A 12-billion-parameter dense classifier, distilled from Llama 4 Scout, that takes a prompt or a model response and returns safe/unsafe plus the violated category codes (S1-S14 from the MLCommons taxonomy, plus Code Interpreter Abuse for tool contexts). Llama Guard 4 merges what used to be two models — Llama Guard 3-8B for multilingual text and 3-11B-vision for images — into one checkpoint that also handles multiple images in a single prompt, which the vision predecessor could not. It is usually paired with Llama Prompt Guard 2 (a much smaller BERT-class model for jailbreak and injection detection) because Llama Guard itself is a content classifier, not an injection detector. Weights are free to download; you pay only for the GPU you run it on.
| Scope | Content harm classification (14 MLCommons categories) for text and images, prompt or response |
|---|
| Deployment | Self-hosted weights (vLLM, TGI, Transformers); also offered via Bedrock, Together, Groq and other hosts |
|---|
| Latency cost | A second 12B forward pass per guarded turn; typically 100-400ms on an H100 depending on batch and prompt length |
|---|
| Self-host | Yes — this is the primary deployment mode |
|---|
| Coverage | Input and output; text and multi-image; English plus multilingual text |
|---|
Watch out: It is a content-harm classifier and performs poorly as a prompt-injection defence — you need Prompt Guard 2 or another detector alongside it. The Llama Community License is not OSI-approved and carries an acceptable-use policy and a 700M-MAU commercial gate, which some legal teams reject outright. At 12B it is expensive to serve compared with 2B-8B alternatives, adding meaningful GPU cost and latency for every request when run in-line, and the fixed MLCommons taxonomy is awkward to extend to bespoke policies without fine-tuning.
Weights free under the Llama 4 Community License; you pay only inference compute. Commercial use by an entity with over 700 million monthly active users requires explicit Meta approval.
· open source
An orchestration layer, not a detector. You declare rails in Colang (a Python-like dialogue modelling language) and YAML, and NeMo Guardrails runs them at five points: on user input, on retrieved RAG chunks, on dialog flow, around tool/action calls, and on model output. Each rail delegates to something else — a self-check LLM prompt, AlignScore for groundedness, Presidio for PII, ActiveFence or Cleanlab, or NVIDIA's own NemoGuard NIM models (the Llama-3.1-NemoGuard-8B content-safety model, plus topic-control and jailbreak-detect variants). The value is the composition and the dialog rails, which let you constrain a conversation to approved flows rather than only filtering text. Current release line is 0.24.x, Apache 2.0.
| Scope | Rail orchestration: input, output, dialog/topical, retrieval and execution rails; delegates detection to plugins |
|---|
| Deployment | Python library or self-hosted guardrails server (Docker); optional NIM microservices for the detector models |
|---|
| Latency cost | Additive per rail — a self-check rail costs one extra LLM call; unpublished by the project |
|---|
| Self-host | Yes — fully self-hosted by default |
|---|
| Coverage | Prompt, RAG chunks, tool calls and output; text-first, no native image moderation |
|---|
Watch out: Colang is a bespoke DSL with two incompatible versions (1.0 and 2.0) and a real learning curve — most teams underestimate it. The built-in self-check rails are just LLM prompts, so accuracy is whatever your base model gives you, and a naive config can add several extra LLM round-trips per turn, sometimes doubling or tripling latency. It is still pre-1.0 with breaking changes between minor releases, the project publishes no official latency benchmarks, and the strongest detectors in the ecosystem are gated behind NVIDIA GPUs and NIM licensing. Wrong choice if you just want one classifier call in front of a stateless API.
The toolkit is free (Apache 2.0). NemoGuard NIM microservices are free to use via build.nvidia.com for evaluation; production self-hosted NIM containers require an NVIDIA AI Enterprise licence, list price $4,500 per GPU per year (or ~$1 per GPU-hour on cloud marketplaces).
