Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.
Compliance agents
AI agents and platforms that help achieve and maintain compliance frameworks such as SOC 2, ISO 27001, HIPAA and related audit programs.
148 listings · Open in directory filters · Market map
Key facts
From this dataset
- 148 verified listings on this page, with headquarters in 7 HQ regions and 25 countries.
- Dataset version 0.1.27, generated 2026-10-27.
- AI agents and platforms that help achieve and maintain compliance frameworks such as SOC 2, ISO 27001, HIPAA and related audit programs.
Cite as: Agent Index by Heritage Services, Compliance AI agents, dataset v0.1.27 (https://theagentindex.io/categories/compliance/)
FAQ (from this dataset)
What is listed on this category page?
AI agents and platforms that help achieve and maintain compliance frameworks such as SOC 2, ISO 27001, HIPAA and related audit programs. 148 verified listings from Agent Index dataset v0.1.27.
How many listings are on this page?
148 verified listings in dataset v0.1.27 (2026-10-27).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
19 of 148 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand: 6clicks Hailey AI (Australia), Covasant TPRM (agentic third-party risk management) (India), Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents) (India), Data Adhikaar DPDPA agents (ten-agent compliance fabric) (India), First AML AI Screening Agent (New Zealand), FluxForce Agentic OS (28 financial-crime and compliance agents, incl. Rhea Ledger KYC/AML Analyst) (India), IDfy AI Agents (India), IndiSec DPDPA compliance agents (Veda AI privacy analyst) (India), Nuix Neo AI Agent (investigations and compliance) (Australia), OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI) (India), RegASK AI agents (regulatory intelligence and action workflows) (Singapore), Scrut Automation (India), Signzy Agentic CKYC (India), Silent Eight Iris 7 AI Agents (Singapore), SpotDraft Sidebar AI agents and VerifAI (India), Sprinto (India), Tookitaki FinCense (Singapore), VibrantiX agentic compliance platform (Evidence Review, Vendor Risk Scoring, Risk Detection, Customer Trust, Policy Drafting and Control Remediation agents) (Singapore), Zoven AI (India).
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
Start here in compliance
Criteria from the open dataset — not a ranking, score or paid placement. How we verify
Has published pricing130 listingsWhy this is here: The listing has a non-empty pricing field from a public vendor page we checked.FedRAMP-authorized17 listingsWhy this is here: Tagged fedramp: FedRAMP Marketplace Authorized for the listed product, not platform-only.Free tier / freemium2 listingsWhy this is here: pricing_model is freemium in the open dataset.EU-headquartered48 listingsWhy this is here: hq_region is Europe — country of headquarters as published by the vendor.India / DPDP relevant23 listingsWhy this is here: India headquarters, a DPDP framework tag, or a non-empty india_relevance note.
Use-case comparisons: AML and transaction-monitoring AI agents · KYC and identity AI agents · India, Asia-Pacific and ANZ AML and KYC AI agents · AI SOC and security-analyst agents · Email security and phishing-response AI agents · Contract and legal-review AI agents · Agentic pentesting AI agents · TPRM and vendor-risk AI agents · Privacy operations AI agents · US public-sector and FedRAMP AI agents · AP and finance-automation AI agents · Cloud security (CNAPP) AI agents · AI governance agents and platforms · Identity governance AI agents · Enterprise agent platforms · IT service-management AI agents · Security questionnaire AI agents
Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.
Autonomous Trust Platform with governed AI agents that detect change across systems, vendors, access and AI use, then refresh evidence, run vendor due diligence, prepare audits and close control gaps, with humans approving material decisions.
AI-powered security and compliance platform combining agentic GRC automation with optional in-house GRC expert consulting bundles.
Open-source-leaning AI compliance software that automates evidence collection, policy generation, and continuous monitoring for SOC 2, ISO 27001, HIPAA and GDPR.
Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.
AI-powered GRC platform for program management, evidence, audits and multi-framework compliance.
Compliance and risk automation platform popular with startups and mid-market teams for continuous control monitoring and multi-framework programs.
Compliance platform that combines software with audit delivery pathways for SOC 2 and related frameworks.
Compliance platform with published product pricing pages for building and maintaining security certification programs.
Featured
Agentic AI platform for enterprise GRC that executes third-party risk, controls testing, evidence collection, questionnaires and gap analyses with explainability.
AI governance platform for policy packs, model risk and responsible AI compliance including EU AI Act and NIST AI RMF oriented programs.
AI GRC platform (Risk Cloud) with GRC Agents that act under human supervision for third-party risk, AI governance, enterprise risk and business continuity.
Privacy, GRC and responsible AI governance platform used by large organizations for consent, preference, third-party risk and AI oversight.
Data security, privacy and DSPM platform whose AgentIQ agentic layer runs data-risk work from a request: four BigID agents at launch (Remediate Sensitive Data, AI Governance Enforcement, Access Exposure Analysis, Privacy Operations) investigate, prioritise and act, e.g. revoking access, remediating exposure, applying retention, quarantining data and fulfilling data subject requests.
