Layer researchGovernance, risk and sovereignty
Vendor landscape
As of 2026-08-19. Vendor capability claims are vendor-published unless third-party sourced. Re-verify quarterly.
- Vendor / product
- ServiceNow AI Control Tower
- Category
- Runtime governance / control tower
- Maturity (Aug 2026)
- Kill switches + cross-platform coverage, May 2026
- Notes
- Governs agents across AWS/Azure/GCP/M365 [vendor]
- Vendor / product
- OneTrust
- Category
- GRC + AI governance
- Maturity (Aug 2026)
- Continuous monitoring + agent detection, Mar 2026
- Notes
- Privacy-native lineage [vendor]
- Vendor / product
- Credo AI, Holistic AI
- Category
- AI governance specialists
- Maturity (Aug 2026)
- Active
- Notes
- Policy/registry/evidence; bias-audit strength (Holistic) [vendor]
- Vendor / product
- IBM watsonx.governance
- Category
- Cross-vendor assurance
- Maturity (Aug 2026)
- Active
- Notes
- Positioning as assurance layer [vendor]
- Vendor / product
- Microsoft Purview (for Agents)
- Category
- Compliance/eDiscovery
- Maturity (Aug 2026)
- Wired into Agent 365, 2026
- Notes
- Evidence retention for the Microsoft estate [vendor]
- Vendor / product
- Audit/assurance ecosystem (Big Four practices; ISACA AAIA cert May 2025; IIA framework)
- Category
- Assurance
- Maturity (Aug 2026)
- Methodologies forming
- Notes
- No citation-grounding evidence methodology published yet
- Vendor / product
- ISO 42001/42005/42006 certification bodies
- Category
- Standards
- Maturity (Aug 2026)
- ~350 orgs certified (unofficial count); 42006 accreditation ramping
- Notes
- Early, enterprise-skewed
Agent-washing watch: "AI governance" that stores policy PDFs but cannot inventory agents, capture evidence, or stop anything; compliance offerings still scoped to the superseded Aug 2026 deadline.
Source: research/R11-governance-risk-sovereignty/vendors.md in the evidence repository behind this site.