Retail & E-Commerce
Digital Shelf Analytics & Competitive Intelligence
Minimal RiskUnverifiedDiscuss / dispute
Continuous collection and normalisation of marketplace pricing, promotions, stock, search rank and review sentiment to drive pricing and assortment decisions.
Consensus classification rationale: Minimal-risk AI, but the collection layer and the pricing output are separately regulated. The real IP hooks are (a) the EU sui generis database right (Directive 96/9/EC, Arts 5(a) and 7(1), also referenced in reg-dsm-copyright's own sanction field) over the compiled set of prices, stock levels and search ranks — protecting the compilation as a database, not the underlying facts, which are not themselves copyrightable — and (b) ordinary copyright in review TEXT where a review crosses the threshold of the author's own intellectual creation; this system does not process images, so no image-copyright hook applies here. Reliance on the Art. 4 DSM text-and-data-mining exception for mining review text is not shielded from a website's terms of service the way the Art. 3 research exception is: DSM Art. 7(1) voids contrary contract terms only for Arts 3, 5 and 6, not Art. 4, so a site's ToS-based scraping prohibition — or a qualifying machine-readable Art. 4(3) reservation — can validly exclude Art. 4 for that content even outside a robots.txt-specific mechanism. UCPD/Omnibus transparency duties separately apply where personalised or dynamic pricing reaches consumers. Keep observation provenance per data point, including ToS/robots.txt status at time of collection, so a pricing decision — and the TDM-exception analysis behind it — can be reconstructed.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
pricingSubscription tier + per monitored SKU / market
oversightAnalyst validation before pricing or assortment action
Target market(s)European UnionUnited States (federal)change
Changes which instruments below count as in scope for this profile.
Target markets: European Union, United States (federal)
Regulatory footprint
5 instruments across 4 of 7 regulatory domains, plus 3 standards references- AI law1 instrument
- Data protection1 instrument
- Cyber & resilience1 instrument
- Online safety & platformsnone triggered
- Product safetynone triggered
- Financial servicesnone triggered
- Sector & employment2 instruments
- Standards3 references
By jurisdiction
- EU4European UnionData Act, EU AI Act, EU DSM Copyright Directive (TDM, Arts 3–4), Unfair Commercial Practices Directive
- US1United States (federal)CFAA & Anti-Scraping Regimes
The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →
Confidence in this chain of evidenceConfidence: Check-worthy
The chain holds, but at least one hop rests on a secondary source, an ageing verification or a practice-derived step. Check the flagged hops before you rely on them.
Computed weakest-link over 10 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.
Why this band6 factors lowered the band — each links to the claim behind it
- Source tier: JTC 21 Technical Package (prEN 18228/18229/18281–83) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: IEEE CertifAIEd™ carries no resolvable citation — the claim is uncited. open node →
- Source tier: prEN 18229-1 (Trustworthiness Framework, part 1) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Status certainty: JTC 21 Technical Package (prEN 18228/18229/18281–83) is "draft", not settled in-force law. open node → primary source →
- Status certainty: prEN 18229-1 (Trustworthiness Framework, part 1) is "enquiry", not settled in-force law. open node → primary source →
- Verification age: IEEE CertifAIEd™ has no recorded verification date. open node →
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
Dates that bind
- 2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
- 2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- Unfair Commercial Practices Directive: National fines up to 4% of annual turnover in the member state concerned (Omnibus Directive).
- CFAA & Anti-Scraping Regimes: Civil claims, injunctions, IP blocking; criminal exposure where access controls are circumvented.
