State of Play 2026: AI Governance

Where the market stands

• September 24, 2024. Cisco completed its acquisition of Robust Intelligence, an AI security company.
• May 6, 2025. ServiceNow launched AI Control Tower, a command center to govern, manage and secure ServiceNow and third-party AI agents, models and workflows.
• July 22, 2025. Palo Alto Networks completed its acquisition of Protect AI. It brought the technology into Prisma AIRS, which covers model scanning, AI red teaming, runtime protection and AI agent security.
• October 22, 2025. AuditBoard agreed to acquire FairNow, an AI governance platform with an AI registry and risk assessments. AuditBoard renamed itself Optro on March 9, 2026.
• March 2, 2026. ServiceNow closed its acquisition of Veza, an identity security company. ServiceNow says Veza governs what AI agents can access and do.
• May 5, 2026. ServiceNow expanded AI Control Tower with 30 integrations spanning AWS, Google Cloud and Microsoft Azure, and runtime observability of agents from its acquisition of Traceloop. ServiceNow said general availability was expected in August 2026. Its AI Control Tower release notes list a September 2026 version with trace retention settings and latency and token-usage views.
• July 27, 2026. The Digital Omnibus on AI entered into force and moved the EU AI Act's high-risk dates.
• September 17, 2026. Alation expanded its AI Governance product with connectors that bring agents and models from Amazon Bedrock, Amazon SageMaker, Databricks MLflow, Microsoft Copilot Studio, Microsoft Foundry and Snowflake Cortex into one registry.

The rules the platforms map to

• EU AI Act. In force since August 1, 2024. Prohibited practices and the AI literacy duty have applied since February 2, 2025. Prohibitions added by the Digital Omnibus apply from December 2, 2026. Obligations for general-purpose AI models have applied since August 2, 2025. The Act became applicable on August 2, 2026, with exceptions. High-risk obligations apply from December 2, 2027, and from August 2, 2028 for AI in products.
• Deployer duties. A deployer of a high-risk system must use it according to the provider's instructions, assign human oversight to people with the competence, training and authority, monitor its operation, and keep its automatically generated logs for at least six months.
• ISO/IEC 42001. Published December 18, 2023, it specifies requirements for an AI management system. ISO/IEC 42006, published in July 2025, sets requirements for the bodies that audit and certify against it.
• NIST AI RMF 1.0. Released January 26, 2023, for voluntary use. NIST released a Generative AI Profile on July 26, 2024, and says AI RMF 1.0 is being revised.
• Colorado SB26-189. Signed May 14, 2026. It repeals and reenacts the 2024 Colorado AI Act as rules for automated decision-making technology used in consequential decisions. Developers must give deployers technical documentation from January 1, 2027.

Four kinds of product

• Dedicated governance platforms. Credo AI lists a registry of agents, models, apps and shadow AI, and policy packs for the EU AI Act, NIST AI RMF, ISO 42001 and SOC 2. Holistic AI says it maps controls to the EU AI Act, NIST AI RMF and ISO/IEC 42001, and tests models, LLMs and agents for security, safety and bias. Monitaur says its platform governs models across their lifecycle, and markets it to insurers and other regulated industries.
• Suites that add AI governance. IBM watsonx.governance covers AI inventory, risk and compliance evidence, and connects to IBM OpenPages for risk and audit teams. ServiceNow AI Control Tower runs on the ServiceNow platform. Microsoft Purview applies data security and compliance controls to Microsoft 365 Copilot, Microsoft Foundry, ChatGPT Enterprise, Anthropic Claude (Enterprise) and other AI apps, and Compliance Manager provides templates for AI regulations. Optro says its AI governance product covers more than 25 frameworks, including ISO 42001, the EU AI Act and NIST AI RMF.
• Observability and guardrails. Fiddler sells real-time guardrails for hallucination, toxicity, PII, prompt injection and jailbreak attempts, with observability for agentic and predictive systems. Arthur's open-source Arthur Engine, under the MIT license, runs guardrails and evaluations inside the customer's own stack.
• Data and ML platforms. Databricks says Unity Catalog brings agents, AI apps, MCPs and models under the same governance as data. Collibra AI Governance keeps every AI use case, model and agent in one system of record, with assessments aligned to the EU AI Act and NIST AI RMF. Dataiku Govern has bundle, model and LLM registries and sign-offs that block deployment until requirements are met.

Check whether each product on your list keeps the governance record, monitors models in production, or both.

What each costs where prices are public

• IBM watsonx.governance. List prices as published. IBM lists Risk & Compliance Basic on IBM Cloud from $3,500 a month and Risk & Compliance Advanced, as enterprise software, from $6,450 a month. Each includes 1 instance, 1 module and 1 concurrent user. On AWS Marketplace, the Standard plan costs $42,000 for a 12-month contract and includes 1 instance, 5 AI use cases, 12,000 evaluations and 25 concurrent users. Each additional use case costs $15,960. IBM calls these prices indicative. IBM prices watsonx.governance software by the number of virtual processor cores.
• Microsoft Purview. Prices in US dollars. Controls for Microsoft 365 data use per-user licenses. Audit, communication compliance, retention and eDiscovery for generative AI apps and agents are billed pay-as-you-go through Azure. Microsoft 365 Copilot experiences are not charged. Audit records for non-Microsoft AI apps cost $15 per million records. Communication compliance scanning of AI interactions costs $0.30 per 1,000 text records on the standard meter and $0.50 on the premium meter. One text record is 1,000 characters.
• Fiddler. List prices as published. Guardrails are on a free plan. The Developer plan costs $0.002 per trace. Enterprise, priced by sales, adds VPC and on-premises deployment.
• Arthur. List prices as published. Free for monitoring up to 4 use cases. Premium costs $60 a month for up to 100 use cases. Enterprise is priced by sales.
• Credo AI. Its AWS Marketplace listing prices the Enterprise plan by number of AI use cases, through a private offer.
• Databricks Unity Catalog. Included with the Premium and Enterprise tiers, with no separate license.
• ServiceNow AI Control Tower. Distributed as an application on the ServiceNow Store. ServiceNow's announcements and release notes list no prices.

The pricing units differ: use cases, evaluations, traces, audit records, concurrent users and processor cores. Model your cost at the number of AI systems you expect to govern in year three, not today.

What a deployment requires

Start with the inventory. Connect the platform to where AI is built and bought: ML platforms, cloud AI services, SaaS applications and procurement records. Give each entry an owner and a risk tier.

Load the frameworks that apply to you, and map one set of controls across them. Then switch on intake and approval workflows for the high-risk tier first.

For high-risk systems you deploy, check that the platform can hold the provider's instructions for use, the names of the people assigned to oversight, monitoring results and logs for at least six months.

Run the proof of concept on a real high-risk system and an LLM application or agent. Have a reviewer from risk or legal complete a sign-off without help from a data scientist. Export the evidence package and ask whether your auditor would accept it.

Questions to settle first

Settle these before shortlisting.

• Is your gap a governance record, production monitoring, or both?
• Where is most of your AI built or bought, and does a platform you already pay for govern it?
• Which of your systems fall under Annex III, and are you their provider or deployer?
• Will you certify to ISO/IEC 42001, align to NIST AI RMF, or both?
• Which pricing unit fits your growth: use cases, evaluations, traces, users or cores?
• Who will own the inventory and the review queue after launch?