· open source
A validator framework: you assemble Guards from small validators (toxicity, PII, competitor mentions, regex, JSON schema conformance, hallucination checks) pulled from Guardrails Hub, and attach them as input or output guards around any LLM call. It also does structured-output enforcement with re-asking on validation failure, which is what many teams actually use it for. The company has shifted focus toward Snowglobe, a simulation product that generates synthetic conversations and evaluation datasets to test a policy before you ship it. Important operational change: the maintainers announced that validators are moving to plain PyPI packages installed with pip, and that Guardrails discontinued its hosted remote inferencing on 25 August 2026.
| Scope | Composable validators: PII, toxicity, topic bans, competitor mentions, hallucination/provenance, JSON schema conformance |
|---|
| Deployment | Python library, or self-hosted Guardrails Server exposing an OpenAI-compatible endpoint |
|---|
| Latency cost | Per-validator; regex/heuristic validators are sub-millisecond, ML validators cost a model call each |
|---|
| Self-host | Yes — and now required, since hosted inferencing ended 25 Aug 2026 |
|---|
| Coverage | Input and output guards; text only |
|---|
Watch out: The August 2026 shutdown of hosted remote inferencing means every ML-based validator now needs you to host the model — teams that adopted it for the convenience of hosted endpoints have migration work. Validator quality is uneven because much of the Hub is community-contributed, and running several ML validators in sequence stacks latency quickly. The company's centre of gravity has moved to Snowglobe, so the OSS runtime is not obviously the strategic product, and there is no published commercial pricing. Wrong choice for non-Python stacks or when you need a vendor-supported SLA.
OSS framework free under Apache 2.0. Hosted remote inferencing for validators was discontinued 25 August 2026. Snowglobe and any commercial plan pricing are not published — sales contact only. Treat commercial pricing as unknown.
· open source
A hosted detection API aimed squarely at prompt injection and jailbreaks rather than general content moderation — its detection models were trained substantially on attack data from Gandalf, Lakera's public prompt-injection game. You send prompt or response text and get back per-category flags; typical integration is a single HTTP call in front of the model. Lakera is now part of Check Point (the site carries Check Point's copyright and corporate footer), and the offering has broadened into four lines: Workforce AI Security for shadow-AI discovery, AI Agent Security for runtime protection, plus automated and expert-led AI red teaming. Lakera publishes a 0.01% production false-positive rate and 1M+ secured transactions per app per day.
| Scope | Prompt injection, jailbreak, data leakage/PII, content moderation; plus red teaming and shadow-AI discovery |
|---|
| Deployment | SaaS REST API (drop-in call before/after the model); enterprise deployment options via Check Point |
|---|
| Latency cost | Vendor targets tens of milliseconds per call; no independently verified figure published |
|---|
| Self-host | No — hosted API is the standard model |
|---|
| Coverage | Input and output; text; agent runtime and workforce AI usage |
|---|
Watch out: No published pricing at all, which makes budgeting and comparison impossible without a sales cycle. It is a hosted API, so every guarded prompt leaves your network — a hard stop for some regulated and EU-data-residency deployments, and self-hosting is not a standard option. Post-acquisition the roadmap now serves Check Point's platform strategy, which historically means tighter bundling and less standalone developer focus. Content moderation is not its strength; pair it with a harm classifier if you also need that.
unknown — no public list pricing; a free trial and self-serve tier exist on platform.lakera.ai, but plan prices are not published and enterprise deals go through Check Point sales.
A single POST to /v1/moderations returns boolean flags and calibrated 0-1 scores for 13 categories: harassment, harassment/threatening, hate, hate/threatening, illicit, illicit/violent, self-harm, self-harm/intent, self-harm/instructions, sexual, sexual/minors, violence and violence/graphic. The current model is omni-moderation-latest, which accepts images up to 20MB as well as text — six categories (self-harm variants, sexual, violence, violence/graphic) score on image input, while text-only categories return 0 for image-only requests. The endpoint is free to use, which makes it the cheapest credible moderation baseline available and the default recommendation for anyone already calling OpenAI.
| Scope | Content harm: 13 categories with per-category scores; text and images |
|---|
| Deployment | SaaS REST endpoint (/v1/moderations), omni-moderation-latest |
|---|
| Latency cost | One extra HTTP round-trip; typically tens to low hundreds of ms |
|---|
| Self-host | No |
|---|
| Coverage | Input and output text, plus images up to 20MB; no injection, PII or groundedness checks |
|---|
Watch out: It detects content harm only — it will not catch prompt injection, jailbreaks, PII leakage or hallucination, so it is not a security control. Every moderated string is sent to OpenAI, which is a data-residency and confidentiality problem for many enterprises and forbidden outright in some regulated settings. OpenAI explicitly warns that it upgrades the underlying model over time, so any policy hard-coded to category_scores thresholds will drift and needs periodic recalibration. Categories are fixed with no custom-category support, and there is no SLA or self-hosted option for a free endpoint.
