Seminal AI
§6

AI safety, guardrails and governance

This category covers the runtime controls that sit between users, LLMs and tools — classifiers that score prompts and completions for harm, prompt-injection and jailbreak detectors, PII redaction, groundedness/hallucination checks and topic restriction — plus the governance frameworks that auditors and regulators actually ask about. The market has split into three tiers: free or near-free classifier models you host yourself (Llama Guard, Granite Guardian, ShieldGemma), metered cloud moderation APIs bundled with the hyperscaler you already use (Bedrock Guardrails, Azure AI Content Safety, Model Armor, OpenAI's free moderation endpoint), and enterprise AI-security platforms that combine runtime guardrails with red teaming and model-supply-chain scanning.

Data checked 2026-09-06

That third tier consolidated hard in 2025-26: Protect AI is now Palo Alto Networks Prisma AIRS, Lakera is part of Check Point, Robust Intelligence is Cisco AI Defense, and Protect AI's popular LLM Guard OSS project was archived in July 2026. On the governance side the EU AI Act is now the forcing function, though the AI Omnibus that entered into force on 27 July 2026 pushed most high-risk obligations to December 2027 and August 2028. NIST AI RMF, ISO/IEC 42001 and SOC 2 are the three artifacts enterprise buyers request, and they answer different questions.

A How to choose

Four axes actually separate these options: (1) where the guard runs — in your process, in your VPC, or in a vendor's cloud; (2) what it catches — content harm is largely solved and commoditised, while prompt injection, indirect injection via retrieved content, and agent/tool-call abuse are not; (3) added latency and its cost per call; and (4) whether you need an artifact for an auditor rather than a control for a user. Start by being honest about which problem you have. If you need content moderation for a consumer chat product and you are already an OpenAI customer, the free moderation endpoint is the correct answer and anything else is overspend — it costs nothing and covers 13 categories including images.

If you are on Bedrock, Azure OpenAI or Vertex, use the platform guardrail (Bedrock Guardrails, Azure AI Content Safety, Model Armor) rather than a third party: the integration is one config flag, billing is already set up, and at roughly $0.10-$0.15 per 1,000 text units the marginal cost is small relative to inference. Go self-hosted — Llama Guard 4, Granite Guardian 3.3, ShieldGemma 2 — when data residency forbids sending prompts to a third party, when per-call moderation cost at your volume exceeds a GPU's amortised cost, or when you need to fine-tune the taxonomy; the tradeoff is that you now own a second model's GPU footprint, its added 100-400ms, and its evaluation. Reach for a commercial AI-security platform (Prisma AIRS, Check Point/Lakera, Cisco AI Defense, HiddenLayer) only when the buyer is a CISO rather than an engineering lead — their real differentiator is red teaming, model-file scanning, shadow-AI discovery and SIEM integration, not classifier accuracy, and you will pay enterprise contract prices with no public list.

Two warnings. First, do not treat orchestration frameworks (NeMo Guardrails, Guardrails AI) as detectors: they are plumbing that calls detectors, and their out-of-the-box checks are weaker than a dedicated classifier — Guardrails AI in particular shut off its hosted remote inferencing on 25 August 2026, so plan to run the models yourself. Second, no guardrail on this list reliably stops a determined prompt-injection attack; treat them as risk reduction and defence in depth, and design the blast radius (tool permissions, egress rules, human approval on state-changing actions) as if the guardrail will fail.

For governance, the mapping is simple: NIST AI RMF when a US federal customer or your own risk function asks how you manage AI risk (free, voluntary, no certificate); ISO/IEC 42001 when you need a certificate an enterprise procurement team will accept internationally; SOC 2 when a US enterprise buyer asks and you are a SaaS vendor — it says nothing about model behaviour, so pair it with 42001 or a model card rather than presenting it as AI assurance. EU AI Act obligations are not optional if you place systems on the EU market, but the Omnibus delay means most teams have until December 2027 for Annex III high-risk work; GPAI obligations already applied from 2 August 2025.

