CSOAI OS · competitive battlecards
Know the field. Cite the source.
Publicly-reported context on the AI-governance market, each figure carrying the source that published it. Every fact below is reported by that source, not measured by us — and none of it is a finding about any company.
Gartner describes AI governance as a billion-dollar market now forming. The size and growth figures here are the cited analysts' figures, reported by them and not measured by us.
Vanta, Drata, Credo AI and OneTrust are trademarks of their respective owners. Council of AI is not affiliated with, endorsed by, or partnered with any of them. Comparisons below describe published product scope and are sourced where cited; where a company does not publish its pricing we say so rather than repeat an unverified figure. Anything here that is wrong is a defect — tell us at nicholas@csoai.org and the correction is published in our ledger.
Automated security-compliance leader (SOC 2 / ISO 27001) pivoting hard into AI-driven trust and agent governance.
- ·$150M Series D at a $4.15B valuation (Jul 2025); ~$504M raised total since 2021.
- ·16,000+ customers; surpassed $300M ARR in 2026 (tripled since 2024).
- ·Named a Leader in The Forrester Wave: GRC Platforms, Q2 2026; 2026 CNBC Disruptor 50.
- ·Authored AARM — an open spec for governing autonomous AI agents at runtime.
- ·Vanta Government Cloud received FedRAMP 20x Moderate authorization.
- ·ISO 42001 offering: ~70 pre-built controls, ~95% document templates, 2–4 week audit readiness.
- +Fastest path to SOC 2 / ISO 27001 / ISO 42001 audit readiness
- +Huge integration + evidence-automation ecosystem
- +Strong brand + enterprise trust
- −Evidence-collection model doesn't map cleanly to EU AI Act documentation + classification obligations (they aren't observable from infrastructure).
- −Delivered as a hosted product; pricing is not published, and third-party figures for it are unverified and not repeated here.
- −Founded as a security-compliance platform; AI governance was added later — see their own product history.
CSOAI is AI-governance-native and open-source: we map EU AI Act documentation and classification duties, expose deterministic measurements, and publish selected Ed25519-signed evidence cards. The Council remains a design rather than a live review service.
Responsible-AI governance specialist — policy-to-technical-control mapping for enterprises and government.
- ·No. 6 in Applied AI on Fast Company's Most Innovative Companies 2026 (alongside Google, Nvidia, OpenAI, Anthropic).
- ·Named in Gartner's Market Guide for AI Governance Platforms (2025).
- ·Public customers include Mastercard, Booz Allen Hamilton, and US federal programmes.
- ·Pre-built policy packs for EU AI Act, NIST AI RMF, ISO 42001, SOC 2 with audit-ready evidence.
- +Genuine AI-governance focus + policy→control mapping
- +Strong analyst + brand recognition
- +Deep EU AI Act / NIST / ISO content
- −Sold through an enterprise sales motion; pricing is not published, and third-party figures for it are unverified and not repeated here.
- −US-headquartered / CLOUD Act exposure raised as a concern for EU-sovereignty buyers.
- −Delivered as a hosted product. Council of AI publishes an open-source verifier and the card preimage rule, so a card can be recomputed with no vendor software at all.
CSOAI publishes crosswalks for the EU AI Act, NIST AI RMF and ISO 42001, with an open-source, self-hostable core, a designed multi-provider Council, and independently verifiable measurement cards. Crosswalks are mappings, not compliance determinations or certification.
Mature privacy/GRC platform with AI governance as a module — best for orgs already inside the OneTrust ecosystem.
- ·Last valued at $4.5B (Jul 2023, $150M round led by Generation Investment Management).
- ·14,000+ customers, including 75%+ of the Fortune 100; on track to surpass $500M ARR, FCF-positive.
- ·2026: added real-time AI governance — AI agent discovery, AI policy library, runtime guardrail enforcement.
- ·AI governance is sold as a module of the wider privacy platform rather than as a standalone product — see their own product pages. US-hosted.
- +Consolidation play for existing OneTrust privacy/GDPR customers
- +Mature workflow + inventory tooling
- +Huge Fortune-100 install base
- −Deployment is a programme of work with the vendor rather than a self-serve product — their own materials describe an implementation engagement.
- −AI governance is offered as a module within a broader privacy platform, priced as an add-on — see their published product pages.
CSOAI is purpose-built for AI + cyber governance, not a privacy-platform add-on — and it's usable without a consulting project. The Council assistant does the work (classify, assess, sign) instead of leaving 'after-implementation work' to the client, and the open-source core + free tier means no stacked add-on bills. Cyber self-scan lets teams test their own systems too — one OS, not three modules.
Stated about us, not about them: verification is free forever and needs no account, a grade is never sold, every published card can be recomputed offline from bytes we publish, and what we could not measure is labelled unmeasured rather than left out. We measure against an obligation — we do not enforce one, and we certify nothing.
Answers from published measurement, or it refuses. Your question is typed into the lobby — nothing sends until you press Ask.
Deterministic pane commands · grounded /api/chat lane · consent checkpoint on consequential steps