---
title: "US AI Vendor Governance Index — 30 AI Vendors Scored | EFROS"
description: "30 AI vendors scored on 12 US AI governance axes: NIST AI RMF, Colorado AI Act, HIPAA BAA, SR 11-7, ABA Op 512. Public, source-cited, updated quarterly."
canonical: https://efros.com/research/us-ai-vendor-governance-index/
---

- [Home](https://efros.com/)
- /[Research](https://efros.com/research/)
- /US AI Vendor Governance Index

EFROS Research / Public Index

# US AI Vendor Governance Index

An operator-grade, source-cited scorecard for 30 AI vendors evaluated on 12 US AI governance axes: NIST AI RMF, Colorado AI Act, HIPAA BAA, SR 11-7, ABA Formal Op 512, Section 1557, SOC 2, ISO/IEC 42001, US data residency, training-data opt-out, subprocessor transparency, and trust-center maturity.

Public • Source-Cited • Updated Quarterly

Edition: 2026-Q2 Vendors: 30 Axes: 12

By [Stefan Efros](https://www.linkedin.com/in/stefanefros-cyberdefense/), CEO & Founder, EFROS

Updated · June 17, 2026

## What this is

Every regulated buyer faces the same question: is this AI vendor safe for our use case? The trust-portal claim, the vendor sales deck, and the auditor's checklist rarely line up. The Index closes that gap by translating public vendor documentation into a normalized score against the US frameworks operators are actually measured against during audit: NIST AI RMF, the Colorado AI Act, the Microsoft / HHS / FRB sectoral overlays, and the ABA opinion that defines responsible use of AI in legal practice.

The Index is free, public, and ungated. Every cell is source-cited to a vendor trust portal, public BAA, SOC report cover page, or published methodology document. Scoring is "yes" / "partial" / "no" / "na". N/A axes (sector overlays that don't apply to the vendor's deployment category) are excluded from the composite denominator so vendors aren't penalized for axes outside their scope. Composite scoring is sector-weighted: a healthcare-vertical vendor carries 2× weight on Section 1557, a legal-vertical vendor 2× on ABA Op 512, a banking-vertical vendor 2× on SR 11-7.

## How we score
- 12 axes per vendor scored "yes" / "partial" / "no" / "na" with source citation per cell.
- Sector-weighted composite: healthcare 2× Section 1557, legal 2× ABA Op 512, banking 2× SR 11-7, plus 1.5× BAA for any regulated sector.
- Trust-center maturity scored 1-5 separately and contributes 10% of the final composite on top of the 12-axis average.

[Read the full methodology →](https://efros.com/research/us-ai-vendor-governance-index/methodology/)

The full scorecard

## 30 vendors, 12 axes, ranked

Click any vendor name for the source-cited per-vendor view (per-cell notes, strengths, weaknesses, best/avoid use cases). Status badges are color-coded: green = yes, amber = partial, rose = no, zinc = not applicable.

