European AI Governance Tools

#1 Saidot

Helsinki, Finland Subscription plans on the pricing page, prices not shown in the page text; monthly cancellation stated Demo on request

Best for: Teams that want a ready-made library of AI risks and controls instead of building governance forms from scratch

• Operating company. Saidot Ltd.
• Jurisdiction. EU (Finland)
• Where the data sits. See website (hosting region not verified)
• Source code. Closed source
• Replaces. Credo AI, spreadsheet-based AI registers

Saidot, a Helsinki company operating as Saidot Ltd., builds its platform around the idea that most governance work repeats.

Rather than a blank form for every system, the vendor keeps a library of 260+ risks and 110+ policies plus a catalogue of third-party models and products, and the inventory links to it. When a team connects an agent to the model it runs on, the model's known risks appear on the agent, and connecting a dataset brings the privacy requirements with it.

The company publishes a legal centre with its master terms, a data processing addendum, an EU Data Act addendum and a sub-processor list, and its information security management system is certified to ISO/IEC 27001:2022.

Integrations named on the pricing FAQ are Azure AI Foundry and Amazon Bedrock, with a REST API, webhooks and MCP servers for the rest. Plan prices are not visible in the page text and the hosting region is not stated, so both go on the first-call list. Saidot does not test model behaviour, which is why its own page points to Giskard or Validaitor.

Standout feature. Saidot is the platform on this page that pre-fills a system's risk and control file from a vendor-maintained library, so a new registration starts from a draft and not from an empty form.

#2 Modulos

Zurich, Switzerland Founded 2018 Pricing on request (demo) Demo on request

Best for: Regulated organisations that need audit-ready evidence and a business case for AI risk

• Operating company. Modulos AG
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. See website
• Source code. Closed source
• Replaces. Credo AI, manual AI registers

Modulos AG describes its platform as a loop of register, govern, detect, investigate, remediate and update. The part that stands out is Scout, an agent that searches cloud accounts, code and connected tools for AI that nobody registered, so the inventory does not depend on staff volunteering information. Each system in the register carries an approval state, and a control library is mapped to the EU AI Act, ISO/IEC 42001, NIST AI RMF, DORA and NIS2.

The company was founded in Zurich in 2018 as an ETH Zurich spin-off, and its company page states CHF 16.4M raised to date and a SOC 2 Type 2 certification (a vendor statement).

Risk is expressed in euros, which gives a finance team a number to discuss, though the figures are only as good as the input data. Switzerland is outside the EU, so the contract and data questions follow Swiss law under the adequacy decision. There is no price list, and hosting options were not stated on the pages we read.

Standout feature. Modulos is the only tool on this page that expresses AI risk as a euro amount inside the register, backed by an agent that hunts for unregistered AI.

#3 Validaitor

Karlsruhe, Germany See & Control: Starter €490 and Team €790 per AI system per year; 7-day free trial; Enterprise on request Demo on request

Best for: Teams that want governance and technical testing of AI systems in one product

• Operating company. Validaitor GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. See website
• Source code. Closed source
• Replaces. Credo AI, separate red-teaming and register tools

Validaitor GmbH, based in Karlsruhe, joins two jobs that other vendors keep apart. The same platform that holds the register of AI assets also runs red-team suites, a benchmark library and what the vendor calls autonomous AI pen-testing aligned with the OWASP Top 10. Compliance automation, document templates and a trust center sit in the governance part, so one login covers inventory, risk and testing evidence.

The legal entity is entered at Amtsgericht Mannheim under HRB 750606. The See & Control module costs €490 (Starter) or €790 (Team) per AI system per year, with a 7-day free trial and an Enterprise tier on request. Because the unit is the AI system, a company with dozens of small AI features pays more than it would on a flat plan, and testing modules carry their own price list. Hosting and certifications were not checked on the pages read.

Standout feature. Validaitor is the only platform here that sells a register and adversarial testing together and prints a per-system annual price for the register part.

#4 Deeploy

Utrecht, Netherlands Platform fee plus seat fee by stage, no amounts published; Core, Scale and Enterprise plans Demo on request

Best for: Teams that already run models and agents and want governance enforced where they run

• Operating company. Deeploy
• Jurisdiction. EU (Netherlands)
• Where the data sits. SaaS, private cloud, own cloud (AWS or Azure) or on-premise on Enterprise
• Source code. Closed source
• Replaces. Credo AI, manual AI registers

Deeploy, a Utrecht company, sits closer to running systems than most governance tools. It connects to MLOps and GenAI platforms, finds AI that was never onboarded, and then monitors the systems for drift, performance drops and unsafe outputs, with guardrails, tracing and an agent registry for control. Assessments collect evidence automatically against frameworks such as ISO 42001, NIST AI RMF or a custom set.

