C

Credo AI

The models drive a core capability on top of a governance system of record that would work without them. The platform's spine is an inventory and a workflow: an AI registry with agent cards and dependency graphs, a risk and control library, policy packs mapped to named regulations, approval gates, audit trails and evidence generation. Customers could run that with human analysts filling it in, and Credo AI's own account of its history says as much, describing a 2020 to 2023 phase whose breakthrough was replacing spreadsheets and ad hoc reviews with a policy engine.

What the models add is GAIA, a set of governance agents that handle intake and registration, retrieve evidence, assess risk, draft governance plans and remediate, plus automated red teaming, drift detection and classification of shadow AI. Without them, the registry, the policy packs and the workflows remain.

Accuracy is asserted in numbers and measured in none of them, and the agreement disclaims it outright. The product page claims 10x faster compliance, 70 percent less time in engineering bottlenecks, 100 percent AI visibility and 360 degree risk coverage, none with a basis, method or test set, and a customer quote repeats the 10x figure for EU AI Act compliance. Section 8.6 of the Terms of Use says Credo AI makes no warranties or representations on the accuracy, reliability, timeliness or completeness of the services.

Some questions do not apply: the platform produces risk scores, control mappings and evidence rather than legal assertions citing authority, so there is no citator and no reported case to open. What does apply matters for a product whose output is a compliance conclusion mapped to a named statute: nothing published shows how often GAIA's evidence retrieval or risk mapping is right, and no grounding method is described.

A written commitment that the agents work alongside a person, with real review points, short of a threshold. The product page says GAIA's agents automate the most time consuming governance tasks while keeping human oversight for critical decisions. The mechanisms are named: governance workflows with approval gates in the compliance module, escalation to a person in production monitoring, and escalation to a person specifically for high risk actions in agent monitoring.

Continuous evaluation of agent traces feeds those escalations. That matters on a product whose own agents can run remediation. What is not published is the control structure behind it: which actions GAIA may take unattended, what threshold defines a critical decision or a high risk action, and what happens after a remediation agent acts wrongly.

Named customers with named people, short of dates and method. The product page carries attributed statements from Andrew Reiskind, Chief Data Officer at Mastercard, on managing AI risk and implementing generative AI at speed and scale using the AI Registry and Vendor Registry; Renee Langeness, Director of Data Governance at Principal, on standing up an enterprise AI governance workflow; Parth Patel, Executive Director for AI and Data Science, on complementing internal processes; Kathleen Cachel, Senior Data Scientist at AdeptID, on centralized support for annual technical audits; and Brad Mallard, a CTO, on using the platform internally for compliance with its own policies and the EU AI Act.

Partner statements from Microsoft's Chief Product Officer for Responsible AI and IBM add substance about what the integration does. One figure appears inside a customer quote, compliance with the EU AI Act at ten times the speed of doing it manually, with no method attached, and the page's own counters carry no basis. No deployment is dated. Credo AI also publishes a customers and case studies page.

Substantive published commitments, one of them specific, short of segregation and of an element the agreement itself complicates. Section 6.8 of the Terms of Use bars Credo AI from using, processing or accessing User Data to train, develop or improve any machine learning or AI model. It also limits Credo AI's access to providing, maintaining and supporting the service. The same clause names the enterprise AI tools staff may use to deliver the service and confines that use to Credo AI's own enterprise environment and team.

It says no user data leaves that environment and requires deletion at the end of the engagement. Section 11.3 makes User Content the customer's Confidential Information, 11.4 limits disclosure to those with a need to know under equivalent duties, and 6.6 sets a sixty day window after termination followed by deletion. Two gaps remain. Nothing published addresses segregation between customers or between teams inside a tenant.

And section 5.2 grants Credo AI a worldwide, sublicensable, transferable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform and display User Content to provide and improve the services. The purpose is narrow but the verbs are not, and a governance platform holds a customer's AI risk assessments and incident records.

A boilerplate disclaimer sits in the terms while the marketing describes regulatory conclusions, and nothing says where the output stops and legal judgment begins. The product is sold on full alignment with European AI regulation including risk classification and conformity assessments, complete NIST Risk Management Framework compliance, and audit ready documentation for every major AI regulation. Classifying a system's risk tier under the EU AI Act is a legal characterization with consequences.

The company also sells advisory services described as strategic advisory on AI governance. The only related term is section 8.6, disclaiming any representation on accuracy, reliability, timeliness or completeness, which is a warranty disclaimer rather than a statement about advice. Nothing published says that a policy pack mapping, risk classification or conformity artifact is not legal advice, that counsel remains responsible for the determination, or which jurisdictions the regulatory content is maintained for. The audience is clearly professional.

Principles and a data use commitment are published; a governance framework for Credo AI's own AI is not. Credo AI publishes an ethos page, runs an annual AI trust summit, keeps a public governance insights hub and glossary, and presents itself as the company that pioneered the category, so responsible AI language is plentiful. One commitment goes beyond language: section 6.8 of the Terms of Use is a binding statement on how Credo AI handles customer data in relation to AI models, including which enterprise AI tools its own staff may use.

The governance half is still missing. Nothing published names who inside Credo AI is accountable for GAIA's behavior, describes what is evaluated before a governance agent ships, reports any result, or discloses uneven output across sectors, jurisdictions or populations. The company sells ISO 42001 policy packs but does not claim the certification itself. It runs a trust center on Vanta.

Published policy covers most of the ground, short of security detail and a subprocessor list. The Terms of Use cover retention and deletion specifically: User Data is kept as long as needed to provide the services, with a sixty day window after termination to export using standard features, and deletion after that (6.6). Section 6.8 confines access to providing, maintaining and supporting the service, names the enterprise AI tools staff use, and has their data deleted at the end of the engagement.

