theagentindex.io/reports/state-of-ai-compliance-and-audit/ · Last reviewed 24 Oct 2026
Free report · Q4 2026 · CC BY 4.0
State of AI Compliance & Audit (Q4 2026): AI agents and audit firms
410 AI agents and 516 Verified · 11 registry-listed audit firms, analysed from the Agent Index open dataset. Facts only. Not a ranking or a market census.
Download the full report (CSV + printable HTML) Printable HTML
Cite as: Agent Index (https://theagentindex.io) — DOI: 10.5281/zenodo.23604511. Agents v0.1.27, auditors v0.1.32.
Unlock the download
Subscribe free to download the CSV and printable HTML. 100% free through Q1 2027.
1. Key numbers
- 410 verified AI agents across 31 HQ countries.
- 516 Verified · 11 registry-listed audit firms across 15 HQ countries. This firm appears on the official registry, not independently verified by Agent Index.
- 237 agents (57.8%) publish a headquarters outside the United States.
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
2. Agents by category and top 15 tasks
Top 15 tasks
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
3. Where agents are built
HQ country (top 15)
HQ region
- north-america — 183 (44.6%)
- europe — 155 (37.8%)
- india — 24 (5.9%)
- asia-pacific — 19 (4.6%)
- middle-east — 17 (4.1%)
- australia-new-zealand — 8 (2.0%)
- latin-america — 4 (1.0%)
76 agents have a non-empty india_relevance field.
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
4. Pricing transparency
62 agents (15.1%) have a pricing_model value that includes “published”. Remaining stored values are shown as stored. No price ranges are invented.
quote— 324 (79.0%)published-tiers— 62 (15.1%)freemium— 20 (4.9%)annual-contract— 4 (1.0%)
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
5. Government authorizations
72 agents have a non-empty authorizations list. Programs are grouped exactly as stored.
- tx-ramp — 62
- fedramp — 36
- govramp — 21
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
6. Frameworks (vendor-stated)
Top framework tags on agents. These are vendor-stated relevance tags, not certifications. Related reading: EU AI Act timeline after the Digital Omnibus.
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
7. Audit firms by framework and country
- ISO 27001 — 185
- PCI DSS — 164
- CERT-In — 117
- CMMC — 75
- HITRUST — 68
- ISO 27701 — 45
- ISO 42001 — 33
- FedRAMP — 44
- GovRAMP — 30
- SOC 2 — 26
- SOC 1 — 22
- ISMAP — 8
63 firms carry 3 or more framework tags.
Firms by HQ country
- US — 185
- India — 126
- UK — 55
- Japan — 49
- Germany — 31
- Australia — 28
- Netherlands — 19
- Canada — 9
- Brazil — 8
- Ireland — 4
- Singapore — 4
- UAE — 4
- Israel — 2
- Saudi Arabia — 2
- Mexico — 1
Top accreditation registries
- PCI SSC Qualified Security Assessor list — 164
- CERT-In empanelled information security auditing organisations — 117
- Cyber AB Marketplace - C3PAO — 75
- HITRUST Authorized External Assessor list — 66
- ANAB Management Systems CB Directory — 45
- FedRAMP Marketplace - recognized assessors (3PAO) — 44
- DAkkS database of accredited bodies - certification body for management systems — 31
- GovRAMP accredited 3PAO list — 30
- ISMS-AC (Information Management System Accreditation Center, Japan) - accredited ISMS certification bodies — 28
- UKAS - accredited certification bodies — 26
- RvA (Dutch Accreditation Council) register - management system certification bodies — 19
- JAS-ANZ Register - accredited certification bodies — 16
- NABCB accredited management system certification bodies — 15
- ISMAP (Information system Security Management and Assessment Program, Japan) - audit institution list — 8
- Inmetro/Cgcre (Brazil) - accredited information security management system certification bodies (OTS) — 6
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0) · Open dataset · Methodology
8. Methodology and limitations
Listings follow verified-only rules. This is not a market census. There are no rankings or scores. Each record has a last_checked date. Confirm current status on the named registry or vendor page. See the methodology and open dataset.
Source: Agent Index open dataset v0.1.27 / auditors v0.1.32, DOI 10.5281/zenodo.23604511 (CC BY 4.0)