Data privacy infrastructure for DSRs, consent and data governance, plus Transcend Rails policy-as-code controls for what AI agents may do.
Customer trust platform with ConveyorAI for answering security questionnaires and sharing trust center content.
Trust Center and AI Questionnaire Assistance for customer security reviews, now part of Drata (SafeBase brand being unified into Drata).
AI-powered GRC Intelligence Platform (formerly AuditBoard) with domain-trained agents for audit testing, compliance, third-party risk and AI governance.
Governed AI agent for bank AML alert triage, case investigation and SAR narrative drafting, with analyst confirmation required before any case is closed, escalated or filed.
Compliance automation built into Rippling's HR and IT platform, with AI framework setup, evidence collection, in-platform AI remediation, an audit portal and Trust Centers.
Explainable AI agent for financial-crime investigations that prepares cases, runs triage and supports SAR-oriented workflows while institutions keep governance decisions.
Agentic automation platform for audit and finance in which agents run end-to-end procedures over evidence and return traceable workpapers for human review and sign-off.
Agentic KYC operations layer that validates, auto-cures and submits CKYCRR 2.0 records to CERSAI, plus broader AI-powered KYC, KYB and AML screening.
Governed AI agents for KYC/KYB onboarding, credit underwriting, due diligence and DPDP-oriented privacy compliance in regulated finance.
APAC AML and fraud platform that combines community typologies with purpose-built AI agents for detection, screening, customer risk and investigation.
Sovereign GRC AI engine that maps controls, finds gaps, drafts assessment responses and creates risks, issues and tasks inside the 6clicks Hub & Spoke platform.
Search and review agents that run the AML screening lifecycle — finding matches, assessing them against the entity profile, and re-checking hits as cases age.
Autonomous financial-oversight platform that analyses 100% of transactions to surface anomalies, control failures and fraud risk for finance and audit teams.
Agentic AI overlay for AML teams: agents that gather data, summarise cases, flag typologies, draft SAR narratives and triage screening hits, with a human in the loop.
Policy-bound AI agents that adjudicate sanctions, PEP, adverse-media, transaction-monitoring, CDD, trade and fraud alerts on top of a bank's existing screening and monitoring systems.
Autonomous AI agents for privacy, vendor risk and AI governance: discovery, DSR fulfilment, cross-border transfer checks, assessment autofill and AI-agent posture profiles.
Agent-first AI governance platform: a knowledge graph of AI risks, controls and policies, an Agent Catalogue, and MCP servers that let customers' agents draft risk assessments.
Bengaluru-built fraud, AML and KYC/KYB platform where AI agents run investigation SOPs case by case and draft cited verdicts for analysts to decide.
AI agent embedded in Feedzai's RiskOps Studio that analyses fraud rules, retrieves and summarises alert data for investigations, and drafts SAR narratives for investigator review.
Governed agentic workforce on Fenergo's client lifecycle (CLM/KYC) platform: agents complete routine KYC steps, resolve routine screening hits, process documents and source client data, with humans approving outcomes.
Agentic decision platform for banks and insurers with a library of pre-built agents, including Adverse Media Investigation, Business Ownership Intelligence and Sanctions and Watchlist Match Review agents, that run inside decision flows with human review.
AI agents for financial-crime compliance: a Research Agent that gathers and synthesises subject evidence and a Review Agent that fills out case reviews per your procedures, on an agent orchestration platform with analyst approval.
AI agents that run fraud and AML alert triage and investigations: they pull transaction history, check watchlists, run open-source research, assemble evidence, draft narratives and recommend dispositions for analyst approval.
Enterprise GRC platform with built-in agents for evidence analysis, control assessment, risk enrichment and findings extraction, plus an Agent Studio for custom GRC agents and agentic TPRM.
Cyber GRC platform whose AI agents build and run end-to-end compliance workflows from natural-language prompts, covering evidence collection, control testing, gap analysis and continuous control monitoring.
Generative-AI agents for financial-services regulatory compliance: a Screening Agent for horizon scanning and alerts, a Gap Analysis Agent that maps rules such as DORA, PSD3 and MiCAR against your policies, and a Reports Agent.
AI GRC platform whose agents collect and map evidence, test controls continuously, assess policies against frameworks, run natural-language 'TI Playbooks' and answer security questionnaires.
AI governance platform whose agents discover AI systems, assess controls against evidence, quantify AI risk in euros and investigate changes on a schedule, while decisions on the record stay with your team.
AI privacy agent built into DataGrail's privacy platform that autofills privacy and AI-risk assessments, classifies cookies, detects AI risk, suggests processing activities and troubleshoots DSR integration errors, acting only with user approval.
AI privacy agent that runs privacy assessments end to end: it monitors tools like Jira, CLM and procurement for new activity, triggers the right PIA/DPIA/TIA/RoPA, researches risk, populates assessments with evidence and routes approvals.
Agent layer behind Ketch's privacy platform that self-populates data maps, runs always-on gap analysis between regulations, your commitments and live systems, and proposes reviewable configuration changes, DPIAs and RoPA exports.
