Banking & Insurance
AI Fund Administration: NAV, Investor Reporting & Fund Accounting
Minimal RiskUnverifiedDiscuss / dispute
AI systems that calculate net asset value (NAV), generate investor statements/reports, and reconcile fund-level accounting for an asset manager, AIFM/UCITS management company, or third-party fund administrator — a back-office valuation and investor-communication function distinct from front-office trade execution/advisory (uc-svc-portfolio) or trade-lifecycle settlement reconciliation (uc-svc-trade).
Consensus classification rationale: AI-driven NAV calculation, investor reporting and fund accounting sit under a valuation-integrity and recordkeeping regime that is distinct from front-office execution or settlement. A US registered fund must keep the books that form the basis of its financial statements and preserve every schedule supporting each NAV computation for six years (Investment Company Act Rules 31a-1 and 31a-2, with Rule 31a-3 governing an administrator that keeps them on the fund's behalf), and an SEC-registered adviser must keep the working records that demonstrate any performance or return figure it presents (Advisers Act Rule 204-2(a)(16)). In the EU, AIFMD Art. 19 requires an AIFM to run a proper, independent and impartial valuation and to calculate and disclose NAV per unit at least annually and, for open-ended funds, at a frequency matched to issuance and redemption, and it keeps the AIFM responsible for the valuation and the published NAV (Art. 19(10)) even when functions are delegated (Art. 20(3)). Because AIFMs and UCITS management companies are DORA financial entities (Art. 2(1)(k)-(l)), the client must also bring the AI system and the provider operating it into its ICT third-party risk management (Arts. 28-30). Valuation errors chiefly cause investor financial harm and recordkeeping breaches rather than an adverse determination on an individual's access to credit or insurance, so the pattern sits outside EU AI Act Annex III.
Decision attributes in force
Autonomyhuman-in-the-loop — Drives the human-oversight duties (Art. 14, Art. 26(2)) and Art. 50 disclosure.
Profiling of natural personsno — Feeds the Art. 6(3) second-subparagraph override directly — profiling makes the derogation categorically unavailable.
Affected subjectsnatural-person — Instruments scoped to natural persons drop out of scope when only legal entities are assessed.
Deployer typeprivate-enterprise — Selects between the recorded alternate classification readings.
Role in the value chainboth — Splits provider duties, deployer duties and upstream GPAI duties.
Consequential scoringno — Consequential scoring of natural persons requires intrinsic interpretability, not post-hoc explanation only.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
Target market(s)European UnionUnited States (federal)change
Changes which instruments below count as in scope for this profile.
Target markets: European Union, United States (federal)
Regulatory footprint
5 instruments across 4 of 7 regulatory domains, plus 3 standards references- AI law1 instrument
- Data protectionnone triggered
- Cyber & resilience1 instrument
- Online safety & platformsnone triggered
- Product safetynone triggered
- Financial services1 instrument
- Sector & employment2 instruments
- Standards3 references
By jurisdiction
- EU3European UnionAIFMD (EU Alternative Investment Fund Managers Directive), DORA, EU AI Act
- US2United States (federal)SEC Advisers Act Rule 204-2 (Books & Records), SEC Investment Company Act Rules 31a-1 to 31a-3 (Fund Books & Records)
The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →
Confidence in this chain of evidenceConfidence: Check-worthy
The chain holds, but at least one hop rests on a secondary source, an ageing verification or a practice-derived step. Check the flagged hops before you rely on them.
Computed weakest-link over 10 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.
