How vendor profiles are reviewed

1. Inclusion Criteria

A product is added when the available public evidence supports the basic information we record. The main checks are:

• Identifiable Legal Entity: Verified corporate headquarters, transparent ownership, and publicly accessible terms of service.
• Functional Compliance Utility: Live, demonstrable features supporting AI literacy (Art. 4), risk management (Art. 9), documentation (Art. 11/Annex IV), post-market logging (Art. 12), cybersecurity testing (Art. 15), or transparency labeling (Art. 50).
• Documented Data Residency: Explicit disclosure of hosting topologies (EU Sovereign Cloud, Private VPC, or US Multi-tenant) for privacy and data-governance context.
• No Unqualified "Magic Compliance" Claims: Products claiming to "instantly make you compliant" without supporting technical evidence are excluded. Software is indexed solely as a support tool for organizational compliance workflows.

2. Profile Review Process

Profiles are reviewed using the following checks:

1. Vendor Discovery: Identification of specialized governance, red-teaming, or inventory tooling.
2. Product Capability Audit: Review of public API documentation, SDKs, and user consoles.
3. EU Article Mapping: Cross-referencing platform features against specific articles of Regulation (EU) 2024/1689.
4. Security & Audit Check: Verification of published SOC 2 Type II, ISO 27001, or ISO 42001 attestations.
5. Pricing & Deployment Model Check: Verification of entry pricing tiers and hosting infrastructure.
6. Editorial Review: Assignment of verification status, confidence score, and clear scope limitations.
7. Re-review: Re-audit of all entries following European Commission guidelines and AI Office notices.

3. Editorial Independence & Monetization Disclosure

Vendors cannot pay to alter their article mappings, manipulate risk scores, or remove recorded product limitations. Paid placements are offered as the Founding Vendor Placement at $499 for 12 months, paid once with no automatic renewal. Paid placement is visibly labeled and provides highlighted directory positioning without altering requirement mappings, evidence verification, editorial conclusions or legal/regulatory determinations. Navigator-highlighted profiles that are not paid placements are editorial selections and are not sponsored.

4. Primary Regulatory Sources

Our requirement mappings cite primary EU sources exclusively:

• Regulation (EU) 2024/1689: Artificial Intelligence Act (Official Journal of the European Union).
• Digital Omnibus Regulation (July 2026): Updated application dates for Annex III standalone systems.
• European AI Office Guidelines: Article 50 transparency and synthetic media watermarking codes of practice.

Regulatory and source review history

This history records what the automated checks found. A changed source is not, by itself, a legal conclusion. Material changes and unavailable vendor sources are kept in a separate review queue.