Agentic vendor-assessment workflow in which four agents (Initiator, Collector, Analyst, Reporter) start assessments, gather evidence, produce cited findings and route an executive summary for human approval.
Team of risk-informed AI agents for each stage of the third-party risk lifecycle, covering intake checks, evidence review, issues management and executive reporting, with the customer's team in control.
AI agent built into the Lumos identity governance platform that designs roles, completes access reviews (approve/flag with peer and usage analysis) and investigates identity risk, explaining every decision.
AI agents in SpotDraft's contract platform for contract review, contract queries, clause drafting and regulatory tracking, plus VerifAI playbook review inside Microsoft Word.
Agentic AI platform, formerly ContractPodAi, that runs contract lifecycle, legal, procurement and finance work end to end, including drafting, redlining, negotiation and obligations.
Audit-engagement agents inside Caseware: the Disclosure Checklist Agent drafts cited Yes/No/N-A checklist responses from financial statements, and the Risk Suggestion Agent drafts engagement-specific risks for auditor review.
Agent workforce for audit and advisory firms: agents plan engagements, run testing through to workpapers, review conclusions against evidence and draft financial statements, coordinated by Field Orchestrator.
Generally available Agent Studio for deploying AI agents inside Appian processes that reason over enterprise data and act under platform guardrails; Appian Government Cloud is FedRAMP High authorized.
Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.
CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.
A
Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized.
Pre-built Agentforce agents for federal, state and local government, covering complaint management, benefits and licensing, code-violation compliance and internal IT compliance; Salesforce says Agentforce is FedRAMP High authorized in Government Cloud Plus.
Vivox AI compliance agents (Rachel, AI compliance analyst)
Vivox AI (Digital Intelligent Solutions Ltd)
United Kingdom
Pre-trained AI agents for AML, KYB/KYC and financial crime that take on Level 1 analyst work: sanctions and PEP alert reviews, adverse media monitoring, corporate registry and UBO analysis, and narrative report writing.
Ten specialised AML investigation agents that screen, research, analyse and validate each onboarding or transaction alert, write a cited case narrative and hand the decision to a human analyst; a Red Team Agent challenges every finding.
Fraud and AML platform with named agents that disposition screening alerts, run enhanced due diligence and business verification, analyse networks, draft SAR narratives, tune monitoring rules and build dispute packages.
Named AI agents that act as L1/L2 AML analysts: they review and disposition sanctions, PEP and watchlist alerts, transaction screening and monitoring alerts, adverse media, EDD and KYC work, escalating or closing cases with justification.
Agent platform for bank and fintech financial-crime operations: pre-built and custom agents gather evidence, apply the institution's policy and draft full cases for EDD, monitoring alerts, sanctions, SAR drafting and KYB, with every action logged.
AI-native GRC platform whose agents monitor controls, collect evidence, map controls, flag gaps, draft security-questionnaire responses and remediate gaps across 40+ frameworks, with a dedicated compliance expert per customer.
Enterprise GRC platform with a fleet of task-specific AI agents for evidence review, control advice and remediation, policy drafting, risk treatment planning, vendor questionnaire review and risk scoring, and customer security questionnaires.
EU-hosted compliance platform for European companies whose agents read documents and GitHub evidence, watch security advisories, flag gaps and propose actions, with per-agent autonomy set to Propose & Wait, Hybrid or Full.
Agentic third-party cyber risk assessments that scope each vendor by inherent risk, analyse outside-in ratings, inside-out control evidence and vendor artifacts, and produce cited risk summaries with continuous drift monitoring.
Agent layer across the osapiens HUB that runs supplier onboarding, record validation, questionnaire pre-fill, supplier case management and risk-trend analysis for supply-chain due diligence (LkSG, CSDDD, EUDR and more), within customer-set guardrails.
Legal AI platform with contracting, research and compliance agents, plus an Agent Studio that runs whole legal workflows from intake to approval against the organisation's playbooks.
Teams of AI agents for finance shared services that capture, code, tax-validate and PO-match invoices, process order confirmations, delivery notes and dunning letters, and post validated results to the ERP with traceable reasoning.
Spend-management AI agents that enforce spend policy, collect and match receipts, chase approvals, code transactions for month-end close and handle procurement, travel and payment requests.
No-code agent builder and prebuilt agents on Workiva's reporting, audit and GRC platform, used for finance tie-outs and roll-forwards and for evidence collection, control testing and remediation, with configurable review and approval steps.
Enterprise workflow platform whose AI agents (Coach, Knowledge Buddy, Automate, developer agents and the Blueprint design agent) run on Pega's trusted workflows; Pega Cloud for Government, including these gen AI agents, is FedRAMP High authorized.
Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).
Agentic AI security analyst in the Singularity platform that runs alert investigations to a verdict and, with Singularity Hyperautomation, triggers response within pre-approved policies; SentinelOne says Purple AI is FedRAMP High authorized.
Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.