Why this band7 factors lowered the band — each links to the claim behind it
- Source tier: SEC Investment Company Act Rules 31a-1 to 31a-3 (Fund Books & Records) carries no resolvable citation — the claim is uncited. open node →
- Source tier: JTC 21 Technical Package (prEN 18228/18229/18281–83) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: IEEE CertifAIEd™ carries no resolvable citation — the claim is uncited. open node →
- Source tier: prEN 18229-1 (Trustworthiness Framework, part 1) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Status certainty: JTC 21 Technical Package (prEN 18228/18229/18281–83) is "draft", not settled in-force law. open node → primary source →
- Status certainty: prEN 18229-1 (Trustworthiness Framework, part 1) is "enquiry", not settled in-force law. open node → primary source →
- Verification age: IEEE CertifAIEd™ has no recorded verification date. open node →
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
Dates that bind
- 2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
- 2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- SEC Investment Company Act Rules 31a-1 to 31a-3 (Fund Books & Records): The recordkeeping duty rests on section 31(a) of the Investment Company Act (15 U.S.C. 80a-30(a)). The SEC enforces it through cease-and-desist proceedings and civil penalties (section 9(f), 15 U.S.C. 80a-9(f)), injunctions and civil penalties in federal court (section 42, 15 U.S.C. 80a-41), and orders prohibiting a person who has willfully violated the federal securities laws, permanently or for a period, from serving or acting as an employee, officer, director, investment adviser, depositor or principal underwriter of a registered investment company (section 9(b), 15 U.S.C. 80a-9(b)).
- SEC Advisers Act Rule 204-2 (Books & Records): SEC enforcement, deficiency letters, books-and-records penalties.
- AIFMD (EU Alternative Investment Fund Managers Directive): Enforced by Member-State competent authorities. Art. 46(2) gives them powers including to require the cessation of practices contrary to the Directive, to request a temporary prohibition of professional activity and to withdraw an AIFM's authorisation; Art. 48(1) requires national administrative measures and penalties that are effective, proportionate and dissuasive (amounts are set by national law), and Art. 48(2) allows public disclosure of the measures and penalties imposed.
- DORA: Administrative penalties; periodic penalty payments for critical third parties
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4 obligations named above as active workstreams with an accountable owner.
- Design and document a human-oversight procedure appropriate to how this system is used.
- Produce the technical documentation and evidence artefacts already mapped to this use case (Multi-Region Failover & Resilience Testing, Vendor & Model Due-Diligence Kit, HITL Escalation Queue & Review UI) before they are requested.
- Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Classification precedent
Consensus reading: Minimal Risk open in the graph →
AI-driven NAV calculation, investor reporting and fund accounting sit under a valuation-integrity and recordkeeping regime that is distinct from front-office execution or settlement. A US registered fund must keep the books that form the basis of its financial statements and preserve every schedule supporting each NAV computation for six years (Investment Company Act Rules 31a-1 and 31a-2, with Rule 31a-3 governing an administrator that keeps them on the fund's behalf), and an SEC-registered adviser must keep the working records that demonstrate any performance or return figure it presents (Advisers Act Rule 204-2(a)(16)). In the EU, AIFMD Art. 19 requires an AIFM to run a proper, independent and impartial valuation and to calculate and disclose NAV per unit at least annually and, for open-ended funds, at a frequency matched to issuance and redemption, and it keeps the AIFM responsible for the valuation and the published NAV (Art. 19(10)) even when functions are delegated (Art. 20(3)). Because AIFMs and UCITS management companies are DORA financial entities (Art. 2(1)(k)-(l)), the client must also bring the AI system and the provider operating it into its ICT third-party risk management (Arts. 28-30). Valuation errors chiefly cause investor financial harm and recordkeeping breaches rather than an adverse determination on an individual's access to credit or insurance, so the pattern sits outside EU AI Act Annex III.
