Category scope
What these ratings cover
AI governance software should help teams move from scattered AI use to accountable, reviewable decisions. This category compares discoverability and inventory, risk classification, provider and deployer workflows, controls, technical documentation, human oversight, monitoring and incident handling. A register alone does not count as lifecycle governance.
Included
- Inventory of internally built, purchased, embedded and generative AI systems, with owners and intended purpose
- Risk screening and classification workflows that distinguish provider and deployer responsibilities
- Control mapping, approvals, impact assessments and traceable governance decisions
- Evidence and documentation workflows, including human oversight and change history
- Lifecycle monitoring, incident handling, periodic review and retirement records
Not included
- Model testing or observability products without organisational governance workflows
- AI development platforms whose main purpose is training or hosting models
- Consulting, legal advice and policy libraries without a software product
- A checklist or AI register that does not connect systems to owners, reviews and evidence