Modulos vs Saidot: AI Governance Comparison (2026)

Both vendors model governance as a graph, but they put different things at the centre. The Modulos Governance Graph is built around controls, each written once and mapped to every framework it serves: 453 of 929 controls count toward two or more of the 26 frameworks, and evidence attached to a control counts wherever it applies. The EU set is complete, from the AI Act and the Cyber Resilience Act to NIS2, DORA and GDPR. It includes EN 18286, the first harmonised standard under the AI Act since its Official Journal citation on 14 October 2026, with prEN 18228 and prEN 18282 mapped as drafts. Modulos experts sit on CEN-CENELEC JTC 21 and ISO/IEC JTC 1/SC 42, including JWG 6 on conformity assessment.

Saidot describes itself as the “AI governance platform built on a knowledge graph”. The graph links systems, models, agents, datasets, risks, controls and policies, curated with more than 260 risks, 620 controls, 110 policies and 170 third-party AI models and products. Linked components let a change travel: Saidot’s AI Governance Agent can tell a team in Slack that a model update has brought new risks to a system that uses it. Its homepage names the EU AI Act, ISO/IEC 42001 and the NIST AI RMF among the policies covered. However, we did not find EN 18286 or the draft harmonised standards on its public pages as of 16 October 2026.

The Modulos edge: Shared controls carry evidence and test verdicts across frameworks, and the first harmonised standard under the AI Act already sits in the same graph as DORA, NIS2 and GDPR.

Scout, the Modulos AI agent, discovers AI in the platforms it connects to. It lists Azure AI Foundry agents and Azure OpenAI deployments, inventories Microsoft Copilot Studio agents across a whole tenant, and reads the OpenAI Platform organisation and Claude Console to show who uses AI through API keys. Discovery runs when a user asks, with read-only access, and each find stays a proposed Draft until a person confirms it. Submitting the Draft triggers a completeness check and an initial risk assessment, and a Registration Manager then approves or rejects the system with a recorded reason.

Saidot’s product page describes registration of in-house and third-party AI systems, with their models, agents and datasets as components. Models import through native integrations with Azure OpenAI Service, Azure AI Services, Azure ML and Amazon Bedrock, and agents from Microsoft Foundry Agent Service and Amazon Bedrock; other platforms connect over REST and webhooks. At registration Saidot can classify a system under the EU AI Act automatically, by inheritance from its components or by hand. For teams that build on those clouds it is a direct route into the register, but Copilot Studio and direct API use do not appear on its published import list.

The Modulos edge: Scout reaches AI built outside a model platform, such as Copilot Studio agents and direct OpenAI or Claude API use, and each find goes to a reviewer with a first risk assessment.

The Fermi Risk Agent gives every AI risk an annual loss figure in EUR, GBP or USD. It runs as a step in a scheduled job, so each figure is re-estimated as controls and evidence change, and the platform keeps risk value over time. From the portfolio view a risk officer can drill from the organisation down to a single threat vector, coloured by how much of each Risk Limit is in use. For an EU bank or insurer, that puts AI risk in the units its operational risk reporting already uses.

Saidot scores risk qualitatively. On its product page, each risk gets a likelihood and an impact on a scale of 1 to 5, first as inherent risk and then as residual risk after controls. It is a clear and auditable method for registers that report risk as levels, but it does not express exposure in money.

The Modulos edge: A board sets Risk Limits in currency and sees which AI systems consume them, refreshed on every scheduled run.

Agent Tests turn a written compliance question into a recurring job. The team states the objective and the pass criteria in plain English, picks a daily, weekly, monthly or quarterly cadence, and an agent with read-only tools inspects the connected code, cloud and data sources. Each run ends in a cited pass, fail or error verdict that is stored immutably. A failure sets the mapped controls back to not executed and notifies their owners, while an error leaves them unchanged, and a later pass does not restore them on its own.

Saidot generates testing plans for AI systems. According to its product page, red teaming probes content safety, security and data confidentiality across 17 risks, and regular testing covers 44. Saidot ingests runtime observability events from the AI stack, which can open incidents, trigger reviews or change risk levels, with notifications in Slack or Jira. For customers’ own assistants it offers three MCP servers (Docs, Library and Governance) and a REST API that covers about 95% of the platform.

The Modulos edge: Each test result becomes control state, so the conformity record moves on the same day a scheduled check fails.

Modulos completed ISO/IEC 42001 product conformity assessment of its own platform with CertX (certificate 213-001/24) and holds a SOC 2 Type 2 report. Its named customers include PwC, Armasuisse, Beyond Gravity, the ETH AI Center, JobCloud, SCSK and Serai, along with A-ZN, Slovenia’s insurance supervisor, and Xayn, which became the first company in Germany certified to ISO/IEC 42001. Evidence flows in from sources such as the Claude Console, Copilot Studio, Azure, AWS, Snowflake and GitHub, and each AI system keeps a history of who changed what and when.

Saidot’s information security management system is ISO/IEC 27001:2022 certified by Prescient Security, but we found no public ISO/IEC 42001 disclosure. Its site lists integrations with Azure AI Foundry, Amazon Bedrock, Snowflake, Jira and Slack, and Saidot is available on the Microsoft Azure Marketplace. Its homepage quotes Sarah Bird, Microsoft’s CPO for Responsible AI, on the Azure AI integration.

The Modulos edge: Modulos brings an ISO/IEC 42001 certificate for the platform itself and named references in insurance supervision, defence procurement and professional services.