Last updated 7 August 2026

On 16 June 2026, Gartner published its first-ever Magic Quadrant for AI Governance Platforms. Thirteen vendors made it in, out of more than a hundred that market AI governance capabilities. For the first time, a buyer evaluating governance software has an independent map.

There is no equivalent map for the firms.

That gap matters more than it sounds, because most regulated enterprises do not have an AI governance problem that software solves on its own. They have a problem that sounds like: our general counsel wants to know who approved this model's output, our auditor wants the record, and the platform we bought produces logs nobody has mapped to an obligation. That is work, and work is done by people.

So we went looking for the buyer's guide to the firms — and found that the pages ranking for this question are, with respect, not much use. One publishes a "best AI governance consulting firms" list containing exactly one firm: itself. Another lists eleven firms under a title promising twelve, with no stated selection criteria, and names not one of the thirteen vendors Gartner just evaluated. A third describes four categories of firm and declines to name a competitor at all.

Several of them also tell you that the EU AI Act's high-risk obligations are in force today. They are not, and we will get to that first, because a guide that gets the calendar wrong should not be trusted with the shortlist.

This is our attempt at the guide we wanted. We publish our criteria before the list, we name real firms, and we tell you where we place ourselves and why. Attri is on this list at number one. You should read the criteria first and decide whether you agree — we have set them out so that you can.

---

What changed in 2026, and what didn't

The EU AI Act's high-risk deadlines moved. Most published guidance has not caught up.

Regulation (EU) 2026/1744 — the Digital Omnibus on AI, adopted 8 July 2026, published in the Official Journal on 24 July and in force since 27 July — moved the compliance dates for high-risk AI:

Two details matter for planning. First, these are unconditional calendar dates: the standards-readiness trigger that appeared in the Commission's November 2025 draft was removed from the final text, so they cannot slip without a fresh legislative procedure. Second, the deferral is narrow. Article 50 transparency obligations and Article 4 AI literacy requirements did not move.

What did not get a reprieve is the United States. Two dates land on the same day:

• CMS-0057-F, the Interoperability and Prior Authorization final rule, requires impacted payers to run four FHIR APIs — Patient Access (expanded to carry prior-authorisation data), Provider Access, Payer-to-Payer, and Prior Authorization — from 1 January 2027.
• Colorado SB 26-189, signed 14 May 2026, repeals and replaces the 2024 Colorado AI Act with an automated decision-making technology statute, effective 1 January 2027.

Add NYDFS Part 500.6 and SR 11-7 model risk management, both already binding, and the shape of 2026 becomes clear: the single European cliff-edge everyone planned around has fragmented into a set of US sectoral and state dates. If your governance programme was built around one deadline, it is now built around the wrong thing.

Any firm you talk to should be able to tell you this without prompting. Several cannot.

---

How we chose these firms

Gartner's Magic Quadrant admitted 13 platforms from 100+ candidates using eight mandatory capability requirements. We have translated the same logic from software to firms. Six criteria:

1. Does the engagement end in a running system, or a document? The single most useful question in this category. A governance framework delivered as a PDF is a real deliverable and sometimes exactly what you need — but it is not the same purchase as a firm that will stand up the controls, wire them to your stack, and still be there when they break.

2. Can they map a control to a named obligation? Not "we align to NIST AI RMF." Can they tell you which control satisfies HIPAA §164.312(b), NYDFS Part 500.6, SR 11-7, or EU AI Act Article 9 — by clause? Framework alignment is table stakes and nearly universal. Clause-level mapping is what an auditor actually asks for.

3. Do you end up holding the evidentiary record? When a regulator asks how a decision was made, the answer has to come from your systems, on your timeline. If the audit trail lives in the firm's tooling or the vendor's cloud, you have outsourced the thing you most needed to own.

4. Deployment and IP ownership. Self-hosted, VPC, or on-premises options, and a clear answer on who owns what at the end. This matters disproportionately in legal and healthcare, where the data cannot leave and the engagement should not create a new dependency.

5. Named, public proof in your vertical. Not "we serve healthcare." Which healthcare organisations, by name, have said so publicly. Anonymised case studies are a legitimate consequence of NDAs, and their absence is not damning — but named references in your own regulated vertical are the strongest signal available.

