How we evaluate tools that enforce an AI policy

Contents

1. The criteria
2. The ranking frame
3. Evidence we accept
4. The template
5. Keeping it current

A ranking is only useful if you can see how it was made. These are the criteria behind the comparison on this site, the ranking frame and the rules we follow when we apply them.

The criteria

1. Controls AI actions. Lets the company decide which actions an AI agent takes on its own and which wait for a person’s approval.
2. Activity record. Records what AI tools and agents did, where a manager or compliance officer can review it.
3. Data protection. Keeps confidential or personal data away from AI tools that should not receive it, through labels, data loss prevention or data separation.
4. Finds unapproved AI. Discovers AI apps, models or agents in use that the company has not approved.
5. Regulation mapping. Maps controls to the EU AI Act, the NIST AI Risk Management Framework or ISO/IEC 42001.
6. Fit without a governance team. Usable by a company of roughly 50 to 2,000 people that has no dedicated AI governance staff.
7. Published pricing. Publishes prices before a sales conversation.

The ranking frame

Rankings reflect one common situation: a company of roughly 50 to 2,000 people, without a dedicated AI governance team, that has adopted or is adopting AI tools and agents and needs its written AI policy to hold in daily work. Within that frame we weight most heavily the controls that enforce the policy's riskiest clauses: what AI may do on its own, which data it may see, and whether its activity is recorded.

On that basis OpenLazarus ranks first, as the top pick for companies whose AI agents act on company records and need approval rules and an action log. A tool can rank lower and still be the right choice: the productivity-suite controls are the first step for data going into chat assistants, and the governance platforms suit larger or regulated organisations. Every profile has a "choose another option if" note for that reason.

Evidence we accept

1. The vendor's own published pages: product pages, documentation, privacy statements and pricing, when published.
2. Official regulatory sources: the European Commission, EUR-Lex and national standards bodies such as NIST.
3. Reputable research: published studies with a stated method and sample, such as IBM's Cost of a Data Breach report.

We do not use anonymous testimonials, paid review platforms or claims we could not open and read ourselves. When a vendor does not publish something, such as pricing, we say "not published" rather than guess. Analyst recognitions are reported as the vendor's own claims unless we have read the report.

The template

The AI policy template reflects the EU AI Act as amended in 2026, the European Commission's guidance on AI literacy and common practice in company policies. It is a starting point, not legal advice for any particular company, and each company should check it against its own contracts, policies and local law.

Keeping it current

We re-check every tool and every regulatory statement at least once a quarter. Each page shows its last update and a log of material changes, and sources show the date we accessed them.

Further reading

• Guide · Acceptable useAI acceptable use and approvals: what AI may do aloneThe hardest clause in an AI policy is the one about actions. A department-by-department table of what AI may do alone, what needs a person's approval and what it must never do.
• Guide · RegulationEU AI Act Article 4: what AI literacy requires of companiesArticle 4 is the AI Act duty that reaches almost every company using AI. It asks for measures, not certificates, and it has been enforceable by national authorities since August 2026.
• Guide · The templateHow to adapt an AI policy template to your companyA template saves the drafting, not the decisions. These are the decisions behind each clause, and the variations that matter for small firms, regulated firms and companies in the EU.