B At a glance

Name ScopeDeploymentLatency costSelf-hostCoverage Pricing
Llama Guard 4 Content harm classification (14 MLCommons categories) for text and images, prompt or responseSelf-hosted weights (vLLM, TGI, Transformers); also offered via Bedrock, Together, Groq and other hostsA second 12B forward pass per guarded turn; typically 100-400ms on an H100 depending on batch and prompt lengthYes — this is the primary deployment modeInput and output; text and multi-image; English plus multilingual text Weights free under the Llama 4 Community License; you pay only inference compute. Commercial use by an entity with over 700 million monthly active users requires explicit Meta approval.
NVIDIA NeMo Guardrails Rail orchestration: input, output, dialog/topical, retrieval and execution rails; delegates detection to pluginsPython library or self-hosted guardrails server (Docker); optional NIM microservices for the detector modelsAdditive per rail — a self-check rail costs one extra LLM call; unpublished by the projectYes — fully self-hosted by defaultPrompt, RAG chunks, tool calls and output; text-first, no native image moderation The toolkit is free (Apache 2.0). NemoGuard NIM microservices are free to use via build.nvidia.com for evaluation; production self-hosted NIM containers require an NVIDIA AI Enterprise licence, list price $4,500 per GPU per year (or ~$1 per GPU-hour on cloud marketplaces).
Guardrails AI Composable validators: PII, toxicity, topic bans, competitor mentions, hallucination/provenance, JSON schema conformancePython library, or self-hosted Guardrails Server exposing an OpenAI-compatible endpointPer-validator; regex/heuristic validators are sub-millisecond, ML validators cost a model call eachYes — and now required, since hosted inferencing ended 25 Aug 2026Input and output guards; text only OSS framework free under Apache 2.0. Hosted remote inferencing for validators was discontinued 25 August 2026. Snowglobe and any commercial plan pricing are not published — sales contact only. Treat commercial pricing as unknown.
Lakera Guard (Check Point) Prompt injection, jailbreak, data leakage/PII, content moderation; plus red teaming and shadow-AI discoverySaaS REST API (drop-in call before/after the model); enterprise deployment options via Check PointVendor targets tens of milliseconds per call; no independently verified figure publishedNo — hosted API is the standard modelInput and output; text; agent runtime and workforce AI usage unknown — no public list pricing; a free trial and self-serve tier exist on platform.lakera.ai, but plan prices are not published and enterprise deals go through Check Point sales.
OpenAI Moderation API Content harm: 13 categories with per-category scores; text and imagesSaaS REST endpoint (/v1/moderations), omni-moderation-latestOne extra HTTP round-trip; typically tens to low hundreds of msNoInput and output text, plus images up to 20MB; no injection, PII or groundedness checks $0 — OpenAI states "The moderation endpoint is free to use." You still need an API account; rate limits apply to your organisation tier.
Azure AI Content Safety Harm categories with severity, Prompt Shields (direct + document injection), groundedness, protected material, custom categories, task adherenceAzure SaaS API and Content Safety Studio; disconnected container commitment tiers available for on-premOne API call per check; F0 capped at 5 RPS, S0 at 1000 requests/10s (groundedness 50 RPS)Partial — disconnected containers exist under annual commitment contractsInput and output; text, image and preview multimodal; agent tool-call adherence F0 free tier: 5,000 text records and 5,000 images per month, at 5 RPS, including Prompt Shields, protected material and groundedness. S0 standard tier is metered per 1,000 text records (a record is up to 1,000 Unicode code points) and per 1,000 images, but Microsoft's public pricing page renders the amounts as "$-" and directs you to the Azure pricing calculator — treat the S0 unit price as unknown until you check the calculator for your region.
Palo Alto Networks Prisma AIRS (formerly Protect AI) Model file scanning, AI posture management, red teaming, runtime prompt/response security, agent identity, AI gatewaySaaS platform with network/API interception; integrates with Palo Alto NGFW and Prisma estateunknown — not published; runtime interception is in-line with model trafficNo — SaaS control planeFull lifecycle: build-time model artifacts through runtime prompts, responses and agent actions unknown — no public list pricing. Sold through Palo Alto Networks enterprise sales, typically on a credit/consumption model within a broader Prisma agreement.
Amazon Bedrock Guardrails Content filters, denied topics, word/profanity filters, PII + regex redaction, contextual grounding, automated reasoning checksAttached to Bedrock Invoke/Converse, or standalone via the ApplyGuardrail APIResponse includes guardrailProcessingLatency per invocation; additive per enabled policyNoInput and output, model-agnostic via ApplyGuardrail; text-centric Content filters $0.15 per 1,000 text units; denied topics $0.15 per 1,000 text units; sensitive information filters (PII) $0.10 per 1,000 text units; contextual grounding checks $0.10 per 1,000 text units; Automated Reasoning checks $0.17 per 1,000 text units per policy. Word filters and regex-based sensitive information filters are free.
Google Cloud Model Armor Responsible-AI content safety incl. mandatory CSAM, prompt injection/jailbreak, sensitive data (DLP), malicious URLs, document screeningREST API; org-wide floor settings; inline integrations with Vertex AI, Agent Gateway, Apigee, Gemini Enterpriseunknown — not published; one screening call per prompt and per responseNoInput and output, model-agnostic; text plus PDF/Office document screening unknown — Google states pricing is based on tokens consumed and that Model Armor is available standalone or within Security Command Center, but the per-million-token rate was not retrievable from the public pricing page at time of writing. Verify in the Google Cloud pricing calculator before budgeting.
Cisco AI Defense Algorithmic red teaming, runtime guardrails, AI asset discovery, third-party AI app access governance, supply chain riskNetwork-embedded enforcement plus SaaS control plane; integrates with Cisco Secure Accessunknown — not published; enforcement is in-line with network trafficNoModel validation pre-deployment and prompt/response enforcement at runtime, across owned and third-party AI apps unknown — no published list pricing; sold through Cisco enterprise sales, usually bundled with Cisco Secure Access or the broader security portfolio. An "Explorer Edition" entry tier exists but its price is not published.
HiddenLayer AISec Platform AI asset discovery, model file/supply-chain scanning, runtime attack detection, automated red teamingSaaS platform, agentless; integrates with cloud, CI/CD, MLOps and SIEM/SOARunknown — vendor claims runtime detection without performance impact; no published figuresunknown — not stated publiclyBuild-time model artifacts and runtime behaviour; security-focused rather than content-policy focused unknown — no pricing published; demo request and enterprise sales only.
IBM Granite Guardian 3.3 Harm (bias, jailbreak, violence, profanity, sexual, unethical), RAG groundedness and answer relevance, function-calling hallucinationSelf-hosted weights (Hugging Face, vLLM, Ollama); also available via IBM watsonx.aiOne 8B forward pass per check in scoring mode; materially higher with <think> reasoning enabledYes — Apache 2.0 with no usage gateInput, output, retrieved context and tool calls; text only Free — Apache 2.0 weights on Hugging Face; you pay only inference compute. Also consumable as a paid service through IBM watsonx.ai (watsonx pricing is separate and metered).
ShieldGemma 2 Image safety only: sexually explicit, dangerous content, violence/goreSelf-hosted weights (Hugging Face, Kaggle); Vertex AI Model GardenOne 4B vision forward pass per image; cheap relative to 7B+ vision guardsYesImages only, input or generated output; no text, no injection detection Free weights under the Gemma Terms of Use; you pay only inference compute. Also available through Vertex AI Model Garden at standard Vertex compute rates.
Microsoft Presidio PII detection, anonymisation and de-anonymisation; text, images and DICOMPython library, or self-hosted Docker services (analyzer, anonymizer, image-redactor)Milliseconds for regex/rule recognisers; tens to hundreds of ms when using transformer NERYes — self-hosting is the only modeInput and output text, plus image and medical-image redaction; no harm or injection detection Free — MIT licence, runs entirely on your own compute. No hosted service and no usage fees.
LLM Guard 15 input + 20 output scanners: injection, toxicity, secrets, PII, code, bias, factual consistency, malicious URLsPython library or self-hosted API container — archived, read-only repositoryHigh when chaining transformer scanners; each ML scanner is a separate model inferenceYes — self-hosted onlyInput and output text; frozen at the July 2026 archive state Free (MIT), but unmaintained. The commercial successor capability now lives in Palo Alto Networks Prisma AIRS, which has no public pricing.
EU AI Act (Regulation 2024/1689) Risk-tiered obligations for prohibited, high-risk, limited-risk and minimal-risk AI systems, plus GPAI model dutiesLegal obligation on providers, deployers, importers and distributors placing systems on the EU marketNot applicable — compliance cost is documentation, conformity assessment and post-market monitoringNot applicableProhibitions Feb 2025; GPAI Aug 2025; general application Aug 2026; transparency + NCII/CSAM Dec 2026; Annex III high-risk Dec 2027; Annex I Aug 2028 The regulation text is free to read. Compliance cost is the real number: conformity assessment, technical documentation, post-market monitoring and, for high-risk systems, notified-body involvement. Penalties reach EUR 35 million or 7% of global annual turnover for prohibited practices.
NIST AI Risk Management Framework Voluntary organisational risk management across the AI lifecycle: Govern, Map, Measure, Manage; plus a Generative AI ProfileDocumentation and process framework adopted internally; supported by the free Playbook and crosswalksNot applicable — cost is staff time on governance and documentationNot applicableWhole AI lifecycle and organisational governance; no technical controls, no certificate $0 — all NIST AI RMF materials, the Playbook, the Generative AI Profile and the crosswalks are free public documents.
ISO/IEC 42001 AI management system requirements plus Annex A controls: AI policy, impact assessment, data for AI, lifecycle, third partiesOrganisational management system, audited by an accredited certification body (Stage 1 + Stage 2, annual surveillance)Not applicable — cost is audit fees plus 6-12 months of implementation effortNot applicableGovernance and process across the AI lifecycle; certifies the system, not model behaviour unknown — ISO charges for the standard document (typically low hundreds of Swiss francs; the ISO store page was not retrievable at time of writing). The larger cost is certification: gap assessment, implementation and a two-stage accredited audit with annual surveillance, commonly quoted in the tens of thousands of USD for a mid-sized organisation.
SOC 2 for AI vendors Trust Services Criteria: Security (mandatory), Availability, Processing Integrity, Confidentiality, Privacy — no AI-specific criteriaIndependent CPA firm examination; Type 1 (point in time) or Type 2 (3-12 month observation period)Not applicable — cost is audit fees plus an observation window before a Type 2 can be issuedNot applicableOrganisational and system controls over customer data; must be paired with ISO 42001 or model documentation to cover AI-specific risk unknown as a list price — SOC 2 is an audit engagement, not a product. Market rates commonly run roughly $10,000-$50,000 per audit depending on scope and auditor, plus compliance-automation tooling (Vanta, Drata and similar) at several thousand to low tens of thousands per year. Confirm with your chosen CPA firm.

