What are AI governance tools?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI governance tools are software that helps an organization keep track of the AI it builds, buys and uses, decide who may use it for what, check it against its own policies and the rules that apply, and keep proof of all of it. Gartner calls the category AI governance platforms. The IAPP’s 2026 vendor report groups the capabilities into four: policy and compliance, technical assessments and evaluations, assurance and auditing, and consulting and advisory. No single tool does everything, so the choice starts with which problem is costing you most.
What the tools do
| Capability | The question it answers |
|---|---|
| Inventory | What AI do we have, where, and who owns it? |
| Risk rating | Which systems need the most scrutiny? |
| Policy and regulation mapping | Which rules apply to this system, and what do they ask? |
| Workflows and approvals | Who reviewed and approved this use, and on what evidence? |
| Testing and evaluation | Is the model accurate, fair, robust and safe enough for its use? |
| Monitoring | Is it still working, and has anything drifted? |
| Runtime guardrails | Can we block or hold a harmful prompt, answer or action as it happens? |
| Third-party and vendor risk | What AI do our suppliers use on our data, and have we assessed it? |
| Evidence and audit trail | Can we show an auditor or examiner what happened, and can they check it? |
The kinds of tool on the market
- GRC suites with an AI module. Good if you already run governance, risk and compliance on one of them; often thin on the model-specific parts.
- Model operations and monitoring tools. Strong on deploying, testing and watching models; usually light on approvals, policy and the regulator’s view.
- AI security and gateway tools. Sit between users or agents and the models, filtering prompts and outputs and enforcing rules in real time.
- Specialist AI governance platforms. Built around the inventory, assessments and approvals, often with regulation packs.
- Cloud providers’ own consoles. Governance features for the AI that runs on that cloud, and not much beyond it.
Many organizations end up with two: one for the record and approvals, one for testing or runtime controls, connected so results flow into the record.
Questions to ask a vendor
- Does it cover AI we buy and AI inside software we already use, not only models we build?
- Does it cover AI agents, including what they’re allowed to do?
- Which regulations does it map to out of the box, and who keeps those maps current? For a Canadian bank: OSFI E-23, B-10 and B-13, and the AMF in Quebec.
- Who can approve what? Can it stop a developer approving their own model?
- Can an examiner check the evidence without trusting the vendor, or only read a report it generates?
- Where is our data stored, and can it run in our own environment?
- What does it cost at our size, and what do we have to build ourselves to make it work?
When a spreadsheet is enough
With a handful of AI uses, one owner and no regulator asking, a well-kept spreadsheet and a written policy can be enough. It stops being enough when several people edit it, approvals live in email, versions multiply, or someone outside the company needs to rely on it. At that point the question isn’t the list; it’s proving who decided what, and when.
Start with an AI use case inventory and an acceptable use policy either way. A tool is easier to pick once you know what you’re governing.
Where MINERVA fits
MINERVA is the record and approvals part, built for banks and insurers under OSFI: the model inventory, risk ratings, validation and monitoring results, approvals that refuse when the same person built and reviewed a model, AI vendors and agents, and an evidence packet an examiner can verify offline. It isn’t a model-hosting or monitoring platform; tests run where your data is and their results are recorded. Compare it with others on the E-23 software comparison, or see AI governance software.
Related questions
What is an AI governance platform?
Software that gives the people responsible for AI a central view of the AI an organization builds, buys and uses, applies risk frameworks and policies to it, and runs the controls and approvals. Gartner calls the category AI governance platforms.
What features should AI governance tools have?
An inventory, risk rating, policy and regulation mapping, review and approval workflows, testing and monitoring results, third-party coverage, and an evidence trail that an auditor or examiner can check.
Are there free AI governance tools?
Some open-source tools cover parts of it, such as testing, red teaming and guardrails, and public templates such as Canada’s Algorithmic Impact Assessment cover assessments. Full platforms with inventory and approvals are usually paid.
Do I need an AI governance tool to comply with OSFI E-23?
No. E-23 sets expectations, not a tool. But it expects an inventory, risk ratings, independent review, approvals and monitoring for every model, AI included, and most institutions find that hard to evidence with spreadsheets and email.
How do AI governance tools differ from MLOps tools?
MLOps tools build, deploy and monitor models. AI governance tools decide and record who may use which AI for what, against which policies and rules, and keep the evidence. They often connect.
Sources
- IAPP — AI Governance Vendor Report (28 January 2026)
- Gartner — AI governance platforms (Peer Insights market definition)
- OSFI — Guideline E-23, Model Risk Management (2027)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.