Skip to main content

EFROS Research / Public Index

US AI Vendor Governance Index

An operator-grade, source-cited scorecard for 20 AI vendors evaluated on 12 US AI governance axes — NIST AI RMF, Colorado AI Act, HIPAA BAA, SR 11-7, ABA Formal Op 512, Section 1557, SOC 2, ISO/IEC 42001, US data residency, training-data opt-out, subprocessor transparency, and trust-center maturity.

Public • Source-Cited • Updated Quarterly

Edition: 2026-Q2Vendors: 20Axes: 12
By Stefan Efros, CEO & Founder, EFROSReviewed by Daniel Agrici, Chief Security Officer, EFROS
Reviewed by CSO ·

What this is

Every regulated buyer faces the same question — is this AI vendor safe for our use case? The trust-portal claim, the vendor sales deck, and the auditor's checklist rarely line up. The Index closes that gap by translating public vendor documentation into a normalized score against the US frameworks operators are actually measured against during audit: NIST AI RMF, the Colorado AI Act, the Microsoft / HHS / FRB sectoral overlays, and the ABA opinion that defines responsible use of AI in legal practice.

The Index is free, public, and ungated. Every cell is source-cited to a vendor trust portal, public BAA, SOC report cover page, or published methodology document. Scoring is "yes" / "partial" / "no" / "na" — N/A axes (sector overlays that don't apply to the vendor's deployment category) are excluded from the composite denominator so vendors aren't penalized for axes outside their scope. Composite scoring is sector-weighted: a healthcare-vertical vendor carries 2× weight on Section 1557, a legal-vertical vendor 2× on ABA Op 512, a banking-vertical vendor 2× on SR 11-7.

How we score

  • 12 axes per vendor scored "yes" / "partial" / "no" / "na" with source citation per cell.
  • Sector-weighted composite — healthcare 2× Section 1557, legal 2× ABA Op 512, banking 2× SR 11-7, plus 1.5× BAA for any regulated sector.
  • Trust-center maturity scored 1-5 separately and contributes 10% of the final composite on top of the 12-axis average.
Read the full methodology →

The full scorecard

20 vendors, 12 axes, ranked

Click any vendor name for the source-cited deep dive (per-cell notes, strengths, weaknesses, best/avoid use cases). Status badges are color-coded: green = yes, amber = partial, rose = no, zinc = not applicable.

