governance content. Framework mapping is not certification or a finding that a customer meets those requirements.
DataRobot's documentation index lists deployed-workload monitoring, OpenTelemetry metrics and logs, and deployment approval policies. This index does not establish feature availability in every edition or deployment.
Customer compliance workflow support
Test the questionnaire, reviewer overrides, current obligation mapping and evidence export; assign owners to every out-of-platform requirement.
vendor asserted · Reviewed 11/3/2026
DataRobot's risk documentation distinguishes automated in-platform mitigation checks, EU AI Act requirements handled outside the platform and GPAI downstream information. This documents a workflow boundary, not a correct legal classification or completed conformity assessment of a customer's system.
Enzai describes structured AI intake, centralized inventories, assessments and oversight workflows.
Customer compliance workflow support
Request the current mapping version, applicability decisions, evidence exports and treatment of obligations outside the tool.
vendor asserted · Reviewed 11/2/2026
Enzai describes structured AI intake, assessment and approval workflows mapped to EU AI Act, alongside other frameworks. The published mapping is a supplier-described governance capability; it does not establish that a customer system meets every applicable requirement.
Holistic AI describes AI discovery, risk testing, monitoring and governance workflows in one platform.
Customer compliance workflow support
Ask for obligation-level mappings, version history, evidence exports and responsibilities that remain outside the platform.
vendor asserted · Reviewed 11/2/2026
Holistic AI describes EU AI Act control mapping, approvals, deployment gates and human oversight in its governance platform. These are vendor-described workflow functions, not a conformity assessment, proof of legal compliance or independently tested enforcement performance.
Holistic AI names the EU AI Act, NIST AI RMF, ISO/IEC 42001 and NYC Local Law 144 in its framework-assessment and mapping features. Scope: vendor-described assessment content, not certification or a regulatory applicability finding.
IBM describes tools for AI governance relationships, lifecycle risk management, policies and monitoring.
vendor asserted · Reviewed 10/14/2026
IBM's AWS-service documentation describes Model Risk Governance processes for risk assessment and adherence to corporate and regulatory policies, including EU AI Act assessment. Scope: vendor-described governance functionality, not a determination that the product or customer complies with the Act.
OneTrust describes AI discovery, inventory, risk assessment, workflows and runtime governance.
Customer compliance workflow support
Test a versioned obligation mapping and material-change workflow; retain the reviewer decision and duties outside the platform.
vendor asserted · Reviewed 11/3/2026
OneTrust describes EU AI Act templates, context-based risk tiering and reassessment after material AI changes. These are vendor-described governance workflows. They do not establish a correct legal classification, completed conformity assessment or compliance of a customer's AI system.
OneTrust describes assessment templates and policy mapping aligned to the EU AI Act, NIST AI RMF and ISO/IEC 42001. Scope: vendor-described governance content, not certification, legal advice or a regulatory conformity finding.
Saidot describes a connected AI inventory with risk, policy, control and evidence workflows.
Customer compliance workflow support
Review a sample applicability decision, obligation mapping, evidence record and export against your own system and role.
vendor asserted · Reviewed 11/2/2026
Saidot describes curated controls and guided workflows for the EU AI Act alongside other policies. This supports discovery of a governance workflow offering; it does not establish completeness of its legal mapping, customer conformity or independently tested compliance.
Saidot describes policy and control content addressing the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Scope: vendor-described governance coverage; it is not certification or a finding that a customer satisfies those instruments.
Secureframe describes automated evidence collection, continuous monitoring and risk management.
Customer compliance workflow support
Confirm the purchased module, current control mapping, evidence requirements and independent reviewer responsibilities.
vendor asserted · Reviewed 11/2/2026
Secureframe's framework-offering documentation lists EU AI Act within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.
TrustArc describes privacy task management, data mapping and scored privacy assessment workflows.
Customer compliance workflow support
Request current obligation-level mappings and identify responsibilities outside the platform; assess any separate assurance-service claim independently.
vendor asserted · Reviewed 11/3/2026
TrustArc's EU AI Act page describes assessment templates, inventory/risk workflows and PrivacyCentral reporting. GovernAtlas treats these as vendor-described governance support, not legal applicability, a recognized conformity assessment or an official EU AI Act certification.
Trustible describes structured AI intake, risk assessment, monitoring and governance evidence workflows.
vendor asserted · Reviewed 10/14/2026
Trustible names the EU AI Act, NIST AI RMF, ISO/IEC 42001 and NYC Local Law 144 among supported governance frameworks. Scope: vendor-described framework coverage; mapping does not establish certification or legal applicability.