Castellum.AI Arbiter AI agents (alert resolution, transaction and fraud monitoring agents)
Castellum.AI
United States
AML/KYC agents that resolve L1 and L2 screening alerts (sanctions, PEPs, adverse media) against the institution's own policies, plus transaction-monitoring and fraud-monitoring agents, with a documented rationale for every decision.
Financial-crime agents on SymphonyAI's agent-native Symphony Risk Intelligence platform: manager and specialist agents that prepare TM and screening investigations, enrich watchlist records, track threat and regulatory intelligence, and run KYC/EDD workflows.
Specialised AI agents that pre-investigate KYB cases end to end (documents, UBOs, AML screening hits, online reputation), auto-approve routine cases under the customer's policy and escalate edge cases with a full audit trail.
Themis AI Investigator (AML/KYB due-diligence agents)
Themis (Themis International Services Ltd)
United Kingdom
A coordinated team of AML-trained AI agents that runs enhanced due-diligence and KYB investigations in minutes: registry and web collection, officer/UBO screening, adverse-media analysis and transparent red/amber/green risk grading, with analysts keeping the final decision.
Behavox Digital Employees (AI agents for compliance surveillance alert review)
Behavox (Behavox Limited)
United Kingdom
AI agents that close routine Level 1 communications and trade-surveillance alerts on their own, using three-model consensus (any disagreement escalates to a human), with a regulator-ready Bundle Log of every decision.
Persona-based GRC agents in the SureCloud platform that run continuous risk, compliance, third-party and audit work on schedule or trigger, chaining reusable no-code Skills, with human approval gates and separate logging of AI and human actions.
German, EU-hosted AI agent in the Athereon GRC platform that identifies risks, captures assets, maps gaps against NIS2/ISO 27001/DORA/TISAX/CRA, and sends and fills security questionnaires, asking for approval before it changes anything.
Library of prebuilt risk and GRC agents on Salesforce Agentforce inside Riskonnect: risk-register signal, risk builder, regulatory mapping, policy impact and horizon-monitoring agents, plus claims and incident intake/audit agents.
Packaged DSAR agent that handles intake, jurisdiction deadlines, identity checkpoints, discovery across connected HRIS/CRM/ticketing/file systems, third-party PII redaction and response drafting, with a person approving the release.
Wolfia Questionnaire Agent (security questionnaires and trust center)
Wolfia (Wolfia Inc.)
United States
Security-questionnaire agent that drafts every answer with a citation from the company's own corpus, routes ungrounded questions to the owning expert, returns the file in its original format, and fills portal-only questionnaires via a Chrome extension.
Agentic ERP for multi-entity finance teams: executive agents (Bill, Contract, Accrual) do accounting work, audit agents check their output and instructions against written accounting and approval policies, and materiality-based approval controls decide what needs a controller or CFO.
Close-management and accounting platform whose agents turn source records (leases, commission plans, card spend, payables) into subledgers, propose the accounting treatment for approval, build schedules and derive journal entries automatically.
Agentic cyber assurance and continuous compliance platform whose AI agents collect evidence, test controls, find gaps against 50+ frameworks (FISMA, NIST 800-53, FedRAMP, CMMC) and generate ATO artifacts; the platform is FedRAMP High authorized.
Suite of AI agents for human risk management that automatically generate and deliver personalised phishing simulations, training, remedial and policy-quiz content per user; the FedRAMP Moderate KnowBe4 Platform covers AIDA (except AIDA Deepfakes).
IBM's agent platform to build, deploy, orchestrate and govern AI agents (IBM, custom and partner agents for HR, procurement and other domains); watsonx Orchestrate for Government is in scope of IBM Data Services for Government, FedRAMP Moderate.
Halo AI Agents (service management with FedRAMP GRC module)
Halo (Halo Service Solutions Limited)
United Kingdom
ITSM/ESM platform (formerly HaloITSM) with AI agents: conversational agents for end users and fulfillers, and process agents (Dispatch, 1st Line Support, Major Incident, Knowledge, Change Management) that act on their own within role-based permissions. The platform, including a FedRAMP/CMMC GRC module, is FedRAMP 20x Moderate.
Compliance platform for onboarding, monitoring and case work where AI agents run sanctions, PEP, adverse-media and alert investigations, resolve ownership (UBO) gaps and review documents, returning a cited verdict and recommended action for an analyst to decide.
Shufti Transaction Trust Monitoring (agentic FRAML engine)
Shufti (Shufti Pro Limited)
United Kingdom
Agentic fraud and AML (FRAML) transaction monitoring in which governed AI agents score transactions, triage and investigate alerts and draft regulator-format SAR/STR reports, with the MLRO approving every filing.
Oracle Nexus for financial crime investigations (Nexus Case Flow and Nexus Reach agents)
Oracle (Oracle Financial Services)
United States
Oracle's financial-crime case management with agentic AI that pre-investigates AML, fraud, sanctions and KYC cases unprompted, gathers evidence and entity context, runs adverse-media scans and drafts investigation narratives for human review.
EU-hosted compliance platform where AI agents connected to your systems draft policies, map controls across frameworks, collect evidence daily, flag control drift and draft risk treatments, with every output a draft a human must accept.