US AI Vendor Governance Index — 20 vendors scored on 11 axes plus composite score and grade, sorted by composite descending.
#VendorCategorySectorScoreGradeBAAOpt-outUS ResSOC 2ISO 42001NIST AICO AI§1557SR 11-7ABA 512Subproc
1AbridgeHealthcarehealthcare87AYesYesYesYesPartialPartialPartialYesN/AN/AYes
2Thomson Reuters CoCounselLegallegal80BYesYesYesYesNoPartialPartialN/AN/AYesYes
3FICO Falcon Fraud Manager + FICO Score AIBankingbanking80BYesYesYesYesNoPartialPartialN/AYesN/AYes
4Lexis+ AILegallegal76BYesYesYesYesNoPartialNoN/AN/AYesYes
5Westlaw Precision AILegallegal76BYesYesYesYesNoPartialNoN/AN/AYesYes
6Microsoft 365 CopilotProductivitygeneral75BYesYesYesYesPartialPartialPartialPartialPartialPartialYes
7HarveyLegallegal74BYesYesYesYesNoPartialPartialN/AN/AYesPartial
8Zest AIBankingbanking74BYesYesYesYesNoPartialPartialN/AYesN/APartial
9UpstartBankingbanking74BYesYesYesYesNoPartialPartialN/AYesN/APartial
10Suki AIHealthcarehealthcare72BYesYesYesYesNoPartialPartialPartialN/AN/AYes
11Nuance DAX Copilot (Microsoft)Healthcarehealthcare70BYesYesYesYesNoPartialNoPartialN/AN/AYes
12Salesforce Einstein / AgentforceProductivitygeneral69CYesYesYesYesNoPartialNoPartialPartialN/AYes
13GleanProductivitygeneral69CYesYesYesYesNoPartialNoN/AN/AN/AYes
14Arctic WolfSecurity MSSPgeneral69CYesYesYesYesNoPartialNoN/AN/AN/AYes
15HuntressSecurity MSSPgeneral69CYesYesYesYesNoPartialNoN/AN/AN/AYes
16eSentireSecurity MSSPgeneral69CYesYesYesYesNoPartialNoN/AN/AN/AYes
17SophosSecurity MSSPgeneral69CYesYesYesYesNoPartialNoN/AN/AN/AYes
18Unit21Bankingbanking68CYesYesYesYesNoPartialNoN/APartialN/AYes
19Ironclad AILegallegal63CYesYesYesYesNoNoNoN/AN/APartialYes
20Anthropic ClaudeFoundationgeneral58CPartialYesPartialYesNoPartialNoN/AN/AN/AYes
21Google Gemini for WorkspaceFoundationgeneral58CPartialPartialYesYesNoPartialNoN/AN/AN/AYes
22HummingbirdBankingbanking56CYesYesYesYesNoNoNoN/APartialN/APartial
23OpenAI ChatGPT & APIFoundationgeneral53DPartialPartialPartialYesNoPartialNoN/AN/AN/AYes
24ConnectWiseSecurity MSSPgeneral50DPartialYesPartialYesNoNoNoN/AN/AN/AYes
25SpellbookLegallegal45DYesYesPartialPartialNoNoNoN/AN/APartialPartial
26Heidi HealthHealthcarehealthcare45DYesYesPartialPartialNoNoNoPartialN/AN/APartial
27Notion AIProductivitygeneral33FNoPartialNoYesNoNoNoN/AN/AN/AYes
28Meta LlamaFoundationgeneral25FNoYesYesNoNoNoNoN/AN/AN/ANo
29Otter.aiProductivitygeneral25FNoPartialNoYesNoNoNoN/AN/AN/APartial
30Perplexity AIFoundationgeneral19FNoPartialNoPartialNoNoNoN/AN/AN/APartial

Axis legend: BAA = HIPAA Business Associate Agreement; Opt-out = training-data opt-out default; US Res = US data residency configuration option; SOC 2 = SOC 2 Type II report; ISO 42001 = ISO/IEC 42001 attestation; NIST AI = NIST AI RMF self-attestation; CO AI = Colorado AI Act readiness; §1557 = HHS-OCR Section 1557 readiness; SR 11-7 = FRB SR 11-7 readiness; ABA 512 = ABA Formal Opinion 512 readiness; Subproc = subprocessor list public.

By category

Category leaders

Top vendors within each category, ranked by sector-weighted composite. Sector overlays (Section 1557, SR 11-7, ABA Op 512) are primary differentiators in healthcare and legal categories; the foundation and productivity categories compete on platform fundamentals (BAA, residency, SOC stack, trust-center maturity).

Foundation models

General-purpose LLM providers. Sector overlays (Section 1557, SR 11-7, ABA Op 512) are deployer responsibility.

Productivity / general enterprise

AI overlays on the productivity stack (M365, Workspace, Notion, CRM). Governance posture inherits from the platform.

Legal vertical

Purpose-built for law firms — privilege handling, matter walls, ABA Formal Opinion 512 alignment.

Healthcare vertical

Clinical AI documentation and decision support. HIPAA BAA, Section 1557 algorithmic non-discrimination, HITRUST.

Banking vertical

Credit decisioning, fraud detection, BSA/AML, transaction monitoring. SR 11-7 model risk management is the binding constraint.

Security MSSP / MSP

MSSPs and MSPs with AI-augmented detection, response, and IT operations. Cross-cutting scoring — sector overlays N/A because MSSPs serve all sectors.