$0 — OpenAI states "The moderation endpoint is free to use." You still need an API account; rate limits apply to your organisation tier.
The broadest single moderation API among the hyperscalers. Analyze Text and Analyze Image return multi-severity scores for sexual, violence, hate and self-harm. On top of that sit Prompt Shields (jailbreak and indirect/document injection detection, up to five documents totalling 10K characters), Groundedness detection (preview, up to 55K characters of grounding source), Protected material detection for text and code, Custom Categories in standard and rapid variants, and a newer Task Adherence API that flags when an agent's tool use is misaligned or premature — a genuinely rare capability. It is the engine behind Azure OpenAI's built-in content filters, so if you use Azure OpenAI you are already paying for part of it.
| Scope | Harm categories with severity, Prompt Shields (direct + document injection), groundedness, protected material, custom categories, task adherence |
|---|
| Deployment | Azure SaaS API and Content Safety Studio; disconnected container commitment tiers available for on-prem |
|---|
| Latency cost | One API call per check; F0 capped at 5 RPS, S0 at 1000 requests/10s (groundedness 50 RPS) |
|---|
| Self-host | Partial — disconnected containers exist under annual commitment contracts |
|---|
| Coverage | Input and output; text, image and preview multimodal; agent tool-call adherence |
|---|
Watch out: Feature availability is fragmented by region — groundedness detection runs in only about six regions and custom categories (standard) in three, so your Azure region may simply not support what you need. Several of the most interesting features (groundedness, custom categories, task adherence) are still preview, and Microsoft's stated policy deprecates a preview API version 90 days after its successor ships, which forces ongoing version churn. Protected material, groundedness and custom categories are English-only. Input caps bite in practice: 10K characters for text analysis, 1K for multimodal and custom categories. It cannot be used to detect child sexual exploitation imagery. Public list pricing for the standard tier is effectively hidden.
F0 free tier: 5,000 text records and 5,000 images per month, at 5 RPS, including Prompt Shields, protected material and groundedness. S0 standard tier is metered per 1,000 text records (a record is up to 1,000 Unicode code points) and per 1,000 images, but Microsoft's public pricing page renders the amounts as "$-" and directs you to the Azure pricing calculator — treat the S0 unit price as unknown until you check the calculator for your region.
Protect AI no longer exists as an independent vendor: protectai.com issues a 301 redirect to Palo Alto Networks' Prisma AIRS page. The platform bundles six modules — AI Gateway as the control plane for discovering and governing AI traffic, Agent Security for agent identity and runtime controls, AI Red Teaming, AI Runtime Security, AI Model Security for scanning third-party model files for malicious serialisation, and AI Posture Management for visibility over AI data and model access. The model-scanning lineage traces to Protect AI's Guardian/ModelScan work, which remains one of the few credible answers to poisoned pickle files and compromised Hugging Face artifacts.
| Scope | Model file scanning, AI posture management, red teaming, runtime prompt/response security, agent identity, AI gateway |
|---|
| Deployment | SaaS platform with network/API interception; integrates with Palo Alto NGFW and Prisma estate |
|---|
| Latency cost | unknown — not published; runtime interception is in-line with model traffic |
|---|
| Self-host | No — SaaS control plane |
|---|
| Coverage | Full lifecycle: build-time model artifacts through runtime prompts, responses and agent actions |
|---|
Watch out: Zero pricing transparency and an enterprise sales motion measured in months — unusable for a team that wants to evaluate something this quarter. The acquisition cost the community its open-source assets: LLM Guard was archived in July 2026, and the current product page makes no mention of ModelScan, NB Defense or the huntr bug bounty, so anyone who built on those is on their own. It is a security-team product, not a developer product; the runtime guardrails are a smaller part of the value than the posture and red-teaming modules, and buying it purely as a content filter is significant overspend.
unknown — no public list pricing. Sold through Palo Alto Networks enterprise sales, typically on a credit/consumption model within a broader Prisma agreement.
