The Assurance DeskWhat Arthur AI offers, and what it publishes
Arthur AI is software your team uses, not a consultancy. It finds AI agents across cloud, on-premises and endpoint systems, monitors them for security problems, enforces your policies and produces audit logs and risk assessments. There is a $0 Free tier and a $60 a month Premium tier.
Arthur AI publishes no SOC 2, ISO 27001 or ISO 42001 certification of its own. It names no customers on its product page and does not say which framework it follows, such as the EU AI Act or the US NIST AI RMF. Enterprise pricing means contacting sales. It publishes no indemnity or liability terms.
Arthur AI says its own anomaly detection uses AI. Its privacy policy says data is processed in the US and elsewhere, and that non-US locations may lack equivalent data protection standards. It says it was a 2021 Gartner Cool Vendor and was selected to provide AI performance capabilities for the US Department of Defense.
Strengths
- Publicly discloses that its own platform uses AI ("Agent Behavioral Analytics") for real-time anomaly detection, rather than hiding this
- Product is purpose-built for AI agent discovery, runtime security monitoring and policy enforcement across cloud/on-prem/endpoint agents, with audit-log and risk-assessment output aimed at compliance teams
- Entry-level pricing ($0 and $60/mo tiers) is published openly rather than gated entirely behind "contact sales"
- External validation exists in the form of a 2021 Gartner Cool Vendor recognition and a stated US Department of Defense engagement
Things to check
- No SOC 2, ISO 27001 or ISO 42001 certification is disclosed anywhere on Arthur's public site (homepage, docs hub, terms or privacy policy), so the vendor's own security/compliance posture is unverified by any independent audit evidence found
- No named enterprise customers or case studies are published on the core product page, so claimed enterprise outcomes cannot be independently checked against a real customer account
- The privacy policy itself flags that customer data may be processed in jurisdictions that lack data-protection standards equivalent to the customer's home jurisdiction, which is a material point for buyers evaluating this vendor for AI-governance/compliance use cases
Common questions
Is Arthur AI SOC 2 or ISO 27001 certified?
It does not say so. Its homepage, docs, terms and privacy policy do not mention SOC 2, ISO 27001 or ISO 42001.
What does Arthur AI cost?
$0 a month for the Free tier and $60 a month for Premium. Enterprise pricing is available only from sales.
Is Arthur AI a consultancy?
No. It is software your team uses to find and monitor AI agents, enforce policy and produce audit logs and risk assessments.
Where does Arthur AI process data?
In the US and other international locations, its privacy policy says. It warns that non-US locations may lack equivalent data protection standards.
Evidence for each Arthur AI score
Show our working
Notes behind each thing to check
- No SOC 2, ISO 27001 or ISO 42001 certification is disclosed anywhere on Arthur's public site (homepage, docs hub, terms or privacy policy), so the vendor's own security/compliance posture is unverified by any independent audit evidence found (Checked https://www.arthur.ai, https://docs.arthur.ai/, https://www.arthur.ai/terms and https://www.arthur.ai/privacy on 2026-09-20, none mention SOC 2, ISO 27001 or ISO 42001)
- No named enterprise customers or case studies are published on the core product page, so claimed enterprise outcomes cannot be independently checked against a real customer account (https://www.arthur.ai/discover-and-govern-agents reviewed 2026-09-20, all workflow examples are generic/anonymised (e.g. "support-agent-v4"), no named customers or case studies present)
- The privacy policy itself flags that customer data may be processed in jurisdictions that lack data-protection standards equivalent to the customer's home jurisdiction, which is a material point for buyers evaluating this vendor for AI-governance/compliance use cases (https://www.arthur.ai/privacy, reviewed 2026-09-20: policy states data is processed in the US "as well as other international locations" and acknowledges "non-U.S. jurisdictions may lack equivalent data protection standards")
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | No published record found of Arthur defending any client through a regulatory investigation, breach or incident; disclosures flag clientOutcomes as false and no case study evidences this anywhere in the fact-set. | |
| Qualifications of the people who do the work | Drawback states no SOC 2, ISO 27001 or ISO 42001 is disclosed anywhere on Arthur's site (homepage, docs, terms, privacy), and disclosures.accreditation and credentials are both false. | |
| What it publishes about fees | Publishes Free ($0/mo) and Premium ($60/mo) pricing on its own pricing page (disclosures.fees true), but Enterprise tier is contact-sales only with no published rate card or worked example. | |
| Knowledge of your sector | dp_ai_gov_practice_evidence says the practice evidence is product-only, not third-party audited, cites no named framework (NIST AI RMF, EU AI Act, ISO 42001), and the drawback confirms no named enterprise customers or case studies are published; Gartner/DoD mentions are unverified vendor-disclosed claims, not named practice evidence. | |
| Independence from what it sells | No SOC 2/ISO certification is disclosed anywhere, so Arthur's own compliance/security posture is wholly self-declared with no independent audit evidence found in the fact-set. | |
| Who carries the risk if the advice is wrong | disclosures.piInsurance is false and no PI insurance or liability terms are disclosed anywhere; only corporate-structure facts exist (Delaware Inc., SEC EDGAR CIK 0001832497, DC-governed terms). |
Sources for Arthur AI
- Arthur AI, Inc. is registered with SEC EDGAR under CIK 0001832497 as a Delaware corporation, with three Form D filings (2020, 2022, 2026) listing a Washington, DC business address (CIK 0001832497, Delaware, 2815 Woodley Road NW, Washington, DC 20008) (sec.gov, checked 20 September 2026)
- Arthur's own privacy policy states the company is headquartered in Washington, DC, and that personal data is transferred to, stored and processed in the US and other international locations where it has affiliates and service providers (HQ Washington, DC; data processed in US + international locations) (arthur.ai, checked 20 September 2026)
- Arthur's terms of service (legal entity name ArthurAI, Inc.) sets the District of Columbia as the governing jurisdiction for disputes, consistent with its SEC-registered DC address (Governing jurisdiction: District of Columbia) (arthur.ai, checked 20 September 2026)
- Arthur publicly discloses pricing tiers of $0/mo (Free) and $60/mo (Premium) on its own pricing page, with Enterprise pricing only available by contacting sales ($0/mo Free, $60/mo Premium, Enterprise = custom/contact sales) (arthur.ai, checked 20 September 2026)
- Arthur's newsroom discloses a $42M Series B (2022) and $15M Series A (2021), and states Arthur was named a 2021 Gartner Cool Vendor in AI Governance and Responsible AI and was selected to provide AI performance capabilities for the US Department of Defense (Series A $15M (2021), Series B $42M (2022); 2021 Gartner Cool Vendor; DoD engagement) (arthur.ai, checked 20 September 2026)
Exposed to the EU AI ActRegulated sectors
Where this firm appears
- Does the EU AI Act apply to a UK firm?
- Your sector adds its own rules to UK data protection law
- Which data protection, AI governance and cyber security providers publish a price?
- Compare providers
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.