European Cyber GRC platform whose AI agent, Jerry, turns NIS2, ISO 27001 and DORA requirements into measures and tasks, assigns them to owners, follows up delays, collects and checks evidence freshness and escalates only what is blocked.
IndiSec DPDPA compliance agents (Veda AI privacy analyst)
IndiSec (Indisec Edge Private Limited)
India
India DPDP Act compliance platform where assessment, obligation, consent, notification and evidence agents (plus the Veda AI privacy analyst) run gap assessments, track obligations, draft notices and assemble evidence, with lawyers and the customer approving every gate.
Veeam PrivacyOps AI agents (Consent Agent, DSR and Assessment agents)
Veeam Software (Securiti AI, a Veeam company)
United States
Privacy-operations agents on Veeam's DataAI Command Platform: a generally available Consent Agent that builds, tests, monitors and auto-remediates consent across sites and downstream systems, plus announced DSR intake-form and assessment-autofill agents.
AI analyst agents for financial-crime compliance that run KYC and KYB onboarding reviews, disposition sanctions, PEP and adverse-media alerts, perform enhanced due diligence and rescreenings, and draft SAR/UAR filings with audit-ready decision logs.
Permissions-aware AI agents on Box's content platform: the Box Agent plans multi-step work across files, Extract agents turn documents into structured metadata, a Classification agent labels sensitive content, and Box AI Studio builds custom agents; Box AI sits inside Box's FedRAMP High boundary per the Marketplace listing.
Multi-agent orchestration for financial-statement audits: an orchestrator staffs engagements with long-running agents that draft disclosure-checklist answers, categorise trial balances, generate PBC request lists, prepare and perform procedures and draft workpapers, all ending in a human sign-off queue.
Archer Evolv AI Operators (Evolv Foundation and Evolv Workplace)
Archer (Archer Technologies LLC)
United States
Governed GRC agents ('AI Operators') inside the Archer system of record: identity-bound, scope-limited, human-supervised agents for control generation and assurance, regulatory change, reportable-event review and record hygiene; the Archer Evolv product is TX-RAMP Level 2 certified.
Deep Fathom Compliance Readiness Platform (agentic CMMC / NIST SP 800-171 readiness)
Deep Fathom, Inc.
United States
CMMC and NIST SP 800-171 readiness platform for US defence contractors where AI agents interpret obligations, plan and advance routine readiness work, continuously map the CMMC boundary and collect evidence, with human review gates on consequential decisions.
C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne)
C1 (ConductorOne, Inc. d/b/a C1)
United States
Governed AI agent on C1's identity platform that carries out identity work end to end from a plain-language request (revoking stale admin grants, building access reviews, assembling audit evidence on who reached production, finding orphaned entitlement owners), acting only within the operator's own permissions and logging every action.
Vulcan Justinian (AI agent for government legal, regulatory and permitting work; VulcanGov)
Vulcan Technologies (Vulcan Technologies, Inc.)
United States
AI agent for US government knowledge workers, grounded in a large corpus of federal and state statutes, regulations, court cases and fiscal data. It runs 50-state research in parallel with citations, monitors legal changes, reviews permit applications against the code, drafts memos and comment responses, and builds internal tools inside the agency boundary.
CLEAR Investigate (agentic AI investigations for government, risk and fraud teams)
Thomson Reuters
Canada
Agentic investigation tool built on Thomson Reuters CLEAR public-records data. From a plain-language question it plans and runs searches across CLEAR data and the open web, resolves conflicting records and returns concise cited findings with a record of the searches it ran, for AML, fraud, program-integrity and law-enforcement investigators.
Generally available agentic AML module for banks: a central orchestrator coordinates specialised agents that gather data, analyse transactions and customer behaviour, review prior alerts and deliver a decision-ready Level 1 alert recommendation with documented rationale, with analysts making every final decision.
Oscilar Agent Hub (AML, sanctions, fraud and onboarding agents)
Oscilar (Oscilar, Inc.)
United States
Risk-decisioning platform with 30+ orchestrated agents on a shared risk memory, including AML L1 review, sanctions screening dispositions, adverse media, EDD dossier, SAR narrative, fraud L1 review, fraud-network and KYB review agents, where every recommendation is confirmed by a human analyst.
Brazilian risk and compliance decisioning platform whose AI agents read the full KYC/KYB dossier, compare it with current regulation, flag risks such as adverse-media homonyms, and suggest a justified decision with a confidence level for the analyst to validate, with continuous re-analysis when a monitored person or company changes.
German agentic GRC/ISMS platform whose agents import and map existing registers and documents, check them against the method (e.g. BSI IT-Grundschutz), turn gaps into owned tasks, propose risk ratings and controls, assign evidence, prepare audit answers and reassess risks when a record changes, with no change taking effect without human approval.