A configurable policy object you attach to Bedrock calls, or invoke standalone via the ApplyGuardrail API. Policies stack: content filters (hate, insults, sexual, violence, misconduct, prompt attack) with configurable strength; denied topics defined in natural language; word and profanity filters; sensitive information filters that block or mask PII entities and custom regexes; contextual grounding checks that score grounding and relevance against source passages; and Automated Reasoning checks, which use formal verification against a policy model rather than a classifier. Critically, ApplyGuardrail is explicitly decoupled from foundation models — you can send any text from any model, including self-hosted or third-party ones, and get back an assessment, so it works as a general-purpose moderation API for AWS shops.
| Scope | Content filters, denied topics, word/profanity filters, PII + regex redaction, contextual grounding, automated reasoning checks |
|---|
| Deployment | Attached to Bedrock Invoke/Converse, or standalone via the ApplyGuardrail API |
|---|
| Latency cost | Response includes guardrailProcessingLatency per invocation; additive per enabled policy |
|---|
| Self-host | No |
|---|
| Coverage | Input and output, model-agnostic via ApplyGuardrail; text-centric |
|---|
Watch out: Costs stack per policy: enabling content filters, denied topics, PII and grounding on both the prompt and the response means four to eight billable policy evaluations per turn, and at $0.10-$0.15 per 1,000 units that becomes a real line item at scale — model the bill before enabling everything. Contextual grounding requires you to pass source passages, so it only helps in RAG shapes. Denied topics are natural-language definitions evaluated by a model, so precision varies and needs iteration. There is no self-hosted option and no way to run it outside AWS, and multimodal/image coverage is thinner than Azure's.
Content filters $0.15 per 1,000 text units; denied topics $0.15 per 1,000 text units; sensitive information filters (PII) $0.10 per 1,000 text units; contextual grounding checks $0.10 per 1,000 text units; Automated Reasoning checks $0.17 per 1,000 text units per policy. Word filters and regex-based sensitive information filters are free.
Google's model-agnostic screening service for LLM prompts and responses. Filters cover responsible-AI content safety (hate, harassment, sexually explicit, dangerous content, plus CSAM which is always on and cannot be disabled), prompt injection and jailbreak detection, sensitive data protection built on Cloud DLP templates for PII and credential redaction, malicious URL detection (first 256 URLs found), and document screening for PDF, Word, Excel, PowerPoint and text files up to 4MB. Its distinguishing feature is floor settings — an organisation-level minimum policy that applies across all templates, so a platform team can guarantee a security baseline that individual project owners cannot weaken. Processing is stateless: data is discarded immediately unless Cloud Logging is enabled.
| Scope | Responsible-AI content safety incl. mandatory CSAM, prompt injection/jailbreak, sensitive data (DLP), malicious URLs, document screening |
|---|
| Deployment | REST API; org-wide floor settings; inline integrations with Vertex AI, Agent Gateway, Apigee, Gemini Enterprise |
|---|
| Latency cost | unknown — not published; one screening call per prompt and per response |
|---|
| Self-host | No |
|---|
| Coverage | Input and output, model-agnostic; text plus PDF/Office document screening |
|---|
Watch out: Pricing is genuinely hard to pin down from public pages, which is a poor sign for cost planning — confirm rates with your account team. Malicious-URL scanning stops at the first 256 URLs, and document screening caps at 4MB per file. Sensitive data protection depends on Cloud DLP templates, so you inherit DLP's configuration overhead. It is GCP-resident with no self-hosted option, and its content-safety taxonomy is narrower than Azure's severity-graded model. Being surfaced through Security Command Center means the natural buyer is a cloud security team, and app developers may find the console indirection awkward.
unknown — Google states pricing is based on tokens consumed and that Model Armor is available standalone or within Security Command Center, but the per-million-token rate was not retrievable from the public pricing page at time of writing. Verify in the Google Cloud pricing calculator before budgeting.
Cisco's AI security product line, assembled around the Robust Intelligence team it acquired in 2024. Five capabilities: algorithmic red teaming that probes models and applications for safety and security vulnerabilities automatically; runtime protection delivered as network-embedded guardrails rather than an SDK; AI cloud visibility that inventories models and connected data sources; AI Access for governing employee use of third-party AI apps; and AI supply chain risk management for model and file governance. The network-layer placement is the real differentiator — Cisco can see and enforce on AI traffic without applications integrating anything, and it pulls threat intelligence from Talos to cover attack classes beyond prompt injection, such as model denial-of-service and off-topic attacks. An Explorer Edition offers a lower-friction entry point for red teaming.