C Entries

Llama Guard 4

A 12-billion-parameter dense classifier, distilled from Llama 4 Scout, that takes a prompt or a model response and returns safe/unsafe plus the violated category codes (S1-S14 from the MLCommons taxonomy, plus Code Interpreter Abuse for tool contexts). Llama Guard 4 merges what used to be two models — Llama Guard 3-8B for multilingual text and 3-11B-vision for images — into one checkpoint that also handles multiple images in a single prompt, which the vision predecessor could not. It is usually paired with Llama Prompt Guard 2 (a much smaller BERT-class model for jailbreak and injection detection) because Llama Guard itself is a content classifier, not an injection detector. Weights are free to download; you pay only for the GPU you run it on.

ScopeContent harm classification (14 MLCommons categories) for text and images, prompt or response
DeploymentSelf-hosted weights (vLLM, TGI, Transformers); also offered via Bedrock, Together, Groq and other hosts
Latency costA second 12B forward pass per guarded turn; typically 100-400ms on an H100 depending on batch and prompt length
Self-hostYes — this is the primary deployment mode
CoverageInput and output; text and multi-image; English plus multilingual text

Watch out: It is a content-harm classifier and performs poorly as a prompt-injection defence — you need Prompt Guard 2 or another detector alongside it. The Llama Community License is not OSI-approved and carries an acceptable-use policy and a 700M-MAU commercial gate, which some legal teams reject outright. At 12B it is expensive to serve compared with 2B-8B alternatives, adding meaningful GPU cost and latency for every request when run in-line, and the fixed MLCommons taxonomy is awkward to extend to bespoke policies without fine-tuning.

Weights free under the Llama 4 Community License; you pay only inference compute. Commercial use by an entity with over 700 million monthly active users requires explicit Meta approval. · open source

NVIDIA NeMo Guardrails

An orchestration layer, not a detector. You declare rails in Colang (a Python-like dialogue modelling language) and YAML, and NeMo Guardrails runs them at five points: on user input, on retrieved RAG chunks, on dialog flow, around tool/action calls, and on model output. Each rail delegates to something else — a self-check LLM prompt, AlignScore for groundedness, Presidio for PII, ActiveFence or Cleanlab, or NVIDIA's own NemoGuard NIM models (the Llama-3.1-NemoGuard-8B content-safety model, plus topic-control and jailbreak-detect variants). The value is the composition and the dialog rails, which let you constrain a conversation to approved flows rather than only filtering text. Current release line is 0.24.x, Apache 2.0.

ScopeRail orchestration: input, output, dialog/topical, retrieval and execution rails; delegates detection to plugins
DeploymentPython library or self-hosted guardrails server (Docker); optional NIM microservices for the detector models
Latency costAdditive per rail — a self-check rail costs one extra LLM call; unpublished by the project
Self-hostYes — fully self-hosted by default
CoveragePrompt, RAG chunks, tool calls and output; text-first, no native image moderation

Watch out: Colang is a bespoke DSL with two incompatible versions (1.0 and 2.0) and a real learning curve — most teams underestimate it. The built-in self-check rails are just LLM prompts, so accuracy is whatever your base model gives you, and a naive config can add several extra LLM round-trips per turn, sometimes doubling or tripling latency. It is still pre-1.0 with breaking changes between minor releases, the project publishes no official latency benchmarks, and the strongest detectors in the ecosystem are gated behind NVIDIA GPUs and NIM licensing. Wrong choice if you just want one classifier call in front of a stateless API.