Mindlapse Ernest (agentic Cyber-GRC: compliance, third-party and risk agents)
Mindlapse (Mindlapse SAS)
France
French agentic Cyber-GRC operating system whose Ernest engine runs separate planner, collector, adjudicator and writer agents to verify every governance claim (from policies, control owners or vendors) against evidence, connector signals and a cyber knowledge graph, returning sourced verdicts with confidence that are re-checked continuously and accepted or rejected by a human.
noze DataGovern (on-premise compliance agents for NIS2, GDPR and the AI Act)
noze (noze S.r.l.)
Italy
Italian on-premise platform whose AI agents read company documents and procedures, map them to NIS2, GDPR, AI Act, CRA and DORA obligations, flag gaps and risks with the source linked, and pre-fill registers, evidence and one remediation plan; a person approves every proposal and each confirmed gap becomes an owned task.
Data Adhikaar DPDPA agents (ten-agent compliance fabric)
Data Adhikaar (Qodequay Technologies Pvt. Ltd.)
India
India DPDP Act compliance platform run by ten scoped agents for data discovery and RoPA, consent, data principal rights requests, breach response, DPIAs, regulatory intelligence, policy drafting, processor risk and audit evidence, with human approval gates for Board notifications, policy publication and severity downgrades.
German agent that completes incoming security questionnaires (vendor assessments, TISAX, ISO 27001, DORA) in Excel, PDF, Word or vendor portals from the customer's policies, certificates and past answers, with a source citation on every answer, consistent answers to re-worded questions, expert routing and team approval.
FloQast Transform AI agents (accounting close agents built from finished work, plus prebuilt agents)
FloQast (FloQast, Inc.)
United States
Close-management platform whose Transform AI agents run accounting workflows end to end (reconciliations, journal entries, close tasks); Transform can rebuild a finished close into a governed, documented agent tested against approved numbers, and each agent needs accountant sign-off before it runs.
Hybridity compliance execution platform agents (policy-to-control registry, scheduled evidence and batch contract checks)
Hybridity (Hybridity AB)
Sweden
Swedish compliance execution platform for regulated firms that turns a company's own policies into a requirement registry, checks it against DORA, NIS 2, GDPR or customer demands, and hands routine work to agents (contracts checked in batches, evidence collected on schedule, updates computed when a rule changes), with a person approving every result.
FluxForce Agentic OS (28 financial-crime and compliance agents, incl. Rhea Ledger KYC/AML Analyst)
FluxForce (FluxForce AI Pvt. Ltd.)
India
An 'Agentic OS' of 28 named AI agents in three squads covering fraud, KYC/AML, sanctions screening, STR/SAR drafting, audit trails and model risk for banks, fintechs and insurers. Each agent works in shadow mode first, then within autonomy bands and a per-agent kill switch that the institution sets.
episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence)
episki (episki, llc)
United States
A GRC platform built around agents that draft policies, answer inbound security questionnaires, review vendors' SOC 2 and CAIQ responses, map controls, assess risks and write deterministic evidence-collection recipes. Every plan, step-run and sensitive action goes through human approvals and safety floors. Pricing is published.
Cloudgeni cloud agents (Compliance Remediation, Drift & Import, PR Review and other infrastructure agents)
Cloudgeni (Cloudgeni AS)
Norway
Oslo-built agentic cloud operations platform whose agents find cloud security and compliance issues, investigate across cloud state and IaC, write the Terraform/Bicep fix, validate it with a plan and policy checks and open a pull request, then verify the fix after it lands. The Compliance Remediation Agent works from Prowler, Security Hub, Defender and Checkov findings against CIS, SOC 2, ISO 27001 and NIS2. Autonomy is set by policy.
BRYTER Hybrid Agents (AI plus rule-based workflow agents for DORA, DPA and NDA contract review)
BRYTER (BRYTER GmbH)
Germany
Legal and compliance agents that combine AI document review with BRYTER's rule-based workflow engine to run specific tasks end to end, such as reviewing contracts against DORA, reviewing DPAs and NDAs against a playbook, and generating the amendment agreements or reports.
BILL AI agents (W-9 Agent, Reconciliation Agent and other touchless AP agents)
BILL (BILL Holdings, Inc.)
United States
AI agents inside the BILL finance platform for small and midsize businesses: the W-9 Agent requests, follows up on, collects and pre-validates vendor W-9s (names and TINs), and the Reconciliation Agent codes and reconciles receipts, with the customer's team approving the final data.
Cortea Audit Quality Agents (AI agents for external audit file review, sample testing and disclosure checks)
Cortea (AI Audit Systems GmbH)
Germany
Berlin-based AI quality layer for audit firms. Its agents review audit files end to end, cross-checking figures, disclosures and assertions across financial statements, audit reports and working papers, run substantive sample testing against the auditor's criteria and work through IFRS/UK GAAP/Companies Act disclosure checklists, documenting findings for auditor and partner sign-off.
Steuerboard Kompass (agentic OS for German tax firms: AI agents working directly on DATEV data)
Steuerboard (Steuerboard Labs GmbH)
Germany
Generally available since Oct 14, 2026: an agentic operating system for German tax-advisory firms (Steuerkanzleien). AI agents work on the firm's DATEV data in the background. They check client bookkeeping for missing receipts, unusual costs and missing tax codes, flag missing year-end closing entries, calculate BWA metrics and email clients to request missing documents, and changes go back to DATEV only after the firm approves them.
