We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Credo AI logo

Credo AI review

Software product

US AI governance software that large organisations license and run themselves, to register, assess and monitor AI systems against rules such as the EU AI Act.

Relevant if you need software to track your AI systems against the EU AI Act or ISO 42001

Price Not published
Indemnity cover Published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Credo AI scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 4/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 3/5

What Credo AI offers, and what it publishes

You get software, not advice. It keeps a register of your AI systems and agents, runs ongoing risk assessments and monitors them in use. Its policy packs include the EU AI Act, ISO 42001 and, in the US, the NIST AI RMF, Colorado's SB21-169 and New York City's Local Law 144.

Credo AI does not publish a price; the site offers only a 'Request demo' link. It publishes a page describing an independent SOC 2 Type II examination. Its trust centre also claims 'ISO 27001 Compliant' and 'FedRAMP Compliant', but we found no certificates for these.

Credo AI publishes a case study on Mastercard's use of its AI Registry and Vendor Registry modules. Its terms say customer data is not used to train Credo AI's own models. It is a US company based in California; we found no UK company, UK office or G-Cloud listing.

Strengths

  • Publishes a dedicated SOC 2 Type II page describing an independent examination of the platform, rather than only a self-declared security statement
  • Named, detailed customer case study with a large regulated-sector client (Mastercard) describing specific product modules used (AI Registry, Vendor Registry) and stated outcomes
  • Explicit data-handling commitment published in its Terms of Use that customer data is not used to train or improve Credo AI's own machine learning models
  • Pre-built policy packs mapped to multiple named regulatory frameworks (EU AI Act, NIST AI RMF, ISO 42001, Colorado SB21-169, NYC Local Law 144) suggest broad regulatory coverage

Things to check

  • No public pricing page or indicative figures exist; access to any pricing information requires requesting a sales demo.
  • Alongside its verifiable SOC 2 Type II report, the Trust Center lists broad 'compliant' claims (including 'FedRAMP Compliant') without evidence of a formal certificate or authorization number, a more informal and harder-to-verify standard than a named audit.
  • No UK Companies House registration, UK office, or UK government G-Cloud/Digital Marketplace listing was found for Credo AI, which may matter for UK public-sector buyers seeking a UK-contracting entity.

Common questions

Does Credo AI publish pricing?

No. The only route to a price is a demo request.

Is its security independently audited?

Partly. It publishes a page describing an independent SOC 2 Type II examination. We found no certificates for its other 'compliant' claims.

What do its terms say about liability?

They cap it at US $50 for claims about the website or its content, with exceptions such as fraud. Ask what your software contract says.

Evidence for each Credo AI score

Show our working

Notes behind each thing to check

  • No public pricing page or indicative figures exist; access to any pricing information requires requesting a sales demo. (https://www.credo.ai/ offers only a 'Request demo' call-to-action; no dedicated pricing page was found on the site)
  • Alongside its verifiable SOC 2 Type II report, the Trust Center lists broad 'compliant' claims (including 'FedRAMP Compliant') without evidence of a formal certificate or authorization number, a more informal and harder-to-verify standard than a named audit. (Third-party summaries of trust.credo.ai describe Credo AI as 'PCI Compliant, HIPAA Compliant, SOC 2 Compliant, GDPR Compliant, ISO 27001 Compliant, FedRAMP Compliant' without linking each claim to a specific certificate, https://trust.credo.ai/)
  • No UK Companies House registration, UK office, or UK government G-Cloud/Digital Marketplace listing was found for Credo AI, which may matter for UK public-sector buyers seeking a UK-contracting entity. (A search of find-and-update.company-information.service.gov.uk for 'Credo AI' returned no matching entity as of this research)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Product pages describe 'automated evidence generation and audit trails' as part of its Compliance & Policy Engine mapped to named frameworks, though no sample export or regulator-facing report was shown.
Qualifications of the people who do the work 4/5 Publishes a dedicated SOC 2 Type II page and Trust Center listing multiple compliance claims, and names founder/CEO Navrina Singh, though no dedicated CISO or security lead is named.
What it publishes about fees 1/5 No pricing page or figures exist anywhere on the public site; only a demo request form is offered.
Knowledge of your sector 4/5 Publishes a detailed named case study on financial-services AI governance at Mastercard and lists sector-relevant frameworks such as Colorado SB21-169 insurance law, evidencing real sector-specific deployment.
Independence from what it sells 3/5 The SOC 2 Type II report is a genuine independent examination, but several other Trust Center claims (ISO 27001, FedRAMP, PCI, HIPAA 'compliant') are asserted without linked certificates or audit references.
Who carries the risk if the advice is wrong 3/5 Public Terms & Conditions state a specific liability cap of US $50 with named carve-outs, a published if very low figure, though it likely applies to the marketing site rather than the enterprise SaaS contract.

Sources for Credo AI

  • Company registration (Credo AI is a US company headquartered in the San Francisco Bay Area, California, founded in 2020 by Navrina Singh; no UK Companies House entity for 'Credo AI' was found in this research) (credo.ai, checked 17 July 2026)
  • Product scope (AI governance platform covering AI/agent registry and discovery, continuous risk assessment, a 'Compliance & Policy Engine' with pre-built policy packs (EU AI Act, NIST AI RMF, ISO 42001, SOC 2, Colorado SB21-169, NYC Local Law 144), and runtime monitoring) (credo.ai, checked 17 July 2026)
  • Pricing disclosure (No public pricing page exists; the site offers only a 'Request demo' call-to-action with no published tiers or figures anywhere found) (credo.ai, checked 17 July 2026)
  • Security certification (Publishes a dedicated SOC 2 Type II page describing an independent SOC 2 Type II examination of the platform, alongside broader self-described 'ISO 27001 Compliant, PCI Compliant, HIPAA Compliant, GDPR Compliant, FedRAMP Compliant' claims on its Trust Center) (credo.ai, checked 17 July 2026)
  • Named case study (Published named case study describing Mastercard's use of the AI Registry and Vendor Registry modules to govern generative AI risk at scale in financial services) (credo.ai, checked 17 July 2026)
  • Liability terms (Public Terms & Conditions cap Credo AI's liability at US $50 for claims related to the website/content, except for death, personal injury, fraud or wilful misconduct, and specify California governing law) (credo.ai, checked 17 July 2026)

SOC 2 Type II ISO 27001 (self-described as 'compliant' on Trust Center, without a linked certificate)

Exposed to the EU AI ActSeeking ISO 42001 certificationRegulated sectorsSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.