Prevents falling behindOff-the-shelf productAI-native

Credo AI

Credo.AI Corp. ·www.credo.ai· As of: 2026-08-24

Keeps every AI use case, model and AI vendor in one register, attaches to each entry the approvals and evidence a regulation or a customer asks for, and records who decided what and when.

Work through this tool with an AI

ClaudeChatGPTPerplexity

Our verdict

An auditor, a corporate procurement team and a customer with reporting duties of their own all ask the same thing: which AI systems run here, who approved them, and what the approval rests on. A company without an answer loses the deal or the certificate. A register closes that gap. It carries nobody further than that, because the competitor buys the same platform and has the same register within the week. What sets a company apart are the decisions it draws from that register, and no software makes those.

Evidence:As of 2026-08-24Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service addressOpen sourceAs of 2026-08-24Effective 08.04.2026, training reservation for personal information collected through site and service, standard contractual clauses as transfer basis, no representative in the Union, no storage location namedOpen sourceAs of 2026-08-24SOC 2 Type II, categories reviewed are security, availability and confidentiality, report on request, annual repeat promisedOpen sourceAs of 2026-08-24Dedicated page on the AI Regulation aimed at the customer's duties, still on the 2024 timetable, without the shifted high-risk deadlinesOpen sourceAs of 2026-08-24Separate design tenant, recommendation to use non-production data only, general availability announced for the first quarter of 2026, commercial terms after release left open, no model provider namedOpen sourceAs of 2026-08-24Series B of 21 million US dollars dated 30.07.2024, investors, 41.3 million US dollars in total per the vendorOpen sourceAs of 2026-08-24Series A of 12.8 million US dollars dated 17.05.2022, founded in March 2020, platform generally available since April 2022Open sourceAs of 2026-08-24OEM agreement with IBM dated 28.04.2025, Policy Packs as the content of the Compliance Accelerators add-on in IBM watsonx.governanceOpen sourceAs of 2026-08-24Alliance with QuantumBlack, AI by McKinsey, dated 02.04.2024Open sourceAs of 2026-08-24Placement as a Visionary in Gartner's first Magic Quadrant for AI governance platforms dated 16.06.2026Open sourceAs of 2026-08-24Trademark case 3:24-cv-02032-CRB before the United States District Court for the Northern District of California, filed 03.04.2024, open, last docket entry 17.08.2026Open sourceAs of 2026-08-24No pricing page, no trust page, no subprocessor list and no separate data processing document among the 500 sitemap addresses checkedOpen sourceAs of 2026-08-24Named connections of the integrations hub for use cases, models, evidence and datasetsOpen sourceAs of 2026-08-24AI governance module with a use case register and mapping to ISO/IEC 42001, the NIST framework and the AI Regulation at a vendor from evidence automationOpen source

Who it fits

Solo

not suitable

Sales runs through an enterprise agreement and an advisory engagement. There is no pricing page and no self-service entry. Three use cases go into a spreadsheet faster than the first sales call takes.

Mid-market

suitable with caveats

It becomes interesting once a use case falls under Annex III of the AI Regulation, credit scoring or pricing in life and health insurance for instance, or once customers start sending supplier questionnaires about AI use. The Annex III duties apply from 02.12.2027. Until then a documented approval process plus a maintained spreadsheet carries further than a licence with no public price to negotiate against.

Enterprise

suitable

This is where the tool belongs: many units, many models, an internal audit function that wants evidence, and a procurement team asking suppliers about their AI use. IBM has shipped Credo AI's policy content inside its own product since 28.04.2025, and McKinsey's QuantumBlack has taken the platform to clients since 02.04.2024. Three points stay open before signing because they are not publicly documented: storage location, subprocessors, and the model provider behind the built-in assistant.

Buy, switch or build

Off-the-shelf

GRC suite that absorbs AI as one more domain

The established names are OneTrust, ServiceNow, MetricStream and Archer. Corporates stay with them because the AI register then sits next to the processing register and the risk register, uses the same approval chain and has long been cleared by procurement. A second tool means a second permissions process, a second supplier review and a second invoice. Anyone already running IBM watsonx.governance has had access to Credo AI's policy content through the Compliance Accelerators add-on since 28.04.2025, without signing a contract with Credo AI at all.

AI-native

Evidence automation with an AI module rather than an AI platform with evidence

Vanta and Drata come from evidence automation for SOC 2 and ISO 27001 and have added an AI governance module on top, with a use case register and mapping to ISO/IEC 42001, the NIST framework and the AI Regulation. The difference is the way in: both run a public pricing page and a route to a trial without a sales appointment. Drata has shown an ISO 42001 certificate of its own since 02.12.2025, though without naming the certification body or the scope. What you give up is depth on models and vendors: the risk library, the vendor transparency reports and the per-model evaluation evidence are what Credo AI gets bought for.