The toolkit is free (Apache 2.0). NemoGuard NIM microservices are free to use via build.nvidia.com for evaluation; production self-hosted NIM containers require an NVIDIA AI Enterprise licence, list price $4,500 per GPU per year (or ~$1 per GPU-hour on cloud marketplaces). · open source

Guardrails AI

A validator framework: you assemble Guards from small validators (toxicity, PII, competitor mentions, regex, JSON schema conformance, hallucination checks) pulled from Guardrails Hub, and attach them as input or output guards around any LLM call. It also does structured-output enforcement with re-asking on validation failure, which is what many teams actually use it for. The company has shifted focus toward Snowglobe, a simulation product that generates synthetic conversations and evaluation datasets to test a policy before you ship it. Important operational change: the maintainers announced that validators are moving to plain PyPI packages installed with pip, and that Guardrails discontinued its hosted remote inferencing on 25 August 2026.

ScopeComposable validators: PII, toxicity, topic bans, competitor mentions, hallucination/provenance, JSON schema conformance
DeploymentPython library, or self-hosted Guardrails Server exposing an OpenAI-compatible endpoint
Latency costPer-validator; regex/heuristic validators are sub-millisecond, ML validators cost a model call each
Self-hostYes — and now required, since hosted inferencing ended 25 Aug 2026
CoverageInput and output guards; text only

Watch out: The August 2026 shutdown of hosted remote inferencing means every ML-based validator now needs you to host the model — teams that adopted it for the convenience of hosted endpoints have migration work. Validator quality is uneven because much of the Hub is community-contributed, and running several ML validators in sequence stacks latency quickly. The company's centre of gravity has moved to Snowglobe, so the OSS runtime is not obviously the strategic product, and there is no published commercial pricing. Wrong choice for non-Python stacks or when you need a vendor-supported SLA.

OSS framework free under Apache 2.0. Hosted remote inferencing for validators was discontinued 25 August 2026. Snowglobe and any commercial plan pricing are not published — sales contact only. Treat commercial pricing as unknown. · open source

Lakera Guard (Check Point)

A hosted detection API aimed squarely at prompt injection and jailbreaks rather than general content moderation — its detection models were trained substantially on attack data from Gandalf, Lakera's public prompt-injection game. You send prompt or response text and get back per-category flags; typical integration is a single HTTP call in front of the model. Lakera is now part of Check Point (the site carries Check Point's copyright and corporate footer), and the offering has broadened into four lines: Workforce AI Security for shadow-AI discovery, AI Agent Security for runtime protection, plus automated and expert-led AI red teaming. Lakera publishes a 0.01% production false-positive rate and 1M+ secured transactions per app per day.

ScopePrompt injection, jailbreak, data leakage/PII, content moderation; plus red teaming and shadow-AI discovery
DeploymentSaaS REST API (drop-in call before/after the model); enterprise deployment options via Check Point
Latency costVendor targets tens of milliseconds per call; no independently verified figure published
Self-hostNo — hosted API is the standard model
CoverageInput and output; text; agent runtime and workforce AI usage

Watch out: No published pricing at all, which makes budgeting and comparison impossible without a sales cycle. It is a hosted API, so every guarded prompt leaves your network — a hard stop for some regulated and EU-data-residency deployments, and self-hosting is not a standard option. Post-acquisition the roadmap now serves Check Point's platform strategy, which historically means tighter bundling and less standalone developer focus. Content moderation is not its strength; pair it with a harm classifier if you also need that.

unknown — no public list pricing; a free trial and self-serve tier exist on platform.lakera.ai, but plan prices are not published and enterprise deals go through Check Point sales.

OpenAI Moderation API

A single POST to /v1/moderations returns boolean flags and calibrated 0-1 scores for 13 categories: harassment, harassment/threatening, hate, hate/threatening, illicit, illicit/violent, self-harm, self-harm/intent, self-harm/instructions, sexual, sexual/minors, violence and violence/graphic. The current model is omni-moderation-latest, which accepts images up to 20MB as well as text — six categories (self-harm variants, sexual, violence, violence/graphic) score on image input, while text-only categories return 0 for image-only requests. The endpoint is free to use, which makes it the cheapest credible moderation baseline available and the default recommendation for anyone already calling OpenAI.

ScopeContent harm: 13 categories with per-category scores; text and images
DeploymentSaaS REST endpoint (/v1/moderations), omni-moderation-latest
Latency costOne extra HTTP round-trip; typically tens to low hundreds of ms
Self-hostNo
CoverageInput and output text, plus images up to 20MB; no injection, PII or groundedness checks

Watch out: It detects content harm only — it will not catch prompt injection, jailbreaks, PII leakage or hallucination, so it is not a security control. Every moderated string is sent to OpenAI, which is a data-residency and confidentiality problem for many enterprises and forbidden outright in some regulated settings. OpenAI explicitly warns that it upgrades the underlying model over time, so any policy hard-coded to category_scores thresholds will drift and needs periodic recalibration. Categories are fixed with no custom-category support, and there is no SLA or self-hosted option for a free endpoint.

$0 — OpenAI states "The moderation endpoint is free to use." You still need an API account; rate limits apply to your organisation tier.

Azure AI Content Safety

The broadest single moderation API among the hyperscalers. Analyze Text and Analyze Image return multi-severity scores for sexual, violence, hate and self-harm. On top of that sit Prompt Shields (jailbreak and indirect/document injection detection, up to five documents totalling 10K characters), Groundedness detection (preview, up to 55K characters of grounding source), Protected material detection for text and code, Custom Categories in standard and rapid variants, and a newer Task Adherence API that flags when an agent's tool use is misaligned or premature — a genuinely rare capability. It is the engine behind Azure OpenAI's built-in content filters, so if you use Azure OpenAI you are already paying for part of it.