What the reading rests on — the provisions this classification actually pulls in:
- Art. 4 — AI Literacy
- EU AI Act (Regulation (EU) 2024/1689)
- SEC Investment Company Act Rules 31a-1 to 31a-3 (Fund Books & Records) (17 C.F.R. §§ 270.31a-1, 270.31a-2 and 270.31a-3 — Rules 31a-1, 31a-2 and 31a-3 under section 31 of the Investment Company Act of 1940 (15 U.S.C. 80a-30))
- SEC Advisers Act Rule 204-2 (Books & Records) (17 CFR 275.204-2 (Advisers Act books and records))
- AIFMD (EU Alternative Investment Fund Managers Directive) (Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010, as amended (most recently by Directive (EU) 2024/927 of 13 March 2024))
- DORA (Regulation (EU) 2022/2554)
No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →
Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective
Applicable Regulations (5)
EU AI Act (Regulation (EU) 2024/1689)
unverified · verified 2026-08-12 source (as amended) EUR-LexAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex. in force EU
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Art. 50 → 2 Aug 2026, Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). (Digital Omnibus: Regulation (EU) 2026/1744, in force 27 July 2026).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
SEC Investment Company Act Rules 31a-1 to 31a-3 (Fund Books & Records) (17 C.F.R. §§ 270.31a-1, 270.31a-2 and 270.31a-3 — Rules 31a-1, 31a-2 and 31a-3 under section 31 of the Investment Company Act of 1940 (15 U.S.C. 80a-30))
in-force · verified 2026-09-18 in force US
Rules under section 31 of the Investment Company Act of 1940 that require every registered investment company (and any majority-owned subsidiary underwriter, broker, dealer or investment adviser) to maintain and keep current the books and records that form the basis for its financial statements — journals, general and auxiliary ledgers and the other records listed in Rule 31a-1(b) — and to preserve them under Rule 31a-2: journals and ledgers permanently, and all schedules evidencing and supporting each computation of net asset value (including each swing-pricing adjustment) for not less than six years. Where another person such as a fund administrator prepares or maintains the records, the fund must obtain a written agreement that the records are its property and will be surrendered promptly on request (Rule 31a-3(a)), and records held electronically must be kept under procedures that safeguard them from loss, alteration or destruction (Rule 31a-2(f)).
Sanctions: The recordkeeping duty rests on section 31(a) of the Investment Company Act (15 U.S.C. 80a-30(a)). The SEC enforces it through cease-and-desist proceedings and civil penalties (section 9(f), 15 U.S.C. 80a-9(f)), injunctions and civil penalties in federal court (section 42, 15 U.S.C. 80a-41), and orders prohibiting a person who has willfully violated the federal securities laws, permanently or for a period, from serving or acting as an employee, officer, director, investment adviser, depositor or principal underwriter of a registered investment company (section 9(b), 15 U.S.C. 80a-9(b)).
SEC Advisers Act Rule 204-2 (Books & Records) (17 CFR 275.204-2 (Advisers Act books and records))
Registered investment advisers must preserve records of recommendations, advisory communications and the data behind them. Where an AI agent evaluates portfolios, drafts client communications or generates recommendations, its inferences and prompts become advisory records that need an attribution chain to a named supervising person — generic system service accounts are not acceptable.
Sanctions: SEC enforcement, deficiency letters, books-and-records penalties.
AIFMD (EU Alternative Investment Fund Managers Directive) (Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010, as amended (most recently by Directive (EU) 2024/927 of 13 March 2024))
Harmonised EU authorisation and conduct regime for managers of alternative investment funds (AIFMs). Art. 19 requires an AIFM to establish appropriate and consistent procedures for a proper and independent valuation of each AIF's assets, to perform the valuation impartially and with all due skill, care and diligence, and to calculate and disclose NAV per unit or share to investors at least once a year (for open-ended AIFs also at a frequency appropriate to the assets and to issuance and redemption frequency), and it keeps the AIFM responsible for the proper valuation, the NAV calculation and the publication of the NAV. Small 'sub-threshold' AIFMs (Art. 3(2)) are subject only to Art. 3(3)-(4).
Sanctions: Enforced by Member-State competent authorities. Art. 46(2) gives them powers including to require the cessation of practices contrary to the Directive, to request a temporary prohibition of professional activity and to withdraw an AIFM's authorisation; Art. 48(1) requires national administrative measures and penalties that are effective, proportionate and dissuasive (amounts are set by national law), and Art. 48(2) allows public disclosure of the measures and penalties imposed.
DORA (Regulation (EU) 2022/2554)
Digital operational resilience for the financial sector — in force and applying since 17 January 2025: ICT third-party risk (CTPP oversight), change management, resilience testing — applies to AI-based trading, credit and KYC systems. ICT third-party risk management extends to AI supply chains: model and dependency inventories (AIBOM/SBOM-style), contractual audit and exit rights, and concentration risk across model providers.