The privacy policy names Deeploy at Oudegracht 91A in Utrecht, Chamber of Commerce number 78193621, as controller. Enterprise customers can choose SaaS, private cloud, their own AWS or Azure account, or on-premise, which makes it the most flexible on hosting among the registers.

Pricing is a platform fee plus a seat fee by company stage, with a minimum of 3 seats on Core and 5 on Scale, and no amounts are published. Core has no SSO or SLA, and business-side intake is lighter than at Enzai.

Standout feature. Deeploy enforces governance on the serving layer, with drift alerts and guardrails, which most registers on this page leave to other tools.

#5 Enzai

Belfast, United Kingdom Demo required; no public pricing Demo on request

Best for: Legal, risk and security teams that need an approval workflow for every new AI request

• Operating company. Enzai Technologies Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. See website
• Source code. Closed source
• Replaces. Credo AI, ticket-based AI approvals

Enzai organises its product in four steps: discover, intake, comply and enforce. Discovery builds a single inventory of AI in use, shadow AI included, and intake sends each new AI request through legal, risk and security review before launch. Frameworks covered are the EU AI Act, ISO 42001, NIST AI RMF and GDPR, and an MCP server lets agents log tool calls into governance.

Enzai Technologies Limited is registered in Northern Ireland under NI681546, with offices in Belfast and London. The United Kingdom left the EU, so EU law does not apply to the contract directly and UK adequacy and UK GDPR rules do.

The terms found on the website are site terms, so the customer contract entity should be confirmed when buying. Jira and ServiceNow integrations are named, no price is published, and testing of model quality is left to tools such as Validaitor or Giskard.

Standout feature. Enzai turns AI approval into a ticketed workflow that legal, risk and security teams can run in the tools they already use.

#6 Naaia

Louveciennes, France Demo on request; no public pricing Demo on request

Best for: Companies that need one system for AI risk across several regulations, including product rules such as medical devices

• Operating company. naaia (société par actions simplifiée)
• Jurisdiction. EU (France)
• Where the data sits. See website
• Source code. Closed source
• Replaces. Credo AI, compliance spreadsheets

Naaia calls its product a European AI management system. The registry holds projects, systems, models and components, a qualification engine classifies them, and a compliance engine turns the applicable rules into tasks and workflows. The scope reaches beyond the AI Act to ISO 42001 and product regulations, and the site shows a medical device use case.

The legal notice names naaia, a société par actions simplifiée with registered office in Louveciennes, entered at the Versailles commercial register under 913 352 688 with share capital of €50,000.

Naaia Academy offers training and the company sells advisory next to the software, so a first deployment can include people as well as code. Pricing is not published, the pages do not say where the platform is hosted, and a team with only EU AI Act needs may find AddComply narrower and simpler.

Standout feature. Naaia treats an AI system as a component of a regulated product, with training and advisory attached to the same contract.

#7 2021.AI

Copenhagen, Denmark Campaign prices through 2026: €2,675 per month (list €3,345) and €4,000 per month (list €5,475); custom plan on request Demo on request

Best for: Organisations that want governed internal AI chat and a registry in one product, possibly on their own infrastructure

• Operating company. 2021.AI
• Jurisdiction. EU (Denmark)
• Where the data sits. Cloud, private cloud or on-premise (vendor statement)
• Source code. Closed source
• Replaces. Credo AI, public AI chat tools used without oversight

2021.AI, a Copenhagen company, sells the GRACE platform in modules: GenAI chat, AI security, governance and a developer layer. Its central idea is that a governed chat application gives staff a sanctioned place to use AI, and the registry fills automatically from that use instead of from forms. A local or hybrid language model can run beside it, and GDPR guardrails apply to prompts.

Two plans carry prices: €2,675 per month (list €3,345) and €4,000 per month (list €5,475), both campaign prices through 2026, plus a custom plan. The vendor states that GRACE runs in cloud, private cloud or on-premise. That entry price suits a larger organisation, some security and privacy features come from partners, and the legal form of the company was not stated on the pages checked. A team that only needs a register may find SimpleAct enough.

Standout feature. 2021.AI is the one platform here where the AI register builds itself as staff use a governed internal chat.

#8 Calvin Risk

Zurich, Switzerland Demo on request; no public pricing Demo on request

Best for: Insurers, banks and similar firms that need measurable evidence of how AI behaves

• Operating company. Calvin Risk AG
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. See website
• Source code. Closed source
• Replaces. Credo AI, manual model validation reports

Calvin Risk puts testing first and governance on top of it. The platform generates test data and scenarios, stresses models and agents under realistic and adversarial conditions, and scores outcomes on performance, robustness, fairness, explainability and safety. Drift detection and audit-ready records follow, with governance workflows layered over the evidence.

