An enterprise client asks for SOC 2, an investor asks "so where are you on the EU AI Act?", and you're a three-person AI startup. That used to mean a year of manual bureaucracy - now it's a platform 🛡️
What it is
AI governance / compliance is the practice of managing the risks of AI systems under regulation: risk management, data governance, transparency, human oversight, model documentation. It went from "nice to have" to a legal obligation - and a whole software category grew up around it: compliance automation. The most visible player in it is Vanta.
Where it came from
The trigger was the EU AI Act, the first comprehensive AI law. It takes a risk-tier approach: prohibited / high-risk / limited / minimal. This is "GDPR for AI" - it sets the global benchmark other jurisdictions look to. In parallel came ISO/IEC 42001, the first global certifiable standard for responsible AI: you can be formally certified against it, the same way you would be against the familiar ISO 27001.
Why it took off
The law phases in over time: the ban on "unacceptable" practices applies from February 2025 (already in force), obligations for general-purpose AI from August 2025. For high-risk systems the deadline was originally set at 2 August 2026, but the Digital Omnibus package (political agreement of May 2026) pushes obligations for standalone systems out to December 2027 - pending formal adoption and publication (EU timeline). The dates move around, but the direction is clear: some requirements are already live, and most companies' compliance programs are half-baked. Plus the everyday market truth: without SOC 2 / ISO 27001, an enterprise client simply won't sign with an AI startup. Compliance has turned from "paperwork for lawyers" into a sales tool.
The tool: Vanta
Vanta (vanta.com) is a compliance automation platform: you connect your clouds, repos and SaaS through 400+ integrations, and it collects evidence for you, runs automated control tests every hour and assembles the package for your auditor. 16,000+ customers, including half of your AI stack: Cursor, Lovable, Replit, GitHub, Duolingo.
Why it's in a card about AI compliance:
- ISO 42001 out of the box: AI management policy templates, mapped controls, AI-specific risk scenarios (official page). Vanta itself is one of the first companies certified against ISO 42001.
- EU AI Act as a ready-made framework: 150+ controls and 16 policies from the law laid out in a guided workflow with templates.
- Cross-mapping: evidence is reused across frameworks - ISO 42001 covers ~50% of EU AI Act requirements, and overlaps with SOC 2 / ISO 27001 are mapped too. One data collection pass, several certificates.
- Vanta AI Agent summarizes policies, finds gaps in your evidence and speeds up remediation.
On price, honestly: there's no public pricing - only a quote after a demo (Essentials / Plus / Professional / Enterprise plans, no free tier). According to the Vendr marketplace, the median contract is $20k/year, ranging from $7.5k to $57k. Tag: paid.
How to apply it now
- Take inventory of your AI systems and classify them by EU AI Act risk tier.
- Decide what the market needs first: for selling in the US - SOC 2; for the EU and enterprise - ISO 27001; for "we're an AI company you can trust" - ISO 42001.
- Book a Vanta demo (and its competitors - Drata, Secureframe) and compare quotes: price depends on team size and the number of frameworks.
- Use your existing processes (GDPR / Russia's 152-FZ, infosec) as the foundation - don't build from scratch, cross-mapping will do the rest.
What to watch out for
- EU AI Act fines are steep: up to €35M or 7% of global turnover for prohibited practices, up to €15M or 3% for high-risk violations. High-risk deadlines are slipping (Digital Omnibus), but some obligations are already in force - don't drag your feet.
- A platform is not a certificate: Vanta collects evidence and gets you audit-ready, but the audit itself is done by an external accredited auditor - that's separate money and weeks of process.
- Pricing is quote-only - plan to negotiate (per Vendr, buyers save ~30% off the first quote on average) and check the surcharge for each additional framework.
- For a solo vibe-coder with no enterprise clients, Vanta is overkill: this is a story for teams selling to businesses.
- Russia has its own requirements (152-FZ, personal data localization); the extraterritorial reach of the EU AI Act hits anyone working with the EU market.