- EU DSM Copyright Directive (TDM, Arts 3–4): The Directive contains no penalty provision of its own (the text has no 'penalty' or 'sanction' clause): a reproduction or extraction not covered by the Art. 3 / Art. 4 exceptions, e.g. mining online content whose use the rightholder has expressly reserved under Art. 4(3), remains an act restricted by the rights the Directive refers to (Art. 2 of Directive 2001/29/EC, Arts 5(a) and 7(1) of Directive 96/9/EC, Art. 4(1)(a)-(b) of Directive 2009/24/EC, Art. 15(1) DSM) and is enforced through the Member States' national copyright remedies, while Art. 7(1) makes contractual provisions contrary to Art. 3 unenforceable.
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4 obligations named above as active workstreams with an accountable owner.
- Stand up the named oversight design — Mode 3 — with a documented human-review procedure.
- Produce the technical documentation and evidence artefacts already mapped to this use case (Data Lineage & Versioning, Deterministic Policy Engine (OPA / Cedar), Ephemeral Execution Isolation) before they are requested.
- Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Classification precedent
Consensus reading: Minimal Risk open in the graph →
Minimal-risk AI, but the collection layer and the pricing output are separately regulated. The real IP hooks are (a) the EU sui generis database right (Directive 96/9/EC, Arts 5(a) and 7(1), also referenced in reg-dsm-copyright's own sanction field) over the compiled set of prices, stock levels and search ranks — protecting the compilation as a database, not the underlying facts, which are not themselves copyrightable — and (b) ordinary copyright in review TEXT where a review crosses the threshold of the author's own intellectual creation; this system does not process images, so no image-copyright hook applies here. Reliance on the Art. 4 DSM text-and-data-mining exception for mining review text is not shielded from a website's terms of service the way the Art. 3 research exception is: DSM Art. 7(1) voids contrary contract terms only for Arts 3, 5 and 6, not Art. 4, so a site's ToS-based scraping prohibition — or a qualifying machine-readable Art. 4(3) reservation — can validly exclude Art. 4 for that content even outside a robots.txt-specific mechanism. UCPD/Omnibus transparency duties separately apply where personalised or dynamic pricing reaches consumers. Keep observation provenance per data point, including ToS/robots.txt status at time of collection, so a pricing decision — and the TDM-exception analysis behind it — can be reconstructed.
What the reading rests on — the provisions this classification actually pulls in:
- Art. 4 — AI Literacy
- EU AI Act (Regulation (EU) 2024/1689)
- Unfair Commercial Practices Directive (Directive 2005/29/EC + Omnibus/EECC price-transparency rules)
- CFAA & Anti-Scraping Regimes (18 U.S.C. §1030)
- Data Act (Regulation (EU) 2023/2854)
- EU DSM Copyright Directive (TDM, Arts 3–4) (Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC (Text with EEA relevance))
No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →
Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective
Applicable Regulations (5)
EU AI Act (Regulation (EU) 2024/1689)
unverified · verified 2026-08-12 source (as amended) EUR-LexAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex. in force EU
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Art. 50 → 2 Aug 2026, Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). (Digital Omnibus: Regulation (EU) 2026/1744, in force 27 July 2026).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
Unfair Commercial Practices Directive (Directive 2005/29/EC + Omnibus/EECC price-transparency rules)
Governs commercial practices toward consumers: dynamic and personalised pricing, ranking transparency and misleading omissions in digital-shelf and marketplace operations.
Sanctions: National fines up to 4% of annual turnover in the member state concerned (Omnibus Directive).
CFAA & Anti-Scraping Regimes (18 U.S.C. §1030)
US Computer Fraud and Abuse Act plus contractual terms-of-service and EU database-right claims that constrain automated collection of marketplace and competitor data.
Sanctions: Civil claims, injunctions, IP blocking; criminal exposure where access controls are circumvented.
Data Act (Regulation (EU) 2023/2854)
Access and re-use rights for (industrial) data, switching and interoperability duties — affects data sourcing for RAG pipelines and connected products.
