Service-as-a-Software Architecture

Service-as-a-Software in Regulated Markets

Outcome-priced AI service delivery: autonomous workflows execute the bulk of execution-heavy cognitive work while domain specialists act as supervisors, auditors and escalation owners. The compliance consequence is that accountability shifts to measured outcomes — accuracy, escalation rates and evidence — rather than billable effort.

This is the design lens: compliance designed into the system — control objectives, components, patterns and the evidence plan — not audited onto it afterwards.

Graph v2.21.0 · 4 pipeline stages · 6 mandatory artifacts

Enterprise chassis — Four-Layer TRiSM Enterprise Stack

Enterprise-wide chassis (per-workload blueprints plug into layers 2–4)

The enterprise-wide chassis (vs. per-workload blueprints): (1) Governance layer / System of Record — register, AI-BOM, intake, risk tiering; (2) Knowledge & context layer / System of Context — governed RAG, lineage, tenant isolation; (3) Orchestration & execution layer / System of Action — agent frameworks, multi-model routing & fallback; (4) Runtime inspection layer / System of Defense — inline single-pass guardrail proxies, HITL gateway, immutable logging. Per-workload blueprints (Guarded RAG, HITL Core, RDA stack…) instantiate inside layers 2–4; layer 1 is shared. Structural rule: layer 1 is second-line and vendor-independent (pat-lines-defense).

Layer 1 · Governance layer — System of Record

AI register, AI-BOM, intake portal, risk tiering. Shared across all workloads; second-line and vendor-independent.

Layer 2 · Knowledge & context layer — System of Context

Governed RAG, lineage, tenant isolation and segmented vector storage.

Layer 3 · Orchestration & execution layer — System of Action

Agent frameworks, multi-model routing and fallback, tool authorisation.

Layer 4 · Runtime inspection layer — System of Defense

Inline single-pass guardrail proxies, HITL gateway, immutable logging.

Included components & patterns

AI Register & Model Registry / Factsheets AI Intake Portal & Use-Case Triage Sovereign Context Layer Multi-Model Router & Fallback Abstraction Dual-Gate Validation Pipeline HITL Escalation Queue & Review UI WORM / Immutable Audit Vault Three Lines of Defense Separation Shadow-Mode Execution Cognitive Orchestrator Supervisor Attribution Chain Shadow-AI Discovery & Asset Inventory Scanner

Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.

Vendor market layer

Functional vendor categories (17)

The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.

AI GRC & Governance Platforms

Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping and control deduplication, audit-evidence generation, intake workflows. Named products live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. What the class buys you: one register a second line can defend, and evidence assembled once and reused across frameworks. Selection metrics: see meta.marketLandscape.selectionMetrics.grc. One compilation-reported item is deliberately kept as unverified: a claimed updated US banking model-risk guidance 'SR 26-2'. Two secondary compilations repeating it is corroboration of the rumour, not of the guidance; it stays flagged pending verification against Federal Reserve primary sources, and a curator verification proposal is filed. All alignments in this layer are vendor-positioned claims, never certifications.

unverified · verified 2026-08-18 community-maintained

selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Credo AI	AI governance platform	Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	ISO 42001 alignment (claimed)EU AI Act readiness positioning
Holistic AI	AI governance & audit	Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	NYC LL144 audit support (claimed)EU AI Act readiness positioning
IBM watsonx.governance	AI governance platform	Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	ISO 42001 alignment (claimed)Art. 11 documentation support (claimed)
ModelOp	AI/model governance	Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed)
Monitaur	insurance & lending model governance	Model governance and documentation aimed at insurance and lending supervision. Typical: insurance underwriting, credit decisioning. Scope overlap: Its model-governance scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	NAIC model-governance positioning (claimed)SR 11-7 practice alignment (claimed)
OneTrust	GRC & privacy platform	Privacy and AI governance modules extending an existing GRC system of record. Typical: DPIA/FRIA workflow, policy management. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	ISO 27001 (claimed)GDPR-positioned
ServiceNow	intake & ITSM workflow	Use-case intake, approval workflow and risk records inside an existing ITSM estate. Typical: AI intake, policy administration. Scope overlap: Its AI-governance module overlaps this platform's own scope; we have a commercial interest in the comparison.	SaaS (vendor cloud)	ISO 42001 alignment (claimed)EU AI Act readiness positioning

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graph dispute / propose change

Runtime Security & Guardrail Vendors

First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.

unverified · verified 2026-08-18 community-maintained

selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Lakera	guardrail proxy	Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering.	not checked	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
HiddenLayer	model/agent detection & response	Model-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry.	not checked	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Palo Alto Prisma AIRS	network-integrated AI security	AI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control.	not checked	SOC 2 (claimed)enterprise security integration (claimed)
Cisco AI Defense	network-integrated AI security	Discovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement.	not checked	enterprise security integration (claimed)
NVIDIA NeMo Guardrails	open guardrail framework	Programmable dialogue and action rails, self-hostable alongside your models. Typical: dialogue rails, action gating.	open source	supports Art. 15 robustness measures (claimed)
Guardrails AI	open guardrail framework	Open validator library for structured output checks and policy validators. Typical: output validation, schema enforcement.	open source	OSS, no vendor certification
Garak	adversarial scanner	Open-source LLM vulnerability scanner used for pre-deployment probing. Typical: red-teaming, release gating.	not checked	OSS, no vendor certificationsupports Art. 15 testing evidence (claimed)
Protect AI	ML supply-chain & model security	Model scanning and ML supply-chain security tooling (Palo Alto Networks acquisition reported 2025). Typical: model scanning, supply-chain security.	SaaS (vendor cloud)	supports Art. 15 cybersecurity measures (claimed)

open in graph dispute / propose change

Secure Data Infrastructure & Vector Storage

Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.

unverified · verified 2026-08-18 community-maintained

selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Azure AI Search	managed retrieval	Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search.	not checked	ISO 27001 (claimed)SOC 2 (claimed)
Databricks Unity Catalog	governed lakehouse	Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG.	not checked	SOC 2 (claimed)lineage/Art. 10 support (claimed)
Relyance AI	code-level data & AI lineage	Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	GDPR programme tooling (claimed)EU AI Act readiness positioning
Snowflake Cortex	governed lakehouse	Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics.	not checked	SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)

open in graph dispute / propose change

Regulated Foundation-Model Platforms

Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Named products live in marketExamples, where the deployment model is recorded in the hosting field rather than asserted in prose. What the class buys you: a model supply relationship with contractual data handling and documentation you can pass to a customer. GPAI-chapter duties and provider due diligence attach at this layer. Selection metrics: see meta.marketLandscape.selectionMetrics.models.