ScopeHarm categories with severity, Prompt Shields (direct + document injection), groundedness, protected material, custom categories, task adherence
DeploymentAzure SaaS API and Content Safety Studio; disconnected container commitment tiers available for on-prem
Latency costOne API call per check; F0 capped at 5 RPS, S0 at 1000 requests/10s (groundedness 50 RPS)
Self-hostPartial — disconnected containers exist under annual commitment contracts
CoverageInput and output; text, image and preview multimodal; agent tool-call adherence

Watch out: Feature availability is fragmented by region — groundedness detection runs in only about six regions and custom categories (standard) in three, so your Azure region may simply not support what you need. Several of the most interesting features (groundedness, custom categories, task adherence) are still preview, and Microsoft's stated policy deprecates a preview API version 90 days after its successor ships, which forces ongoing version churn. Protected material, groundedness and custom categories are English-only. Input caps bite in practice: 10K characters for text analysis, 1K for multimodal and custom categories. It cannot be used to detect child sexual exploitation imagery. Public list pricing for the standard tier is effectively hidden.

F0 free tier: 5,000 text records and 5,000 images per month, at 5 RPS, including Prompt Shields, protected material and groundedness. S0 standard tier is metered per 1,000 text records (a record is up to 1,000 Unicode code points) and per 1,000 images, but Microsoft's public pricing page renders the amounts as "$-" and directs you to the Azure pricing calculator — treat the S0 unit price as unknown until you check the calculator for your region.

Palo Alto Networks Prisma AIRS (formerly Protect AI)

Protect AI no longer exists as an independent vendor: protectai.com issues a 301 redirect to Palo Alto Networks' Prisma AIRS page. The platform bundles six modules — AI Gateway as the control plane for discovering and governing AI traffic, Agent Security for agent identity and runtime controls, AI Red Teaming, AI Runtime Security, AI Model Security for scanning third-party model files for malicious serialisation, and AI Posture Management for visibility over AI data and model access. The model-scanning lineage traces to Protect AI's Guardian/ModelScan work, which remains one of the few credible answers to poisoned pickle files and compromised Hugging Face artifacts.

ScopeModel file scanning, AI posture management, red teaming, runtime prompt/response security, agent identity, AI gateway
DeploymentSaaS platform with network/API interception; integrates with Palo Alto NGFW and Prisma estate
Latency costunknown — not published; runtime interception is in-line with model traffic
Self-hostNo — SaaS control plane
CoverageFull lifecycle: build-time model artifacts through runtime prompts, responses and agent actions

Watch out: Zero pricing transparency and an enterprise sales motion measured in months — unusable for a team that wants to evaluate something this quarter. The acquisition cost the community its open-source assets: LLM Guard was archived in July 2026, and the current product page makes no mention of ModelScan, NB Defense or the huntr bug bounty, so anyone who built on those is on their own. It is a security-team product, not a developer product; the runtime guardrails are a smaller part of the value than the posture and red-teaming modules, and buying it purely as a content filter is significant overspend.

unknown — no public list pricing. Sold through Palo Alto Networks enterprise sales, typically on a credit/consumption model within a broader Prisma agreement.

Amazon Bedrock Guardrails

A configurable policy object you attach to Bedrock calls, or invoke standalone via the ApplyGuardrail API. Policies stack: content filters (hate, insults, sexual, violence, misconduct, prompt attack) with configurable strength; denied topics defined in natural language; word and profanity filters; sensitive information filters that block or mask PII entities and custom regexes; contextual grounding checks that score grounding and relevance against source passages; and Automated Reasoning checks, which use formal verification against a policy model rather than a classifier. Critically, ApplyGuardrail is explicitly decoupled from foundation models — you can send any text from any model, including self-hosted or third-party ones, and get back an assessment, so it works as a general-purpose moderation API for AWS shops.

ScopeContent filters, denied topics, word/profanity filters, PII + regex redaction, contextual grounding, automated reasoning checks
DeploymentAttached to Bedrock Invoke/Converse, or standalone via the ApplyGuardrail API
Latency costResponse includes guardrailProcessingLatency per invocation; additive per enabled policy
Self-hostNo
CoverageInput and output, model-agnostic via ApplyGuardrail; text-centric

Watch out: Costs stack per policy: enabling content filters, denied topics, PII and grounding on both the prompt and the response means four to eight billable policy evaluations per turn, and at $0.10-$0.15 per 1,000 units that becomes a real line item at scale — model the bill before enabling everything. Contextual grounding requires you to pass source passages, so it only helps in RAG shapes. Denied topics are natural-language definitions evaluated by a model, so precision varies and needs iteration. There is no self-hosted option and no way to run it outside AWS, and multimodal/image coverage is thinner than Azure's.

Content filters $0.15 per 1,000 text units; denied topics $0.15 per 1,000 text units; sensitive information filters (PII) $0.10 per 1,000 text units; contextual grounding checks $0.10 per 1,000 text units; Automated Reasoning checks $0.17 per 1,000 text units per policy. Word filters and regex-based sensitive information filters are free.

Google Cloud Model Armor

Google's model-agnostic screening service for LLM prompts and responses. Filters cover responsible-AI content safety (hate, harassment, sexually explicit, dangerous content, plus CSAM which is always on and cannot be disabled), prompt injection and jailbreak detection, sensitive data protection built on Cloud DLP templates for PII and credential redaction, malicious URL detection (first 256 URLs found), and document screening for PDF, Word, Excel, PowerPoint and text files up to 4MB. Its distinguishing feature is floor settings — an organisation-level minimum policy that applies across all templates, so a platform team can guarantee a security baseline that individual project owners cannot weaken. Processing is stateless: data is discarded immediately unless Cloud Logging is enabled.

ScopeResponsible-AI content safety incl. mandatory CSAM, prompt injection/jailbreak, sensitive data (DLP), malicious URLs, document screening
DeploymentREST API; org-wide floor settings; inline integrations with Vertex AI, Agent Gateway, Apigee, Gemini Enterprise
Latency costunknown — not published; one screening call per prompt and per response
Self-hostNo
CoverageInput and output, model-agnostic; text plus PDF/Office document screening

Watch out: Pricing is genuinely hard to pin down from public pages, which is a poor sign for cost planning — confirm rates with your account team. Malicious-URL scanning stops at the first 256 URLs, and document screening caps at 4MB per file. Sensitive data protection depends on Cloud DLP templates, so you inherit DLP's configuration overhead. It is GCP-resident with no self-hosted option, and its content-safety taxonomy is narrower than Azure's severity-graded model. Being surfaced through Security Command Center means the natural buyer is a cloud security team, and app developers may find the console indirection awkward.

unknown — Google states pricing is based on tokens consumed and that Model Armor is available standalone or within Security Command Center, but the per-million-token rate was not retrievable from the public pricing page at time of writing. Verify in the Google Cloud pricing calculator before budgeting.