Build it yourself

Build the register yourself and draw evidence from your own operations

The building blocks are in our own catalogue. LiteLLM as a model gateway records which application calls which model. Langfuse logs the calls with input, output and cost, and thereby produces the evidence trail an auditor wants to see. Nudge Security finds the AI services nobody registered. Supabase carries the register with use case, model, vendor and approval status, n8n routes approvals through the chain, and Claude Code builds the whole thing. For a company with twenty to thirty use cases that comes to ten to fifteen person-days in our own experience, plus ongoing upkeep. It fails in four places: the legal work of mapping a control to a legal provision and re-doing that mapping when deadlines shift; tenant separation as soon as several legal entities use it; the immutability of the evidence an auditor takes for granted; and the day the person who built it leaves.

Our advice

  • Solo: A spreadsheet and a fixed quarterly slot. This vendor's route to market does not fit this size.
  • Mid-market: Build it yourself first and document the approval process. Buy once a use case falls under Annex III or a major customer demands evidence.
  • Enterprise: Buying is the right answer. But get the storage location, the subprocessor list and the model provider behind the assistant into the contract in writing, because nothing on any of the three is public.

Who is behind it

Staying power: Funded

Six years since founding, two years since the last round. The Series B of 21 million US dollars dated 30.07.2024 and the OEM agreement with IBM carry current operations; what is missing for the established rating is seven years in market, a corporate owner and demonstrated profit. On top of that a trademark dispute is running: Credo Technology Group, Ltd. has been suing Credo.AI Corp. over the Credo mark since 03.04.2024, the case is open, last docket entry 17.08.2026.

  • Founded and launched: founded in March 2020, platform generally available since April 2022, based in Los Altos, California; both year figures per the vendor's own accountAs of 2026-08-24Series A of 12.8 million US dollars dated 17.05.2022, founded in March 2020, platform generally available since April 2022Open source · As of 2026-08-24
  • Funding: 12.8 million US dollars Series A dated 17.05.2022, led by Sands Capital; 21 million US dollars Series B dated 30.07.2024 with CrimsoNox Capital, Mozilla Ventures and FPV Ventures; 41.3 million US dollars in total per the vendorAs of 2026-08-24Series B of 21 million US dollars dated 30.07.2024, investors, 41.3 million US dollars in total per the vendorOpen source · As of 2026-08-24
  • Routes to market: OEM agreement with IBM since 28.04.2025: Credo AI's Policy Packs supply the content for the Compliance Accelerators add-on in IBM watsonx.governance. Alliance with QuantumBlack, AI by McKinsey, since 02.04.2024As of 2026-08-24OEM agreement with IBM dated 28.04.2025, Policy Packs as the content of the Compliance Accelerators add-on in IBM watsonx.governanceOpen source · As of 2026-08-24
  • Analyst placement: placed as a Visionary in Gartner's first Magic Quadrant for AI governance platforms on 16.06.2026; named a Leader in the Forrester Wave on AI Governance Solutions for the third quarter of 2025 per the vendorAs of 2026-08-24Placement as a Visionary in Gartner's first Magic Quadrant for AI governance platforms dated 16.06.2026Open source · As of 2026-08-24
  • Legal entity and pending case: Credo.AI Corp., service address 4546 El Camino Real B10 #795, Los Altos, California; venue per the terms of use is San Francisco County. Trademark case 3:24-cv-02032-CRB has been pending before the United States District Court for the Northern District of California since 03.04.2024, last docket entry 17.08.2026As of 2026-08-24Trademark case 3:24-cv-02032-CRB before the United States District Court for the Northern District of California, filed 03.04.2024, open, last docket entry 17.08.2026Open source · As of 2026-08-24