unverified · verified 2026-08-18 community-maintained

selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
OpenAI (Enterprise / API)	proprietary frontier	Enterprise tiers offer zero-data-retention and no-training commitments over the commercial API. Typical: general copilots, document reasoning.	not checked	SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)GDPR-positioned
Anthropic Claude (Enterprise)	proprietary frontier	Enterprise/ZDR tiers with published safety and model documentation practice. Typical: regulated assistants, long-context analysis.	not checked	SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)HIPAA-eligible (claimed)
Google Gemini Enterprise	proprietary frontier	Vertex-hosted frontier models with regional grounding and customer-managed keys. Typical: enterprise search, multimodal workflows.	not checked	SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)EU data-boundary positioning
Cohere	proprietary frontier	Private-cloud and on-prem deployment of retrieval-oriented models. Typical: private RAG, enterprise search.	self-hostable	SOC 2 (claimed)
Mistral AI	open-weight / EU	EU-headquartered provider; positions its open-weight offering for EU sovereignty and auditability requirements — the open-source exemption question is contested and not treated here as settled. Typical: sovereign deployments, self-hosted inference.	self-hostable	EU sovereignty positioning
Meta Llama	open-weight / EU	Openly licensed weights that can be self-hosted under your own jurisdiction and inspection regime. Typical: self-hosted inference, air-gapped deployments.	not checked	open-weight sovereignty positioning
Gretel	synthetic data	Synthetic tabular and text generation with privacy metrics for training-data substitution. Typical: bias mitigation, data minimisation.	not checked	Art. 10 data-governance support (claimed)GDPR-positioned
Tonic.ai	synthetic data	De-identification and synthetic test data for regulated development environments. Typical: test data, de-identified pipelines.	not checked	SOC 2 (claimed)HIPAA-positioned
MOSTLY AI	synthetic data	Synthetic data generation with fairness and representativeness reporting. Typical: bias mitigation, data sharing.	not checked	GDPR-positioned Art. 10 data-governance support (claimed)
Scale AI	fine-tuning / data ops	Human labelling, evaluation and RLHF pipelines for enterprise fine-tuning. Typical: fine-tuning, model evaluation.	not checked	SOC 2 (claimed)evaluation-evidence positioning
Weights & Biases	fine-tuning / MLOps	Experiment tracking, model registry and evaluation records across training runs. Typical: training records, model registry.	not checked	SOC 2 (claimed)Art. 11 documentation support (claimed)

open in graph dispute / propose change

Agent Orchestration & SDLC Toolkits

Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.

unverified · verified 2026-08-18 community-maintained

selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
LangChain / LangGraph	agent framework	Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows.	not checked	supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed)
LlamaIndex	RAG framework	Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents.	open source	retrieval-governance positioning
Microsoft AutoGen	multi-agent framework	Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents.	not checked	research/OSS, no vendor certification
CrewAI	multi-agent framework	Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents.	not checked	vendor-stated security posture
DSPy	prompt/program optimisation	Declarative programs with optimisers that make prompt changes reproducible and testable. Typical: evaluated pipelines, model validation.	not checked	model-validation positioning (SR 11-7 style, claimed)
Semantic Kernel	enterprise SDK	Microsoft SDK for planners and plugins inside .NET/Java estates. Typical: enterprise copilots, tool plugins.	not checked	enterprise-estate integration (claimed)
PydanticAI	typed agent SDK	Type-validated agent outputs and tool signatures for deterministic contracts. Typical: structured outputs, typed tool calls.	not checked	schema-enforcement positioning
Model Context Protocol (MCP)	protocol / standard	Open protocol for tool and context exposure; a protocol, not a product — governance sits in the gateway around it. Typical: tool interoperability, gateway mediation.	not checked	open protocol, no certification
E2B	sandboxed runtime	Ephemeral cloud sandboxes for agent code execution with isolation per task. Typical: code agents, untrusted execution.	not checked	isolation/sandbox positioning
Airia	enterprise agent platform	Enterprise platform for building and running agents with connector, policy and routing layers. Typical: agent orchestration, internal copilots.	SaaS (vendor cloud)	EU AI Act readiness positioningSOC 2 programme positioning (claimed)

open in graph dispute / propose change

Productized Vertical AI (Service-as-a-Software)

Turnkey domain execution platforms delivering outcomes under SLA: multi-model engines plus industry playbooks plus embedded guardrails, operated by the provider with specialist QA. Named products live in marketExamples; a certification appears as a certification only where a certificate or registry reference is recorded on the entry. The buyer's duties do not disappear — see meta.deliveryModels.regulatedCaveats and ctl-thirdparty-ai. Selection metrics: see meta.marketLandscape.selectionMetrics.productized.

unverified · verified 2026-08-18 community-maintained

selection metrics: ISO 42001 certification, outcome-based SLAs with compliance artifacts included, domain playbook depth, auditability of the provider's own pipeline

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
eClerx GenAI360	Outcome-priced domain platform	Turnkey ComplianceOps / CareOps / ContentOps class modules operated by the provider with specialist QA. Typical: compliance operations, customer operations, content operations.	not checked	ISO 42001 (claimed)
WNS	Managed AI-enabled business process	Business-process provider delivering AI-assisted domain execution under SLA. Typical: finance operations, customer operations.	not checked	SOC 2 (claimed)
workflows.io	AI-native agency OS	AI-native operating system for agency-style delivery of repeatable knowledge work. Typical: content operations, marketing operations.	not checked	GDPR-positioned

open in graph dispute / propose change

Sovereign Infrastructure

Compute and storage under EU jurisdictional control. Two structurally different offers, and the difference is the decision: native EU providers give full jurisdictional isolation with narrower service catalogs and thinner managed-AI tooling; hyperscaler sovereign constructions give the broad catalog with contractual and operational isolation, where the residual question is the control plane, support access and operational metadata rather than the data plane. Named offers live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. Claimed alignments recorded per entry: positioning for BSI C5 / C3A and ANSSI SecNumCloud attestation, NIS2 and DORA third-party requirements. Nothing here is an endorsement, and no provider in this category is 'CLOUD-Act-proof' by label alone — ask who holds the keys and who administers the plane.