| # | Vendor | Category | Sector | Score | Grade | BAA | Opt-out | US Res | SOC 2 | ISO 42001 | NIST AI | CO AI | §1557 | SR 11-7 | ABA 512 | Subproc |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | Abridge | Healthcare | healthcare | 87 | A | Yes | Yes | Yes | Yes | Partial | Partial | Partial | Yes | N/A | N/A | Yes |
| 2 | Thomson Reuters CoCounsel | Legal | legal | 80 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | N/A | N/A | Yes | Yes |
| 3 | FICO Falcon Fraud Manager + FICO Score AI | Banking | banking | 80 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | N/A | Yes | N/A | Yes |
| 4 | Lexis+ AI | Legal | legal | 76 | B | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | Yes | Yes |
| 5 | Westlaw Precision AI | Legal | legal | 76 | B | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | Yes | Yes |
| 6 | Microsoft 365 Copilot | Productivity | general | 75 | B | Yes | Yes | Yes | Yes | Partial | Partial | Partial | Partial | Partial | Partial | Yes |
| 7 | Harvey | Legal | legal | 74 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | N/A | N/A | Yes | Partial |
| 8 | Zest AI | Banking | banking | 74 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | N/A | Yes | N/A | Partial |
| 9 | Upstart | Banking | banking | 74 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | N/A | Yes | N/A | Partial |
| 10 | Suki AI | Healthcare | healthcare | 72 | B | Yes | Yes | Yes | Yes | No | Partial | Partial | Partial | N/A | N/A | Yes |
| 11 | Nuance DAX Copilot (Microsoft) | Healthcare | healthcare | 70 | B | Yes | Yes | Yes | Yes | No | Partial | No | Partial | N/A | N/A | Yes |
| 12 | Salesforce Einstein / Agentforce | Productivity | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | Partial | Partial | N/A | Yes |
| 13 | Glean | Productivity | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 14 | Arctic Wolf | Security MSSP | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 15 | Huntress | Security MSSP | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 16 | eSentire | Security MSSP | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 17 | Sophos | Security MSSP | general | 69 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 18 | Unit21 | Banking | banking | 68 | C | Yes | Yes | Yes | Yes | No | Partial | No | N/A | Partial | N/A | Yes |
| 19 | Ironclad AI | Legal | legal | 63 | C | Yes | Yes | Yes | Yes | No | No | No | N/A | N/A | Partial | Yes |
| 20 | Anthropic Claude | Foundation | general | 58 | C | Partial | Yes | Partial | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 21 | Google Gemini for Workspace | Foundation | general | 58 | C | Partial | Partial | Yes | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 22 | Hummingbird | Banking | banking | 56 | C | Yes | Yes | Yes | Yes | No | No | No | N/A | Partial | N/A | Partial |
| 23 | OpenAI ChatGPT & API | Foundation | general | 53 | D | Partial | Partial | Partial | Yes | No | Partial | No | N/A | N/A | N/A | Yes |
| 24 | ConnectWise | Security MSSP | general | 50 | D | Partial | Yes | Partial | Yes | No | No | No | N/A | N/A | N/A | Yes |
| 25 | Spellbook | Legal | legal | 45 | D | Yes | Yes | Partial | Partial | No | No | No | N/A | N/A | Partial | Partial |
| 26 | Heidi Health | Healthcare | healthcare | 45 | D | Yes | Yes | Partial | Partial | No | No | No | Partial | N/A | N/A | Partial |
| 27 | Notion AI | Productivity | general | 33 | F | No | Partial | No | Yes | No | No | No | N/A | N/A | N/A | Yes |
| 28 | Meta Llama | Foundation | general | 25 | F | No | Yes | Yes | No | No | No | No | N/A | N/A | N/A | No |
| 29 | Otter.ai | Productivity | general | 25 | F | No | Partial | No | Yes | No | No | No | N/A | N/A | N/A | Partial |
| 30 | Perplexity AI | Foundation | general | 19 | F | No | Partial | No | Partial | No | No | No | N/A | N/A | N/A | Partial |

Axis legend: BAA = HIPAA Business Associate Agreement; Opt-out = training-data opt-out default; US Res = US data residency configuration option; SOC 2 = SOC 2 Type II report; ISO 42001 = ISO/IEC 42001 attestation; NIST AI = NIST AI RMF self-attestation; CO AI = Colorado AI Act readiness; §1557 = HHS-OCR Section 1557 readiness; SR 11-7 = FRB SR 11-7 readiness; ABA 512 = ABA Formal Opinion 512 readiness; Subproc = subprocessor list public.

By category

## Category leaders

Top vendors within each category, ranked by sector-weighted composite. Sector overlays (Section 1557, SR 11-7, ABA Op 512) are the primary differentiators in healthcare and legal categories. The foundation and productivity categories compete on platform fundamentals (BAA, residency, SOC stack, trust-center maturity).

### Foundation models

General-purpose LLM providers. Sector overlays (Section 1557, SR 11-7, ABA Op 512) are deployer responsibility.