Cisco AI Defense

Cisco's AI security product line, assembled around the Robust Intelligence team it acquired in 2024. Five capabilities: algorithmic red teaming that probes models and applications for safety and security vulnerabilities automatically; runtime protection delivered as network-embedded guardrails rather than an SDK; AI cloud visibility that inventories models and connected data sources; AI Access for governing employee use of third-party AI apps; and AI supply chain risk management for model and file governance. The network-layer placement is the real differentiator — Cisco can see and enforce on AI traffic without applications integrating anything, and it pulls threat intelligence from Talos to cover attack classes beyond prompt injection, such as model denial-of-service and off-topic attacks. An Explorer Edition offers a lower-friction entry point for red teaming.

ScopeAlgorithmic red teaming, runtime guardrails, AI asset discovery, third-party AI app access governance, supply chain risk
DeploymentNetwork-embedded enforcement plus SaaS control plane; integrates with Cisco Secure Access
Latency costunknown — not published; enforcement is in-line with network traffic
Self-hostNo
CoverageModel validation pre-deployment and prompt/response enforcement at runtime, across owned and third-party AI apps

Watch out: No public pricing and a portfolio sales motion — this lands via your Cisco account team, not a signup page. Network-embedded enforcement is powerful for coverage but coarse for per-application policy, and it presumes traffic traverses Cisco infrastructure, which is often untrue for cloud-native workloads talking directly to model APIs. Cisco's own product page no longer references Robust Intelligence, so the OSS and research artifacts from that lineage should not be assumed to be maintained. Overkill and awkward for a single application team that just needs an output filter.

unknown — no published list pricing; sold through Cisco enterprise sales, usually bundled with Cisco Secure Access or the broader security portfolio. An "Explorer Edition" entry tier exists but its price is not published.

HiddenLayer AISec Platform

One of the few remaining independent AI-security vendors after the 2025-26 consolidation. Four modules: AI Discovery for finding AI assets including shadow deployments, AI Supply Chain Security for validating model integrity before deployment, AI Runtime Security for detecting attacks in production, and AI Attack Simulation for continuous adversarial testing. Its architectural claim is agentless and model-agnostic operation with no access to training data required, which lowers the barrier for security teams inserting controls into pipelines they do not own. Integrations target CI/CD, MLOps platforms and SIEM/SOAR, positioning it as a security-operations feed rather than an application library.

ScopeAI asset discovery, model file/supply-chain scanning, runtime attack detection, automated red teaming
DeploymentSaaS platform, agentless; integrates with cloud, CI/CD, MLOps and SIEM/SOAR
Latency costunknown — vendor claims runtime detection without performance impact; no published figures
Self-hostunknown — not stated publicly
CoverageBuild-time model artifacts and runtime behaviour; security-focused rather than content-policy focused

Watch out: No public pricing, no free tier and no self-serve trial — evaluation requires a sales conversation. As an independent vendor in a consolidating market it carries acquisition risk, which matters if you are embedding it deeply. Its runtime detection is oriented toward security telemetry and response rather than fine-grained content policy, so it is the wrong tool if what you need is a tunable harm classifier or an output filter for a consumer product. Being agentless means detection is inferential rather than in-process, which trades precision for coverage.

unknown — no pricing published; demo request and enterprise sales only.

IBM Granite Guardian 3.3

The broadest risk taxonomy of the open guard models, and the only major one under a true OSI licence. Granite Guardian 3.3 8B judges prompts and responses across harm dimensions (social bias, jailbreak, violence, profanity, sexual content, unethical behaviour), RAG-specific dimensions (groundedness and answer relevance hallucination), and agentic dimensions (function-calling hallucination) — meaning one model replaces what elsewhere requires a harm classifier plus a separate groundedness checker plus a tool-call validator. It is a hybrid thinking model: you can enable reasoning traces with <think> tags for harder judgements, or run scoring-only mode for faster inference. IBM reports 0.81 aggregate F1 on harm benchmarks, 0.761 balanced accuracy on LM-AggreFact for RAG hallucination, and 0.74 balanced accuracy on function calling.

ScopeHarm (bias, jailbreak, violence, profanity, sexual, unethical), RAG groundedness and answer relevance, function-calling hallucination
DeploymentSelf-hosted weights (Hugging Face, vLLM, Ollama); also available via IBM watsonx.ai
Latency costOne 8B forward pass per check in scoring mode; materially higher with <think> reasoning enabled
Self-hostYes — Apache 2.0 with no usage gate
CoverageInput, output, retrieved context and tool calls; text only

Watch out: IBM's published scores are respectable but not dominant — 0.74 balanced accuracy on function-calling hallucination means roughly one in four judgements is wrong, which is too weak to gate high-stakes agent actions on its own. Running an 8B model in-line on every turn costs real GPU capacity and latency, and enabling thinking mode makes that substantially worse. Ecosystem tooling and community fine-tunes are thinner than around Llama Guard, so you will find fewer worked examples. Text only — no image moderation.

Free — Apache 2.0 weights on Hugging Face; you pay only inference compute. Also consumable as a paid service through IBM watsonx.ai (watsonx pricing is separate and metered). · open source

ShieldGemma 2

An image safety classifier built on the Gemma 3 4B instruction-tuned checkpoint. Given an image, it returns yes/no judgements against three policies: sexually explicit content, dangerous content that facilitates real-world harm, and violence/gore. It is deliberately narrow — the original ShieldGemma family shipped text moderation models at 2B, 9B and 27B, and ShieldGemma 2 pivots to image-only at a much smaller scale, which makes it cheap enough to run on every generated or uploaded image. Google reports it outperforming LLaVA-Guard 7B and GPT-4o mini on image safety benchmarks. Use it alongside a text classifier, not instead of one.