unverified · verified 2026-08-18 community-maintained

selection metrics: jurisdiction of the control plane (not only the data plane), operator nationality and support-access paths, key custody, C5 / C3A / SecNumCloud attestation scope, managed-AI service depth vs. isolation trade-off, exit and repatriation terms

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
OVHcloud	native EU	French provider with EU-only jurisdiction and a narrower managed-AI catalog than the hyperscalers. Typical: EU-resident inference, regulated workload hosting.	not checked	ISO 27001 (claimed)SecNumCloud-positioned GDPR-positioned
Scaleway	native EU	EU-operated cloud with GPU instances and managed inference under French corporate control. Typical: EU-resident inference, fine-tuning.	not checked	ISO 27001 (claimed)GDPR-positioned
STACKIT	native EU	German provider (Schwarz Group) positioned for data residency in Germany. Typical: public sector, retail data platforms.	not checked	C5-positioned GDPR-positioned
AWS European Sovereign Cloud	sovereign hyperscaler	Separately operated EU region set with EU-resident personnel and keys; full hyperscaler catalog. Typical: large-scale enterprise AI, regulated hosting.	not checked	ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning
Microsoft Azure EU Data Boundary	sovereign hyperscaler	EU processing and storage boundary across Azure and Copilot services with confidential-compute options. Typical: enterprise copilots, regulated hosting.	not checked	ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning
Google Cloud Sovereign Controls	sovereign hyperscaler	Partner-operated and data-boundary variants with external key management. Typical: regulated analytics, EU-resident inference.	not checked	ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning
Groq	specialized GPU / accelerator	LPU inference hardware marketed on deterministic low latency rather than training throughput. Typical: low-latency agents, real-time decisioning.	not checked	SOC 2 (claimed)
CoreWeave	specialized GPU / accelerator	GPU-dense cloud for training and high-throughput inference with dedicated capacity contracts. Typical: model training, batch inference.	not checked	SOC 2 (claimed)ISO 27001 (claimed)
Lambda Labs	specialized GPU / accelerator	GPU cloud and on-prem clusters aimed at research and fine-tuning workloads. Typical: fine-tuning, research clusters.	not checked	SOC 2 (claimed)
Together AI	inference platform	Hosted open-weight model inference and fine-tuning with per-token pricing. Typical: open-weight inference, fine-tuning.	not checked	SOC 2 (claimed)open-weight sovereignty positioning
Fireworks AI	inference platform	Optimised serving of open-weight models with function-calling and structured output support. Typical: agent tool-calling, high-QPS inference.	not checked	SOC 2 (claimed)HIPAA-eligible (claimed)
Baseten	inference platform	Model deployment platform with autoscaling endpoints and VPC deployment options. Typical: custom model serving, VPC-isolated inference.	not checked	SOC 2 (claimed)HIPAA-eligible (claimed)
Modal	serverless compute	Serverless GPU execution for jobs, batch pipelines and sandboxed agent tasks. Typical: batch pipelines, sandboxed execution.	not checked	SOC 2 (claimed)
Replicate	serverless compute	API-first hosting of community and custom models, priced per run. Typical: prototyping, multimodal inference.	not checked	vendor-stated security posture
Anyscale	serverless compute	Managed Ray for distributed training, serving and multi-step agent workloads. Typical: distributed training, agent fan-out.	not checked	SOC 2 (claimed)

open in graph dispute / propose change

Confidential Computing & Privacy Engines

Data-in-use protection and pre-model privacy interception: enclave and runtime encryption, key management, tokenisation vaults, PII detection and redaction, application-layer and vector encryption. Named products live in marketExamples; prose here describes the class. Select on: enclave attestation support, key custody model (external HSM / BYOK), detokenisation audit trail, latency added per call, and coverage of the identifier classes your regime actually names. Selection metrics: see meta.marketLandscape.selectionMetrics.privacy.

unverified · verified 2026-08-18 community-maintained

selection metrics: enclave attestation support, key custody (external HSM / BYOK), detokenisation audit trail, added latency per call, coverage of the identifier classes your regime names, in-boundary deployment option

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Anjuna	confidential computing	Runs workloads inside hardware enclaves without application rewrites. Typical: data-in-use protection, regulated inference.	not checked	confidential-computing positioningDORA-positioned (claimed)
Fortanix	confidential computing & KMS	Enclave runtime plus key management and tokenisation services. Typical: key management, data-in-use protection.	not checked	FIPS 140-2 (claimed)DORA-positioned (claimed)HIPAA-positioned (claimed)
Skyflow	privacy vault	Polymorphic data vault de-identifying records before they reach a model. Typical: PII vaulting, pre-model redaction.	not checked	SOC 2 (claimed)HIPAA-positioned GDPR-positioned
Private AI	PII detection & redaction	Detection and redaction of identifiers across text, documents and audio. Typical: inline redaction, document de-identification.	not checked	GDPR-positioned HIPAA-positioned
IronCore Labs	encrypted vector search	Application-layer encryption for embeddings, addressing vector-reconstruction risk. Typical: encrypted RAG, erasure support.	not checked	GDPR-positionederasure/embedding-risk positioning

open in graph dispute / propose change

Agentic Execution Governance

The youngest tier: governance of what an agent is allowed to do at execution time — non-human identity, per-task scoping, action approval, agent inventory and agent-level red-teaming. Named products live in marketExamples; prose here describes the class. Because the category is new, capability claims outrun deployments: ask for a reference in your own regime before believing a control is covered, and treat entries with limited public verification as unconfirmed. Selection metrics: see meta.marketLandscape.selectionMetrics.agentgov.

unverified · verified 2026-08-18 community-maintained

selection metrics: non-human identity inventory completeness, credential time-to-live and revocation latency, per-action approval hooks, agent-level red-team coverage, evidence export a 2nd line can read, deployment references in your regime

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Pillar Security	agent security & inventory	Discovery, inventory and runtime policy for agents in the estate. Typical: agent registry, policy enforcement.	not checked	agent-inventory positioning
Lyzr	agent governance & observability	Agent platform with governance, approval and observability features. Typical: agent approval, agent analytics.	not checked	vendor-stated security posture
Astrix Security	non-human identity	Lifecycle governance of machine and agent identities and their grants. Typical: credential scoping, NHI inventory.	not checked	SOC 2 (claimed)NHI governance positioning
Britive	just-in-time access	Ephemeral, per-task privileges instead of standing credentials. Typical: JIT credentials, privilege reduction.	not checked	SOC 2 (claimed)least-privilege positioning

open in graph dispute / propose change

Grounding, Retrieval & Agent Memory

The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.