Operator signal

Trust-center maturity (1-5)

Trust-center maturity captures how much of a vendor's governance posture is self-serve verifiable versus locked behind an NDA or a sales conversation. A score of 5 means a public certificate library, audit reports under NDA, granular subprocessor and residency documentation, and AI-specific governance pages. A score of 1 or 2 means a thin security page and direct-request documentation only.

Microsoft (M365 Copilot, DAX Copilot) and Salesforce share the highest trust-center maturity scores — public certificate libraries, granular subprocessor lists, and audit-report distribution at scale. Abridge is the only clinical-AI vendor at parity. The bottom of the distribution is dominated by smaller vendors and foundation models in earlier governance stages.

What the data shows

Key findings

  1. 1. ISO/IEC 42001 is the biggest market-wide gap.No vendor in the Index holds a completed ISO/IEC 42001 AI management system attestation as of May 2026. Microsoft and Abridge are the closest — both publicly state alignment work in progress. For buyers asking "what's the AI-specific certification floor," there isn't one yet — and that's true even for the vendors with the most mature broader compliance stacks.
  2. 2. Sector overlays sort the leaderboard.Healthcare-vertical vendors (Abridge, DAX Copilot, Suki) lead on Section 1557 readiness; legal-vertical vendors (Harvey, CoCounsel, Lexis+ AI, Westlaw Precision AI) lead on ABA Op 512. Foundation models score lower on the composite because sector overlays are deployer responsibility — Section 1557, SR 11-7, and ABA Op 512 are all "N/A" at the vendor layer for general-purpose LLMs.
  3. 3. BAA gaps are the #1 disqualifier for shadow-AI workloads.Notion AI, Otter.ai, and Perplexity are widely deployed in regulated organizations but none of them sign BAAs. The audit finding we see most often involves PHI or attorney-client content flowing into one of these three tools without the deploying organization realizing the BAA gap. DLP at the upload boundary is the right preventive control.
  4. 4. Trust-center maturity correlates strongly with composite.Vendors at trust-center score 5 (Microsoft M365 Copilot, DAX Copilot, Salesforce, Abridge) cluster near the top of the composite. Vendors at score 2 (Meta Llama, Perplexity, Otter.ai, Spellbook, Heidi Health) cluster near the bottom. The 10% contribution to the composite formula matters less than the underlying signal — vendors that invest in self-serve trust documentation also tend to invest in the underlying controls.
  5. 5. Colorado AI Act posture is structurally vendor-side weak.Even at the top of the Index, Colorado AI Act readiness is "partial" at best — most vendors document the deployer responsibility model but do not claim full developer-side compliance. SB 24-205 places most of the burden on the deployer regardless, so this is structurally honest, but it means buyers cannot offload Colorado AI Act exposure to a vendor selection. The deployer obligations (impact assessments, consumer notice, right to appeal) remain in-house regardless of which vendor is chosen.

Methodology + disclaimer

Scoring as of 2026-05-13 from public information — vendor trust portals, published BAAs and DPAs, SOC report cover pages, model cards, and vendor governance documentation. Each cell is source-cited; methodology is auditable. Posture changes frequently — re-verify with the vendor's trust center before contract. Updated quarterly. The Index is an EFROS research artifact, not legal or compliance advice. Nothing in this Index constitutes an endorsement of any vendor; vendors with strong composite scores may still be poor fits for a specific deployment context.

Full methodology and source list →

Three ways forward

Use the Index as a starting point. Reserve a fixed-fee AI Governance Audit if a specific deployment needs operator-grade verification, run the self-serve AI Risk Score to benchmark your own posture in five minutes, or read the sector-specific playbooks for your regulatory context.

Sector-specific AI governance

By sector

By US state (state-specific framework relevance)

Get the next edition first

Subscribe to EFROS Research Updates. Quarterly editions, mid-quarter changelog when material vendor governance changes ship. No marketing drip — research only. Unsubscribe with one click.

We never sell or share emails. Your address is logged in our research list only — see our privacy policy.