AI vendor catalog
Evaluating AI vendors from scratch is time-consuming and error-prone. The AI Vendor Catalog gives the governance team a head start with pre-populated profiles for more than 850 AI vendors: complete with risk indicators, compliance certifications, and deployment metadata.
How the premium modules are offered
- Included on the TODO.LAW cloud, in the free pilot and on the paid plan.
- On a managed instance or on your own hardware, they are licensed separately.
What is the AI vendor catalog?
The AI Vendor Catalog is a searchable, pre-populated directory of AI tool and service providers. Each vendor profile includes structured governance data: what the vendor does, where data is processed, what certifications they hold, whether they train on customer data, and their EU AI Act risk classification.
The catalog is powered by VendorWatch, an independent AI vendor intelligence service that continuously audits and updates vendor profiles. Data syncs automatically, so the catalog stays current without manual research.
Why it matters
Due diligence at scale
Manually researching each AI vendor's data practices, certifications, and risk posture is impractical. The catalog provides a standardized baseline for every vendor evaluation.
Faster procurement
When a team requests a new AI tool, governance can check the catalog immediately: no weeks-long vendor questionnaire cycle needed for initial assessment.
Regulatory compliance
The EU AI Act requires deployers to understand the AI systems they use. Pre-classified vendor risk levels and compliance indicators help meet Art. 6 and Art. 26 obligations.
Continuous updates
Vendor risk profiles change as companies update their terms, certifications expire, or data practices evolve. Automated sync ensures the catalog reflects current reality.
Vendor catalog vs vendor risk
The AI Vendor Catalog and the Vendor Risk module serve different purposes in the governance lifecycle. They complement each other.
Vendor catalog
- Pre-populated directory of more than 850 AI vendors
- External intelligence: data from VendorWatch
- Read-only reference for initial due diligence
- Core question: “What do we know about this vendor?”
Vendor risk
- The organization's vendor records
- Internal assessments: the organization's risk evaluations
- Full CRUD with status tracking and contract management
- Core question: “How risky is this vendor for us?”
What's in a vendor profile
Identity
Name, slug, logo, website, description, category, headquarters country
AI Model Information
Model names, model types (proprietary, open-source, fine-tuned), training data transparency
Data & Privacy
Data processing locations, data retention policy, trains on customer data (yes/no), sub-processors disclosed
Compliance & Certifications
SOC 2, ISO 27001, GDPR compliance status, EU AI Act risk classification, HIPAA eligibility
Governance Metadata
Last audit date, VendorWatch risk score, catalog sync timestamp, source URL
How it works
Browse or search
Search the catalog by vendor name, category, or compliance attribute. Filter by risk level, certification status, or data processing location.
Review the profile
Each vendor has a detailed profile page with structured governance data: risk indicators, compliance certifications, data practices, and AI model information.
Inform the decision
Use the catalog data to accelerate vendor assessments, support procurement decisions, or evaluate shadow AI tools that employees have reported.
Automatic sync
The catalog syncs with VendorWatch on a regular schedule. New vendors are added and existing profiles are updated automatically as intelligence becomes available.