unverified · verified 2026-08-18 community-maintained

selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Docling	document parser	Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines.	self-hostable	EU sovereignty positioning
LlamaParse	document parser	Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction.	not checked	SOC 2 (claimed)
Amazon Textract	document parser	OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing.	not checked	SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed)
Diffbot	web/knowledge extraction	Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution.	not checked	vendor-stated security posture
Firecrawl	web/knowledge extraction	Crawling and clean markdown extraction for grounding on public sources. Typical: regulatory monitoring, public-source grounding.	not checked	vendor-stated security posture
Voyage AI	embeddings	Domain-tuned embedding models including legal and finance variants. Typical: retrieval quality, domain RAG.	not checked	vendor-stated security posture
Nomic	embeddings	Open embedding models with local inference and dataset visualisation. Typical: on-prem retrieval, dataset inspection.	self-hostable
Pinecone	vector database	Managed serverless vector search with namespace isolation. Typical: tenant-isolated RAG, semantic search.	not checked	SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)
Weaviate	vector database	Vector database available managed or self-hosted with hybrid search. Typical: hybrid retrieval, self-hosted RAG.	open source	SOC 2 (claimed)
Qdrant	vector database	Open-source vector store with payload filtering and on-prem deployment. Typical: air-gapped RAG, filtered retrieval.	open source	GDPR-positioned
Milvus	vector database	Open-source vector database for very large collections. Typical: large-scale retrieval.	open source
pgvector	vector database	Postgres extension keeping vectors under the same RBAC, backup and retention regime as records. Typical: record-bound retrieval, small-scale RAG.	self-hostable	record-retention alignment (claimed)
Letta (MemGPT)	agent memory store	Persistent agent memory with explicit memory blocks and editing. Typical: long-running agents, personalisation.	self-hostable
Mem0	agent memory store	Memory layer extracting durable facts from agent conversations. Typical: personalised agents, support copilots.	not checked	vendor-stated security posture
Zep	agent memory store	Temporal knowledge-graph memory with fact validity intervals. Typical: auditable memory, long-running agents.	not checked	GDPR-positionedbitemporal record positioning
Cognee	agent memory store	Open-source memory/knowledge pipeline building graphs from agent interactions. Typical: knowledge accumulation, research agents.	self-hostable

open in graph dispute / propose change

Agent Observability & Model Risk Management

Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.

unverified · verified 2026-08-18 community-maintained

selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
LangSmith	agent tracing & evaluation	Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation.	not checked	SOC 2 (claimed)supports Art. 12 record-keeping (claimed)
Langfuse	agent tracing & evaluation	Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics.	open source	GDPR-positioned supports Art. 12 record-keeping (claimed)
Arize AI / Phoenix	ML & LLM observability	Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics.	not checked	SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed)
Helicone	LLM gateway & logging	Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control.	not checked	SOC 2 (claimed)supports Art. 12 record-keeping (claimed)
MLflow	experiment & model registry	Open-source tracking, model registry and lineage across training and deployment. Typical: model registry, validation records.	open source	model-validation positioning (SR 11-7 style, claimed)
Ragas	RAG evaluation	Open evaluation metrics for retrieval faithfulness and answer grounding. Typical: grounding checks, RAG regression.	not checked	OSS, no vendor certification
Deepchecks	validation & testing	Continuous validation suites for data and model behaviour. Typical: release gating, data validation.	not checked	evaluation-evidence positioning
Fairlearn	fairness toolkit	Open-source fairness assessment and mitigation for classification and regression. Typical: bias testing, fairness reporting.	not checked	OSS, no vendor certificationsupports Art. 10 bias examination (claimed)
Fiddler AI	model performance management	Explainability and monitoring platform aimed at regulated model risk teams. Typical: explainability, model monitoring.	not checked	SOC 2 (claimed)model-risk positioning (SR 11-7 style, claimed)
ValidMind	model risk management	Model validation documentation and workflow for banking model-risk functions. Typical: validation reports, MRM workflow.	not checked	SOC 2 (claimed)model-risk positioning (SR 11-7 style, claimed)
WhyLabs	data & model monitoring	Telemetry and drift monitoring over model inputs and outputs. Typical: drift detection, data quality monitoring.	SaaS (vendor cloud)	supports Art. 72 post-market monitoring (claimed)
Evidently AI	evaluation & monitoring	Open-source evaluation and monitoring reports for ML and LLM pipelines. Typical: evaluation reports, drift detection.	open source	supports Art. 72 post-market monitoring (claimed)
Galileo AI	LLM evaluation & observability	Evaluation metrics and traces for generative applications. Typical: LLM evaluation, trace inspection.	SaaS (vendor cloud)	supports Art. 15 accuracy measures (claimed)
Patronus AI · eingestellt (2026-08-31)	automated LLM evaluation	Automated scoring and adversarial test suites for generative output. Typical: automated evaluation, red teaming.	SaaS (vendor cloud)	supports Art. 15 robustness measures (claimed)
Arthur AI	model performance monitoring	Performance, bias and drift monitoring across deployed models. Typical: bias monitoring, performance monitoring.	SaaS (vendor cloud)	supports Art. 72 post-market monitoring (claimed)supports Art. 10 bias examination (claimed)

open in graph dispute / propose change

Agentic Applications & Copilots

Finished agentic products bought rather than built: developer and productivity copilots, research assistants, SOC and support agents. The governance point is not the product but the wrapper: these tools act with delegated authority inside your estate, so they belong in the agent inventory, need scoped non-human identities and permission boundaries, and inherit deployer duties — buying the product does not buy the obligations away.