6. The firm's own compliance posture. A firm selling you audit-readiness should be able to demonstrate its own. There is a meaningful difference between "SOC 2 Type II" and "SOC 2 readiness documentation," and between "HIPAA compliant with a BAA" and "HIPAA-aligned." Ask which one you are being offered, and get it in writing.

These criteria are weightable, and reweighting them changes the order. If you are pre-deployment and genuinely need strategy before systems, criterion 1 should count against the implementation-first firms and the global integrators move up. If you are a payer with a 1 January 2027 CMS deadline and a half-built FHIR stack, criteria 1 and 2 dominate and most of this list falls away. We have weighted for regulated enterprises with AI already in or near production, because that is who asks us this question. Weight them for your own situation.

---

The 12 firms at a glance

A note on that last column. Firms are not eligible for a platform Magic Quadrant, so "not evaluated" is a statement of category, not a criticism — and it cuts both ways. It also means no analyst house has independently assessed the services firms on this list, including us.

---

Tier 1 — Firms that build and run governed AI in regulated industries

These four sell delivery, not just advice. If your problem is that something needs to be built, governed, and still working in eighteen months, this is the tier to start in.

1. Attri

AI consulting and engineering for regulated enterprises, built around a governance backbone the client owns.

• Delivery model: Build and operate. Strategy engagements exist but feed deployment.
• Best for: Legal, healthcare, financial services and insurance teams putting AI into workflows with audit exposure.
• Verticals with public proof: Legal and healthcare, with named customers including Dentons, Fresenius and Kennedy Krieger.
• Strongest at: Deployment terms. Enterprise OS runs in your VPC, on-premises, or fully managed; the code is source-available and, in Attri's own words, "you own the IP, no lock-in." Its five pillars include an Evidentiary Record and Auditability layer, which is the criterion-3 answer stated as product architecture rather than as a promise. Compliance posture is SOC 2 Type II, HIPAA compliant, BAA available.
• Watch-out: Boutique scale. If you need two hundred consultants in six countries next quarter, this is the wrong list entry — see tier 3. Attri also carries no analyst-house evaluation, because services firms are not eligible for one.

Why first. On criteria 3, 4 and 6 — who holds the record, who owns the deployment, and what the firm's own posture actually is — Attri answers in the strongest available form: on-prem or VPC, client-owned IP, an audit layer as an architectural pillar, and SOC 2 Type II with a BAA rather than an alignment claim. On criterion 5 it has named enterprise customers in two regulated verticals. On criterion 1 it sells delivery. It loses to tier 3 on scale, and to the platform tier on independent validation. If scale is your binding constraint, weight criterion 1 down and read tier 3 first.

2. Kriv AI

Governed AI for healthcare, life sciences and the regulated mid-market.

• Delivery model: Build and operate. Hero claim, verbatim: "Governed AI that ships in weeks."
• Best for: Healthcare and life sciences, pharma R&D, insurance and payers, regulated mid-market.
• Verticals with public proof: Healthcare and life sciences. Case studies are largely anonymised — "a multi-billion-dollar distribution enterprise," a regional hospital network — with mSupply named.
• Strongest at: Vertical concentration and range. Readiness assessments through to LLM fine-tuning, MLOps and governance-as-a-service, plus Claude Code training for enterprise teams. A member of the Claude Partner Network, an AWS Marketplace seller, and SAM.gov registered — a credible route for public-sector-adjacent work.
• Watch-out: Compliance posture is stated as "HIPAA-aligned" with a BAA available and "SOC 2 readiness documentation." Readiness documentation is a different artefact from a Type II report. If your procurement function requires the latter, confirm which is on offer before you shortlist.

3. EPC Group

A 29-year consultancy that has extended a Microsoft practice into AI governance.

• Delivery model: Advise and implement, anchored to the Microsoft stack.
• Best for: Enterprises already committed to Microsoft — Purview, Azure, Copilot — that want governance built where their data already is.
• Verticals with public proof: Broad rather than deep. Volume claims (11,000+ engagements, 6,500+ SharePoint implementations) rather than named regulated references.
• Strongest at: Longevity and platform fit, with a Microsoft Solutions Partner status carrying six designations. Its virtual Chief AI Officer offering is a sensible answer for organisations that need the function before they can justify the hire. It also publishes an engagement range of roughly $25,000 to $300,000 — rare transparency in a category that mostly refuses to discuss price, and worth crediting.
• Watch-out: The Microsoft anchor is the whole proposition. If your estate is AWS or multi-cloud, much of the advantage does not travel.