A current published claim makes a product discoverable here. Its original classification remains visible. A negative statement, a restricted feature or a qualified promise can also mention a framework: matching text is not a positive compliance assessment.
A BAA is a scoped agreement.
HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate may itself be a business associate, even when it cannot decrypt the data. Establish the relationship, obtain the appropriate agreement and assess the safeguards for the service you intend to use.
SOC 2 is an assurance report; ISO 27001 concerns an information security management system. Neither label alone answers your HIPAA deployment question. Ask for the relevant report or certificate, its scope, date and exclusions, and evaluate what it actually covers.
The HIPAA Security Rule addresses administrative, physical and technical safeguards. Your risk analysis, workforce practices, integrations and configuration remain part of the assessment. Review before sharing PHI and when material circumstances change.
Identify who decides the purposes and who processes on instructions. Review the DPA, subprocessors, transfers, rights assistance and retention for the actual service. A vendor privacy claim or an EU hosting option leaves those questions open.
Assess the intended purpose, operator role and current applicable obligations before selecting controls. A mapping platform can help organize work; its policy pack does not establish legal applicability, a completed conformity assessment or customer compliance.
A claim starts the conversation. Evidence moves it forward.
Start with the AI system, intended purpose and your role. Evaluate the platform's support against the obligations that actually apply, rather than accepting a universal compliance score.
A policy pack or control mapping is workflow support. It is not a legal applicability decision, conformity assessment or completed customer obligation. These questions prepare a review; they are not an exhaustive assessment.
Answers stay in this page’s memory. Export before leaving or switching frameworks; switching clears answers. Record source links and review notes, never patient information or credentials. “Evidence received” is not a finding of compliance.
01 / System & roleWhat system, intended purpose and operator role are we assessing?
Record the model/system boundary, intended users, deployment context and your role across the supply chain. Distinguish provider, deployer and other roles; assess role changes after modifications with the appropriate reviewer.
02 / Applicability & timingWhich rules apply to this use, and when?
Retain a dated applicability assessment using current official legal sources. Address exclusions, prohibited uses, risk classification, transparency and any model-specific obligations as relevant. Do not use a vendor's old timeline as legal authority.
03 / Mapping qualityCan we trace each relevant obligation to an owner, control and evidence?
Request a versioned obligation-level mapping with citations, assumptions, exclusions and update history. Check how legal changes are reviewed and how gaps are escalated. A percentage-complete dashboard is not evidence of conformity.
04 / Documentation & oversightWhat technical records and human decisions can we inspect?
Request relevant system documentation, instructions, risk records, data-governance evidence and oversight procedures. Test review and escalation paths with a synthetic scenario. Record limits in the tool's ability to generate or validate documents.
05 / Conformity & responsibilityWhat assessment or registration work remains outside the platform?
Where applicable, identify the required assessment route and responsible parties with your reviewer. Request supporting records and their scope. Do not infer a completed conformity assessment from software-generated documentation or a policy-pack subscription.
06 / Monitoring & changesHow do incidents, changes and continuing obligations reach an accountable owner?
Request monitoring, logging, incident escalation and change-review workflows suited to the system and role. Run a simulated material change and verify reassessment, evidence retention and ownership.
07 / Portable evidenceCan we export a useful record and challenge a mapping?
Ask for an export containing sources, versions, decisions, controls, supporting evidence and unresolved gaps. Check access controls and audit trails. Assign an independent acceptance owner; a vendor cannot approve its own legal conclusions for you.
QUESTIONS ANSWERED
Before you shortlist.
Does GovernAtlas certify these products?
No. Discovery links published claims to their sources. Inclusion, payment and a framework mention do not establish compliance or suitability for your deployment.
What if a vendor has no matching evidence?
Our current coverage may be incomplete. Use the checklist to ask the vendor for documents and submit public sources for editorial review. An unknown result is not an adverse finding.
Can I use the checklist for a clinical AI tool?
Use it for the PHI-handling review, then separately evaluate clinical safety, intended use, human oversight and any applicable medical-device requirements. HIPAA alone does not establish clinical safety or effectiveness.
Can companies pay for a better evidence classification?
No. Public research and this checklist stay free. Company subscriptions do not change editorial gates, evidence classifications or search eligibility.
GovernAtlas editorial buying method · reviewed November 2, 2026. Primary references: HHS business associates, HHS risk analysis. The checklist is a preparation aid, not an exhaustive legal assessment.