Where do you stand? › Route 3 · Vendors & stack
I know which systems I need — who supplies them?
Pick the components you have to put in place. For each one you get the build-vs-buy reading and the market layer that supplies it, with the same scored recommendations and confidence the full analysis uses. Nothing is stored; the selection lives in the URL.
Target market(s)European UnionUnited States (federal)change
Legally-driven components are flagged when their requiring regulation sits outside your selected markets.
density
Step 1 of 2 — pick your components1 selected
AI Register & Model Registry / Factsheets
Step 2 of 2 — the vendor & stack view
1 of 1 selected components are covered by 3 market layers.
Named vendors are community-maintained, disputable examples — not an endorsement. The stable object is the market layer. Compare with the reference stack for your regulatory profile →
Build or buy, per component (1)
AI Register & Model Registry / Factsheets buy (products exist) KRJPCNVNUS-NY
A AI GRC & Governance Platforms / Agent Observability & Model Risk Management / Public Transparency Registers & System Cards product can carry this; the buyer's duties stay with you.
Required by: AI Framework Act (KR), AI Promotion Act (JP), Algorithmic Recommendation Provisions (CN), Law on Digital Technology Industry (VN), New York RAISE Act, Standalone AI Law (VN) in forcein forcein forcein forceenacted — not yet applicablein force
Legally required in KR, JP, CN, VN, US-NY — none of your selected markets carry this driver; treat it as a market-specific requirement, not a universal one. Help verify coverage →
Public Transparency Registers & System Cards — covers 1 of your components
Covers: AI Register & Model Registry / Factsheets. This layer supplies 2 components in the graph.
Confidence: strong (70/100)
Community-maintained examples
Saidot
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Saidot | public AI register | AI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | EU AI Act documentation positioningISO 42001 alignment (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (AI Register & Model Registry / Factsheets) — a direct supplied_by path in the graph.
- This layer's graph purpose overlaps strongly with your scope (1 of 2 components it supplies are in scope).
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 1 community-maintained example vendor recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
Alternatives
- AI GRC & Governance Platforms — confidence moderate (66/100, -4 vs. this layer); overlapping coverage, no additional selected component
- Agent Observability & Model Risk Management — confidence moderate (65/100, -5 vs. this layer); overlapping coverage, no additional selected component
AI GRC & Governance Platforms — covers 1 of your components
Covers: AI Register & Model Registry / Factsheets. This layer supplies 7 components in the graph.
Confidence: moderate (66/100)
Community-maintained examples
Credo AI · ModelOp · Holistic AI · IBM watsonx.governance · OneTrust · ServiceNow · Monitaur
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Credo AI | AI governance platform | Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)EU AI Act readiness positioning |
| Holistic AI | AI governance & audit | Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | NYC LL144 audit support (claimed)EU AI Act readiness positioning |
| IBM watsonx.governance | AI governance platform | Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)Art. 11 documentation support (claimed) |
| ModelOp | AI/model governance | Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed) |
| Monitaur | insurance & lending model governance | Model governance and documentation aimed at insurance and lending supervision. Typical: insurance underwriting, credit decisioning. Scope overlap: Its model-governance scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | NAIC model-governance positioning (claimed)SR 11-7 practice alignment (claimed) |
| OneTrust | GRC & privacy platform | Privacy and AI governance modules extending an existing GRC system of record. Typical: DPIA/FRIA workflow, policy management. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 27001 (claimed)GDPR-positioned |
| ServiceNow | intake & ITSM workflow | Use-case intake, approval workflow and risk records inside an existing ITSM estate. Typical: AI intake, policy administration. Scope overlap: Its AI-governance module overlaps this platform's own scope; we have a commercial interest in the comparison. | SaaS (vendor cloud) | ISO 42001 alignment (claimed)EU AI Act readiness positioning |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (AI Register & Model Registry / Factsheets) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 7 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 7 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Public Transparency Registers & System Cards — confidence strong (70/100, +4 vs. this layer); overlapping coverage, no additional selected component
- Agent Observability & Model Risk Management — confidence moderate (65/100, -1 vs. this layer); overlapping coverage, no additional selected component
Agent Observability & Model Risk Management — covers 1 of your components
Covers: AI Register & Model Registry / Factsheets. This layer supplies 10 components in the graph.
Confidence: moderate (65/100)
Community-maintained examples
LangSmith · Langfuse · Arize AI / Phoenix · Helicone · MLflow · Ragas · Deepchecks · Fairlearn · Fiddler AI · ValidMind · WhyLabs · Evidently AI · Galileo AI · Patronus AI · Arthur AI
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangSmith | agent tracing & evaluation | Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| Langfuse | agent tracing & evaluation | Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics. | open source | GDPR-positionedsupports Art. 12 record-keeping (claimed) |
| Arize AI / Phoenix | ML & LLM observability | Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics. | not checked | SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed) |
| Helicone | LLM gateway & logging | Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| MLflow | experiment & model registry | Open-source tracking, model registry and lineage across training and deployment. Typical: model registry, validation records. | open source | model-validation positioning (SR 11-7 style, claimed) |
| Ragas | RAG evaluation | Open evaluation metrics for retrieval faithfulness and answer grounding. Typical: grounding checks, RAG regression. | not checked | OSS, no vendor certification |
| Deepchecks | validation & testing | Continuous validation suites for data and model behaviour. Typical: release gating, data validation. | not checked | evaluation-evidence positioning |
| Fairlearn | fairness toolkit | Open-source fairness assessment and mitigation for classification and regression. Typical: bias testing, fairness reporting. | not checked | OSS, no vendor certificationsupports Art. 10 bias examination (claimed) |
| Fiddler AI | model performance management | Explainability and monitoring platform aimed at regulated model risk teams. Typical: explainability, model monitoring. | not checked | SOC 2 (claimed)model-risk positioning (SR 11-7 style, claimed) |
| ValidMind | model risk management | Model validation documentation and workflow for banking model-risk functions. Typical: validation reports, MRM workflow. | not checked | SOC 2 (claimed)model-risk positioning (SR 11-7 style, claimed) |
| WhyLabs | data & model monitoring | Telemetry and drift monitoring over model inputs and outputs. Typical: drift detection, data quality monitoring. | SaaS (vendor cloud) | supports Art. 72 post-market monitoring (claimed) |
| Evidently AI | evaluation & monitoring | Open-source evaluation and monitoring reports for ML and LLM pipelines. Typical: evaluation reports, drift detection. | open source | supports Art. 72 post-market monitoring (claimed) |
| Galileo AI | LLM evaluation & observability | Evaluation metrics and traces for generative applications. Typical: LLM evaluation, trace inspection. | SaaS (vendor cloud) | supports Art. 15 accuracy measures (claimed) |
| Patronus AI · eingestellt (2026-08-31) | automated LLM evaluation | Automated scoring and adversarial test suites for generative output. Typical: automated evaluation, red teaming. | SaaS (vendor cloud) | supports Art. 15 robustness measures (claimed) |
| Arthur AI | model performance monitoring | Performance, bias and drift monitoring across deployed models. Typical: bias monitoring, performance monitoring. | SaaS (vendor cloud) | supports Art. 72 post-market monitoring (claimed)supports Art. 10 bias examination (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (AI Register & Model Registry / Factsheets) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 15 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 10 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Public Transparency Registers & System Cards — confidence strong (70/100, +5 vs. this layer); overlapping coverage, no additional selected component
- AI GRC & Governance Platforms — confidence moderate (66/100, +1 vs. this layer); overlapping coverage, no additional selected component