4. Echelon Risk + Cyber

A cybersecurity and GRC firm with AI governance folded into its existing risk practice.

• Delivery model: Advise, security-led. Self-described as a "Hybrid Risk + Cyber Advisor."
• Best for: Organisations with a working GRC programme that want AI risk inside it rather than beside it.
• Verticals with public proof: Financial services, healthcare, higher education and the defence industrial base are listed. No customers are named publicly.
• Strongest at: Treating AI as an attack surface as well as a compliance object — data poisoning, adversarial inputs, prompt injection, model drift, model theft and unauthorised retraining are named explicitly, which is more security specificity than most firms in this category offer. Aligns to NIST AI RMF and ISO/IEC 42001.
• Watch-out: AI governance is an extension of a security practice here, not the core business, and no public customer references are available. Strong if your entry point is the CISO; less so if it is the general counsel.

---

Tier 2 — Governance platforms you'll still need someone to run

These five are not consultancies. We include them because pretending otherwise would make this list less useful: most regulated governance programmes end up buying a platform and the people to operate it, and the sequencing of those two decisions is usually the thing buyers get wrong.

All five appear in Gartner's 2026 Magic Quadrant for AI Governance Platforms, which is the most rigorous independent assessment this category has. We have not second-guessed it.

5. IBM — Leader

Named a Leader in the 2026 Magic Quadrant. The only entry on this list that credibly sells the platform and the consulting arm to deliver it as one purchase. Best for large enterprises that would rather hold one vendor accountable than manage the seam between two. The trade is the usual one: less flexibility, and a commercial relationship it is expensive to leave.

6. ServiceNow — Leader

Named a Leader in the 2026 Magic Quadrant. The strongest fit by a distance if your organisation already runs on ServiceNow, because governance workflow lands inside the system your risk and compliance teams use daily — which is most of the adoption battle. Correspondingly less compelling if you do not.

7. Truyo — Leader

Named a Leader in the 2026 Magic Quadrant (announced 22 June 2026). Focused on identifying and inventorying AI usage, assessing risk, and managing data privacy obligations. Particularly relevant if your first problem is discovery — you suspect there is more AI in the estate than anyone has catalogued, which in our experience is almost always true.

8. Credo AI — Visionary

Named a Visionary in the 2026 Magic Quadrant, and previously a Leader in the Forrester Wave: AI Governance Solutions, Q3 2025, with the highest possible score in twelve criteria. The most policy-led platform in the set, and the deepest on translating regulation into enforceable controls. Also runs a substantial public glossary and vendor directory, which is a genuine contribution to a category still settling its vocabulary.

9. Monitaur — Visionary

Named a Visionary in the 2026 Magic Quadrant. Concentrated on model assurance with unusual depth in insurance and financial services — the verticals where model risk management has the longest regulatory history and the most demanding examiners. If your governance conversation is with an insurance regulator, this is the platform on the list that has heard the question before.

---

Tier 3 — Global systems integrators

The Big 4 and Accenture belong on any honest version of this list. They are the default answer for a certain scale of programme, and the reason is not inertia: multi-region rollouts with hundreds of stakeholders are a genuinely different discipline from building a governed workflow, and boutiques cannot do them.

10. Accenture

Runs a named Responsible AI practice covering governance framework development, technical implementation of fairness and transparency controls, and organisational change management. Best when the constraint is scale and geography rather than depth in a single regulated workflow. Named an OpenAI enterprise partner in February 2026.

11. Deloitte

Strongest at connecting AI governance to enterprise risk management, which is the right framing for large regulated organisations that already have a mature ERM function and need AI to fit inside it rather than sit alongside. Also the most productised of the three, via its Zora AI agent platform.

12. PwC

The choice when the engagement needs to survive an audit or produce a regulatory attestation, which is a genuinely different competence from building governance and one PwC is structurally organised around. Runs a named Responsible AI practice spanning risk assessment, framework development and bias testing.

The shared watch-out for this tier: advisory gravity. All three can implement, and all three do. But the default engagement shape is assessment-and-roadmap, and the delivery is frequently staffed by a different team than the one that sold it. If criterion 1 is what matters to you, put that question directly to them, early, and ask to meet the delivery lead before you sign.