unverified · verified 2026-08-18 community-maintained

selection metrics: Permission model and identity scoping; audit log export; tenant data-handling and retention terms; deployer-duty support (disclosure, oversight, incident reporting); outcome pricing vs seat pricing.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
GitHub Copilot	developer copilot	Code completion and agent modes inside the IDE and repository workflow. Typical: software engineering, code review.	not checked	SOC 2 (claimed)enterprise data-handling commitments (claimed)
Microsoft 365 Copilot	productivity copilot	Assistant across mail, documents and meetings inheriting existing tenant permissions. Typical: knowledge work, meeting summaries.	not checked	ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning
Perplexity Enterprise	research assistant	Cited web and internal search with source attribution per answer. Typical: market research, citation-backed search.	not checked	SOC 2 (claimed)enterprise data-handling commitments (claimed)
Cursor	developer copilot	AI-native editor with repository-wide agent edits. Typical: software engineering, refactoring.	not checked	SOC 2 (claimed)privacy-mode option (claimed)
Dropzone AI	security operations agent	Autonomous triage of security alerts with written investigation records. Typical: SOC triage, incident write-ups.	not checked	SOC 2 (claimed)
Devin (Cognition)	autonomous software agent	Long-running software agent taking tickets to pull requests. Typical: software engineering, backlog automation.	not checked	vendor-stated security posture
Vanta	compliance automation	Continuous control monitoring and evidence collection across frameworks. Typical: evidence automation, audit readiness.	not checked	SOC 2 (claimed)ISO 27001/42001 evidence workflows (claimed)
Fin (Intercom)	customer-service agent	Resolution-priced support agent answering from your help content. Typical: customer support, deflection.	not checked	SOC 2 (claimed)GDPR-positioned
SAP	embedded enterprise AI	AI features and agents embedded in ERP, HR and procurement suites, governed through the vendor's own AI platform layer. Typical: embedded HR AI, procurement automation, finance automation.	SaaS (vendor cloud)	ISO/IEC 42001 certification claim (claimed)EU AI Act readiness positioning

open in graph dispute / propose change

Runtime Guardrails & Enforcement

Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.

unverified · verified 2026-08-18 community-maintained

selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Guardrails AI	validation framework	Open-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output.	open source	supports Art. 15 robustness measures (claimed)
NVIDIA NeMo Guardrails	dialogue policy rails	Programmable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy.	open source	supports Art. 50 interaction disclosure patterns (claimed)
Lakera AI	guardrail proxy	Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering.	SaaS (vendor cloud)	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Credal AI	enterprise access & policy layer	Permission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP.	SaaS (vendor cloud)	SOC 2 (claimed)

open in graph dispute / propose change

Cryptographic Evidence & Audit Ledger

Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.

unverified · verified 2026-08-18 community-maintained

selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Fact0	cryptographic evidence ledger	Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail.	not checked	supports Art. 12 record-keeping (claimed)
Traccia	audit trail & traceability	Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage.	not checked	supports Art. 12 record-keeping (claimed)

open in graph dispute / propose change

AI Asset Discovery & Shadow-AI Inventory

Automated discovery of AI in an existing estate: model and agent detection in source repositories, LLM API egress in cloud and network telemetry, AI features switched on inside employee SaaS, reconciliation against the CMDB and the AI register, ownership attribution and drift between declared and observed estate. Distinct from the GRC layer, which is the system of record for what is already known: this class finds the population that record is supposed to cover. Selection metrics: see meta.marketLandscape.selectionMetrics.discovery.

unverified · verified 2026-08-17 community-maintained

selection metrics: Coverage of the estate you actually have (repos, cloud accounts, SaaS tenants, network egress) rather than the connector count; false-positive rate on detected AI usage; whether findings reconcile into your existing register rather than a second inventory; ownership attribution quality; agent-based vs. agentless deployment; whether discovery data leaves your tenancy.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Truyo	shadow-AI discovery	Discovery of AI usage across SaaS and cloud accounts with intake and governance workflow on top. Typical: shadow-AI inventory, AI intake. Scope overlap: Its governance-workflow scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	EU AI Act readiness positioning GDPR programme tooling (claimed)

open in graph dispute / propose change

AI Supply-Chain Security & AIBOM

Bills of materials for AI: base architecture, training-data dependencies, fine-tuning history and licence lineage of a model, plus scanning of third-party pretrained weights and model artifacts for backdoors, poisoning and tampering before ingestion. Adjacent to, but not the same as, software SBOM tooling — the unit of analysis is a weights artifact and its provenance. Selection metrics: see meta.marketLandscape.selectionMetrics.supplychain.

unverified · verified 2026-08-17 community-maintained

selection metrics: Whether the AIBOM records training-data and fine-tuning lineage or only package dependencies; artifact formats scanned (safetensors, pickle, GGUF, container images); detection basis for tampering and poisoning (signature, behavioural, provenance attestation) and its false-positive rate; support for signing and verifying weights in your own pipeline; whether ingestion can be blocked, not just reported.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Cranium AI	AIBOM & model provenance	AI bill-of-materials generation, model-provenance capture and third-party model risk scanning. Typical: AIBOM, third-party model ingestion. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	NIST AI RMF alignment (claimed)EU AI Act readiness positioning

open in graph dispute / propose change

Public Transparency Registers & System Cards

Authoring and publishing the outward-facing record: public AI registers, system and model cards, conformity declarations and plain-language notices, with versioning so a published statement can be tied to the system version it described. The register content is produced elsewhere; this class is the publication and version-control surface for it. Selection metrics: see meta.marketLandscape.selectionMetrics.transparency.

unverified · verified 2026-08-17 community-maintained

selection metrics: Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Saidot	public AI register	AI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	EU AI Act documentation positioning ISO 42001 alignment (claimed)

open in graph dispute / propose change

Market dynamics: Thin wrappers around foundation-model APIs commoditize as providers absorb enterprise features; durable moats are (a) integrated GRC infrastructure spanning heterogeneous clouds and legacy estates, and (b) productized vertical execution with certified operations. Cross-framework control deduplication ('governance graph' products) is the market's rediscovery of this graph's reuse principle — one operational control mapped to many regimes at once.

Reference stacks by regulatory profile

Three illustrative assemblies across the five procurement tiers, taken from the Aug 2026 vendor research compilation. They are starting points for a build-or-buy conversation, not certified stacks: no combination of the products below makes a deployment compliant, and every vendor name here is a community-disputable example rather than an endorsement.

Five procurement tiers (5)

Tier 1 · Sovereign infrastructure — where compute, storage and the control plane sit, and under whose law.

Tier 2 · Confidential computing & privacy engines — protection of data in use and pre-model interception of identifiers.

Tier 3 · Runtime AI security — inline guardrails, injection defence and action interception at request time.