Sanctions: Administrative penalties; periodic penalty payments for critical third parties
Legal Obligations (1)
density
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — read the OJ or consolidated text on EUR-Lex.
Control Objectives (0)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
JTC 21 Technical Package (prEN 18228/18229/18281–83)
CEN-CENELEC JTC 21 technical package under standardisation request M/593 (prEN 18228 trustworthiness, 18229 risk management, 18281–83 CV/NLP evaluation et al.); staged drafts, none OJEU-cited yet — Annex III applicability (Dec 2027) is Omnibus-coupled to their availability.
evidence for: EU AI Act
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
prEN 18229-1 (Trustworthiness Framework, part 1)
Part 1 of the JTC 21 trustworthiness deliverable — the framework layer other prEN 18xxx documents build on.
evidence for: EU AI Act
Evidence you will need (7)
The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →
Documents & files (1)
Written deliverables an authority or auditor can request as a file.
Post-Market Monitoring Plan & Incident Reportstext-derivedserves 4 obligations
Art. 72 monitoring plan plus Art. 73 serious-incident reports (15 days; 2 days for widespread infringement) — reconciled in one runbook with GDPR Art. 33 (72h), NIS2 (24h/72h) and DORA timelines.
verifiability: documented artefact — verifiable on inspection
chain: Art. 72/73 — Post-Market Monitoring & Incidents · Art. 72/73 — Post-Market Monitoring & Incidents → CO: Performance Monitoring & Drift Management · DORA · NIS2 Directive · Clinical Imaging Triage & Patient Follow-Up · Cross-Border Statutory Tax & Wealth Filing · +2 more
Assessments (1)
A structured judgement about risk, rights or a management system.
FRIA / AI Impact Assessment (AIIA)text-derivedserves 3 obligations
Fundamental-rights impact assessment (Art. 27, deployer-side) generalized to the AI Impact Assessment: societal, legal and operational risk evaluation per ISO/IEC 42005 and ISO 42001 Clause 8.2, defining HITL intervention parameters and acceptable-use bounds. Cadence: pre-deployment, refreshed annually and on major model updates — a stale AIIA is a finding, not a document.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 27 — Fundamental Rights Impact Assessment · EU AI Act · Clinical Imaging Triage & Patient Follow-Up
Test reports (1)
Measured results from testing, evaluation or red-teaming.
Accuracy, Robustness & Red-Teaming Reportspractice-derived — dispute welcomeserves 2 obligations
Art. 15 evidence: declared accuracy metrics, adversarial and corruption robustness results (DIN SPEC 92001-2, ISO 24029), penetration and jailbreak-resistance testing, groundedness evaluation scores.
verifiability: independently-attested
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Adversarial Robustness Verified · Enterprise SDLC Code Automation & QA · LLM01 Prompt Injection
Log records (2)
Machine-generated records produced while the system runs.
Event Logs & Decision Tracestext-derivedserves 17 obligations
The single highest-leverage artifact: hash-chained, WORM-stored logs with structured decision traces. Required capability fields per FprEN ISO/IEC 24970: input/output traces, execution timestamps, acting user/agent identity, referenced sources, human overrides. Audit-packet spec per event: model version, system-prompt/context hash, hyper-parameters (temperature, top-p), output payload, confidence score, active policy-ruleset versions, human override record. Simultaneously serves AI Act Art. 12, GDPR accountability, DORA incident reporting, NIS2 logging, PLD disclosure duties and its rebuttable defect presumption; financial-sector regimes push retention to 7 years (SEC 17a-4-class WORM rules). Credibility bar: anchor hash-chain heads externally (qualified timestamp / eIDAS ledger) so integrity survives an insider with admin rights.
verifiability: externally-anchored
chain: Art. 12 — Record-Keeping / Logging · CRA Art. 14 — Vulnerability & Severe-Incident Reporting · DORA Art. 19 — Major ICT-Incident Reporting · GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule · NIS2 Art. 23 — Significant-Incident Reporting · +21 more
Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations
Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.
verifiability: tamper-evident
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more
Process records (2)
Traces that a process actually happened, and who did it.