EU DSM Copyright Directive (TDM, Arts 3–4) (Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC (Text with EEA relevance))
Directive (EU) 2019/790 harmonises EU copyright for digital and cross-border uses and, in Articles 3 and 4, creates mandatory exceptions allowing reproductions and extractions of lawfully accessible works for text and data mining (any automated analytical technique generating information such as patterns, trends and correlations, Art. 2(2)) by research organisations and cultural heritage institutions for scientific research (Art. 3) and by anyone for any purpose (Art. 4). The Art. 4 exception applies only where rightholders have not expressly reserved the use, for online content by machine-readable means (Art. 4(3)), so an operator that trains, fine-tunes or indexes AI models on third-party text, images or code must have lawful access to that content and honour opt-outs or obtain licences. The EU AI Act (Art. 53(1)(c)) turns compliance with those Art. 4(3) reservations into an obligation for every provider of a general-purpose AI model.
Sanctions: The Directive contains no penalty provision of its own (the text has no 'penalty' or 'sanction' clause): a reproduction or extraction not covered by the Art. 3 / Art. 4 exceptions, e.g. mining online content whose use the rightholder has expressly reserved under Art. 4(3), remains an act restricted by the rights the Directive refers to (Art. 2 of Directive 2001/29/EC, Arts 5(a) and 7(1) of Directive 96/9/EC, Art. 4(1)(a)-(b) of Directive 2009/24/EC, Art. 15(1) DSM) and is enforced through the Member States' national copyright remedies, while Art. 7(1) makes contractual provisions contrary to Art. 3 unenforceable.
Legal Obligations (1)
density
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — read the OJ or consolidated text on EUR-Lex.
Control Objectives (0)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
JTC 21 Technical Package (prEN 18228/18229/18281–83)
CEN-CENELEC JTC 21 technical package under standardisation request M/593 (prEN 18228 trustworthiness, 18229 risk management, 18281–83 CV/NLP evaluation et al.); staged drafts, none OJEU-cited yet — Annex III applicability (Dec 2027) is Omnibus-coupled to their availability.
evidence for: EU AI Act
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
prEN 18229-1 (Trustworthiness Framework, part 1)
Part 1 of the JTC 21 trustworthiness deliverable — the framework layer other prEN 18xxx documents build on.
evidence for: EU AI Act
Evidence you will need (3)
The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →
Assessments (1)
A structured judgement about risk, rights or a management system.
FRIA / AI Impact Assessment (AIIA)text-derivedserves 3 obligations
Fundamental-rights impact assessment (Art. 27, deployer-side) generalized to the AI Impact Assessment: societal, legal and operational risk evaluation per ISO/IEC 42005 and ISO 42001 Clause 8.2, defining HITL intervention parameters and acceptable-use bounds. Cadence: pre-deployment, refreshed annually and on major model updates — a stale AIIA is a finding, not a document.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 27 — Fundamental Rights Impact Assessment · EU AI Act · Clinical Imaging Triage & Patient Follow-Up
Log records (1)
Machine-generated records produced while the system runs.
Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations
Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.
verifiability: tamper-evident
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more
Process records (1)
Traces that a process actually happened, and who did it.
AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations
Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.
verifiability: documented artefact — verifiable on inspection
chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority
Architecture Blueprint
Agentic RDA Stack (6 Layers)
Regulatory Design & Architecture framework for agentic systems: (1) isolated ephemeral execution (gVisor/Firecracker, read-only root, egress allowlists) → (2) agentic zero-trust identity (per-agent ID, short-lived OBO OAuth 2.1 tokens) → (3) MCP gateway with default-deny ACLs & credential vault → (4) reasoning + guardrail interception (prompt shields, sidecar alignment checks) → (5) human-oversight & durable state persistence (propose-action objects, checkpoint store) → (6) continuous observability & signed audit logs (≥ 6 months, SIEM).
Mode 3 — Human-on-the-Loop
Autonomous execution with aggregate oversight: dashboards, sampling audits (5–10%), real-time veto. For high-volume, low-individual-impact steps.
