AI Compliance: EU AI Act Software Buyer's Guide

Key takeaways

• AI compliance tooling is worth buying only if it produces an audit-ready AI use case inventory with named owners, risk tiers and review dates, and detects Shadow AI.
• Run a four-week scored evaluation with a requirements checklist sent to vendors, and make each vendor demonstrate capabilities live on your sample inventory.
• Buy a consultant for the initial discovery and classification pass, and buy software for ongoing register maintenance, owner assignment and audit-ready evidence.
• ISO/IEC 42001 certification is not required for EU AI Act compliance; what auditors want is a risk-tiered inventory, named owners, review dates and control mappings.

AI compliance tooling is worth buying when it produces an audit-ready AI use case inventory with named owners, risk tiers and review dates, and finds Shadow AI your team does not know about. This guide gives you a scored evaluation framework, a requirements checklist, and an honest run of GOVERNBOX.ai through the same criteria.

What does AI compliance require under the EU AI Act?

The EU AI Act sorts AI systems into four risk tiers (prohibited, high-risk, limited-risk/transparency, minimal) and attaches obligations to each, with application dates phased in from February 2025 through 2026 (European Commission, AI Act overview). Even US-based organizations can be in scope if their AI systems produce output used inside the EU, or if they place systems on the EU market.

Who in the US is actually in scope

You are covered if your nonprofit, health system, insurer or agency deploys AI whose outputs affect people in the EU, or you sell AI tools to EU customers. Purely domestic use with no EU nexus generally falls outside the Act, though US regulators and internal audit functions increasingly ask for the same evidence.

Obligations that map to tooling requirements

High-risk systems require risk management, data governance, logging, human oversight and technical documentation. Limited-risk systems require transparency: telling users they are interacting with AI. Both translate into a documented inventory of use cases, named owners, risk tiers and review dates, which is what your platform must produce.

How do you classify your AI systems by risk tier before buying tooling?

Before you evaluate any platform, build the inventory it will manage: every AI system in use, a named owner, a risk tier, and a review date. A spreadsheet can hold that data, but a system of record keeps it current and audit-ready. Classify first, buy second.

Why classification comes before vendor selection

Your risk tier distribution determines what you need from a vendor. If most of your inventory sits at high risk, documentation and human-oversight evidence matter more than discovery features; if you suspect Shadow AI, discovery matters first. Run the classification exercise manually and you will also learn which controls map across ISO 27001, NIST CSF, and NCSC CAF, exposing gaps no tool will fill for you. Vendors, including GOVERNBOX.ai, assume a classified inventory as input; garbage in, audit findings out.

Which features matter most when comparing AI compliance platforms?

AI use case inventory with named owners and review dates

The core artifact any platform must produce is an inventory where every AI system carries a named owner, a risk tier and a review date. If the tool cannot answer "who signed off on this use case and when is it next reviewed," it is a spreadsheet with a login page. Test this during the demo: ask the vendor to show a record where the owner field, the tier and the review date are all populated and enforced. If any of the three is optional free text, scoring evidence will not survive an audit.

Shadow AI discovery

Your inventory is only as good as what it catches that you did not enter yourself. Ask how the platform detects unapproved AI tools: SSO log analysis, network scanning, expense data, or self-reporting. Then ask what happens after detection, because a flagged tool with no workflow to assign an owner and a review date just moves the spreadsheet problem into someone else's UI. This matters even for US organizations, since the EU AI Act applies to providers and deployers placing systems on the EU market regardless of where they are based, per the European Commission's AI Act overview. Score discovery and remediation as one capability, not two.

Control mapping and compliance crosswalk

Look for a maintained crosswalk between AI controls and ISO 27001, NIST CSF or NCSC CAF, so one control entry satisfies multiple frameworks. Ask who keeps the crosswalk current when frameworks are revised, and whether you can export it.

Board-level reporting and exports

You need exports your director, COO or counsel can read without a seat in the tool: PDF or slide-ready summaries of coverage, open risks and overdue reviews. Vendors that gate reporting behind enterprise tiers should lose points. GOVERNBOX.ai includes flat org pricing with board-ready reporting, but like every platform here it depends on you actually maintaining owner and review-date fields; no tool generates governance you did not record.

How should in-house legal and compliance teams evaluate AI vendors for EU AI compliance?

Run a four-week evaluation with a fixed process: week one, write your requirements and send them; weeks two and three, run scored demos against your own use cases; week four, check references and pricing. A small team that skips the scoring step ends up choosing on demo polish, which is how GRC purchases drift back to spreadsheets.

Week one, write the requirements down before contacting anyone: list the fields your inventory must carry, the frameworks your auditor expects, and the exports your board reads. Send that document to every vendor and ask for written answers, not a demo. Weeks two and three, run scored demos where the vendor works on your sample inventory, not their canned data, and record the evidence behind each 1-to-5 score the same day. Week four, check two references per finalist and ask each reference the same three questions: what broke during implementation, what the tool still cannot do, and whether they would buy it again. Keep the scorecard in the same system of record you expect the vendor to replace, because the evaluation itself is your first piece of AI governance evidence.

A scored evaluation framework

Build a weighted scorecard before any vendor call. Weight the criteria by what your auditor will ask for: named owner per AI use case, risk tier assignment, review dates, control mapping to ISO 27001 and NIST CSF, export quality for board reporting, and Shadow AI discovery. Score each vendor 1 to 5 per criterion and record the evidence behind every score. If a vendor claims a capability, ask them to perform it live on your sample inventory, not theirs.

Honesty check on ourselves: GOVERNBOX requires a credit card to trial and has no free tier, so your evaluation cost includes a subscription, and our framework mapping is narrower than enterprise suites like OneTrust or Holistic AI. Price that in.