Vendor & Model Due-Diligence Recordspractice-derived — dispute welcomeserves 4 obligations
DORA Art. 30 / AI Act deployer evidence: scored vendor assessments (jurisdiction, ZDR, BYOK, C5/AIC4/42001 evidence, tenant isolation), contract register, exit strategies for critical third parties.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 26 — Deployer Obligations → CO: Embedded-AI Vendor Governance · DORA · HIPAA (US Health Privacy) · Procurement Variance & Vendor KPI Monitoring
AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations
Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.
verifiability: documented artefact — verifiable on inspection
chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority
Architecture Blueprint
Human-in-the-Loop Core Pattern
For high-risk decision support over people (HR, credit, benefits): confidence-thresholded escalation queues, WORM audit vault, bias testing per ISO 5259 — the human decision is architecturally enforced. CORRECTED 2026-08-15: this pattern previously recommended a post-hoc explainability API (SHAP/LIME or CoT traces) as the explanation mechanism for consequential scoring of natural persons. That is the wrong default. Post-hoc local explainers are sampling-unstable, vary with perturbation choice and are susceptible to fairwashing, and an adverse-action reason that would not change the outcome if the applicant remediated it is not a defensible reason. For consequential scoring (credit, insurance pricing, tenant screening, employment scoring) use intrinsic interpretability — glass-box additive models with monotonic constraints — and keep post-hoc methods as a supplementary diagnostic only.
Deterministic Document-Validation Pipeline
Schema, completeness and duplicate checks implemented as deterministic rules with a model used only for extraction, never for judgement. The absence of an evaluative step is what keeps a narrow procedural task narrow — and what makes an Art. 6(3)(a) claim documentable.
Sovereign Resilient Enterprise Pattern
For regulated finance / high-sensitivity workloads: EU-jurisdiction or EUCS-High+ cloud, confidential computing, BYOK via external HSM, multi-region failover, full FCoT/OpenTelemetry tracing, DORA-grade third-party auditing.
Required Technical Components (21)
Multi-Region Failover & Resilience Testing
DORA-grade continuity: regional redundancy, chaos testing, exit strategies for critical third parties.
from: DORA · Sovereign Resilient Enterprise Pattern
Vendor & Model Due-Diligence Kit
Scoring model: jurisdiction (CLOUD Act exposure), zero-data-retention, BYOK support, audit evidence (C5/AIC4/ISO 42001/EN 18286:2026), tenant isolation.
from: DORA · Sovereign Resilient Enterprise Pattern
HITL Escalation Queue & Review UI
HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.
from: Human-in-the-Loop Core Pattern
Explainability API (SHAP/LIME/CoT)
Feature attributions for classical ML, reasoning-trace summaries for GenAI — feeds the human reviewer and the technical file.
from: Human-in-the-Loop Core Pattern
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Human-in-the-Loop Core Pattern · Deterministic Document-Validation Pipeline
Bias Testing & Data Quality Pipeline
Representativeness checks, bias metrics and mitigation per ISO/IEC 5259; versioned datasets with lineage.
from: Human-in-the-Loop Core Pattern
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
from: Human-in-the-Loop Core Pattern
Kill Switch / Graceful Degradation
Operator stop controls and degraded-mode fallbacks; real-time override (veto) channels for HOTL operation.
from: Human-in-the-Loop Core Pattern
Trust & Risk Dual Scoring
Escalation triggers built from two independent signals, because raw model confidence is uncalibrated: calibrated trust scores (prompt relevance, similarity to historic successes, cross-model consistency) plus deterministic risk scores (sensitive categories, transaction value, protected data) — either crossing its threshold forces human review.
from: Human-in-the-Loop Core Pattern
Active-Learning Feedback Loop
Human corrections at oversight gates are serialized as structured data — original context, model proposal, human edit, rationale — and fed into fine-tuning pipelines and prompt registries, systematically reducing future escalation rates instead of dying in review UIs.