[#### Anthropic Claude C58/ 100 compositeClaude foundation model family delivered via claude.ai (Free/Pro/Team/Enterprise) and a developer API. Differentiated on Constitutional AI training and safety research orientation.](https://efros.com/research/us-ai-vendor-governance-index/anthropic-claude/) [#### Google Gemini for Workspace C58/ 100 compositeGemini foundation models delivered through Google Workspace integration (Docs, Gmail, Drive) and the Vertex AI developer platform. Highest pull for Workspace-standardized organizations.](https://efros.com/research/us-ai-vendor-governance-index/google-gemini/) [#### OpenAI ChatGPT & API D53/ 100 compositeGPT-class foundation models delivered via ChatGPT consumer/enterprise tiers and a developer API. The most-deployed generative AI vendor in US enterprise.](https://efros.com/research/us-ai-vendor-governance-index/openai-chatgpt/) [#### Meta Llama F25/ 100 compositeOpen-weight foundation model family (Llama 3.x, Llama 4) distributed under a community license. Used primarily as a self-hosted or partner-hosted alternative to API-only vendors.](https://efros.com/research/us-ai-vendor-governance-index/meta-llama/) [#### Perplexity AI F19/ 100 compositeAnswer engine combining proprietary retrieval with multiple foundation models (GPT, Claude, Sonar). Differentiated on citation-grounded responses over raw chat.](https://efros.com/research/us-ai-vendor-governance-index/perplexity/)

### Productivity / general enterprise

AI overlays on the productivity stack (M365, Workspace, Notion, CRM). Governance posture is inherited from the platform.

[#### Microsoft 365 Copilot B75/ 100 compositeGenerative AI overlay on the Microsoft 365 stack (Outlook, Word, Excel, PowerPoint, Teams). Available only to commercial M365 tenants.](https://efros.com/research/us-ai-vendor-governance-index/microsoft-365-copilot/) [#### Salesforce Einstein / Agentforce C69/ 100 compositeAI and agent infrastructure built into Salesforce CRM. The Einstein Trust Layer enforces no-train, masking, and audit logging at the platform level.](https://efros.com/research/us-ai-vendor-governance-index/salesforce-einstein/) [#### Glean C69/ 100 compositeEnterprise generative search and AI agent platform that indexes the SaaS stack (Drive, SharePoint, Slack, Confluence, Salesforce, etc.) and returns permission-aware AI answers.](https://efros.com/research/us-ai-vendor-governance-index/glean/) [#### Notion AI F33/ 100 compositeAI overlay on Notion's collaborative workspace. Used for summarization, drafting, semantic search, and database automation within Notion content.](https://efros.com/research/us-ai-vendor-governance-index/notion-ai/) [#### Otter.ai F25/ 100 compositeReal-time meeting transcription and summarization. Common deployment in sales/CS, sometimes leaking into clinical or legal meeting workflows where governance gaps matter.](https://efros.com/research/us-ai-vendor-governance-index/otter-ai/)

### Legal vertical

Purpose-built for law firms: privilege handling, matter walls, ABA Formal Opinion 512 alignment.

[#### Thomson Reuters CoCounsel B80/ 100 compositeLegal AI assistant from Thomson Reuters (parent of Westlaw and Practical Law). Acquired Casetext in 2023. Integrated with Westlaw and Practical Law content.](https://efros.com/research/us-ai-vendor-governance-index/thomson-reuters-cocounsel/) [#### Lexis+ AI B76/ 100 compositeLexisNexis's legal AI assistant integrated with the Lexis content corpus. Citation grounding from the Lexis case-law and secondary-source database is the differentiator.](https://efros.com/research/us-ai-vendor-governance-index/lexis-plus-ai/) [#### Westlaw Precision AI B76/ 100 compositeWestlaw's AI-assisted research layer: natural-language query, AI-generated case summaries, and AI memo drafting grounded in Westlaw's primary-source database.](https://efros.com/research/us-ai-vendor-governance-index/westlaw-precision-ai/) [#### Harvey B74/ 100 compositeGenerative AI platform purpose-built for law firms. Backed by OpenAI; primarily deployed at Am Law 100/200 firms for drafting, research, and matter-aware workflows.](https://efros.com/research/us-ai-vendor-governance-index/harvey/) [#### Ironclad AI C63/ 100 compositeContract lifecycle management platform with AI features for contract drafting, review, and metadata extraction. Targets in-house legal teams.](https://efros.com/research/us-ai-vendor-governance-index/ironclad-ai/)

### Healthcare vertical

Clinical AI documentation and decision support. HIPAA BAA, Section 1557 algorithmic non-discrimination, HITRUST.

