25 questions · 100 points

How AI governance tools are scored

Twenty-five questions across inventory, risk, controls, evidence and lifecycle oversight. Every AI governance entry is scored against the same set, from public vendor pages only.

See the rated category All rubrics

Rubric edition 2026.11 · recalculated 13 November 2026 · 8 entries

Facts first, score second

Each entry carries two kinds of information. Keeping them apart is what makes the score checkable.

The entry records

What a vendor says about its own product, taken from a named page and stamped with the date it was read. Where a vendor publishes nothing, the entry says "not published". That is a finding in its own right.

The score judges

How much of these 25 questions the recorded facts support. A product can be strong and still score low, because strong products often publish little. The breakdown shows which answers were found, which were partial and which were missing.

How points are awarded

Each question scores 0, 2 or 4. 25 questions put the maximum at 100 points. A published "no" and a missing answer both add 0, but the breakdown marks them differently.

4 points

The vendor's pages describe the capability clearly, not just in a logo or a slogan.

2 points

The pages describe a narrower or partial version of the capability.

0 points

The vendor says it is absent, the offer does not meet the question, or no supporting page was found. Only the last case is flagged as missing.

The questions

The standard beside each question is the one applied to every platform in the category, so any total can be recomputed by hand.

Inventory and scope5 questions, 20 points

ID	Question	What earns the points
I1	Central AI system inventory	A searchable register of AI systems or use cases.
I2	Third-party AI included	Vendor, embedded or externally supplied AI can be recorded.
I3	Discovery beyond manual entry	A documented way to discover AI in the organisation or connect discovery sources.
I4	Purpose and ownership recorded	A use case can be tied to its purpose and accountable people or teams.
I5	Generative AI and agents covered	The published product scope explicitly includes generative AI, agents or both.

Risk and regulation5 questions, 20 points

ID	Question	What earns the points
R1	Risk assessment and classification	A documented workflow assesses or classifies AI use cases by risk.
R2	EU AI Act mapping	A product workflow, template or controls are expressly mapped to the EU AI Act.
R3	More than one governance framework	The product maps controls to additional frameworks such as ISO/IEC 42001 or NIST AI RMF.
R4	Impact assessment workflow	A documented impact or fundamental-rights assessment is available.
R5	Responsibilities and stakeholders	The workflow assigns or routes review across accountable functions or stakeholders.

Controls and workflow5 questions, 20 points

ID	Question	What earns the points
W1	Structured intake	New AI use cases enter through a documented request or intake workflow.
W2	Approval gates	Reviews or approvals can be required before deployment or material changes.
W3	Role-based governance	The product documents differentiated roles or access for governance work.
W4	Human oversight recorded	Human oversight responsibilities or checkpoints can be documented in the workflow.
W5	Policies become controls	Policies or regulatory requirements map to trackable controls or actions.

Evidence and records5 questions, 20 points

ID	Question	What earns the points
E1	Technical evidence and documentation	The product records or manages technical documentation and supporting evidence.
E2	System relationships and lineage	Links between systems, models, data, vendors or dependencies can be represented.
E3	Traceable review history	Actions, changes or reviews have a documented history or audit trail.
E4	Governance reporting	A governance report, factsheet or evidence export is documented.
E5	Evidence tied to controls	Evidence, sign-offs or validation results can be attached to governance requirements.

Lifecycle assurance5 questions, 20 points

ID	Question	What earns the points
L1	Post-deployment monitoring	Monitoring continues after deployment, beyond a one-time approval.
L2	Performance and responsible-AI testing	Testing or monitoring includes quality, fairness, bias, robustness or drift.
L3	Incident or issue follow-up	Detected issues can trigger a documented response, workflow or remediation.
L4	Runtime controls	The product documents guardrails or controls that can act during AI use.
L5	Periodic review and change	The product documents reassessment, review intervals or lifecycle change handling.

What we could review

An answer is only as good as the access behind it.

Public sources for every entry

All 8 entries in this category were scored from the vendor's public product and documentation pages. No demo, contract or security pack was examined, so the score records published evidence only.

What is not scored

A rubric is defined by its exclusions too. These were considered and left out because they separate nothing between these products.

Model training and hosting capability: an AI platform is not an AI governance product.
Raw model accuracy benchmarks: the question is whether governance work is recorded, not how a model scores.
Sales demo access and contract terms: not public evidence.

Editions

Two scores are only comparable when they come from the same edition of the same rubric.

Edition 2026.11 · 13 November 2026

First published edition. Twenty-five questions across five areas, four points each, with not-found answers flagged separately from explicit absences.

Open the category Other categories Correct an entry or dispute a score