Frequently Asked Questions

Continuous evaluations are automated checks that score every production interaction an AI agent handles — not just a sample, not just the ones that generate complaints. For buyers evaluating platforms, the key questions are: does the platform run evaluations at inference time or as a batch job after the fact, how granular is the scoring, and can you configure what "correct" looks like for your specific use cases. Platforms that only offer manual review workflows or periodic batch scoring leave gaps where agent behavior can drift for days before anyone notices. Continuous evaluation capability is what separates a governance-ready platform from one that gives you visibility only after the damage is already done.

Observability for AI agents means a platform captures the full internal trace of every decision — every model call, every tool invoked, every piece of context retrieved, every reasoning step taken — so you can see exactly what happened during a session, not just what came out at the end. For buyers, strong observability means being able to replay any failure, attribute behavior changes to a specific prompt version or model update, and produce that trace as auditable evidence for compliance reviews. Without it, you're governing from final outputs only — which means you can see that something went wrong but have no way to trace where in the decision chain it broke. That's not a governance posture; it's forensics after the fact.

Testing checks how an agent behaves in a controlled environment with known inputs. Monitoring shows how it behaves with real users and unpredictable data over time. Both are necessary because an agent can pass every pre-deployment test and still drift significantly once it hits production — real user behavior, shifting data patterns, and upstream system changes all introduce variables that testing can't fully anticipate. From a governance standpoint, monitoring is what keeps policy enforcement connected to reality after deployment. A governance framework without production monitoring is a set of rules that only apply to the demo. For a full breakdown of the signal categories that matter most in production AI monitoring, see the GAIG monitoring signals guide.

Your compliance obligations change with it. The EU AI Act classifies AI systems by risk level and attaches different requirements to each category. If a system begins as a minimal or limited risk tool and later gets used in a context that places it into the high-risk category — such as hiring decisions, credit assessments, or healthcare applications — the full set of high-risk obligations applies from that point forward. That includes conformity assessments, detailed technical documentation, mandatory human oversight mechanisms, and ongoing post-market monitoring. The underlying technology does not need to change for the classification to shift. How the system is used determines the category, which means compliance needs to be reassessed whenever the use case evolves.

Yes. GDPR applies to any organization anywhere in the world that processes personal data belonging to individuals in the European Union. If you have European customers, users, or website visitors whose data you collect in any form, GDPR obligations apply to you regardless of where your company is incorporated or headquartered. Fines for non-compliance can reach up to four percent of global annual revenue and are enforced by EU data protection authorities who have acted against US companies before. Being based in the US does not create an exemption.

AI compliance platform pricing depends heavily on what compliance work the platform is actually doing for you. Security certification automation, model risk documentation, regulatory framework mapping, and continuous audit evidence generation are all different products with different pricing structures. The factors that move the number most are which regulatory frameworks you need coverage for, how many AI systems or models fall within scope, whether you need ongoing monitoring or primarily pre-deployment documentation, and the size and complexity of your deployment environment. Most enterprise compliance platforms require a direct conversation to quote accurately because the scope varies too much for a standard price list to be meaningful. Start by identifying your primary compliance obligation — certification, model validation, regulatory alignment, or audit readiness — then use that to drive the vendor conversation. The GAIG marketplace can connect you with the right vendors for your specific compliance requirements.

AI compliance refers to meeting specific regulatory or certification requirements — like SOC 2 or SR 11-7. AI governance is broader: it includes the policies, processes, and accountability structures that ensure AI systems operate responsibly over time. Most enterprise AI programs need both. Compliance platforms like Vanta address the certification layer. Governance platforms like Monitaur address the operational oversight layer.

An AI compliance platform helps organizations demonstrate that their AI systems operate safely, fairly, and in line with legal requirements. Depending on the platform, this can include automating security certifications, monitoring AI model behavior in production, documenting model validation processes, or evaluating content against regulatory rules in real time.

AI governance platform pricing varies significantly and raw ranges tell you almost nothing useful without context. What actually drives cost differences are scope of deployment — how many models, teams, or AI systems the platform needs to cover — depth of capability in the areas you need most, whether the vendor prices by user seat, model count, or API volume, and how much implementation and onboarding support is included. Platforms built for enterprise-scale governance across large model portfolios are priced differently from modular tools that let you start with one specific capability and expand. The most useful thing you can do before any pricing conversation is define which governance problems you're solving and at what scale. Submit an inquiry through the GAIG marketplace and we'll match you with vendors based on your actual requirements.

As AI becomes central to business decisions, companies need a way to monitor what their models are doing, catch errors before they cause harm, and demonstrate compliance to regulators and auditors. Without governance tooling, most organizations have no reliable way to prove their AI is behaving as intended.