AI Compliance Tooling: What to Check Before You Buy

This is general information for people evaluating AI compliance tooling. It is not legal, financial, or procurement advice, and it is not a compliance assessment of any product or deployment.

Compliance is a conclusion, and software cannot reach it

Whether a deployment satisfies HIPAA, the GDPR, sector rules or the EU AI Act is a question about your specific use, your data, your jurisdiction and your sector. A person who is accountable for the answer reaches it. Your counsel, your compliance officer, an auditor.

What tooling does is produce the evidence that person needs, and keep it retrievable a year later when somebody asks. That is a real product category worth paying for. It is not the same thing as compliance, and a vendor implying otherwise is selling something they are not in a position to sell.

The practical test: if you were asked tomorrow to show how a particular automated decision was reached, who approved the system, what it was tested against, and what happened when it was wrong, could you? Tooling is how you get to yes. It is not the yes.

What the category does

Strip the positioning and these platforms are documentation infrastructure. They keep an inventory of models and AI features in use. They record who approved each one and on what basis. They log inputs and outputs so a decision can be reconstructed. They run recurring tests for drift and for disparate outcomes across groups. They generate reports from all of it.

Useful, unglamorous, and worth buying if you have enough AI in production to lose track of it. Which is the real qualifying question, and it is about your inventory, not the software.

Badges that do not mean what they look like

Procurement pages are dense with certification marks, and they are not equivalent.

There is no such thing as HIPAA certification. No government body certifies anyone as HIPAA compliant. HHS does not run a program, and any badge claiming it is either a private assessment being dressed up or a straightforward misrepresentation. What exists is a Business Associate Agreement, a contract that allocates responsibility. Ask for the BAA, not the badge.

SOC 2 is an audit of controls, not a grade. A Type II report covers a defined period and a scope the vendor chose. A vendor that hands you the report is telling you something. A vendor that shows you the logo and not the report is telling you something else. The scope section is the part to read.

ISO 27001 and ISO 42001 are certifiable against a management-system standard, which means processes exist and are audited. It says nothing about whether the product is right for your use case.

Six questions before you buy

• What does it observe, and how? Direct integration or self-reported entries. A register somebody fills in by hand goes stale within a quarter, and staleness is invisible until an auditor arrives.
• Who has to feed it? Governance tools fail on adoption, not on features. If it needs engineers to log things manually, budget for the fact that they will not.
• Can you get your records out? Evidence you cannot export is evidence held hostage. Ask for the export format before signing, because obligations outlive vendor relationships.
• Does it fit an obligation you have? Buying an EU AI Act module when nothing you run is in scope is expensive theater. Establish the obligation first.
• What does it refuse to say? Vendors willing to state their limits are more trustworthy than vendors who imply the tool closes the question. A product that outputs "compliant" is overreaching by design.
• Would your auditor accept the output? The cheapest possible diligence is asking them before you buy, and almost nobody does it.

The complication

Everything above argues for buying carefully, and there is a real cost on the other side.

Teams that treat governance tooling as premature often have no inventory at all, and discover during a customer security review or an incident that nobody can say which systems use AI or who approved them. Reconstructing that after the fact is far more expensive than maintaining it, and sometimes impossible, because the people who knew have left.

A spreadsheet is a legitimate starting point and stops being one quietly. The signal is not company size. It is whether any single person can still name every AI feature in production without asking around.

Start with the record, not the platform

Most teams buying governance software need one capability first: a durable, exportable record of what an AI system was asked, what it returned, and who signed off. Everything else in the category is built on top of that, and without it the dashboards have nothing real to show.

Our AI Output Audit-Trail Kit ($79) builds exactly that layer, and it is deliberately not a compliance verdict. It gives you the evidence to hand the person whose job is to reach one.

Frequently Asked Questions

Can AI governance software make my company compliant?

No. Compliance is a conclusion about your specific use, data, jurisdiction and sector, reached by a person who is accountable for it, such as your counsel, compliance officer or auditor. Tooling produces the evidence that person needs and keeps it retrievable. A vendor implying the software itself delivers compliance is overreaching.

Is HIPAA certification real?

No government body certifies organizations as HIPAA compliant, and HHS runs no such program. A HIPAA certified badge is either a private assessment presented as something official or a misrepresentation. What exists is a Business Associate Agreement, a contract allocating responsibility. Ask a vendor for the BAA, not the badge.

What does SOC 2 tell me?

A SOC 2 Type II report describes an audit of controls over a defined period, within a scope the vendor selected. It is not a pass or fail grade. The scope section is the useful part, and a vendor willing to share the full report is giving you more than one that shows only the logo.

What makes governance tooling fail after purchase?

Adoption, not features. Tools that depend on people manually logging entries go stale within a quarter, and the staleness is invisible until an auditor asks. Before buying, establish what the tool observes directly through integration versus what a human has to remember to enter, and assume the manual portion will not happen.

When is a spreadsheet no longer enough?

The signal is not company size. It is whether any single person can still name every AI feature in production, who approved each one, and what it was tested against, without asking around. Once nobody can, you have an inventory problem, and reconstructing that record after an incident is far more expensive than maintaining it.