Tier 4 · Agentic execution governance — non-human identity, per-task scoping, action approval and agent inventory.

Tier 5 · Governance systems of record — the 2nd-line registry, control evidence and regulatory reporting.

Financial services

Credit scoring and pricing, agentic trading and portfolio support, agentic procurement and deal desks — Annex III high-risk classes plus DORA operational resilience and Fed SR 11-7 model-risk practice; retained-records rules (SEC 17a-4, FINRA 4511) reach agent memory.

Typical use-case classes

AI Credit Scoring & Loan Decisioning Trade Lifecycle & Settlement Reconciliation Algorithmic Portfolio Execution & Advisory Autonomous Procurement / Ops Agent

Sovereign infrastructure

Hyperscaler sovereign construction where the managed-AI catalog is needed (AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty); native EU (OVHcloud, STACKIT) where the control plane must stay national.

Confidential computing & privacy

Fortanix or Anjuna for data-in-use and key custody (Fortanix positioned for DORA data-in-use expectations); Skyflow for payment/identifier tokenisation.

Runtime AI security

Lakera/Check Point or Palo Alto Prisma AIRS inline; Azure AI Content Safety where the workload already sits there.

Agentic execution governance

Pillar Security or Microsoft Agent Governance Toolkit for non-human identity and action approval; Mindgard for agent red-teaming cycles.

Governance systems of record

ModelOp or ValidMind for model-risk documentation and validation (claims alignment with SR 11-7 practice; reported updated US banking guidance 'SR 26-2' pending verification); Credo AI or IBM watsonx.governance for the AI Act registry.

Healthcare

Clinical documentation, triage support and diagnostic assistance — HIPAA where US data is involved, FDA SaMD where the function is a medical device, AI Act Annex I/III where the system is a safety component or an Annex III use.

Typical use-case classes

Clinical Documentation & Ambient Scribing Diagnostic Decision Support

Sovereign infrastructure

EU-region deployment with in-boundary inference; native EU providers where patient data must not touch a non-EU-controlled plane.

Confidential computing & privacy

Private AI or Skyflow for PHI redaction and tokenisation before the model call; Fortanix for data-in-use (claims HIPAA alignment).

Runtime AI security

Guardrail layer tuned for clinical hallucination and unsafe-advice classes (NeMo Guardrails, Aim Security, Lakera).

Agentic execution governance

Keep autonomy low: action approval and per-task scoping (Pillar Security class) rather than autonomous execution.

Governance systems of record

Enzai or Holistic AI for the AI Act and clinical-governance registry; ValidMind for performance validation evidence.

Public sector

Benefit eligibility, casework triage and citizen-facing assistants — Annex III public-service classes, NIS2 for essential entities, and sovereignty bars (BSI C5/C3A, ANSSI SecNumCloud) that most tenders now encode.

Typical use-case classes

Public Benefits & Eligibility Decisions Customer Service Chatbot / Assistant

Sovereign infrastructure

Native EU or nationally qualified providers (OVHcloud/SecNumCloud-qualified offers, STACKIT, Scaleway); hyperscaler sovereign constructions only where the tender accepts the control-plane residual.

Confidential computing & privacy

BYOK/HYOK with external key custody; IronCore Labs class encryption for vector stores holding case data.

Runtime AI security

Self-hostable guardrails (NeMo Guardrails) so the inline security layer does not itself export prompts.

Agentic execution governance

Human decision retained by law: registry, action logging and non-human identity, not autonomous action.

Governance systems of record

Sprinto or Enzai for control automation and the public accountability record; Monitaur for decision-level auditability.

Delivery models

BPO · SaaS · Service-as-a-Software

BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk

SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk

Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk

Caveats in regulated markets

— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.

— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.

— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).

— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.

Service-as-a-Software Delivery Three Lines of Defense Separation CO: Embedded-AI Vendor Governance Gartner AI TRiSM

Translational pipeline

Use case → risk tier → control layers → vendor stack

use-case identification → statutory & risk tiering → architectural control layers → vendor stack mapping

useCase —classified_as→ riskClass —imposes→ article —operationalized_by→ control objective —satisfied_by→ component/pattern —supplied_by→ vendorCategory; evidence hangs off obligations and control objectives throughout.

Enterprises fail in one of two directions: over-engineering (redundant controls, latency, cost) or under-engineering (regulatory exposure). The pipeline forces proportionality: the risk tier — not the vendor pitch — decides the control depth, and the control set — not the incumbent stack — decides the vendor shortlist.

Intake binding

The operational front door is a structured intake portal (comp-intake): business objective, autonomy degree, data sensitivity, deployment context → automated tier proposal via the detectors + evaluator pipeline → approval workflow → register entry with AI-BOM stub. Nothing reaches production without passing through it — Shadow-AI discovery is the enforcement backstop.

SaaS 1.0 vs. Service as Software

The structural shift: software stops being a tool a human operates and becomes the digital labour layer that completes the outcome. Every row changes what a regulator can inspect.

Structural dimension	SaaS 1.0	Service as Software (SaaS 2.0)
Primary functional role	System of record / engagement	System of action / digital labour layer
Cognitive ownership	Human reasons, software executes commands	AI agent reasons, plans and executes autonomously
Monetization architecture	Per-seat subscription licensing	Outcome-based, transaction-based or hybrid-metered
Interface & interaction	Dashboard, GUI, web portal	API orchestration, background execution, local MCP
Economic value proposition	Efficiency — speeds up human tasks	Task completion — replaces or scales cognitive labour
Gross margin profile	80–90%	50–60% (inference and compute cost per task)
Enterprise integration point	User provisioning and feature adoption	Deep API integration, data pipelines, dynamic governance
Regulatory centre of gravity	Access control and data processing	Autonomy bounds, logging, attribution and human oversight

Unit economics under outcome pricing

Hybrid base-plus-outcome: a base fee covers infrastructure, model access and continuous compliance monitoring; outcome tiers bill per verified completion, protecting the provider against un-recouped inference cost during exploratory usage.

Task granularity and dynamic model routing: routine reasoning goes to small fine-tuned models, frontier models are reserved for edge cases — the routing policy itself becomes a documented design decision under Art. 11.

Caveat: Outcome pricing moves execution risk to the provider but not the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise.