| Scope | Algorithmic red teaming, runtime guardrails, AI asset discovery, third-party AI app access governance, supply chain risk |
|---|
| Deployment | Network-embedded enforcement plus SaaS control plane; integrates with Cisco Secure Access |
|---|
| Latency cost | unknown — not published; enforcement is in-line with network traffic |
|---|
| Self-host | No |
|---|
| Coverage | Model validation pre-deployment and prompt/response enforcement at runtime, across owned and third-party AI apps |
|---|
Watch out: No public pricing and a portfolio sales motion — this lands via your Cisco account team, not a signup page. Network-embedded enforcement is powerful for coverage but coarse for per-application policy, and it presumes traffic traverses Cisco infrastructure, which is often untrue for cloud-native workloads talking directly to model APIs. Cisco's own product page no longer references Robust Intelligence, so the OSS and research artifacts from that lineage should not be assumed to be maintained. Overkill and awkward for a single application team that just needs an output filter.
unknown — no published list pricing; sold through Cisco enterprise sales, usually bundled with Cisco Secure Access or the broader security portfolio. An "Explorer Edition" entry tier exists but its price is not published.
One of the few remaining independent AI-security vendors after the 2025-26 consolidation. Four modules: AI Discovery for finding AI assets including shadow deployments, AI Supply Chain Security for validating model integrity before deployment, AI Runtime Security for detecting attacks in production, and AI Attack Simulation for continuous adversarial testing. Its architectural claim is agentless and model-agnostic operation with no access to training data required, which lowers the barrier for security teams inserting controls into pipelines they do not own. Integrations target CI/CD, MLOps platforms and SIEM/SOAR, positioning it as a security-operations feed rather than an application library.
| Scope | AI asset discovery, model file/supply-chain scanning, runtime attack detection, automated red teaming |
|---|
| Deployment | SaaS platform, agentless; integrates with cloud, CI/CD, MLOps and SIEM/SOAR |
|---|
| Latency cost | unknown — vendor claims runtime detection without performance impact; no published figures |
|---|
| Self-host | unknown — not stated publicly |
|---|
| Coverage | Build-time model artifacts and runtime behaviour; security-focused rather than content-policy focused |
|---|
Watch out: No public pricing, no free tier and no self-serve trial — evaluation requires a sales conversation. As an independent vendor in a consolidating market it carries acquisition risk, which matters if you are embedding it deeply. Its runtime detection is oriented toward security telemetry and response rather than fine-grained content policy, so it is the wrong tool if what you need is a tunable harm classifier or an output filter for a consumer product. Being agentless means detection is inferential rather than in-process, which trades precision for coverage.
unknown — no pricing published; demo request and enterprise sales only.
The broadest risk taxonomy of the open guard models, and the only major one under a true OSI licence. Granite Guardian 3.3 8B judges prompts and responses across harm dimensions (social bias, jailbreak, violence, profanity, sexual content, unethical behaviour), RAG-specific dimensions (groundedness and answer relevance hallucination), and agentic dimensions (function-calling hallucination) — meaning one model replaces what elsewhere requires a harm classifier plus a separate groundedness checker plus a tool-call validator. It is a hybrid thinking model: you can enable reasoning traces with <think> tags for harder judgements, or run scoring-only mode for faster inference. IBM reports 0.81 aggregate F1 on harm benchmarks, 0.761 balanced accuracy on LM-AggreFact for RAG hallucination, and 0.74 balanced accuracy on function calling.
| Scope | Harm (bias, jailbreak, violence, profanity, sexual, unethical), RAG groundedness and answer relevance, function-calling hallucination |
|---|
| Deployment | Self-hosted weights (Hugging Face, vLLM, Ollama); also available via IBM watsonx.ai |
|---|
| Latency cost | One 8B forward pass per check in scoring mode; materially higher with <think> reasoning enabled |
|---|
| Self-host | Yes — Apache 2.0 with no usage gate |
|---|
| Coverage | Input, output, retrieved context and tool calls; text only |
|---|
Watch out: IBM's published scores are respectable but not dominant — 0.74 balanced accuracy on function-calling hallucination means roughly one in four judgements is wrong, which is too weak to gate high-stakes agent actions on its own. Running an 8B model in-line on every turn costs real GPU capacity and latency, and enabling thinking mode makes that substantially worse. Ecosystem tooling and community fine-tunes are thinner than around Llama Guard, so you will find fewer worked examples. Text only — no image moderation.
Free — Apache 2.0 weights on Hugging Face; you pay only inference compute. Also consumable as a paid service through IBM watsonx.ai (watsonx pricing is separate and metered).