[#### Abridge A87/ 100 compositeAmbient clinical AI documentation. Clinician-experience design, citation-grounded notes, and EHR integration (notably Epic) are the differentiators.](https://efros.com/research/us-ai-vendor-governance-index/abridge/) [#### Suki AI B72/ 100 compositeClinical AI voice assistant for ambient note generation, dictation, and EHR navigation. EHR-integrated (Epic, Athenahealth, Cerner, Meditech, NextGen).](https://efros.com/research/us-ai-vendor-governance-index/suki/) [#### Nuance DAX Copilot (Microsoft) B70/ 100 compositeAmbient clinical AI scribe. Captures clinician-patient encounters and generates structured clinical notes. EHR-integrated (Epic, Cerner, athenahealth, others).](https://efros.com/research/us-ai-vendor-governance-index/nuance-dax-copilot/) [#### Heidi Health D45/ 100 compositeClinical AI documentation assistant. Australia-headquartered with US market expansion. Used heavily in solo and small-practice deployments due to lower price point.](https://efros.com/research/us-ai-vendor-governance-index/heidi-health/)

### Banking vertical

Credit decisioning, fraud detection, BSA/AML, transaction monitoring. SR 11-7 model risk management is the binding constraint.

[#### FICO Falcon Fraud Manager + FICO Score AI B80/ 100 compositeDecades-deep machine-learning portfolio across fraud detection (Falcon) and credit decisioning (FICO Score 10 T). The reference SR 11-7 documentation in the industry. Most US banks already operate against FICO's validation patterns.](https://efros.com/research/us-ai-vendor-governance-index/fico-falcon-fraud-manager/) [#### Zest AI B74/ 100 compositeAI-driven credit underwriting platform with strong fair-lending documentation. Explicit ECOA/Reg B and adverse-action explainability output, designed for examiner-facing defensibility.](https://efros.com/research/us-ai-vendor-governance-index/zest-ai/) [#### Upstart B74/ 100 compositeAI lending platform with CFPB no-action letter history. Operates as a partner for community banks and credit unions that want AI-driven origination without building it internally. CFPB scrutiny and fair-lending audit history are unusually deep.](https://efros.com/research/us-ai-vendor-governance-index/upstart/) [#### Unit21 C68/ 100 compositeModern transaction-monitoring and fraud detection platform. Deployed at fintech-adjacent banks, neobanks, payments processors, and crypto-aligned institutions where legacy AML vendors don't fit.](https://efros.com/research/us-ai-vendor-governance-index/unit21/) [#### Hummingbird C56/ 100 compositeModern compliance operations platform: BSA/AML case management, investigations, SAR filing, transaction monitoring overlay. Used by community banks, credit unions, and crypto-adjacent institutions for examiner-ready AML workflow.](https://efros.com/research/us-ai-vendor-governance-index/hummingbird/)

### Security MSSP / MSP

MSSPs and MSPs with AI-augmented detection, response, and IT operations. Cross-cutting scoring; sector overlays N/A because MSSPs serve all sectors.