from: Human-in-the-Loop Core Pattern
Confidence Scoring & Threshold Gate
Computes a probabilistic confidence score for every output and holds the transaction when the score falls below the workflow's regulatory threshold.
from: Human-in-the-Loop Core Pattern
Document Intelligence Engine
OCR, layout parsing and semantic clause extraction over filings, contracts and invoices, emitting structured records with span-level source references.
from: Deterministic Document-Validation Pipeline
AI Register & Model Registry / Factsheets
AI register & model registry: central inventory of every model, agent, RAG pipeline and embedded third-party SaaS AI across the estate, with factsheets per asset. v2.0 duty: every application — internal, open-source or procured — continuously publishes a machine-readable AI-BOM and Factsheet into the register; an asset without a current AI-BOM is an inventory gap, not a formality. Feeds Colorado AIA/ LL144 disclosure duties and the Art. 11 technical file; the enforcement backstop is Shadow-AI discovery on the risk register.
from: Deterministic Document-Validation Pipeline
Confidential Computing Enclaves
AMD SEV / Intel TDX: data protected from the cloud operator even in memory during inference.
from: Sovereign Resilient Enterprise Pattern
BYOK via External HSM
Customer-controlled key sovereignty; cascaded encryption independent of the cloud provider.
from: Sovereign Resilient Enterprise Pattern
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
from: Sovereign Resilient Enterprise Pattern
Bitemporal Memory (GDPR×Art.12)
valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.
from: Sovereign Resilient Enterprise Pattern
Sovereign Context Layer
Governed runtime workspace operationalizing Art. 10: traceable lineage for every RAG chunk and training record at execution time, canonical version-controlled business glossary (documents Art. 10(2)(d) baseline assumptions), and continuous data-quality monitoring with threshold alerts and logged remediation for the Art. 10(3) 'error-free and complete' standard.
from: Sovereign Resilient Enterprise Pattern
Isolated Tenant Storage Enclave
Per-client storage boundary for raw payloads, intermediate artefacts and outputs, so no tenant data is co-mingled or reachable across engagements.
from: Sovereign Resilient Enterprise Pattern
Zero-Trust Ingestion Gateway
Authenticated, policy-checked entry point for client payloads; enforces tenant identity, schema validation and rate limits before any data reaches an inference path.
from: Sovereign Resilient Enterprise Pattern
Local Perimeter Execution (MCP)
Execution agents run inside the corporate perimeter and reach tools through the Model Context Protocol instead of shipping raw records to third-party model endpoints. Context is scoped to the minimum attributes the task needs, which is how data minimisation (GDPR Art. 5(1)(c)) and Art. 25 privacy-by-design survive multi-tool agent orchestration.
from: Sovereign Resilient Enterprise Pattern
Build or Buy — Vendor Layer (10)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Sovereign Infrastructure
Compute and storage under EU jurisdictional control. Two structurally different offers, and the difference is the decision: native EU providers give full jurisdictional isolation with narrower service catalogs and thinner managed-AI tooling; hyperscaler sovereign constructions give the broad catalog with contractual and operational isolation, where the residual question is the control plane, support access and operational metadata rather than the data plane. Named offers live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. Claimed alignments recorded per entry: positioning for BSI C5 / C3A and ANSSI SecNumCloud attestation, NIS2 and DORA third-party requirements. Nothing here is an endorsement, and no provider in this category is 'CLOUD-Act-proof' by label alone — ask who holds the keys and who administers the plane.