The imprint names Calvin Risk AG at Josefstrasse 219, 8005 Zurich, and the company page describes an ETH Zurich spin-off working with insurance, banking and transportation. The site is in English and German.

It is not a full register or intake system, so a company with many third-party AI tools would pair it with Enzai or Saidot. No price is published, hosting options were not stated, and the percentage improvements quoted on the site are vendor claims. Switzerland is outside the EU.

Standout feature. Calvin Risk produces measured behaviour evidence for insurers, banks and transport firms, which a register alone cannot provide.

#9 SimpleAct

Recklinghausen, Germany Starter €199 per month (€159 billed yearly), Professional €349 (€279 yearly), Enterprise on request; net of VAT Demo on request

Best for: Small and mid-size companies that need to start EU AI Act compliance and GDPR records together

• Operating company. SimpleAct UG (haftungsbeschränkt)
• Jurisdiction. EU (Germany)
• Where the data sits. Germany (Hetzner)
• Source code. Closed source
• Replaces. Credo AI, spreadsheets for the EU AI Act

SimpleAct, from Recklinghausen, keeps AI inventory, risk assessment and evidence in one record, and every change lands in an audit history. A guided questionnaire checks prohibited practices, Annex III high-risk triggers and transparency duties, and the classification follows from the answers by rule, with article references. A GDPR module adds RoPA, DPIA and TOMs in the same workspace, and Annex IV documentation is a listed feature.

The imprint names SimpleAct UG (haftungsbeschränkt) at Amtsgericht Recklinghausen, HRB 10368, and the site is hosted by Hetzner Online GmbH in Germany. Starter costs €199 per month (€159 billed yearly) and Professional €349 (€279 yearly), net of VAT, with a free quick check that needs no sign-up. Starter stops at five AI systems and three users, the 7-day trial needs a credit card, and no certifications are stated. A UG is a small-company form, so ask about continuity.

Standout feature. SimpleAct attaches a visible price, €199 a month, to a rule-based EU AI Act classification and a GDPR record workspace hosted in Germany.

#10 AddComply

Jönköping, Sweden Demo on request; no public pricing Demo on request

Best for: Organisations that only need to follow the EU AI Act and want legal-led guidance

• Operating company. AddComply AB
• Jurisdiction. EU (Sweden)
• Where the data sits. See website (sub-processor list published)
• Source code. Closed source
• Replaces. Credo AI, EU AI Act spreadsheets

AddComply is deliberately narrow. The site says it is built exclusively for the EU AI Act and describes itself as neither a traditional GRC system nor a set of templates. A self-assessment classifies the risk and the company's role, a tailored path follows, and task reminders, role-based access and generated audit documentation support the work.

The footer names AddComply AB with headquarters at Gjuterigatan 9 in Jönköping and lists offices in Stockholm, Gothenburg, Oskarshamn and Växjö, and the site says the company was founded by experts in AI law, digital law and compliance. It covers the EU AI Act and not ISO 42001 or NIST, which Modulos and Naaia map. It does not discover AI systems on its own or test them, no prices are published, and the hosting location is not stated.

Standout feature. AddComply is the only entry in this category built around a single regulation and founded by lawyers instead of engineers.

#11 Giskard

France Founded 2021 Open source free; Professional on request Demo on request

Best for: Teams that need to test models and agents before release

• Operating company. GISKARD AI SAS
• Jurisdiction. EU (France)
• Where the data sits. On-premise, private cloud or SaaS with data residency options
• Source code. Closed source
• Replaces. Weights & Biases Weave evaluations, Arize, Deepchecks

Giskard covers the testing step that governance registers leave to someone else. It generates adversarial and quality tests for models and agents, scoring prompt injection, data disclosure, sycophancy, hallucination, contradictions and inappropriate refusals. The Professional tier lists 50+ automated adversarial probes, including multi-turn attacks, and coverage of agent risk frameworks such as OWASP.

GISKARD AI SAS says it is built in France and was founded in 2021 by people with experience at Dataiku and Thales.

The library is published under Apache-2.0 on GitHub, and its README states that v3 is a fresh rewrite, so older scripts may need migration. The enterprise tier lists on-premise, private cloud or SaaS deployment with data residency, SSO and role-based access. Giskard keeps no register and does not track or serve models, the free tier gets best-effort support, and the Professional price is not published.

Standout feature. Giskard is the only open-source component in this category, a testing library that sits beside whichever register a company chooses.