· open source
An image safety classifier built on the Gemma 3 4B instruction-tuned checkpoint. Given an image, it returns yes/no judgements against three policies: sexually explicit content, dangerous content that facilitates real-world harm, and violence/gore. It is deliberately narrow — the original ShieldGemma family shipped text moderation models at 2B, 9B and 27B, and ShieldGemma 2 pivots to image-only at a much smaller scale, which makes it cheap enough to run on every generated or uploaded image. Google reports it outperforming LLaVA-Guard 7B and GPT-4o mini on image safety benchmarks. Use it alongside a text classifier, not instead of one.
| Scope | Image safety only: sexually explicit, dangerous content, violence/gore |
|---|
| Deployment | Self-hosted weights (Hugging Face, Kaggle); Vertex AI Model Garden |
|---|
| Latency cost | One 4B vision forward pass per image; cheap relative to 7B+ vision guards |
|---|
| Self-host | Yes |
|---|
| Coverage | Images only, input or generated output; no text, no injection detection |
|---|
Watch out: Three policies only — no hate symbols, no self-harm imagery, no CSAM detection (for which you must use NCMEC-affiliated tooling, not a general classifier), and no text moderation at all, so it is never a complete guardrail on its own. The Gemma licence carries prohibited-use terms and is not OSI-approved. Because the policy is expressed in the prompt, results are sensitive to how you word the policy, and Google's benchmark comparisons are internal. Serving a 4B vision model still means a GPU in your inference path.
Free weights under the Gemma Terms of Use; you pay only inference compute. Also available through Vertex AI Model Garden at standard Vertex compute rates.
· open source
The default open-source answer for PII redaction in LLM pipelines. Presidio combines named entity recognition (spaCy, Hugging Face transformers, Stanza), regular expressions, rule-based context enrichment and checksum validation to find entities like names, locations, credit cards, national ID numbers, phone numbers and crypto wallets, then anonymises them by replacement, masking, hashing or encryption — with a matching de-anonymiser so you can restore values after the model call. A separate image-redaction module handles standard formats and DICOM medical images. It is the PII backend that NeMo Guardrails and many other frameworks call. Note the repo carries a "Presidio is moving to a new home" notice, signalling a governance change.
| Scope | PII detection, anonymisation and de-anonymisation; text, images and DICOM |
|---|
| Deployment | Python library, or self-hosted Docker services (analyzer, anonymizer, image-redactor) |
|---|
| Latency cost | Milliseconds for regex/rule recognisers; tens to hundreds of ms when using transformer NER |
|---|
| Self-host | Yes — self-hosting is the only mode |
|---|
| Coverage | Input and output text, plus image and medical-image redaction; no harm or injection detection |
|---|
Watch out: Recall is the honest problem: NER-based detection misses unusual name forms, non-Western naming conventions and context-dependent identifiers, and out-of-the-box recognisers need substantial tuning per domain and language before they are trustworthy for compliance. Transformer-based recognisers are far more accurate than the default spaCy pipeline but add real latency and memory. It does only PII — no toxicity, no injection detection, no groundedness. And the repository's announced move to a new home means maintenance ownership is in flux, which is worth tracking before you depend on it.
Free — MIT licence, runs entirely on your own compute. No hosted service and no usage fees.
· open source
Listed here as a warning, not a recommendation. LLM Guard was the most widely adopted open-source scanner toolkit: 15 input scanners (Anonymize, BanCode, BanCompetitors, BanSubstrings, BanTopics, Code, Gibberish, InvisibleText, Language, PromptInjection, Regex, Secrets, Sentiment, TokenLimit, Toxicity) and 20 output scanners (adding Bias, Deanonymize, JSON, MaliciousURLs, NoRefusal, FactualConsistency, Relevance, URLReachability and others), all MIT-licensed and self-hosted. Following Palo Alto Networks' acquisition of Protect AI, the repository was archived on 9 July 2026 with an explicit notice that the project and its associated Hugging Face models are no longer under active development or maintained. The code still runs; nobody is patching it.
| Scope | 15 input + 20 output scanners: injection, toxicity, secrets, PII, code, bias, factual consistency, malicious URLs |
|---|
| Deployment | Python library or self-hosted API container — archived, read-only repository |
|---|
| Latency cost | High when chaining transformer scanners; each ML scanner is a separate model inference |
|---|
| Self-host | Yes — self-hosted only |
|---|
| Coverage | Input and output text; frozen at the July 2026 archive state |
|---|
Watch out: Archived and explicitly unmaintained as of 9 July 2026 — no security patches, no dependency updates, and the companion Hugging Face models are frozen too. Do not start a new production deployment on it. Anyone currently running it should plan a migration to a maintained alternative: Presidio for the anonymisation scanners, a guard model such as Llama Guard 4 or Granite Guardian for toxicity and topic bans, and a dedicated injection detector for PromptInjection. Its transformer scanners were also slow when chained, which was a known complaint even while it was maintained.