ScopeImage safety only: sexually explicit, dangerous content, violence/gore
DeploymentSelf-hosted weights (Hugging Face, Kaggle); Vertex AI Model Garden
Latency costOne 4B vision forward pass per image; cheap relative to 7B+ vision guards
Self-hostYes
CoverageImages only, input or generated output; no text, no injection detection

Watch out: Three policies only — no hate symbols, no self-harm imagery, no CSAM detection (for which you must use NCMEC-affiliated tooling, not a general classifier), and no text moderation at all, so it is never a complete guardrail on its own. The Gemma licence carries prohibited-use terms and is not OSI-approved. Because the policy is expressed in the prompt, results are sensitive to how you word the policy, and Google's benchmark comparisons are internal. Serving a 4B vision model still means a GPU in your inference path.

Free weights under the Gemma Terms of Use; you pay only inference compute. Also available through Vertex AI Model Garden at standard Vertex compute rates. · open source

Microsoft Presidio

The default open-source answer for PII redaction in LLM pipelines. Presidio combines named entity recognition (spaCy, Hugging Face transformers, Stanza), regular expressions, rule-based context enrichment and checksum validation to find entities like names, locations, credit cards, national ID numbers, phone numbers and crypto wallets, then anonymises them by replacement, masking, hashing or encryption — with a matching de-anonymiser so you can restore values after the model call. A separate image-redaction module handles standard formats and DICOM medical images. It is the PII backend that NeMo Guardrails and many other frameworks call. Note the repo carries a "Presidio is moving to a new home" notice, signalling a governance change.

ScopePII detection, anonymisation and de-anonymisation; text, images and DICOM
DeploymentPython library, or self-hosted Docker services (analyzer, anonymizer, image-redactor)
Latency costMilliseconds for regex/rule recognisers; tens to hundreds of ms when using transformer NER
Self-hostYes — self-hosting is the only mode
CoverageInput and output text, plus image and medical-image redaction; no harm or injection detection

Watch out: Recall is the honest problem: NER-based detection misses unusual name forms, non-Western naming conventions and context-dependent identifiers, and out-of-the-box recognisers need substantial tuning per domain and language before they are trustworthy for compliance. Transformer-based recognisers are far more accurate than the default spaCy pipeline but add real latency and memory. It does only PII — no toxicity, no injection detection, no groundedness. And the repository's announced move to a new home means maintenance ownership is in flux, which is worth tracking before you depend on it.

Free — MIT licence, runs entirely on your own compute. No hosted service and no usage fees. · open source

LLM Guard

Listed here as a warning, not a recommendation. LLM Guard was the most widely adopted open-source scanner toolkit: 15 input scanners (Anonymize, BanCode, BanCompetitors, BanSubstrings, BanTopics, Code, Gibberish, InvisibleText, Language, PromptInjection, Regex, Secrets, Sentiment, TokenLimit, Toxicity) and 20 output scanners (adding Bias, Deanonymize, JSON, MaliciousURLs, NoRefusal, FactualConsistency, Relevance, URLReachability and others), all MIT-licensed and self-hosted. Following Palo Alto Networks' acquisition of Protect AI, the repository was archived on 9 July 2026 with an explicit notice that the project and its associated Hugging Face models are no longer under active development or maintained. The code still runs; nobody is patching it.

Scope15 input + 20 output scanners: injection, toxicity, secrets, PII, code, bias, factual consistency, malicious URLs
DeploymentPython library or self-hosted API container — archived, read-only repository
Latency costHigh when chaining transformer scanners; each ML scanner is a separate model inference
Self-hostYes — self-hosted only
CoverageInput and output text; frozen at the July 2026 archive state

Watch out: Archived and explicitly unmaintained as of 9 July 2026 — no security patches, no dependency updates, and the companion Hugging Face models are frozen too. Do not start a new production deployment on it. Anyone currently running it should plan a migration to a maintained alternative: Presidio for the anonymisation scanners, a guard model such as Llama Guard 4 or Granite Guardian for toxicity and topic bans, and a dedicated injection detector for PromptInjection. Its transformer scanners were also slow when chained, which was a known complaint even while it was maintained.

Free (MIT), but unmaintained. The commercial successor capability now lives in Palo Alto Networks Prisma AIRS, which has no public pricing. · open source · discontinued

EU AI Act (Regulation 2024/1689)

The first binding horizontal AI regulation, applying to anyone placing AI systems on the EU market regardless of where they are established. Obligations phase in: prohibited practices and AI literacy applied from 2 February 2025; GPAI model obligations, governance rules and penalties from 2 August 2025 (GPAI models already on the market before that date have until 2 August 2027 to comply); the remainder of the Act from 2 August 2026; and transparency duties for synthetic audio, image, video and text under Article 50(2), plus the prohibitions on non-consensual intimate imagery and CSAM generation, from 2 December 2026. The AI Omnibus — adopted 19 November 2025, politically agreed 7 May 2026, in force 27 July 2026 — pushed Annex III high-risk systems (biometrics, critical infrastructure, education, employment, migration, asylum, border control) to 2 December 2027 and Annex I product-embedded systems to 2 August 2028, on the reasoning that harmonised standards were not ready.

ScopeRisk-tiered obligations for prohibited, high-risk, limited-risk and minimal-risk AI systems, plus GPAI model duties
DeploymentLegal obligation on providers, deployers, importers and distributors placing systems on the EU market
Latency costNot applicable — compliance cost is documentation, conformity assessment and post-market monitoring
Self-hostNot applicable
CoverageProhibitions Feb 2025; GPAI Aug 2025; general application Aug 2026; transparency + NCII/CSAM Dec 2026; Annex III high-risk Dec 2027; Annex I Aug 2028

Watch out: The timeline has already moved once, and the Omnibus signalled that political appetite for delay exists — planning against a date that may shift again is genuinely hard. Harmonised standards are still incomplete, so 'how to comply' for high-risk systems remains partly undefined, and the Article 6(5) classification guidelines were themselves due only in February 2026. Classification is the hardest practical problem: deciding whether your system is high-risk, limited-risk or out of scope often needs legal advice, and getting it wrong is expensive in both directions. It is a legal obligation, not a control — no tool on this list makes you compliant.