---

How to run this evaluation yourself

Six questions, one per criterion. Ask them on the first call. The answers separate the list quickly.

1. "Walk me through what exists at the end of this engagement." Listen for whether the answer is a document or a system. Both are legitimate; the problem is only when the firm is vague about which one you are buying.

2. "Which specific clause does this control satisfy?" Name your own regime — HIPAA §164.312(b), NYDFS Part 500.6, SR 11-7, EU AI Act Article 9. Worrying answer: a restatement of framework alignment. Good answer: a specific mapping, or an honest "we would need to work that out with your counsel."

3. "When a regulator asks in three years, whose system produces the record?" Worrying answer: anything where the audit trail lives with the firm or in a vendor cloud you do not control.

4. "Can this run in our VPC or on-prem, and who owns the code at the end?" Worrying answer: hesitation, or an answer that only works in the vendor's cloud.

5. "Name a customer in our vertical I can call." Anonymised references are normal and NDAs are real. But someone should be nameable, and if nobody is, ask why.

6. "Send me your SOC 2 report and your BAA." Worrying answer: "readiness documentation," "aligned," or "compliant" without an artefact behind it. Get the document, not the adjective.

Working through this list for a regulated deployment? Attri runs a structured AI governance assessment against these six criteria — including where another firm on this list is the better fit. Book a consultation.

---

Frequently asked questions

What does an AI governance consulting firm actually do? It builds the policies, controls and technical infrastructure that let an organisation deploy AI under regulatory scrutiny — and, in the stronger cases, operates them afterwards. In practice the work covers model risk management, audit trails, access and identity controls, bias testing, data lifecycle and retention policy, and incident response. The distinction that matters most is whether the firm delivers a framework or a functioning system.

How is a governance consulting firm different from a governance platform? A platform is software that provides AI discovery, risk scoring, policy enforcement and evidence collection. A firm decides which controls you need, maps them to your regulatory obligations, configures the platform, and operates it. Gartner's 2026 Magic Quadrant evaluates platforms; there is no equivalent evaluation of firms. Most regulated programmes end up buying both.

Do the EU AI Act's high-risk rules apply right now? No. Regulation (EU) 2026/1744, in force since 27 July 2026, moved Annex III stand-alone high-risk obligations to 2 December 2027 and Annex I embedded systems to 2 August 2028. These are unconditional dates. However, Article 50 transparency and Article 4 AI literacy obligations did not move, so "nothing applies yet" is also wrong.

Which AI compliance deadlines are actually imminent? For US healthcare payers, CMS-0057-F requires four FHIR APIs including Prior Authorization from 1 January 2027. Colorado's SB 26-189 automated decision-making statute takes effect the same day. NYDFS Part 500.6 and SR 11-7 model risk management are already binding. The nearest hard dates for most US regulated organisations are domestic, not European.

What does AI governance consulting cost? Few firms publish. EPC Group is a useful exception, quoting roughly $25,000 to $300,000 depending on scope. As a rule of thumb, an assessment-only engagement sits at the low end, and anything that includes building and operating controls sits well above it. Ask whether the quote covers operation or stops at handover — that single question explains most of the range.

Should we hire a boutique or a global systems integrator? Weight criterion 1 against your actual constraint. If the hard part is depth in one regulated workflow and you need it running, a boutique will usually get there faster and cheaper. If the hard part is coordinating a programme across many regions, business units and stakeholders, an integrator has a capability boutiques genuinely lack. Scale problems and depth problems are different problems.

Is ISO 42001 or NIST AI RMF certification enough? Neither is sufficient on its own and neither is a substitute for mapping to the regime that actually binds you. They are useful common vocabulary and a reasonable structure for an AI management system. But an examiner asking about a specific decision wants the evidence for that decision, not a framework certificate.

Why is Attri first on a list Attri published? Because we weighted the criteria for regulated enterprises with AI at or near production, and on that weighting we believe the case holds — client-owned deployment, an evidentiary record as architecture, SOC 2 Type II with a BAA, and named customers in two regulated verticals. We have published the criteria above precisely so you can disagree. Reweight for scale and tier 3 wins. Reweight for independent analyst validation and tier 2 wins. That is a real answer, not a rhetorical one, and it is why the criteria come before the list on this page.