Cost of leaving: High

The terms of use grant 60 days for export after the contract ends, after which the vendor may delete. Your own entries can be retrieved. What is missing after the export is the ordering that turned them into evidence: the risk library, the control catalogue and the policy packs are the vendor's content and partly licensed to IBM. The approval chain survives as a file, its mapping to controls and legal provisions does not. Anyone switching after two years rebuilds the evidence base and explains the gap in between to an auditor.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, tied to a conditionavailable on request, no separate document publishedAs of 2026-08-24Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service addressOpen sourceSection 6.4 of the terms of use promises to enter into the standard data processing agreement on request, where the customer is subject to a data protection law such as the GDPR. The text is nowhere publicly retrievable; credo.ai/legal/dpa returns 404 and the sitemap lists no such page.As of 2026-08-24
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.open on a point that decides usabilityunclearAs of 2026-08-24Effective 08.04.2026, training reservation for personal information collected through site and service, standard contractual clauses as transfer basis, no representative in the Union, no storage location namedOpen sourceNeither the privacy policy nor the terms of use name a storage location, a region or an infrastructure provider. No region choice is offered anywhere and there is no security or trust page; credo.ai/security and credo.ai/trust return 404. All 500 addresses listed in the sitemap were checked as well.As of 2026-08-24
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.documented, but unfavourableno public list; individual services named in the terms of useAs of 2026-08-24Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service addressOpen sourceThere is no maintained subprocessor list; credo.ai/subprocessors returns 404. Section 6.8 of the terms of use names ChatGPT Enterprise, Gemini Enterprise, Claude Enterprise and Microsoft Copilot as tools with which the vendor's staff support the service, and states in the same paragraph that user data does not leave the vendor's own environment. Having both side by side belongs in contract negotiations. Which model provider runs the built-in governance assistant appears in none of the public documents.As of 2026-08-24
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, tied to a conditiontransfer to the United States, standard contractual clauses namedAs of 2026-08-24Effective 08.04.2026, training reservation for personal information collected through site and service, standard contractual clauses as transfer basis, no representative in the Union, no storage location namedOpen sourceThe vendor is based in the United States, so a transfer takes place. The privacy policy names the European Union standard contractual clauses or other applicable mechanisms as the basis, without assigning which recipient works on which basis. No representative in the Union under Article 27 GDPR is named, nor any establishment in the Union.As of 2026-08-24
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.documented, tied to a conditioncontractually excluded for customer content, expressly reserved for site and account dataAs of 2026-08-24Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service addressOpen sourceTwo documents give two different answers here, and that is the most important finding in this profile. Section 6.8 of the terms of use rules out using user data to train, develop or improve models. The privacy policy dated 08.04.2026 reserves the opposite for personal information collected through the site and the service, including disclosure to third parties for model training. Section 6.7 additionally permits the use of aggregated and anonymised derivations of usage for the vendor's own purposes, new products included. The commitment does not extend to the model provider behind the built-in assistant, because that provider is named nowhere.As of 2026-08-24
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, tied to a condition60 days for export after the contract ends, deletion thereafter phrased as an optionAs of 2026-08-24Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service addressOpen sourceSection 6.6 of the terms of use quantifies the period: for 60 days after the contract ends the data stays available for export. After that the vendor may delete but is not obliged to; excluded is whatever is required by law or for the vendor's legitimate business purposes. Nothing is said about backups. The text promises no confirmation of deletion.As of 2026-08-24
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, tied to a conditionSOC 2 Type II for security, availability and confidentiality; report on requestAs of 2026-08-24SOC 2 Type II, categories reviewed are security, availability and confidentiality, report on request, annual repeat promisedOpen sourceThe vendor states a SOC 2 Type II report and names the categories reviewed: security, availability and confidentiality. Processing integrity and privacy are not among them. The audit period and the auditing firm are not named, the report is handed out on request, and an annual repeat is promised. No ISO 27001 certificate is mentioned. The asymmetry around ISO/IEC 42001 is worth noting: the vendor sells readiness for that standard, while no certificate of its own under it is shown on the public pages.As of 2026-08-24
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.documented, but unfavourableextensive statements on the customer's duty, no named commitment on its ownAs of 2026-08-24Dedicated page on the AI Regulation aimed at the customer's duties, still on the 2024 timetable, without the shifted high-risk deadlinesOpen sourceThe vendor runs a dedicated page on the AI Regulation which addresses the customer's duties throughout. On its own duties under Article 50 for the built-in governance assistant, which produces suggestions and pre-fills questionnaires, no commitment appears. What is checkable, and awkward for a tool of this kind, is the legal footing of that page: as of 24.08.2026 it still argues on the 2024 timetable and omits the high-risk deadlines shifted by amending Regulation (EU) 2026/1744, so neither 02.12.2027 for Annex III nor 02.08.2028 for Annex I. From the outside this says nothing about how current the policy packs inside the product are.As of 2026-08-24
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.documented, but unfavourableaudit trail over the governed AI objects advertised, reach and retention openAs of 2026-08-24credo.ai/solutions/vendor-complianceOpen sourceAudit trails and reporting are part of the advertised scope per the product navigation and refer to the governed use cases, models and approvals. Whether the customer additionally receives an auditable log of access and changes within their own tenant, how long it is retained, and whether it can be exported into their own systems, is not publicly substantiated. There is no documentation site and no plan overview from which this could be read.As of 2026-08-24

What it really costs

Entry price

The vendor publishes no price. The address credo.ai/pricing returns 404, and among the 500 addresses checked in the sitemap on 24.08.2026 there is no pricing page. Entry runs through a sales conversation and an enterprise agreement; advisory services sit alongside as a separate engagement per the terms of use.As of 2026-08-24No pricing page, no trust page, no subprocessor list and no separate data processing document among the 500 sitemap addresses checkedOpen source

As of 2026-08-24

What gets expensive

In three places worth knowing before the first negotiation. First, there is no list price to negotiate against; the vendor knows the other side's willingness to pay better than the other way round. Second, rolling a register out across several units is project work, and the vendor keeps its own advisory offering for it, billed alongside the licence. Third, the AI assistant was given to design partners free of charge until general availability, and the vendor expressly left the terms after that open in the same document.

