We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Drata logo

Drata review

Software product

US compliance software that you subscribe to and run yourselves, with an ISO 42001 module for AI governance. It is a product, not advice.

Relevant if you want software that links AI risks to controls, owners and evidence for ISO 42001

Price Not published
Indemnity cover Published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Drata scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 4/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 5/5

What Drata offers, and what it publishes

You get a platform, not a consultant. Its ISO 42001 module ties AI risks to controls, owners and evidence. Drata also markets 'AI Agent Governance' mapped to ISO 42001, the EU AI Act and the AIUC-1 standard for AI agents. It publishes named customer case studies, such as Instacart's '375 hours saved'.

Drata does not publish a price. Its plans page lists six tiers across two products, and every one leads to 'Get Started' or 'Contact Sales'. It does not name the body that certified its own ISO 42001, or give the exact date or scope.

Drata's trust centre lists its own SOC 2 Type II, SOC 3, ISO 27001, ISO 42001 and FedRAMP certificates. Its public terms promise 99.9% availability and cap liability at the fees paid in the previous 12 months. It has a London office, and two resellers list it on the UK government's G-Cloud 14 at £1,500 and £6,300 per licence.

Strengths

  • Holds its own ISO/IEC 42001:2023 certification, announced within roughly two years of the standard's publication, alongside SOC 2 Type II, SOC 3, ISO 27001/27017/27018 and FedRAMP Class B
  • Dedicated ISO 42001 product module links AI-specific risks directly to controls, ownership and evidence rather than treating AI governance as a generic add-on
  • Publishes a numeric SLA (99.9% availability commitment) and a defined liability cap in its public Subscription Agreement
  • Named customer case studies with quantified outcomes (e.g. Instacart '375 hours saved', EAB '$20M Trust Center influenced revenue')

Things to check

  • Drata does not publish the certification body or exact scope/date of its ISO/IEC 42001:2023 certification beyond a blog post stating it came 'less than two years' after the standard's publication, making independent verification harder than for vendors who name their auditor.
  • Its plans page gives no prices. You need to contact sales for a quote.

Common questions

Does Drata publish its prices?

No. Its plans page shows six tiers and no figures. Two UK resellers list it on the UK government's G-Cloud 14 at £1,500 and £6,300 per licence.

Does Drata hold ISO 42001 itself?

Yes, by its own account. Its trust centre lists ISO/IEC 42001:2023 as a certificate Drata holds, but Drata does not name the certification body or give the exact date.

Does Drata give EU AI Act advice?

No. It is software your team runs. It markets 'AI Agent Governance' mapped to ISO 42001 and the EU AI Act, and collects evidence automatically, but an audit trail is not a promise that you comply.

Evidence for each Drata score

Show our working

Notes behind each thing to check

  • Drata does not publish the certification body or exact scope/date of its ISO/IEC 42001:2023 certification beyond a blog post stating it came 'less than two years' after the standard's publication, making independent verification harder than for vendors who name their auditor. (drata.com/blog/announcing-iso-42001-certification does not name the certification body or exact certification date/scope in the published content.)
  • Its plans page gives no prices. You need to contact sales for a quote. (drata.com/plans shows six tiers (three per product line) with no dollar amounts, only demo/contact-sales calls to action.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Drata documents continuous, automated evidence collection across 300+ integrations that keeps 'a dependable audit trail' current for audits (drata.com/products/compliance), though it does not explicitly frame this around ICO or AI Act enforcement scenarios.
Qualifications of the people who do the work 4/5 Drata holds verifiable SOC 2 Type II, ISO 27001 and ISO 42001 certifications listed on trust.drata.com, and has publicly named a VP Security/CISO (Matt Hilary) via press coverage, though its own trust page does not name a security contact individually.
What it publishes about fees 1/5 drata.com/plans and drata.com/pricing show only tier names and 'Contact Sales'/'Get Started' calls to action with no dollar figures anywhere on the site.
Knowledge of your sector 4/5 Drata publishes named framework-specific modules covering DORA (financial services), FedRAMP/CMMC (US government/defense) and HIPAA (healthcare) alongside its core SOC 2/ISO 27001 automation.
Independence from what it sells 4/5 Drata's SOC 2 Type II and ISO 27001/27017/27018 certifications are standard independently audited attestations listed on trust.drata.com, but its ISO 42001 announcement does not name the certification body, making that specific claim less independently verifiable.
Who carries the risk if the advice is wrong 5/5 Drata's public Subscription Agreement (drata.com/terms) states a 99.9% service-availability SLA and caps liability at fees paid in the prior 12 months, with named indemnification carve-outs.

Sources for Drata

  • Corporate entity/jurisdiction (Drata Inc., a Delaware corporation, HQ 4660 La Jolla Village Drive, Suite 100, San Diego, CA 92122; EU GDPR representative is Bradwell Limited, Dublin, Ireland; Drata also lists a London office (1 Primrose Street, EC2A 2JN) though no separate UK legal entity name was found) (drata.com, checked 17 July 2026)
  • AI governance product scope (Drata sells a dedicated ISO 42001 module mapping requirements to a centralised control structure with AI-linked risks, ownership and evidence, plus 'AI Agent Governance' positioning mapped to ISO 42001, the EU AI Act and the emerging AIUC-1 standard) (drata.com, checked 17 July 2026)
  • Pricing disclosure (No dollar figures are published on drata.com/plans; two product lines (GRC Platform, Assurance Platform) each carry three tiers (Foundation, Advanced, Enterprise) differentiated only by feature/company-size limits, with every tier's call to action reading 'Get Started' (demo) or 'Contact Sales') (drata.com, checked 17 July 2026)
  • UK presence/government availability (Drata lists a London office on its about page but is not itself a direct UK G-Cloud supplier; two UK resellers (Grove Information Systems and Security Software Solutions Ltd) list Drata as a G-Cloud 14 service, at GBP 1,500/licence and GBP 6,300/licence respectively) (G-Cloud, checked 17 July 2026)
  • Own certifications (Drata's trust centre lists SOC 2 Type II, SOC 3, ISO/IEC 27001:2022, 27017:2015, 27018:2019, ISO/IEC 42001:2023 and FedRAMP Certified - Class B as certifications it holds itself) (trust.drata.com, checked 17 July 2026)

SOC 2 Type II SOC 3 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 42001:2023 FedRAMP Certified - Class B

Seeking ISO 42001 certificationExposed to the EU AI ActSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.