Four ways to check an AI system.
| GRC automationVanta, Drata, Thoropass, Secureframe | AI evaluation and red-team tools | Audit firms and consultants | Vigilens | |
|---|---|---|---|---|
| What is checked | Policies and configuration evidence | Model outputs, before release | Documents and interviews | The AI system's behaviour, control by control |
| When | Continuously, for configuration. Frameworks as checklists | At release, or on demand | Once a year | On every change, inside CI/CD |
| Framework-agnostic | Fixed catalogue of frameworks | No regulatory mapping | One framework per engagement | Eight live as executable tests, plus the customer's own controls, one engine |
| Model-agnostic, EU-sovereign | Not an inference layer | Bound to the model under test | Not applicable | Any backend. EU-sovereign inference through the EU AI-on-Demand Platform |
| Sector-agnostic | Built around SaaS and infosec | Built for ML teams | Organised by practice area | Medtech, space, public sector, infosec on the same engine |
| Verdict | Pass/fail per automated test, self-attested by the company | Scores and metrics | Professional judgement | Decided by rule per control. Evidence hashed. Pack verifiable by hash |
| Predicts drift | No | No | No | GSAI world model: forward simulation over the evidence state |
The GSAI world model is in development.
The industry defends AI from the world. We defend the world from AI.
Why teams pick Vigilens
Framework-agnostic
Eight frameworks live as executable rules (EU AI Act, GDPR, ISO 42001, ISO 27001, ISO 13485, EU MDR, NIST AI RMF, SOC 2). ESA ECSS next. Customers load their own controls into the same engine.
Model-agnostic
One provider interface: hosted, bring-your-own-model, or EU-sovereign inference through the EU AI-on-Demand Platform. The identical test runs on every backend.
Sector-agnostic
The engine does not care what the system does, only whether it does what its specification says. Medtech, information security, data protection and public sector live, space systems in test.
- Self-serve entry. Start on a self-serve plan without a sales call. See current plans.
- Bring your own model. Run the tests on a hosted model, on your own model, or on EU-sovereign inference. Customer data can stay in your environment.
- European. Vigilens AS is registered in Oslo, Norway, inside the EEA.
Vigilens vs Vanta
Vanta is a GRC automation platform. It collects policy and configuration evidence, monitors controls continuously, and offers a catalogue of frameworks that includes AI frameworks such as the EU AI Act and ISO 42001.
In a GRC platform an AI framework is a control checklist with evidence attached. It proves a control is documented. It does not test whether the AI system passes it. Results are pass/fail per automated test, and the company attests about itself.
The two are complementary. Vanta holds the policy, Vigilens holds the proof the system behaves. Use both.
Vigilens vs Drata
Drata is a GRC automation platform with continuous control monitoring and automated evidence collection across company infrastructure. Its framework catalogue includes AI frameworks such as the EU AI Act and ISO 42001.
Those frameworks are control checklists with evidence attached: they prove a control is documented, they do not test whether the AI system passes it. Vigilens runs each regulatory control as an executable test against the AI system on every change, and decides the verdict by rule.
Drata and Vigilens are complementary. Keep the policy and the company controls in Drata, and let Vigilens supply the tested proof for each AI system.
Vigilens vs Credo AI
Credo AI is an AI governance platform. Platforms in this category document the AI system: what it is, who owns it, and which policies and assessments apply to it.
That register is needed, and Vigilens does not replace it. Vigilens runs every regulatory control as an executable test against the system on every change, inside CI/CD, with the evidence hashed. A governance platform records the obligation, Vigilens tests whether the system meets it.
Vigilens vs OneTrust
OneTrust is a privacy and GRC platform used by large enterprises. Like other GRC platforms it holds the policy and the records of the compliance programme.
Vigilens is complementary to it: the policy lives in the GRC platform, the proof that a specific AI system behaves as specified comes from Vigilens, test by test, on every change.
Vigilens vs Saidot
Saidot is an AI governance platform from Finland. Like other platforms in its category it documents AI systems and the policies and assessments that apply to them.
Vigilens works one layer down: every regulatory control is an executable test that runs against the system on every change. Both are European, and they answer different questions: what has been recorded about the system, and whether the system passes.
Vigilens vs Fairly AI
Fairly AI is an AI governance and risk management platform. Like other platforms in its category it documents AI systems and assesses them against policies and risk frameworks.
Vigilens works one layer down: every regulatory control is an executable test that runs against the system on every change, with the verdict decided by rule. A governance platform records the assessment, Vigilens tests whether the system passes.
Vigilens vs Trail
Trail is an AI governance platform from Germany focused on documenting and governing the AI lifecycle.
Vigilens is the executable layer: each regulatory control runs as a test in CI/CD on every change, the verdict is decided by rule, and the evidence is hashed. A team can keep its lifecycle documentation where it is and use Vigilens for the tested proof.
From verification to foresight.
Everything above is about the present tense: does this system pass right now. The layer Vigilens is building next is the future tense. Every verdict, every artifact and every drift event becomes part of a record of how a system behaves over time. The GSAI world model runs forward simulation over that evidence state, to flag the incident before it happens. This layer is in development.
Frequently asked questions
What is the difference between Vigilens and Vanta?
Vanta is a GRC automation platform. It collects policy and configuration evidence, monitors controls continuously and offers frameworks as checklists, including AI frameworks. That proves a control is documented. Vigilens runs each regulatory control as an executable test against the AI system itself, on every change, inside CI/CD. The two are complementary: Vanta holds the policy, Vigilens holds the proof the system behaves.
Is company-level compliance not enough for AI?
It is necessary, and it is not sufficient. Company-level compliance shows that policies exist and that infrastructure is configured as described. It does not show that a specific AI system behaves as its specification says after the last change. Vigilens tests the system, control by control, on every change.
How is Vigilens different from AI-native tools like Credo AI or Fairly AI?
AI governance platforms document the AI system: what it is, who owns it, which policies and assessments apply. Evaluation tools test a model before release. Vigilens runs every regulatory control as an executable test on every change, decides each verdict by rule, and hashes the evidence. Many teams will use a governance platform for the register and Vigilens for the tested proof.
Which platforms are EU-native?
Vigilens is built and registered in Norway, inside the EEA, and offers EU-sovereign inference through the EU AI-on-Demand Platform. Saidot (Finland) and Trail (Germany) are also European. Vanta, Drata, Credo AI and OneTrust are headquartered in the United States.
Does Vigilens cover medical device AI?
Yes. ISO 13485 and EU MDR are two of the eight frameworks live as executable tests, alongside EU AI Act, GDPR, ISO 42001, ISO 27001, NIST AI RMF and SOC 2. Medtech runs on the same engine as information security, data protection and public sector.
Can I bring my own LLM?
Yes. Vigilens is model-agnostic: one provider interface, with hosted models, bring-your-own-model, or EU-sovereign inference through the EU AI-on-Demand Platform. The identical test runs on every backend. Plan details are on the pricing page.
How does Vigilens decide pass or fail?
By rule. Each control is evaluated against evidence and the verdict is one of four: PASS, CONTRADICTS, PARTIAL or INSUFFICIENT. No language model decides the outcome. The evidence is hashed and the pack can be verified by hash.
Not sure which frameworks apply to your AI system? The free classifier answers it in six questions.