Agentic execution stack — seven layers in three tiers

The layered architecture that replaces frontend + database + manual operations, grouped into Engagement (who and what talks to your agents), Capabilities (how they decide and act) and Data (what is kept, and as which kind of record). Each layer carries a specific statutory hook: oversight that is not in the layer where the action happens cannot stop it. The layer taxonomy is adapted from the Al-Risk.ai / Agentico.ai agentic enterprise stack model (2025); the obligations mapping is ours.

Interfaces

Web, app and voice surfaces, digital wallets, social channels, enterprise collaboration tools and marketplace/discovery APIs. Every one of them needs an AI-interaction notice, machine-readable marking of generated or manipulated output, and a disclosure record that survives the session. Public social surfaces add DSA duties; consumer-facing surfaces add accessibility (European Accessibility Act) and sector conduct rules.

components & patterns: Interface Transparency & Content-Marking Layer Synthetic-Content Labelling / Watermarking HITL Escalation Queue & Review UI

obligations: Art. 50 — Transparency Duties Digital Services Act

Third-party agents

Inbound and outbound agent-to-agent interaction: discovery, authentication of the counterparty, mandate and value limits, and a resolvable answer to 'which external principal caused this transaction'. This is where liability allocation stops being theoretical — an external agent acting on your system can flip roles along the value chain.

components & patterns: Agent Discovery & Registry Endpoint Supervisor Attribution Chain Agentic Zero Trust

obligations: Art. 25 — Value Chain / Role Flip Art. 26 — Deployer Obligations

Controls

Guardrails, confidence minima, disbursement and margin caps, non-human identity and the fail-safe stop. Breaching a limit halts all sub-agents and reverts to a safe state rather than continuing at degraded confidence; agents hold ephemeral, per-task credentials rather than standing grants.

components & patterns: Non-Human Identity Credential Broker Guardrail Sidecar / Interception Materiality-Threshold Escalation Kill Switch / Graceful Degradation

obligations: Art. 14 — Human Oversight Art. 15 — Accuracy, Robustness, Cybersecurity

Orchestration

Goal-directed reasoning, tool selection across enterprise APIs, confidence scoring per step, and the human-machine interface with a global halt control. The orchestration policy is a documented design decision, not an implementation detail.

components & patterns: Cognitive Orchestrator Confidence Scoring & Threshold Gate Confidence-Threshold HITL Routing

obligations: Art. 14 — Human Oversight Art. 11 — Technical Documentation

Intelligence

Model routing between small fine-tuned models and frontier models, inference economics, drift monitoring and explanation surfaces. Which model answered which request is part of the technical documentation trail.

components & patterns: Multi-Model Router & Fallback Abstraction Model Abstraction & Graceful Fallback Model Drift & Accuracy Monitor

obligations: Art. 11 — Technical Documentation Art. 15 — Accuracy, Robustness, Cybersecurity

Tools

Agents execute inside the corporate perimeter and reach tools over MCP with context scoped to the minimum attributes required. Every action leaves through one schema-validated boundary that rejects out-of-contract calls and records the attempt either way, instead of shipping raw records to third-party endpoints.

components & patterns: Tool-Use Boundary Proxy MCP Gateway / Proxy Local Perimeter Execution (MCP)Central Credential Vault

obligations: Art. 15 — Accuracy, Robustness, Cybersecurity GDPR

Systems of record

Databases and lakes, tokenisation, vector and graph stores, file systems, agent-workforce accounting — and agent memory treated as a regulated record rather than a cache, with retention schedules, erasure paths that do not break the audit trail, and jurisdictional placement of both data and control plane.

components & patterns: Agent Memory Record Store WORM / Immutable Audit Vault PII/PHI Redaction & Tokenisation Engine Sovereign Deployment Boundary

obligations: Art. 12 — Record-Keeping / Logging SEC Rule 17a-4 (US Records Retention)FINRA Rule 4511 (General Books & Records)GDPR

Implementation priorities (5)

1. Maintain a central inventory of AI use cases and agentic workflows, each catalogued by domain, data dependencies, outcome metric and applicable framework — with a named natural person accountable for each deployment.

2. Move procurement from per-seat licensing to outcome-aligned, consumption-metered contracts that tie spend to verified results and push evidence duties into the provider contract.

3. Mandate oversight infrastructure across every execution layer: accessible HMI, anti-automation-bias safeguards, WORM logging, emergency stop and an unbroken attribution chain.

4. Inventory non-human identities the way you inventory employees: every agent and tool caller has its own identity, a credential lifetime measured in minutes, and an owner who can revoke it — no agent holds a standing credential into production.

5. Decide explicitly whether your agents' memory is a record. If a supervisor could ask for it, it needs a retention schedule, an export format and a jurisdiction — deciding by default means the storage tier decided for you.

Operating model

Operating dimension	Legacy BPO / IT services	Traditional SaaS	Service-as-a-Software
Primary value metric	Input (billable hours & FTEs)	Capability (software access)	Outcome (SLA & completed work)
Scaling mechanism	Linear headcount expansion	User subscriptions	Algorithmic execution at scale
Operational responsibility	Shared / vendor manual labour	Client internal teams	Provider-managed AI systems
Unit economics	High variable labour cost	High gross margin, low service	High margin, non-linear revenue
Primary exposure risk	Human error & attrition	Implementation / adoption failure	Algorithmic bias & non-compliance

The four-stage compliant pipeline

Ingestion & data isolation

Client payload → zero-trust gateway → PII/PHI anonymisation → isolated tenant enclave

Personal and health data are detected and tokenised before any payload reaches an inference path; storage, indexes and embeddings are partitioned per client with RBAC and customer-managed keys.

components: Zero-Trust Ingestion Gateway PII Scrubbing / DLP-NER Layer Isolated Tenant Storage Enclave Segmented Vector Store (RBAC + CMEK)

obligations: Art. 10 — Data Governance GDPR Art. 25 — Data Protection by Design

Deterministic prompt & guardrail orchestration

Sanitised payload → input guardrails → entitlement-scoped retrieval → prompt construction

Retrieval is scoped by tenant and caller entitlement; input rails screen for injection and out-of-policy requests before context is assembled.

components: Input Rails / Prompt Shields Retrieval Rails (ACL-aware RAG)Deterministic Policy Engine (OPA / Cedar)

obligations: Art. 15 — Accuracy, Robustness, Cybersecurity

Multi-model routing & fallback

Dynamic router → policy & SLA evaluation → private endpoint → inference (fallback to local open-source model on failure)