unverified · verified 2026-08-18 community-maintained
selection metrics: jurisdiction of the control plane (not only the data plane), operator nationality and support-access paths, key custody, C5 / C3A / SecNumCloud attestation scope, managed-AI service depth vs. isolation trade-off, exit and repatriation terms
supplies: Multi-Region Failover & Resilience Testing · Sovereign Context Layer
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| OVHcloud | native EU | French provider with EU-only jurisdiction and a narrower managed-AI catalog than the hyperscalers. Typical: EU-resident inference, regulated workload hosting. | not checked | ISO 27001 (claimed)SecNumCloud-positionedGDPR-positioned |
| Scaleway | native EU | EU-operated cloud with GPU instances and managed inference under French corporate control. Typical: EU-resident inference, fine-tuning. | not checked | ISO 27001 (claimed)GDPR-positioned |
| STACKIT | native EU | German provider (Schwarz Group) positioned for data residency in Germany. Typical: public sector, retail data platforms. | not checked | C5-positionedGDPR-positioned |
| AWS European Sovereign Cloud | sovereign hyperscaler | Separately operated EU region set with EU-resident personnel and keys; full hyperscaler catalog. Typical: large-scale enterprise AI, regulated hosting. | not checked | ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping and control deduplication, audit-evidence generation, intake workflows. Named products live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. What the class buys you: one register a second line can defend, and evidence assembled once and reused across frameworks. Selection metrics: see meta.marketLandscape.selectionMetrics.grc. One compilation-reported item is deliberately kept as unverified: a claimed updated US banking model-risk guidance 'SR 26-2'. Two secondary compilations repeating it is corroboration of the rumour, not of the guidance; it stays flagged pending verification against Federal Reserve primary sources, and a curator verification proposal is filed. All alignments in this layer are vendor-positioned claims, never certifications.
unverified · verified 2026-08-18 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Vendor & Model Due-Diligence Kit · AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Credo AI | AI governance platform | Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)EU AI Act readiness positioning |
| Holistic AI | AI governance & audit | Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | NYC LL144 audit support (claimed)EU AI Act readiness positioning |
| IBM watsonx.governance | AI governance platform | Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)Art. 11 documentation support (claimed) |
| ModelOp | AI/model governance | Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed) |
and 3 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.
unverified · verified 2026-08-18 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: HITL Escalation Queue & Review UI
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangChain / LangGraph | agent framework | Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows. | not checked | supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed) |
| LlamaIndex | RAG framework | Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents. | open source | retrieval-governance positioning |
| Microsoft AutoGen | multi-agent framework | Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents. | not checked | research/OSS, no vendor certification |
| CrewAI | multi-agent framework | Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents. | not checked | vendor-stated security posture |
and 6 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Observability & Model Risk Management
Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.
unverified · verified 2026-08-18 community-maintained
selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.
supplies: Explainability API (SHAP/LIME/CoT) · Bias Testing & Data Quality Pipeline · Confidence Scoring & Threshold Gate · AI Register & Model Registry / Factsheets · OpenTelemetry / FCoT Tracing
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangSmith | agent tracing & evaluation | Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| Langfuse | agent tracing & evaluation | Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics. | open source | GDPR-positionedsupports Art. 12 record-keeping (claimed) |
| Arize AI / Phoenix | ML & LLM observability | Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics. | not checked | SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed) |
| Helicone | LLM gateway & logging | Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Cryptographic Evidence & Audit Ledger
Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.
unverified · verified 2026-08-18 community-maintained
selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.
supplies: WORM / Immutable Audit Vault
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Fact0 | cryptographic evidence ledger | Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail. | not checked | supports Art. 12 record-keeping (claimed) |
| Traccia | audit trail & traceability | Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage. | not checked | supports Art. 12 record-keeping (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Grounding, Retrieval & Agent Memory
The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.
unverified · verified 2026-08-18 community-maintained
selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
supplies: Document Intelligence Engine · Bitemporal Memory (GDPR×Art.12) · Isolated Tenant Storage Enclave
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
and 12 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agentic Applications & Copilots
Finished agentic products bought rather than built: developer and productivity copilots, research assistants, SOC and support agents. The governance point is not the product but the wrapper: these tools act with delegated authority inside your estate, so they belong in the agent inventory, need scoped non-human identities and permission boundaries, and inherit deployer duties — buying the product does not buy the obligations away.
unverified · verified 2026-08-18 community-maintained
selection metrics: Permission model and identity scoping; audit log export; tenant data-handling and retention terms; deployer-duty support (disclosure, oversight, incident reporting); outcome pricing vs seat pricing.