Incident practice is stated: notice without undue delay after becoming aware, reasonable steps to mitigate and minimize damage, and a statement that notification is not an admission of fault (6.9). Aggregated and anonymized use is allowed only if it cannot be attributed to the customer (6.7), and confidential information must be returned or destroyed on request with written certification (11.7). Security detail is missing: security is described only as reasonable administrative, technical and physical safeguards, with no encryption standard, access control, testing regime or logging commitment.

No subprocessor list is published, and the data processing agreement is provided on request rather than published. Credo AI's trust center is hosted on Vanta.

What the vendor stands behind is published and specific, including where it stands behind nothing. Section 10.1 of the Terms of Use gives a defense and indemnity against third party claims that the services infringe or misappropriate intellectual property rights. Section 10.2 lists six exclusions, and 10.3 sets the remedies in turn: obtain the right, modify or replace the services with substantially equivalent function, or terminate with a prorated refund.

Section 9.2 caps each party's total liability at the amount paid in the twelve months before the incident. Section 9.3 lifts the cap and the exclusion of indirect damages for breach of confidentiality and for the customer's breach of the license and acceptable use terms. Two express warranties carry stated remedies, each the exclusive remedy: the SaaS products will perform materially as documented, remedied by correction or termination with a prorated refund (8.4), and advisory services will be performed in a professional and workmanlike manner, remedied by performing them again or a refund (8.5).

Section 8.6 disclaims everything else, including any representation on accuracy, reliability, timeliness or completeness. Section 14.1 gives a termination right with a prorated refund if a change materially reduces function. No insurance is stated, the indemnity is not carved out of the cap, and the service level agreement is mutually agreed rather than published.

Named integrations cover the systems the work lives in, short of a description an implementer could use. The product page lists them by category: cloud and AI operations with AWS, Azure, GCP, Databricks and Snowflake; agent platforms with Azure AI Foundry, LangChain, CrewAI and AutoGen; governance, risk and security with ServiceNow, Archer, OneTrust and Qualys; development and MLOps with GitHub, MLflow, Jira, Confluence and Slack; and custom APIs, webhooks, SDKs and connectors.

There is a separate SDK documentation site and a stated ecosystem of more than thirty partners. One integration is described in enough detail to see what moves, and by the counterparty: Microsoft's Chief Product Officer for Responsible AI says it gives governance leaders prescriptive guidance on what to evaluate and lets developers run governance evaluations in their own workflow. The registry also governs MCP servers and platform connections. Depth, direction and configuration for each integration are not published on the product page.

Nothing is published on where the software runs or where customer data sits. The Terms of Use describe SaaS products used through a browser or API and say nothing about hosting region, data residency, tenancy or a deployment choice. The product page describes the architecture in functional layers, not infrastructure, and no region selector, residency commitment or single tenant option appears. Credo AI runs a trust center at trust.credo.ai, a portal hosted on Vanta.

The agreement does note, at 15.9, that the services may be subject to United States and other export laws, which places Credo AI in the US but is not a residency statement.

Credo AI names a certification, and no scope, date or reachable report is published. Its trust center at trust.credo.ai says Credo AI maintains a SOC 2 Type II examination and invests continuously in its security program so the platform meets the same governance standards it helps customers achieve. The platform's compliance module lists SOC 2 among the frameworks it supports for customers; that is a product feature, not an attestation.

What would make the attestation checkable is missing: no auditor, examination period, report date, scope statement or route to the report is published. The trust center is a portal hosted on Vanta.

Credo AI describes a proprietary intelligence layer and governance agents without saying what sits beneath them. GAIA is presented as a set of AI agents for evidence retrieval, risk assessment, incident response and remediation, powered by what the product page calls a proprietary governance knowledge graph. No model, provider, hosting location or commitment to notice of change for those agents is published. Two related facts do not answer the question.

The models named on the site, ChatGPT, Claude and Gemini, are customer deployments the product governs, not Credo AI's supply chain. The enterprise AI tools named in clause 6.8 of the Terms of Use are tools Credo AI's own staff use to support the service, which concerns internal operations. No subprocessor list is published.

The shape is partly visible, and no number is published at any level. There is no pricing page; every path ends at Talk to an Expert or a personalized demo, offered without a credit card. Before that conversation the modular structure is visible, and Credo AI sells on it: AI Registry and Discovery, Risk Intelligence, Compliance and Policy Engine, and Governance are named as modules that work independently, with advice to start with the registry and add others over time, alongside separately sold advisory services.

The Terms of Use add the mechanics. Fees are set in an order form or statement of work, based on services bought rather than actual usage, noncancellable and nonrefundable, invoiced in advance and payable within thirty days, with 1.5 percent monthly interest on late amounts. Contracts renew automatically unless either party gives thirty days' notice, and price changes take effect at renewal on reasonable prior notice.

Section 3.4 confirms account tiers exist with varying features and usage limits, and 4.3 warns that exceeding them may bring charges at then current rates, though neither the tiers nor the limits are named publicly.

Coverage is described with substance across buyers and regulations, and the boundaries are left open. The platform names five stakeholder types it connects: the governance lead, the business user, product and engineering, legal and compliance, and information security and third party risk management. Regulatory coverage is named, with prebuilt policy packs for the EU AI Act, the NIST AI Risk Management Framework, ISO 42001 and SOC 2.

The knowledge graph is described as telling apart a model used in EU healthcare from one used in US financial services. Customer evidence spans payments, insurance, professional services and a technology vendor, and the vendor claims Fortune 500 adoption. No limit is stated: no jurisdiction, regulation, sector or organization size is named as out of scope, no coverage boundary is given for the regulatory content, and nothing describes what a law firm, as against an in house function, would do with the platform.