Free (MIT), but unmaintained. The commercial successor capability now lives in Palo Alto Networks Prisma AIRS, which has no public pricing.
· open source · discontinued
The first binding horizontal AI regulation, applying to anyone placing AI systems on the EU market regardless of where they are established. Obligations phase in: prohibited practices and AI literacy applied from 2 February 2025; GPAI model obligations, governance rules and penalties from 2 August 2025 (GPAI models already on the market before that date have until 2 August 2027 to comply); the remainder of the Act from 2 August 2026; and transparency duties for synthetic audio, image, video and text under Article 50(2), plus the prohibitions on non-consensual intimate imagery and CSAM generation, from 2 December 2026. The AI Omnibus — adopted 19 November 2025, politically agreed 7 May 2026, in force 27 July 2026 — pushed Annex III high-risk systems (biometrics, critical infrastructure, education, employment, migration, asylum, border control) to 2 December 2027 and Annex I product-embedded systems to 2 August 2028, on the reasoning that harmonised standards were not ready.
| Scope | Risk-tiered obligations for prohibited, high-risk, limited-risk and minimal-risk AI systems, plus GPAI model duties |
|---|
| Deployment | Legal obligation on providers, deployers, importers and distributors placing systems on the EU market |
|---|
| Latency cost | Not applicable — compliance cost is documentation, conformity assessment and post-market monitoring |
|---|
| Self-host | Not applicable |
|---|
| Coverage | Prohibitions Feb 2025; GPAI Aug 2025; general application Aug 2026; transparency + NCII/CSAM Dec 2026; Annex III high-risk Dec 2027; Annex I Aug 2028 |
|---|
Watch out: The timeline has already moved once, and the Omnibus signalled that political appetite for delay exists — planning against a date that may shift again is genuinely hard. Harmonised standards are still incomplete, so 'how to comply' for high-risk systems remains partly undefined, and the Article 6(5) classification guidelines were themselves due only in February 2026. Classification is the hardest practical problem: deciding whether your system is high-risk, limited-risk or out of scope often needs legal advice, and getting it wrong is expensive in both directions. It is a legal obligation, not a control — no tool on this list makes you compliant.
The regulation text is free to read. Compliance cost is the real number: conformity assessment, technical documentation, post-market monitoring and, for high-risk systems, notified-body involvement. Penalties reach EUR 35 million or 7% of global annual turnover for prohibited practices.
Published 26 January 2023, the AI RMF 1.0 is a voluntary, sector-agnostic framework for managing risks from AI to individuals, organisations and society, structured around four core functions: Govern, Map, Measure and Manage. It ships with an implementation Playbook, crosswalks to other frameworks including ISO/IEC 42001, and the Generative AI Profile (NIST-AI-600-1, released 26 July 2024) which enumerates risks specific to generative systems — confabulation, dangerous content, data privacy, information integrity, harmful bias — and suggested actions for each. NIST released a concept note on 7 April 2026 for a Trustworthy AI in Critical Infrastructure profile, and AI RMF 1.0 is itself under revision as part of the White House AI Action Plan.
| Scope | Voluntary organisational risk management across the AI lifecycle: Govern, Map, Measure, Manage; plus a Generative AI Profile |
|---|
| Deployment | Documentation and process framework adopted internally; supported by the free Playbook and crosswalks |
|---|
| Latency cost | Not applicable — cost is staff time on governance and documentation |
|---|
| Self-host | Not applicable |
|---|
| Coverage | Whole AI lifecycle and organisational governance; no technical controls, no certificate |
|---|
Watch out: There is no certification and no auditor — you cannot hand a customer a NIST AI RMF certificate, which is exactly what enterprise procurement often wants, so it does not substitute for ISO/IEC 42001. It is descriptive rather than prescriptive: it tells you what to consider, not what control to implement, so two organisations can both claim alignment with wildly different rigour. The Generative AI Profile predates most agentic patterns. And AI RMF 1.0 is currently being revised under the AI Action Plan, so work anchored tightly to the 2023 structure may need rework.