supplies: Document Intelligence Engine
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| GitHub Copilot | developer copilot | Code completion and agent modes inside the IDE and repository workflow. Typical: software engineering, code review. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Microsoft 365 Copilot | productivity copilot | Assistant across mail, documents and meetings inheriting existing tenant permissions. Typical: knowledge work, meeting summaries. | not checked | ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning |
| Perplexity Enterprise | research assistant | Cited web and internal search with source attribution per answer. Typical: market research, citation-backed search. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Cursor | developer copilot | AI-native editor with repository-wide agent edits. Typical: software engineering, refactoring. | not checked | SOC 2 (claimed)privacy-mode option (claimed) |
and 5 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Public Transparency Registers & System Cards
Authoring and publishing the outward-facing record: public AI registers, system and model cards, conformity declarations and plain-language notices, with versioning so a published statement can be tied to the system version it described. The register content is produced elsewhere; this class is the publication and version-control surface for it. Selection metrics: see meta.marketLandscape.selectionMetrics.transparency.
unverified · verified 2026-08-17 community-maintained
selection metrics: Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.
supplies: AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Saidot | public AI register | AI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | EU AI Act documentation positioningISO 42001 alignment (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Confidential Computing & Privacy Engines
Data-in-use protection and pre-model privacy interception: enclave and runtime encryption, key management, tokenisation vaults, PII detection and redaction, application-layer and vector encryption. Named products live in marketExamples; prose here describes the class. Select on: enclave attestation support, key custody model (external HSM / BYOK), detokenisation audit trail, latency added per call, and coverage of the identifier classes your regime actually names. Selection metrics: see meta.marketLandscape.selectionMetrics.privacy.
unverified · verified 2026-08-18 community-maintained
selection metrics: enclave attestation support, key custody (external HSM / BYOK), detokenisation audit trail, added latency per call, coverage of the identifier classes your regime names, in-boundary deployment option
supplies: Confidential Computing Enclaves · BYOK via External HSM
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Anjuna | confidential computing | Runs workloads inside hardware enclaves without application rewrites. Typical: data-in-use protection, regulated inference. | not checked | confidential-computing positioningDORA-positioned (claimed) |
| Fortanix | confidential computing & KMS | Enclave runtime plus key management and tokenisation services. Typical: key management, data-in-use protection. | not checked | FIPS 140-2 (claimed)DORA-positioned (claimed)HIPAA-positioned (claimed) |
| Skyflow | privacy vault | Polymorphic data vault de-identifying records before they reach a model. Typical: PII vaulting, pre-model redaction. | not checked | SOC 2 (claimed)HIPAA-positionedGDPR-positioned |
| Private AI | PII detection & redaction | Detection and redaction of identifiers across text, documents and audio. Typical: inline redaction, document de-identification. | not checked | GDPR-positionedHIPAA-positioned |
and 1 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.
unverified · verified 2026-08-18 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Sovereign Context Layer · Local Perimeter Execution (MCP)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Azure AI Search | managed retrieval | Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search. | not checked | ISO 27001 (claimed)SOC 2 (claimed) |
| Databricks Unity Catalog | governed lakehouse | Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG. | not checked | SOC 2 (claimed)lineage/Art. 10 support (claimed) |
| Relyance AI | code-level data & AI lineage | Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | GDPR programme tooling (claimed)EU AI Act readiness positioning |
| Snowflake Cortex | governed lakehouse | Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
LLM01 Prompt Injection
Direct or indirect (RAG/files/web) instructions override system prompts — the primary attack vector on the perception layer.
mitigate with: Input Rails / Prompt Shields, Guardrail Sidecar / Interception, Trinity Defense (TCB + Command Gates + IFC), Divided-Focus Memory Tiering, Dual-Gate Validation Pipeline
LLM02 Sensitive Info Disclosure
Leakage of PII, trade secrets or system prompts in outputs.
mitigate with: PII Scrubbing / DLP-NER Layer, Output Rails / Groundedness Check, PII/PHI Redaction & Tokenisation Engine
LLM09 Misinformation
Hallucinated or wrong outputs create liability and decision risk.
mitigate with: Output Rails / Groundedness Check, Explainability API (SHAP/LIME/CoT)