[#### Arctic Wolf C69/ 100 compositeConcierge MDR with named-team accountability and AI-augmented threat detection across endpoint, cloud, network, and identity. AI features primarily as detection acceleration rather than autonomous decisioning.](https://efros.com/research/us-ai-vendor-governance-index/arctic-wolf/) [#### Huntress C69/ 100 compositeEndpoint and M365 identity threat detection with AI-augmented threat hunting, sized for SMB-to-mid-market organizations without enterprise MDR budget. Decision-support AI rather than autonomous response.](https://efros.com/research/us-ai-vendor-governance-index/huntress/) [#### eSentire C69/ 100 compositeEnterprise MDR with proprietary threat hunting depth and the most explicit AI-platform branding (Atlas AI) in the MDR category. Threat hunt depth is the differentiator over breadth-first competitors.](https://efros.com/research/us-ai-vendor-governance-index/esentire/) [#### Sophos C69/ 100 compositeVendor-integrated endpoint AI with the longest-running deep-learning malware detection lineage in the category (Invincea acquisition, 2017). Sophos MDR overlays managed detection on top of the platform.](https://efros.com/research/us-ai-vendor-governance-index/sophos/) [#### ConnectWise D50/ 100 compositeRMM and PSA platform with AI features for ticket automation, asset insights, and IT workflow acceleration. MSP-centric: sold to managed service providers who deliver downstream services to end customers.](https://efros.com/research/us-ai-vendor-governance-index/connectwise/)

Operator signal

## Trust-center maturity (1-5)

Trust-center maturity captures how much of a vendor's governance posture is self-serve verifiable versus locked behind an NDA or a sales conversation. A score of 5 means a public certificate library, audit reports under NDA, granular subprocessor and residency documentation, and AI-specific governance pages. A score of 1 or 2 means a thin security page with direct-request documentation only.
- [Abridge](https://efros.com/research/us-ai-vendor-governance-index/abridge/)5/5
- [Microsoft 365 Copilot](https://efros.com/research/us-ai-vendor-governance-index/microsoft-365-copilot/)5/5
- [Nuance DAX Copilot (Microsoft)](https://efros.com/research/us-ai-vendor-governance-index/nuance-dax-copilot/)5/5
- [Salesforce Einstein / Agentforce](https://efros.com/research/us-ai-vendor-governance-index/salesforce-einstein/)5/5
- [Thomson Reuters CoCounsel](https://efros.com/research/us-ai-vendor-governance-index/thomson-reuters-cocounsel/)4/5
- [FICO Falcon Fraud Manager + FICO Score AI](https://efros.com/research/us-ai-vendor-governance-index/fico-falcon-fraud-manager/)4/5
- [Lexis+ AI](https://efros.com/research/us-ai-vendor-governance-index/lexis-plus-ai/)4/5
- [Westlaw Precision AI](https://efros.com/research/us-ai-vendor-governance-index/westlaw-precision-ai/)4/5
- [Suki AI](https://efros.com/research/us-ai-vendor-governance-index/suki/)4/5
- [Glean](https://efros.com/research/us-ai-vendor-governance-index/glean/)4/5
- [Arctic Wolf](https://efros.com/research/us-ai-vendor-governance-index/arctic-wolf/)4/5
- [Huntress](https://efros.com/research/us-ai-vendor-governance-index/huntress/)4/5
- [eSentire](https://efros.com/research/us-ai-vendor-governance-index/esentire/)4/5
- [Sophos](https://efros.com/research/us-ai-vendor-governance-index/sophos/)4/5
- [Unit21](https://efros.com/research/us-ai-vendor-governance-index/unit21/)4/5
- [Ironclad AI](https://efros.com/research/us-ai-vendor-governance-index/ironclad-ai/)4/5
- [Anthropic Claude](https://efros.com/research/us-ai-vendor-governance-index/anthropic-claude/)4/5
- [Google Gemini for Workspace](https://efros.com/research/us-ai-vendor-governance-index/google-gemini/)4/5
- [OpenAI ChatGPT & API](https://efros.com/research/us-ai-vendor-governance-index/openai-chatgpt/)4/5
- [Harvey](https://efros.com/research/us-ai-vendor-governance-index/harvey/)3/5
- [Zest AI](https://efros.com/research/us-ai-vendor-governance-index/zest-ai/)3/5
- [Upstart](https://efros.com/research/us-ai-vendor-governance-index/upstart/)3/5
- [Hummingbird](https://efros.com/research/us-ai-vendor-governance-index/hummingbird/)3/5
- [ConnectWise](https://efros.com/research/us-ai-vendor-governance-index/connectwise/)3/5
- [Notion AI](https://efros.com/research/us-ai-vendor-governance-index/notion-ai/)3/5
- [Spellbook](https://efros.com/research/us-ai-vendor-governance-index/spellbook/)2/5
- [Heidi Health](https://efros.com/research/us-ai-vendor-governance-index/heidi-health/)2/5
- [Meta Llama](https://efros.com/research/us-ai-vendor-governance-index/meta-llama/)2/5
- [Otter.ai](https://efros.com/research/us-ai-vendor-governance-index/otter-ai/)2/5
- [Perplexity AI](https://efros.com/research/us-ai-vendor-governance-index/perplexity/)2/5