Routing decisions consider capability, regulatory constraint, cost and latency. Sensitive workloads are pinned to private, zero-data-retention endpoints; health breaches degrade to secondary or locally hosted models instead of failing the workflow.

components: Multi-Model Orchestration Layer Multi-Model Router & Fallback Abstraction Vendor & Model Due-Diligence Kit

obligations: Art. 15 — Accuracy, Robustness, Cybersecurity Art. 25 — Value Chain / Role Flip

Output audit & human-in-the-loop gateway

Output rails → confidence score C_s vs. θ → (C_s ≥ θ) immutable ledger → delivery · (C_s < θ) escalation queue → specialist verdict

Every execution writes an audit packet — timestamp, model version, prompt, context hash, parameters, output, confidence and any human override — to WORM storage.

components: Output Rails / Groundedness Check Confidence Scoring & Threshold Gate HITL Escalation Queue & Review UI WORM / Immutable Audit Vault External Trust Anchor (Qualified Timestamp / Ledger)

obligations: Art. 12 — Record-Keeping / Logging Art. 14 — Human Oversight

Human oversight: where the threshold sits

Human-in-the-loop (confidence-threshold routing)

High-stakes workflows — identity screening, legal clause extraction, anything affecting a person's access to a service — compute C_s per output. Below θ the transaction pauses and a specialist verdict completes it, logged as part of the decision record.

pattern: Confidence-Threshold HITL Routing

Human-on-the-loop (statistical sampling)

Lower-risk batch work runs autonomously with randomised, statistically representative sampling per batch to measure accuracy, classify errors and detect drift.

pattern: Human-on-the-Loop Statistical Sampling

ISO/IEC 42001 governance loop

Clause 4 — Context of the organisation

Defines organisational boundaries, per-vertical regulatory requirements and client risk appetite as deployment parameters.

Clauses 5 & 6 — Leadership & planning

AI governance board owns the responsible-AI policy, bias tolerances and risk-treatment strategy.

control objective: CO: Pre-Deployment AI Risk & Impact Assessment

Clause 8 — Operational control & impact assessment

Pre-deployment risk and impact assessment, data-quality controls and the HITL intervention framework.

control objective: CO: Data Quality & Origin Management

Clauses 9 & 10 — Evaluation & improvement

Performance monitoring, drift tracking, internal audit and recertification.

control objective: CO: Performance Monitoring & Drift Management

Mandatory compliance artifacts

Artifact set per deployed workflow (6)

AI Impact Assessment (AIIA)

EU AI Act Art. 27; ISO 42001 Clause 8.2

Societal, legal and operational risk evaluation per workflow, including the defined HITL intervention parameters and residual-risk acceptance.

review: Pre-deployment; refreshed annually or on any material model change. · minimum verifiability: independently-attested · AI Impact Assessment (AIIA)

AI System Model Card

NIST AI RMF; AI Act Art. 11 / Annex IV

Model lineage, architecture, pre-training data sources, context limits, evaluation benchmarks and known failure modes.

review: Maintained per model release; published in the deployment repository. · minimum verifiability: tamper-evident · AI System Model Card

Algorithmic Bias & Fairness Audit Report

AI Act Art. 10; EEOC; CFPB

Quantitative demographic-parity, disparate-impact and false-positive distribution analysis against a fixed test baseline.

review: Quarterly automated evaluation plus independent review annually. · minimum verifiability: independently-attested · Algorithmic Bias & Fairness Audit Report

Immutable Decision Ledger (WORM)

AI Act Art. 12; SEC Rule 17a-4; FINRA 4511

Per-execution audit packet: timestamp, model version, system prompt, input-context hash, hyper-parameters, output payload, confidence score and human override record.

review: Continuous real-time generation; retained 6–7 years on WORM storage. · minimum verifiability: externally-anchored · Immutable Decision Ledger (WORM)

Human Oversight Operating Standard (SOP)

AI Act Art. 14; ISO 42001 Annex A.8

Binding procedure defining supervisor roles, competence, review-queue handling, override authority and escalation thresholds θ per workflow.

review: Semi-annual operational review; signed off by operations leadership. · minimum verifiability: tamper-evident · Human Oversight Operating Standard (SOP)

Third-Party AI Data & ZDR Certificate

GDPR Art. 28; ISO 27001 / ISO 42001

Binding vendor terms on zero data retention, non-training use, sub-processor list and security boundary, with technical verification records.

review: Validated at vendor onboarding; annual supplier audit. · minimum verifiability: independently-attested · Third-Party AI Data & ZDR Certificate

Implementation roadmap

2026-Q4 · Phase 1

Foundational governance & architectural hardening

Establish core compliance policies and secure infrastructure enclaves.

Technical: Deploy zero-trust ingestion with PII/PHI tokenisation; stand up the model-abstraction layer.

Governance: Finalise ISO 42001 AIMS policies; execute zero-data-retention vendor contracts.

2027-Q1 · Phase 2

Workflow taxonomy & regulatory tiering

Map every vertical workflow to its risk tier.

Technical: Build HITL operator dashboards with confidence-threshold routing (C_s < θ).

Governance: Complete AI Act classifications (high vs. limited vs. minimal) per workflow.

2027-Q3 · Phase 3

Artifact automation & immutable auditability

Automate production of required compliance documentation.

Technical: Connect transaction pipelines to append-only WORM storage with external trust anchoring.

Governance: Auto-generate AI impact assessments and model cards per deployment.

2028-Q1 · Phase 4

Scaled outcome-based commercial deployment

Move client contracts to outcome-priced structures.

Technical: Continuous drift monitoring and dynamic multi-model fallback in production.

Governance: Annual ISO 42001 audits; continuous AI Act conformity validation.

Key takeaways

Certified governance is a procurement advantage, not overhead — ISO 42001 and a defensible evidence trail decide regulated deals.
Decouple the product from the model: abstraction insulates delivery from outages, deprecations, pricing shifts and regional regulatory divergence.
Human oversight stays central in high-stakes workflows: confidence thresholds route edge cases to specialists and satisfy Art. 14 without collapsing throughput.
Compliance artefacts must be generated by the pipeline, not written after the fact — model cards, impact assessments, fairness reports and immutable ledgers in real time.

Every workflow in the use-case catalog marked as a managed service maps into this pipeline — open a profile to see its delivery stack, or run one through the risk & value evaluator.