Required Technical Components (18)
Data Lineage & Versioning
Provenance tracking of datasets, features and embeddings; write-time attribution (source, actor, timestamp, confidence).
from: Unfair Commercial Practices Directive
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
from: CFAA & Anti-Scraping Regimes · Agentic RDA Stack (6 Layers)
Ephemeral Execution Isolation
gVisor/Firecracker microVMs, read-only root, egress allowlists; container discarded after each task to prevent persistence of exploits.
from: Agentic RDA Stack (6 Layers)
Agentic Zero Trust
Unique cryptographic identity per agent; short-lived, finely-scoped tokens (OAuth 2.1 + PKCE); On-Behalf-Of flow so an agent can never see more than its triggering user.
from: Agentic RDA Stack (6 Layers)
MCP Gateway / Proxy
Central chokepoint for agent tool traffic: default-deny tool ACLs (tools/list vs tools/call), schema & argument inspection, credential injection from vault, rate limits, full audit mirror. Regulatory root cause: the base MCP protocol enforces no authentication or authorization at protocol level — Host/Client/Server topology with Tools/Resources/Prompts primitives ships without an identity layer, so a policy-enforcing gateway is not optional hardening but the only place Art. 12/15 duties can be enforced for tool calls.
from: Agentic RDA Stack (6 Layers)
Guardrail Sidecar / Interception
Rule-based (NeMo/Colang), model-based (alignment checkers) and structural validators deployed as sidecar or gateway plugin (<50 ms), decoupling safety scaling from inference scaling.
from: Agentic RDA Stack (6 Layers)
Propose-Action Objects
Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.
from: Agentic RDA Stack (6 Layers)
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
from: Agentic RDA Stack (6 Layers)
Per-Action Autonomy Tiering
Tools tagged read-only / reversible-write / irreversible-write; controls layer routes each action to the matching oversight mode. Mode selection is per action type, never per agent.
from: Agentic RDA Stack (6 Layers)
Agent Identity & Access (IdP)
Per-agent identities, short-lived scoped tokens, OBO flow enforcement — the identity substrate of agentic zero trust.
from: Agentic RDA Stack (6 Layers)
Central Credential Vault
Agents never hold target-system keys; the gateway injects centrally managed credentials after policy checks.
from: Agentic RDA Stack (6 Layers)
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
from: Agentic RDA Stack (6 Layers)
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Agentic RDA Stack (6 Layers)
Watchdog Supervisor & Rate Limiting
Cost/iteration caps, loop detection, anomaly-triggered mandatory approval (CodeBuddy 'suspicious command override').
from: Agentic RDA Stack (6 Layers)
Trinity Defense (TCB + Command Gates + IFC)
Treats the LLM as an untrusted proposal engine behind a hardened non-LLM Trusted Computing Base. Three pillars: (1) command gates — actions only via a Finite Action Calculus, authorized by a deterministic policy checker before any execution; (2) information-flow control — lattice labels stop confidential data flowing to low-trust sinks without audited declassification; (3) privilege separation — sandboxed low-privilege planner ingests untrusted input, isolated high-privilege worker executes only gate-approved, TCB-normalized actions. Grounded in the impossibility result: token content alone can never unforgeably separate commands from data.
from: Agentic RDA Stack (6 Layers)
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
from: Agentic RDA Stack (6 Layers)
Shadow-Mode Execution
Run governance controls in observe-and-score mode before enforcement: the policy engine and guardrails evaluate every agent action and log verdicts without blocking, yielding empirical false-positive/negative rates and calibrated thresholds. De-risks the enforcement cutover, produces baseline evidence for Art. 9 risk estimation, and is the standard migration path when retrofitting controls onto a live workflow.