Microsoft (M365 Copilot, DAX Copilot) and Salesforce share the highest trust-center maturity scores: public certificate libraries, granular subprocessor lists, and audit-report distribution at scale. Abridge is the only clinical-AI vendor at parity. The bottom of the distribution is dominated by smaller vendors and foundation models in earlier governance stages.

What the data shows

## Key findings
- **1. ISO/IEC 42001 is the biggest market-wide gap.**No vendor in the Index holds a completed ISO/IEC 42001 AI management system attestation as of May 2026. Microsoft and Abridge are the closest. Both publicly state alignment work in progress. For buyers asking "what's the AI-specific certification floor," there isn't one yet, and that's true even for the vendors with the most mature broader compliance stacks.
- **2. Sector overlays sort the leaderboard.**Healthcare-vertical vendors (Abridge, DAX Copilot, Suki) lead on Section 1557 readiness; legal-vertical vendors (Harvey, CoCounsel, Lexis+ AI, Westlaw Precision AI) lead on ABA Op 512. Foundation models score lower on the composite because sector overlays are deployer responsibility. Section 1557, SR 11-7, and ABA Op 512 are all "N/A" at the vendor layer for general-purpose LLMs.
- **3. BAA gaps are the #1 disqualifier for shadow-AI workloads.**Notion AI, Otter.ai, and Perplexity are widely deployed in regulated organizations but none of them sign BAAs. The audit finding we see most often involves PHI or attorney-client content flowing into one of these three tools without the deploying organization realizing the BAA gap. DLP at the upload boundary is the right preventive control.
- **4. Trust-center maturity correlates strongly with composite.**Vendors at trust-center score 5 (Microsoft M365 Copilot, DAX Copilot, Salesforce, Abridge) cluster near the top of the composite. Vendors at score 2 (Meta Llama, Perplexity, Otter.ai, Spellbook, Heidi Health) cluster near the bottom. The 10% contribution to the composite formula matters less than the underlying signal: vendors that invest in self-serve trust documentation also tend to invest in the underlying controls.
- **5. Colorado AI Act posture is structurally vendor-side weak.**Even at the top of the Index, Colorado AI Act readiness is "partial" at best — most vendors document the deployer responsibility model but do not claim full developer-side compliance. Colorado's original SB 24-205 was repealed and replaced by SB 26-189 (signed May 2026, effective January 2027), which narrows the law to a transparency / disclosure regime for automated decision systems and drops the prior risk-management programs, impact assessments, and duty of care. The disclosure obligations still sit with the deployer regardless of which vendor is chosen, so buyers cannot offload Colorado exposure to a vendor selection. NIST AI RMF and ISO/IEC 42001 remain the load-bearing anchors for vendor-side governance evidence.

### Methodology + disclaimer

Scoring as of 2026-05-13 from public information: vendor trust portals, published BAAs and DPAs, SOC report cover pages, model cards, and vendor governance documentation. Each cell is source-cited; methodology is auditable. Posture changes frequently; re-verify with the vendor's trust center before contract. Updated quarterly. The Index is an EFROS research artifact, not legal or compliance advice. Nothing in this Index constitutes an endorsement of any vendor; vendors with strong composite scores may still be poor fits for a specific deployment context.

