Alation launches AI governance tool for compliance

Alation has launched Alation AI Governance, a product designed to give enterprises a single system of record for AI compliance.

The launch comes as companies deploy AI models, agents and tools faster than they can document and oversee them. Many organisations still rely on email chains and shared folders for approvals and evidence gathering, leaving Chief Data Officers and compliance teams to assemble records manually when boards or regulators ask for proof, Alation argued.

That pressure is increasing as AI rules expand across jurisdictions. Alation pointed to the EU AI Act, the NIST AI Risk Management Framework, ISO 42001 and a growing number of state-level AI laws in the US as examples of frameworks companies must track when operating across regions.

The new offering is intended to bring those processes into one place. It creates a register of AI assets across an organisation, links those assets to relevant regulations, generates model cards using asset metadata and data dependencies, and routes approvals through workflows based on the rules that apply to each system, according to Alation.

It also includes compliance reporting aimed at senior executives, with a dashboard for Chief Data Officers, Chief Information Officers, Chief Risk Officers and Chief Compliance Officers. The dashboard shows an overall compliance score, a breakdown by regulation and a list of open risks tied to underlying assets and supporting evidence.

As per Alation, one element of the product is an AI asset registry, designed to capture every model, agent and tool in use across the business, whether pulled in from connected platforms or submitted through a software development kit. Each entry includes a searchable profile and lineage to upstream data dependencies,.

Another component is a set of model cards generated from metadata, data dependencies and regulatory requirements. Each field cites its source and shows what information has been verified and what still requires review.

Approval handling is also a central feature. Routing changes depending on the regulation involved, with higher-risk assets directed to functions such as Legal and the Chief Information Security Officer, while assets covered by other frameworks follow a standard review path. Missing evidence creates remediation tasks linked to the relevant gap, and actions are logged in an audit trail that can be exported for regulators.

The product's regulation registry covers the EU AI Act, the AI-relevant subset of GDPR, NIST AI RMF and ISO 42001, according to Alation. Customers can add further regulations and use AI-assisted suggestions to map requirements.

The launch reflects a broader shift in enterprise AI management as companies move from experimentation to more formal controls. Businesses face growing pressure from boards, customers and regulators to show not only where AI is being used, but also what data it relies on, who approved it and whether it meets internal and external standards.

Alation cited Grant Thornton research showing that 78% of business executives said they could not confidently say they would pass an independent AI governance audit within 90 days. The finding points to a gap between AI adoption and the processes needed to demonstrate oversight.

For Alation, the new product extends its work in data cataloguing and governance into AI-specific oversight. The company has built its position around organising data knowledge inside large organisations and is now applying that model to AI inventories, documentation and compliance records.

"The question in every boardroom has shifted from 'are we using AI?' to 'can we prove we're using it responsibly?'" said GT Volpe, Head of Product Management at Alation. "That proof does not come from policy documents filed in SharePoint. It comes from a system that knows every AI asset you have, which regulations apply to each one, and whether the evidence is complete. That is what Alation AI Governance is."