Governance & Compliance

This category covers the controls placed around data and AI systems: catalogs and metadata platforms that record what data exists and what it means, lineage tools that trace how it moved and was transformed, access governance and policy enforcement, discovery and classification of sensitive data across cloud and on-premises estates, privacy engineering such as masking, tokenisation, encryption, de-identification, and privacy-preserving record linkage, consent and data-subject-request automation, and AI governance products that maintain model inventories and map controls to frameworks including the EU AI Act and the NIST AI Risk Management Framework.Two buying motions run through the category and they rarely share a budget. One is enablement: making data discoverable and safely usable so analytics and model development can proceed. The other is defence: proving to a regulator, auditor, or customer that obligations are met. Questions that separate vendors include whether classification is inferred automatically or requires manual curation, and what the false-positive rate looks like on a real estate rather than a demo; whether policy is enforced at the data plane or only documented; how unstructured and multimodal data is handled, which is where catalog-first products are weakest; whether the tool runs agentlessly or must be deployed into every data store; how lineage is derived, since parsed-query lineage and instrumented lineage differ sharply in coverage; and whether the AI governance module is a real model registry with evidence collection or a policy questionnaire.De-identification that produces artificial records rather than protecting real ones is catalogued under synthetic data. Tooling that moves and reshapes data without governing its use sits under data processing and curation.