The regulation text is free to read. Compliance cost is the real number: conformity assessment, technical documentation, post-market monitoring and, for high-risk systems, notified-body involvement. Penalties reach EUR 35 million or 7% of global annual turnover for prohibited practices.

NIST AI Risk Management Framework

Published 26 January 2023, the AI RMF 1.0 is a voluntary, sector-agnostic framework for managing risks from AI to individuals, organisations and society, structured around four core functions: Govern, Map, Measure and Manage. It ships with an implementation Playbook, crosswalks to other frameworks including ISO/IEC 42001, and the Generative AI Profile (NIST-AI-600-1, released 26 July 2024) which enumerates risks specific to generative systems — confabulation, dangerous content, data privacy, information integrity, harmful bias — and suggested actions for each. NIST released a concept note on 7 April 2026 for a Trustworthy AI in Critical Infrastructure profile, and AI RMF 1.0 is itself under revision as part of the White House AI Action Plan.

ScopeVoluntary organisational risk management across the AI lifecycle: Govern, Map, Measure, Manage; plus a Generative AI Profile
DeploymentDocumentation and process framework adopted internally; supported by the free Playbook and crosswalks
Latency costNot applicable — cost is staff time on governance and documentation
Self-hostNot applicable
CoverageWhole AI lifecycle and organisational governance; no technical controls, no certificate

Watch out: There is no certification and no auditor — you cannot hand a customer a NIST AI RMF certificate, which is exactly what enterprise procurement often wants, so it does not substitute for ISO/IEC 42001. It is descriptive rather than prescriptive: it tells you what to consider, not what control to implement, so two organisations can both claim alignment with wildly different rigour. The Generative AI Profile predates most agentic patterns. And AI RMF 1.0 is currently being revised under the AI Action Plan, so work anchored tightly to the 2023 structure may need rework.

$0 — all NIST AI RMF materials, the Playbook, the Generative AI Profile and the crosswalks are free public documents.

ISO/IEC 42001

Published in December 2023, ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). Structurally it is the familiar Annex SL management-system shape shared with ISO 27001 and ISO 9001 — context, leadership, planning, support, operation, performance evaluation, improvement — with AI-specific Annex A controls covering AI policy, roles, impact assessment, data management for AI, system lifecycle, and third-party and customer relationships. Its practical significance is that it is certifiable by accredited bodies, so unlike NIST AI RMF it produces an artifact that enterprise procurement and EU AI Act conformity work can both point at. Several large AI providers certified during 2024-25, which made it the de facto ask in enterprise AI vendor questionnaires.

ScopeAI management system requirements plus Annex A controls: AI policy, impact assessment, data for AI, lifecycle, third parties
DeploymentOrganisational management system, audited by an accredited certification body (Stage 1 + Stage 2, annual surveillance)
Latency costNot applicable — cost is audit fees plus 6-12 months of implementation effort
Self-hostNot applicable
CoverageGovernance and process across the AI lifecycle; certifies the system, not model behaviour

Watch out: Certification costs real money and 6-12 months of effort, and it certifies your management system, not your model — an ISO 42001 certificate says nothing about whether your model is accurate, unbiased or safe, which buyers routinely misread. The standard text is paywalled per user, which is friction for distributing requirements internally. Annex A controls are stated at a high level and require substantial interpretation. It is not a shortcut to EU AI Act compliance: it helps demonstrate governance, but harmonised standards under the Act are separate and still being finalised. If you have no ISO 27001 foundation, expect the effort to roughly double.

unknown — ISO charges for the standard document (typically low hundreds of Swiss francs; the ISO store page was not retrievable at time of writing). The larger cost is certification: gap assessment, implementation and a two-stage accredited audit with annual surveillance, commonly quoted in the tens of thousands of USD for a mid-sized organisation.

SOC 2 for AI vendors

A SOC 2 report is an independent CPA examination of a service organisation's controls against the AICPA Trust Services Criteria — the 2017 TSC with revised points of focus issued in 2022 — across five categories: Security (always in scope), Availability, Processing Integrity, Confidentiality and Privacy. Type 1 attests to control design at a point in time; Type 2 tests operating effectiveness over a period, usually 3-12 months, and is what enterprise buyers actually mean when they ask. For AI vendors the report's practical role is to answer the data-handling questions: how customer prompts are segregated, retained, encrypted and kept out of training. The TSC contain no AI-specific criteria, so AI-relevant controls have to be described in the system description and mapped into Security, Confidentiality and Processing Integrity.

ScopeTrust Services Criteria: Security (mandatory), Availability, Processing Integrity, Confidentiality, Privacy — no AI-specific criteria
DeploymentIndependent CPA firm examination; Type 1 (point in time) or Type 2 (3-12 month observation period)
Latency costNot applicable — cost is audit fees plus an observation window before a Type 2 can be issued
Self-hostNot applicable
CoverageOrganisational and system controls over customer data; must be paired with ISO 42001 or model documentation to cover AI-specific risk

Watch out: The Trust Services Criteria contain no AI-specific criteria, so a SOC 2 report tells a buyer nothing about model behaviour, evaluation rigour, bias, or guardrail effectiveness — presenting it as AI assurance is misleading and sophisticated buyers will call it out. Scope is defined by the vendor, so two reports are not comparable without reading the system description and, crucially, the exceptions and the complementary user entity controls. Type 2 requires an observation window, so a startup cannot produce one on demand. It is US-centric; European and Asian buyers increasingly ask for ISO 27001 and ISO/IEC 42001 instead. Budget for annual recurrence, not a one-off.

unknown as a list price — SOC 2 is an audit engagement, not a product. Market rates commonly run roughly $10,000-$50,000 per audit depending on scope and auditor, plus compliance-automation tooling (Vanta, Drata and similar) at several thousand to low tens of thousands per year. Confirm with your chosen CPA firm.