What it displaces

  • Spreadsheet of AI systems in use, maintained by one person
  • Approvals living as an email thread in the legal team's inbox
  • Supplier questionnaires answered by hand from scratch for every customer

Interfaces

  • Use case import from Salesforce, ServiceNow, Jira, Asana and Microsoft Dynamics 365
  • Model import from Amazon SageMaker, Amazon Bedrock, Databricks, MLflow, Microsoft Azure Machine Learning and Hugging Face
  • Evidence ingestion from Weights & Biases and Collibra
  • Policy content as an add-on inside IBM watsonx.governance

Matching methods

  • Regulatory Density TestThe test clarifies whether a rule hits this company harder than everyone else, and that decides whether a register stays a duty or becomes the ticket into a regulated segment.
  • DORA AI Capabilities Model (Seven AI Capabilities)The assessment asks for a clear stance on AI and for reachable internal data, and a register of use cases is the reality check on whether that stance holds in daily work at all.
  • Operating Model Grid (Standardization and Integration)A central AI register is a decision about process standardisation and data integration between units, and the grid answers beforehand how much of that the business actually needs.

Sources

  1. 1.Data processing agreement on request, 60-day export window after contract end, aggregated derivations for the vendor's own purposes, training exclusion for user data, named AI tools used in support, venue and service address (opens in a new tab)credo.ai/legal/terms-of-use · As of 2026-08-24
  2. 2.Effective 08.04.2026, training reservation for personal information collected through site and service, standard contractual clauses as transfer basis, no representative in the Union, no storage location named (opens in a new tab)credo.ai/legal/privacy-policy · As of 2026-08-24
  3. 3.SOC 2 Type II, categories reviewed are security, availability and confidentiality, report on request, annual repeat promised (opens in a new tab)credo.ai/legal/soc-2-type-ii-compliance · As of 2026-08-24
  4. 4.Dedicated page on the AI Regulation aimed at the customer's duties, still on the 2024 timetable, without the shifted high-risk deadlines (opens in a new tab)credo.ai/eu-ai-act · As of 2026-08-24
  5. 5.Separate design tenant, recommendation to use non-production data only, general availability announced for the first quarter of 2026, commercial terms after release left open, no model provider named (opens in a new tab)credo.ai/… · As of 2026-08-24
  6. 6.Series B of 21 million US dollars dated 30.07.2024, investors, 41.3 million US dollars in total per the vendor (opens in a new tab)credo.ai/… · As of 2026-08-24
  7. 7.Series A of 12.8 million US dollars dated 17.05.2022, founded in March 2020, platform generally available since April 2022 (opens in a new tab)credo.ai/… · As of 2026-08-24
  8. 8.OEM agreement with IBM dated 28.04.2025, Policy Packs as the content of the Compliance Accelerators add-on in IBM watsonx.governance (opens in a new tab)credo.ai/… · As of 2026-08-24
  9. 9.Alliance with QuantumBlack, AI by McKinsey, dated 02.04.2024 (opens in a new tab)credo.ai/… · As of 2026-08-24
  10. 10.Placement as a Visionary in Gartner's first Magic Quadrant for AI governance platforms dated 16.06.2026 (opens in a new tab)credo.ai/…/gartner-magic-quadrant-ai-governance-platforms-2026 · As of 2026-08-24
  11. 11.Trademark case 3:24-cv-02032-CRB before the United States District Court for the Northern District of California, filed 03.04.2024, open, last docket entry 17.08.2026 (opens in a new tab)cand.uscourts.gov/…/credo-technology-group-ltd-v-credoai-corp · As of 2026-08-24
  12. 12.No pricing page, no trust page, no subprocessor list and no separate data processing document among the 500 sitemap addresses checked (opens in a new tab)credo.ai/sitemap.xml · As of 2026-08-24
  13. 13.Named connections of the integrations hub for use cases, models, evidence and datasets (opens in a new tab)credo.ai/… · As of 2026-08-24
  14. 14.AI governance module with a use case register and mapping to ISO/IEC 42001, the NIST framework and the AI Regulation at a vendor from evidence automation (opens in a new tab)vanta.com/products/iso-42001 · As of 2026-08-24
  15. 15.credo.ai/solutions/vendor-compliance (opens in a new tab)As of 2026-08-24

Last reviewed: 2026-08-24 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.

← Back to the toolbox