[Full methodology and source list →](https://efros.com/research/us-ai-vendor-governance-index/methodology/)

## Three ways forward

Use the Index as a starting point. Reserve a fixed-fee AI Governance Audit if a specific deployment needs operator-grade verification, run the self-serve AI Risk Score to benchmark your own posture in five minutes, or read the sector-specific playbooks for your regulatory context.

[Reserve $5K AI Governance Audit →](https://efros.com/contact/?source=ai-vendor-governance-index) [Run AI Risk Score](https://efros.com/tools/ai-risk-score/?source=ai-vendor-governance-index)

Sector-specific AI governance

By sector

[Legal AI vendors only →](https://efros.com/research/us-ai-vendor-governance-index/by-sector/legal/) [Healthcare AI vendors only →](https://efros.com/research/us-ai-vendor-governance-index/by-sector/healthcare/) [Banking AI vendors only →](https://efros.com/research/us-ai-vendor-governance-index/by-sector/banking/) [Foundation models only →](https://efros.com/research/us-ai-vendor-governance-index/by-sector/foundation/)

By US state (state-specific framework relevance)

[California](https://efros.com/research/us-ai-vendor-governance-index/by-state/california/) [Colorado](https://efros.com/research/us-ai-vendor-governance-index/by-state/colorado/) [New York](https://efros.com/research/us-ai-vendor-governance-index/by-state/new-york/) [Illinois](https://efros.com/research/us-ai-vendor-governance-index/by-state/illinois/) [Texas](https://efros.com/research/us-ai-vendor-governance-index/by-state/texas/)

[Resource: Law Firms →](https://efros.com/resources/ai-governance-for-law-firms/) [Resource: Healthcare →](https://efros.com/resources/colorado-ai-act-healthcare/) [Resource: Banking →](https://efros.com/resources/sr-11-7-community-banks-ai-governance/)

### Get the next edition first

Subscribe to EFROS Research Updates. Quarterly editions, mid-quarter changelog when material vendor governance changes ship. No marketing drip — research only. Unsubscribe with one click.

Email

Subscribe We never sell or share emails. Your address is logged in our research list only — see our [privacy policy](https://efros.com/privacy).

Save, cite, or integrate this edition

[PDF download →](https://efros.com/api/research/index-pdf?edition=2026-Q2) · [Printable view →](https://efros.com/research/us-ai-vendor-governance-index/printable/) · [Markdown export (.md) →](https://efros.com/research/us-ai-vendor-governance-index/efros-us-ai-vendor-governance-index-2026-q2.md) · [JSON API →](https://efros.com/api/research/index.json) · [RSS feed →](https://efros.com/research/us-ai-vendor-governance-index/feed.xml)

[Methodology](https://efros.com/research/us-ai-vendor-governance-index/methodology/) · [Edition changelog](https://efros.com/research/us-ai-vendor-governance-index/changelog/) · [Resolved challenges](https://efros.com/research/us-ai-vendor-governance-index/challenges/)

Related EFROS resources

## AI governance program stack

[### US State AI Law Tracker 9 active state AI laws with compliance dates and obligations.Open→](https://efros.com/research/state-ai-law-tracker/) [### MSSP MCP Server Registry US MSSPs with live MCP servers for AI agent integration.Open→](https://efros.com/research/mssp-mcp-server-registry/) [### EFROS AI Governance service Operating program that uses these research outputs in client work.Open→](https://efros.com/services/ai-governance/) [### NIST AI RMF practical guide Implementation guide for the foundational AI framework.Open→](https://efros.com/resources/nist-ai-rmf-implementation-guide/) [### Colorado AI Act for healthcare Sector deep-dive with vendor BAA matrix.Open→](https://efros.com/resources/colorado-ai-act-healthcare/) [### AI Governance for law firms Legal AI vendor diligence under ABA Formal Opinion 512.Open→](https://efros.com/resources/ai-governance-for-law-firms/)