from: Agentic RDA Stack (6 Layers)
Multi-Model Router & Fallback Abstraction
Abstraction layer decoupling application logic from model providers: dynamic routing on capability, cost, latency SLA and regulatory constraint (sensitive-data classes pinned to ZDR private/VPC endpoints or on-prem open-weight instances); real-time health monitoring with automatic fallback to secondary endpoints or local fine-tuned models on outage/latency spikes. Discharges resilience duties (DORA-class), prevents provider lock-in, and makes model deprecations a routing-table change instead of a re-architecture. Router decisions are logged into the decision trace — model version per event is an audit-packet field.
from: Agentic RDA Stack (6 Layers)
Delivery Stack & Pipeline Stage (5)
Service-as-a-Software delivery: the engines, patterns and artifacts this workflow needs on top of the generic obligations. See the full pipeline
Marketplace Monitoring & Collection Engine
Compliant collection of public marketplace signals with robots/ToS policy checks, rate governance and provenance capture per observation.
Data Lineage & Versioning
Provenance tracking of datasets, features and embeddings; write-time attribution (source, actor, timestamp, confidence).
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
pipeline stage 2 — Deterministic prompt & guardrail orchestration
Human-on-the-Loop Statistical Sampling
For lower-risk batch workflows, agents execute autonomously while auditors review a statistically representative random sample per batch to track accuracy, error classes and drift.
Outcome-SLA Accountability Wrapper
Service-as-a-Software contracts price completed work, not seats or hours — so the SLA must define measured accuracy, escalation rates and liability for algorithmic error, backed by the same telemetry the regulator sees.
Required artifacts
Build or Buy — Vendor Layer (9)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.
unverified · verified 2026-08-18 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Data Lineage & Versioning
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Azure AI Search | managed retrieval | Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search. | not checked | ISO 27001 (claimed)SOC 2 (claimed) |
| Databricks Unity Catalog | governed lakehouse | Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG. | not checked | SOC 2 (claimed)lineage/Art. 10 support (claimed) |
| Relyance AI | code-level data & AI lineage | Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | GDPR programme tooling (claimed)EU AI Act readiness positioning |
| Snowflake Cortex | governed lakehouse | Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Grounding, Retrieval & Agent Memory
The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.
unverified · verified 2026-08-18 community-maintained
selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
supplies: Data Lineage & Versioning
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
and 12 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Guardrails & Enforcement
Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.
unverified · verified 2026-08-18 community-maintained
selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.
supplies: Deterministic Policy Engine (OPA / Cedar)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Guardrails AI | validation framework | Open-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output. | open source | supports Art. 15 robustness measures (claimed) |
| NVIDIA NeMo Guardrails | dialogue policy rails | Programmable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy. | open source | supports Art. 50 interaction disclosure patterns (claimed) |
| Lakera AI | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | SaaS (vendor cloud) | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Credal AI | enterprise access & policy layer | Permission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP. | SaaS (vendor cloud) | SOC 2 (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.
unverified · verified 2026-08-18 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: MCP Gateway / Proxy · Guardrail Sidecar / Interception
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Lakera | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| HiddenLayer | model/agent detection & response | Model-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Palo Alto Prisma AIRS | network-integrated AI security | AI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control. | not checked | SOC 2 (claimed)enterprise security integration (claimed) |
| Cisco AI Defense | network-integrated AI security | Discovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement. | not checked | enterprise security integration (claimed) |
and 4 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agentic Execution Governance
The youngest tier: governance of what an agent is allowed to do at execution time — non-human identity, per-task scoping, action approval, agent inventory and agent-level red-teaming. Named products live in marketExamples; prose here describes the class. Because the category is new, capability claims outrun deployments: ask for a reference in your own regime before believing a control is covered, and treat entries with limited public verification as unconfirmed. Selection metrics: see meta.marketLandscape.selectionMetrics.agentgov.