GetTeddy compliance agents (Certification, Gap Audit, Policy, Evidence, Questionnaire and Contract agents)
GetTeddy (Teddy Technologies GmbH)
Germany
Berlin agentic compliance platform in which six AI agents run recurring ISO 27001, SOC 2, NIS2, TISAX and DORA work on a schedule: planning a first certification, weekly gap audits against connected systems, drafting policies, collecting evidence, drafting security-questionnaire answers and checking vendor contracts and DPAs, with every result logged and approved by a person.
Gu1 compliance and fraud AI agents (Onboarding, Screening, KYT, Case and Reporting agents)
Gu1 (operated by Gueno USA LLC)
Argentina
Buenos Aires-headquartered compliance and fraud platform for Latin American fintechs and banks in which 25+ specialised AI agents run KYC/KYB onboarding, sanctions/PEP screening, real-time transaction monitoring, alert triage with an auditable case file, and regulator-format SAR/STR drafting, while a human decides and signs.
Legiscope GDPR AI agents (RoPA, processor/DPA review, DPIA, incident and rights-request workflows)
Legiscope (Legiscope UAB)
Lithuania
Vilnius-registered 'agentic compliance' GDPR platform whose AI agents write and keep the Article 30 register current as the business changes, find and assess every processor's DPA against Article 28, prepare DPIAs, draft breach-notification decisions and turn data-subject requests into deadline-tracked case records, routing judgement calls to the privacy team.
Sopra Steria IAN – Investigation Agent Network (agentic AML alert investigation)
Sopra Steria (Sopra Steria SE, Hamburg)
Germany
Agentic AI product from Sopra Steria's German company for anti-financial-crime teams: it takes transaction-monitoring alerts and runs the first-level investigation itself (gathering case information from approved sources, analysing facts and patterns in the alert's context, documenting results, sources and reasoning) and prepares a recommended action, while the final case decision stays with the analyst.
Xpert-iA Agent Onboarding clients / LCB-FT (AML onboarding agent for French accounting firms)
Xpert-iA (Xpert-IA SAS)
France
French AI agent for accounting firms' anti-money-laundering (LCB-FT) client onboarding: from a SIREN it pulls the company and directors from the national business register, sends the client a secure portal link and chases missing documents, checks beneficial owners against the RBE register, asset-freeze lists, FATF/EU country risk and document consistency, screens for PEPs, and assembles a traced due-diligence file for the firm to decide.
Dutch AI agent that runs Wwft client due diligence for accounting and tax firms: it analyses client files, UBO structures and legal constructions, checks identities against PEP and sanctions lists, pulls audit information from the Dutch UBO register and Trade Register, flags profile changes and schedules re-reviews, and delivers audit-ready KYC files with a source reference for every conclusion, while a person makes the decision.
Metis Legenda AML (AI agent for KYC due diligence and transaction monitoring)
Metis (Metis S.r.l.)
Italy
Milan AML product in which an AI agent runs Italian 'adeguata verifica' (customer due diligence) end to end: it analyses each onboarding document for relevance and extracts the data, traces beneficial owners through chains of shell companies using private documents and public databases, screens PEP, EU/UN sanctions and internal watchlists, proposes a reasoned risk classification and logs every step in a traceable report; a companion agent analyses transactions to surface real behavioural anomalies and cut false positives.
Freeday KYC digital employee (AI agents for KYC document collection, verification and screening)
Freeday (Freeday B.V.)
Netherlands
Rotterdam 'digital employee' platform whose KYC agents request, validate and classify customer documents in real time, guide customers through verification by voice or chat, run sanctions, adverse-media and PEP checks before onboarding completes, and close routine KYC checks without manual review, routing exceptions to analysts with pre-extracted data and logging every decision for supervisors.
CITSmart GRC.S (GRC + SecOps platform with AI agents that check deadlines and execute response actions)
Central IT (CITSmart)
Brazil
Brazilian GRC-plus-security-operations platform from Central IT: alerts from proxy, DNS, XDR, e-mail and identity tools are correlated and prioritised by AI, AI agents check deadlines, priorities and owners for each compliance or security demand, and AI agents execute checks and response actions in the environment (Cognitive Workflow), with LGPD, ISO 27001, NIST, CIS Controls 8 and ISO 42001 mapped out of the box.
Singapore-headquartered agentic compliance platform whose named agents review uploaded evidence against framework controls and flag gaps, score vendors from 12+ external sources without questionnaires, scan cloud posture and auto-escalate critical findings to the risk register, draft answers to customer security questionnaires (SIG, CAIQ, custom) from live policies, draft policies, and generate fixes for failed controls and mark them ready for re-audit.
Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents)
Crest (Crest Veda TechWorks Private Limited)
India
New Delhi-headquartered third-party risk platform with seven agents marked Live: an outreach agent that autonomously sends and follows up vendor emails and voice reminders and escalates non-response, a questionnaire agent that distributes, chases and analyses vendor questionnaires, plus continuous adverse-media/watchlist monitoring, risk-based scoring, financial analysis, screening and efficiency agents that auto-approve low-risk vendors and trigger re-assessments.
OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI)
OnFinance AI (Mindweave Transformers Private Limited, Bengaluru)
India
Free, self-hosted, open-source (AGPL-3.0) agent from India's OnFinance AI for banks, brokers, NBFCs, AMCs, insurers and fintechs. It runs 26 workflows of specialist agents that keep a company's regulatory profile current, probe repositories, infrastructure and vendors for gaps against SEBI, RBI, IRDAI, CERT-In and DPDP controls, and write findings (each citing a specific clause), remediation plans and audit reports into a validated, append-only ledger for human review.
Covasant TPRM (agentic third-party risk management)
Covasant (Covasant Technologies Private Limited, Hyderabad)
India
Third-party risk product from Hyderabad-headquartered Covasant. Purpose-built AI agents onboard vendors through due-diligence workflows, chase vendors who are slow to respond, keep watching news, sanctions and financial data, and, when risk thresholds break, open remediation workflows, track vendor responses, escalate unresolved issues and produce DORA, SOX and NIST reporting packages.
Italian agent for mid-sized companies and NIS2 entities without an in-house SOC: after verifying domain control it continuously discovers assets and assesses network, web apps and APIs, correlates findings with EPSS and CISA KEV, confirms exploitability with automated validation pentests, ranks risks by business impact and prepares NIS2, DORA and ISO 27001 reports; the team decides what to fix.
NICE Actimize Xceed AI Agents (fraud and AML alert triage and investigation agents)
NICE Actimize (a business of NICE Ltd.)
Israel
AI agents inside NICE Actimize's Xceed AI FRAML platform (combined fraud prevention and AML compliance for financial institutions, with an offering for credit unions and community banks). The agents automate alert categorisation and triage, dismiss false positives and summarise cases, and 'Converse and Suggest' agents plus a CoPilot suggest investigative paths in natural language, with analysts in the loop who keep control of decisions.
AML investigation suite inside ThetaRay's Investigation Center, working on top of ThetaRay's transaction monitoring. Ray analyses each alert end to end (case data, customer and counterparty behaviour, KYC/profile alignment, jurisdictions, related past alerts), produces a full investigation report with a narrative, explained decision and recommended next steps, and gives analysts an on-demand assistant; analysts make the final decision.
DataVisor Vera and Vera Code (agentic AI for fraud and AML strategy, tuning, alert summaries and SAR drafting)
DataVisor (DataVisor, Inc.)
United States
AI teammate for fraud and AML teams on the DataVisor platform. From a plain-language request, Vera orchestrates agents that author detection rules, features and lists, tune strategies against production telemetry, summarise alerts and draft FinCEN-aligned SAR narratives; changes are proposal-only and a human approves before anything reaches production. Vera Code turns requirements into tested, documented configurations.
Uptiq compliance and risk agents (sanctions screening, BSA/AML and regulatory reporting agents for banks)
Uptiq (UPTIQ, Inc.)
United States
Agents for bank and credit-union compliance teams on Uptiq's Qore platform. A Sanctions Screening Agent screens every transaction and party and prioritises alerts by risk, a BSA/AML Agent assembles case files and drafts SAR and CTR narratives for disposition, and a Regulatory Reporting Agent prepares and validates filings and tracks regulatory changes to policy; agents run under the institution's own policies, permissions and approval gates, with every action logged.
AI agent inside the Nuix Neo investigative analytics platform for legal, regulatory, investigations and compliance-monitoring matters: it picks and calls Neo tools on its own to answer plain-language questions across a case, links every answer to source items, tags items and writes findings back to the case, and records each step for audit.
AI agent for enhanced due diligence (EDD) on high-risk customers: it gathers internal and external data, unifies KYC/KYB data, sanctions, adverse media and ownership/associate risk, flags risk factors and mitigants, recommends next steps and drafts a fully cited risk narrative for regulatory review, while the analyst makes the final decision.
Financial-crime platform from Riyadh-based MOZN whose built-in agentic AI triages AML alerts, summarises cases, recommends dispositions, auto-closes low-risk or duplicate cases and drafts SARs, alongside a Fraud Investigation Agent; humans keep consequential decisions.
trail Governance Agents (GRC and AI governance agents)
trail (trail GmbH, part of Collibra since Oct 2026)
Germany
Munich-based trail's Governance Agents run GRC busywork in the background: they read your project files and sources to collect and link evidence, assess controls, classify systems, run risk and vendor assessments and draft policies, proposing changes that a human approves before anything is written.
Singapore-based RegASK monitors regulatory change in 160+ markets for life sciences and consumer products companies, and its AI agents assess impact on products and markets, assign follow-up tasks and execute subsequent actions in configurable workflows, with expert review and a recorded outcome for each run.
Saved
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.