Requirements checklist to send vendors

Send a one-page checklist asking for: an AI use case inventory schema with owner, tier and review date fields; supported frameworks and the crosswalk between them; evidence export formats; Shadow AI discovery method; deployment and data residency options; and flat annual pricing. Vendors who answer in a spreadsheet you can audit are the ones who will survive your auditor.

What documentation and audit evidence must AI compliance software produce?

Evidence that exists only because someone made it

Auditors lose the most time on evidence that exists only because someone assembled it by hand: spreadsheets of AI use cases, policy documents pasted into PDFs, review sign-offs buried in email. A system of record should generate these artifacts as a byproduct of the work itself, not as a separate export project. If your team maintains the AI inventory in one tool and the risk register in another, the gap between them is where audit findings live.

What an auditor will actually ask for

Expect requests for: your AI use case inventory with named owners, risk tier classifications with the rationale, review dates and who signed off, and control mappings showing how your AI safeguards trace to a recognized framework. The NIST AI Risk Management Framework is the common anchor for that mapping, and your tooling should export a crosswalk without manual rework.

Honest limitation: GOVERNBOX.ai produces the inventory, ownership records, risk tiers, and review dates natively, but if you need certifications-grade evidence across dozens of frameworks, platforms like OneTrust or Drata cover more ground.

When is a compliance consultant or service better than a software platform?

Buy services when you do not yet know what your inventory should contain: which AI systems exist, who owns them, and which risk tier each falls into. That discovery and classification work is judgment, and no platform does it for you. A consultant also makes sense for a one-time gap assessment against ISO 27001, NIST CSF, or the NCSC CAF.

Buy software when the problem is ongoing: keeping the risk register current, assigning named owners and review dates, and producing audit-ready evidence on demand. If your pain is spreadsheets and poor board-level reporting, tooling is the fix.

Buy both when discovery is done once by people, then maintained in a system of record. Honest caveat: GOVERNBOX.ai assumes you can supply that initial inventory; it will not replace a consultant for the first classification pass.

How do OneTrust, Holistic AI, Credo AI, IBM watsonx.governance and Drata compare for EU AI Act compliance?

Score each vendor against the same three criteria: risk-tier classification support, audit-ready documentation, and evidence export for board-level visibility. OneTrust, Holistic AI and Credo AI are direct AI GRC platforms with broad EU AI Act feature sets; IBM watsonx.governance leans toward model-level governance inside the watsonx stack; Drata is adjacent, strongest on control automation for frameworks like SOC 2 rather than AI-specific inventories. None of these characterizations replaces a demo: ask each vendor to produce a named-owner, risk-tiered use case register live.

Running GOVERNBOX.ai through the same criteria

GOVERNBOX.ai scores well on the inventory itself: named owners, risk tiers, review dates and Shadow AI discovery in one system of record, with flat organizational pricing rather than per-seat creep. It falls short on breadth. It does not offer the cross-framework control mapping to ISO 27001, NIST CSF or ISO/IEC 42001 that larger suites build out, and it is AI-only, so it will not replace a general GRC platform. If your register is the gap, it fits; if control crosswalks are the gap, it does not.

What does an EU AI Act compliance roadmap look like for a mid-size organization?

Phase 1: inventory and ownership

Start with a complete AI use case inventory. List every AI system in use, including Shadow AI discovered through SSO logs, expense reports and departmental interviews. Assign a named owner to each use case, then set a review date. Most organizations need 60-90 days for this phase, and a purpose-built system of record beats spreadsheets because ownership assignments survive staff turnover.

Phase 2: classification and controls

Tier each system by risk and map controls to the frameworks you already report against. This is where cross-framework compliance work happens: one control, mapped once, evidenced across ISO 27001, NIST CSF and the AI Act. Budget another 90 days.

Phase 3: evidence and board reporting

Build the export pack auditors actually ask for: risk register extracts, impact assessments, control evidence and review-date status. Run one full internal audit cycle before your external audit, then report tier-level status to your director, COO or counsel quarterly.

FAQ

Does the EU AI Act apply to a US-based organization with no EU offices?

Yes, in some cases. The Act covers providers and deployers placing AI systems on the EU market regardless of location, so you are in scope if your AI outputs affect people in the EU or you sell AI tools to EU customers. Purely domestic use with no EU nexus generally falls outside it, though US regulators and internal audit functions increasingly ask for the same evidence.

How much does AI compliance software cost for a mid-size organization?

Most vendors do not publish pricing, and enterprise suites like OneTrust or Holistic AI typically require a sales conversation. GOVERNBOX.ai uses flat organizational pricing rather than per-seat billing, but requires a credit card to trial with no free tier. Send vendors your requirements checklist and ask for flat annual pricing in writing before you commit.

Can I manage AI compliance in spreadsheets instead of buying a platform?

You can start there, and a spreadsheet is fine for the initial classification exercise. The problem is keeping it current: owner assignments and review dates go stale, especially through staff turnover. A system of record also generates audit evidence as a byproduct of the work, rather than as a separate export project each time an auditor asks.

What is Shadow AI and how do I find it?

Shadow AI is the AI tooling your organization uses without approval or inventory entry. Discovery methods include SSO log analysis, network scanning, expense data review, and departmental interviews. Score discovery and remediation together: a flagged tool only matters if a workflow exists to assign it a named owner and a review date.

Do I need ISO 42001 certification to be EU AI Act compliant?

No. ISO/IEC 42001 is a management system standard, not a legal requirement under the Act. What you need is evidence of the Act's obligations: a risk-tiered inventory, named owners, review dates, and documentation for high-risk systems. Certification can help demonstrate alignment, but your tooling should support a crosswalk to recognized frameworks without requiring it.