unverified · verified 2026-08-18 community-maintained
selection metrics: non-human identity inventory completeness, credential time-to-live and revocation latency, per-action approval hooks, agent-level red-team coverage, evidence export a 2nd line can read, deployment references in your regime
supplies: Agent Identity & Access (IdP)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Pillar Security | agent security & inventory | Discovery, inventory and runtime policy for agents in the estate. Typical: agent registry, policy enforcement. | not checked | agent-inventory positioning |
| Lyzr | agent governance & observability | Agent platform with governance, approval and observability features. Typical: agent approval, agent analytics. | not checked | vendor-stated security posture |
| Astrix Security | non-human identity | Lifecycle governance of machine and agent identities and their grants. Typical: credential scoping, NHI inventory. | not checked | SOC 2 (claimed)NHI governance positioning |
| Britive | just-in-time access | Ephemeral, per-task privileges instead of standing credentials. Typical: JIT credentials, privilege reduction. | not checked | SOC 2 (claimed)least-privilege positioning |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Observability & Model Risk Management
Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.
unverified · verified 2026-08-18 community-maintained
selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.
supplies: OpenTelemetry / FCoT Tracing · Shadow-Mode Execution
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangSmith | agent tracing & evaluation | Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| Langfuse | agent tracing & evaluation | Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics. | open source | GDPR-positionedsupports Art. 12 record-keeping (claimed) |
| Arize AI / Phoenix | ML & LLM observability | Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics. | not checked | SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed) |
| Helicone | LLM gateway & logging | Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Cryptographic Evidence & Audit Ledger
Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.
unverified · verified 2026-08-18 community-maintained
selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.
supplies: WORM / Immutable Audit Vault
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Fact0 | cryptographic evidence ledger | Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail. | not checked | supports Art. 12 record-keeping (claimed) |
| Traccia | audit trail & traceability | Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage. | not checked | supports Art. 12 record-keeping (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.
unverified · verified 2026-08-18 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: Multi-Model Router & Fallback Abstraction
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangChain / LangGraph | agent framework | Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows. | not checked | supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed) |
| LlamaIndex | RAG framework | Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents. | open source | retrieval-governance positioning |
| Microsoft AutoGen | multi-agent framework | Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents. | not checked | research/OSS, no vendor certification |
| CrewAI | multi-agent framework | Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents. | not checked | vendor-stated security posture |
and 6 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Regulated Foundation-Model Platforms
Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Named products live in marketExamples, where the deployment model is recorded in the hosting field rather than asserted in prose. What the class buys you: a model supply relationship with contractual data handling and documentation you can pass to a customer. GPAI-chapter duties and provider due diligence attach at this layer. Selection metrics: see meta.marketLandscape.selectionMetrics.models.
unverified · verified 2026-08-18 community-maintained
selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation
supplies: Multi-Model Router & Fallback Abstraction
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| OpenAI (Enterprise / API) | proprietary frontier | Enterprise tiers offer zero-data-retention and no-training commitments over the commercial API. Typical: general copilots, document reasoning. | not checked | SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)GDPR-positioned |
| Anthropic Claude (Enterprise) | proprietary frontier | Enterprise/ZDR tiers with published safety and model documentation practice. Typical: regulated assistants, long-context analysis. | not checked | SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)HIPAA-eligible (claimed) |
| Google Gemini Enterprise | proprietary frontier | Vertex-hosted frontier models with regional grounding and customer-managed keys. Typical: enterprise search, multimodal workflows. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)EU data-boundary positioning |
| Cohere | proprietary frontier | Private-cloud and on-prem deployment of retrieval-oriented models. Typical: private RAG, enterprise search. | self-hostable | SOC 2 (claimed) |
and 7 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
Collection Legality & Anti-Bot Countermeasures
Marketplace collection breaches terms of service or triggers blocking, producing both legal exposure and degraded data.
mitigate with: Deterministic Policy Engine (OPA / Cedar), Data Lineage & Versioning
LLM09 Misinformation
Hallucinated or wrong outputs create liability and decision risk.
mitigate with: Output Rails / Groundedness Check, Explainability API (SHAP/LIME/CoT)