Modulos vs Airia: AI Governance Comparison (2026)

Modulos is the system of record for AI conformity. Each AI system carries its frameworks, controls, evidence, risks and owners, plus a history of who changed what and when. Scout investigates code, cloud and documents and cites file paths and line references, while agents for evidence processing and control assessment suggest changes for a person to review. Modulos has no runtime gateway. Runtime evidence comes from integrated sources such as Vijil, whose trust scores and guardrail data land against the controls they support.

In its own announcement, Airia calls itself “the AI control plane for enterprise organizations”. The platform groups discovery, security (AI guardrails, agent constraints, an MCP gateway and agent red teaming), governance and an optimisation layer with an agent builder, model routing and cost controls. Airia launched its AI governance module on 13 January 2026, adding a governance dashboard, an agent and model registry, a model repository, compliance automation and risk assessment tools. Airia reports more than 300 enterprise customers; ArcelorMittal, BuzzFeed and Mars appear on its homepage.

The Modulos edge: Modulos keeps the conformity record that auditors and supervisors examine, with findings from a runtime control plane such as Airia filed as evidence.

Framework library 1.1.0 in Modulos holds 26 frameworks, including the complete EU set: the AI Act, the Cyber Resilience Act, NIS2, DORA and GDPR. On 14 October 2026 the reference of EN 18286, the quality management system standard, was published in the Official Journal, making it the first harmonised standard under the AI Act. Applying it gives a presumption of conformity with Article 17(1) and the first sentence of Article 11(1). Modulos maps it next to two drafts, prEN 18228 on risk management and prEN 18282 on cybersecurity. ISO/IEC 42001, NIST AI RMF, both OWASP Top 10 lists, US state rules and frameworks from Singapore, the UAE and Saudi Arabia complete the library. Of 929 controls, 453 serve two or more frameworks.

Airia’s governance page names GDPR, HIPAA, ISO 42001, NIST RMF and the EU AI Act and says compliance reports are generated automatically against them, and its homepage adds SR 11-7. However, Airia names these frameworks at headline level. We found no CEN-CENELEC harmonised standard, no CRA, NIS2 or DORA mapping and no published control count.

The Modulos edge: One control set answers the AI Act, EN 18286 and the EU cyber and resilience laws together, so evidence gathered once serves every framework that shares the control.

Scout, the Modulos AI agent, runs discovery on request. It finds agents in Azure AI Foundry and model deployments in Azure OpenAI, takes stock of the Microsoft Copilot Studio agents across the tenant, and checks the customer’s OpenAI Platform organisation and Claude Console to see who uses AI through API keys. Access is read-only. Each find arrives as a proposed Draft that a person must confirm before it enters the inventory. Submission starts registration: Modulos checks the record for completeness and runs an initial risk assessment, then a Registration Manager decides, with the reason for approval or rejection on file. Teams with an existing list can import it from CSV.

Airia’s AI discovery page casts a wider net: real-time monitoring of browser-based AI tools, SASE and identity-provider signals, endpoint scans for local AI, connections into Microsoft 365 and Google Workspace, plus code scans that find LLM integrations, agents and MCP servers before production. Finds land in a registry with ownership tracking. New assets can be tagged automatically by rule as they are deployed. Airia’s pages describe human approvals at runtime, triggered by risk class, data sensitivity or action type, but we did not find a documented approval step for admitting a system to the registry.

The Modulos edge: Every AI system enters the Modulos inventory through a recorded approval with a first risk assessment attached, so an auditor sees a reviewed register.

In Modulos, the Fermi Risk Agent estimates an annual loss in EUR, GBP or USD for each AI risk. Scheduled jobs re-run it, so the figure moves when controls or evidence change. The portfolio view starts at the organisation and drills down to individual threat vectors, each coloured by its Risk Limit use. The AI System Graph traces each threat through its risk to the affected AI system in money. A time series shows how each value has moved, so a risk committee sees AI exposure in the same units as its other operational risks.

Airia’s risk classification lets teams define unlimited risk categories, levels and criteria, apply predefined rules to new assets and accept automated suggestions. An agent can carry a label such as EU AI Act high risk or an internal Tier 1, which can then trigger human approval at runtime. The page links to risk scoring, but we found no description of how scores are computed and no monetary method as of 16 October 2026.

The Modulos edge: The board gets an annual loss figure for each AI risk, checked against Risk Limits and refreshed on schedule as controls change.

With Agent Tests, a compliance check written in plain English becomes a job that runs daily, weekly, monthly or quarterly. An agent inspects connected systems such as a GitHub repository or a Snowflake warehouse through read-only tools and returns a pass, fail or error verdict with citations. Every run is stored immutably. When a verdict fails, the mapped controls drop back to not executed and their owners are notified. Errors leave control state unchanged; a later pass does not restore a control on its own. Modulos holds a SOC 2 Type 2 report and CertX ISO/IEC 42001 product conformity certificate 213-001/24. Xayn reached ISO/IEC 42001 audit readiness with Modulos in four weeks.

Airia tests from the attacker’s side. Its platform lists agent red teaming next to agent constraints and AI guardrails, which its homepage says inspect every action at runtime. Governance output comes as generated compliance reports and an audit trail of agent decisions. Airia holds a SOC 2 Type II attestation for its SaaS operations. However, we found no scheduled conformity test whose result changes the state of a compliance control. The two products answer different questions: whether an agent can be broken or misused, and whether a control still holds.

The Modulos edge: A failed Agent Test reopens the control it covers, so compliance status changes when your systems drift; an Airia red-team report can sit beside it as evidence.