$0 — all NIST AI RMF materials, the Playbook, the Generative AI Profile and the crosswalks are free public documents.
Published in December 2023, ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). Structurally it is the familiar Annex SL management-system shape shared with ISO 27001 and ISO 9001 — context, leadership, planning, support, operation, performance evaluation, improvement — with AI-specific Annex A controls covering AI policy, roles, impact assessment, data management for AI, system lifecycle, and third-party and customer relationships. Its practical significance is that it is certifiable by accredited bodies, so unlike NIST AI RMF it produces an artifact that enterprise procurement and EU AI Act conformity work can both point at. Several large AI providers certified during 2024-25, which made it the de facto ask in enterprise AI vendor questionnaires.
| Scope | AI management system requirements plus Annex A controls: AI policy, impact assessment, data for AI, lifecycle, third parties |
|---|
| Deployment | Organisational management system, audited by an accredited certification body (Stage 1 + Stage 2, annual surveillance) |
|---|
| Latency cost | Not applicable — cost is audit fees plus 6-12 months of implementation effort |
|---|
| Self-host | Not applicable |
|---|
| Coverage | Governance and process across the AI lifecycle; certifies the system, not model behaviour |
|---|
Watch out: Certification costs real money and 6-12 months of effort, and it certifies your management system, not your model — an ISO 42001 certificate says nothing about whether your model is accurate, unbiased or safe, which buyers routinely misread. The standard text is paywalled per user, which is friction for distributing requirements internally. Annex A controls are stated at a high level and require substantial interpretation. It is not a shortcut to EU AI Act compliance: it helps demonstrate governance, but harmonised standards under the Act are separate and still being finalised. If you have no ISO 27001 foundation, expect the effort to roughly double.
unknown — ISO charges for the standard document (typically low hundreds of Swiss francs; the ISO store page was not retrievable at time of writing). The larger cost is certification: gap assessment, implementation and a two-stage accredited audit with annual surveillance, commonly quoted in the tens of thousands of USD for a mid-sized organisation.
A SOC 2 report is an independent CPA examination of a service organisation's controls against the AICPA Trust Services Criteria — the 2017 TSC with revised points of focus issued in 2022 — across five categories: Security (always in scope), Availability, Processing Integrity, Confidentiality and Privacy. Type 1 attests to control design at a point in time; Type 2 tests operating effectiveness over a period, usually 3-12 months, and is what enterprise buyers actually mean when they ask. For AI vendors the report's practical role is to answer the data-handling questions: how customer prompts are segregated, retained, encrypted and kept out of training. The TSC contain no AI-specific criteria, so AI-relevant controls have to be described in the system description and mapped into Security, Confidentiality and Processing Integrity.
| Scope | Trust Services Criteria: Security (mandatory), Availability, Processing Integrity, Confidentiality, Privacy — no AI-specific criteria |
|---|
| Deployment | Independent CPA firm examination; Type 1 (point in time) or Type 2 (3-12 month observation period) |
|---|
| Latency cost | Not applicable — cost is audit fees plus an observation window before a Type 2 can be issued |
|---|
| Self-host | Not applicable |
|---|
| Coverage | Organisational and system controls over customer data; must be paired with ISO 42001 or model documentation to cover AI-specific risk |
|---|
Watch out: The Trust Services Criteria contain no AI-specific criteria, so a SOC 2 report tells a buyer nothing about model behaviour, evaluation rigour, bias, or guardrail effectiveness — presenting it as AI assurance is misleading and sophisticated buyers will call it out. Scope is defined by the vendor, so two reports are not comparable without reading the system description and, crucially, the exceptions and the complementary user entity controls. Type 2 requires an observation window, so a startup cannot produce one on demand. It is US-centric; European and Asian buyers increasingly ask for ISO 27001 and ISO/IEC 42001 instead. Budget for annual recurrence, not a one-off.
unknown as a list price — SOC 2 is an audit engagement, not a product. Market rates commonly run roughly $10,000-$50,000 per audit depending on scope and auditor, plus compliance-automation tooling (Vanta, Drata and similar) at several thousand to low tens of thousands per year. Confirm with your chosen CPA firm.