Holistic AI

• Governance-and-risk suites and advisory firms such as the ones enterprises already buy compliance from could fold AI governance into existing contracts, removing the separate budget line Holistic AI depends on, since the buyer relationship already sits with those incumbents.
• Cloud platforms and model providers could ship AI discovery and policy enforcement inside services enterprises already run, turning a standalone governance platform into a feature that ships within a release cycle.
• The customer proof comes from the company's own case studies and a founder interview, so if no named buyer speaks in independent reporting within a year, a procurement team could choose a same-stage rival such as Credo AI on equal footing.
• The capital position is hard to verify because disclosed amounts are scarce and public funding trackers list a separate Paris company under the Holistic AI name, so a better-funded rival could outspend it on enterprise sales before the gap becomes visible.
• If the EU AI Act enforcement timeline slips or softens, the dated regulatory urgency that drives governance budgets could weaken within three to five years, slowing the buying that Holistic AI's timing depends on.

Holistic AI treats the enterprise rollout of AI as a governance problem and sells software to manage it. The company frames the buyer as the security, legal, and compliance teams, plus the boards, that must approve AI before the business can deploy it, from internal copilots to agentic workflows that take actions. Its platform sets out to discover shadow AI across the enterprise, assess models for risk and bias, and enforce regulatory compliance across the AI lifecycle.

The pain ties to named regulatory regimes rather than vendor invention. Holistic AI maps its platform to the EU AI Act, the NIST AI Risk Management Framework, and ISO 42001, regimes that compliance and legal teams already track, which grounds the problem in obligations buyers must meet rather than risks they merely fear. Mozilla Ventures, an outside investor, describes the company as providing AI trust, risk, security, and compliance so enterprises can adopt AI at scale.

The buyer the company targets sits at the approval gate. Holistic AI positions governance as the step that decides whether an AI project ships, which is why it sells to the people who sign off rather than the engineers who build, and why its messaging leads with visibility and control over the AI portfolio. [s1, s2, s9]

The Holistic AI platform spans discovery, assessment, and enforcement rather than a single point feature. It discovers shadow AI across the environment and maintains an inventory, assesses models for risk and bias through auditing and red teaming, and enforces compliance with regulatory frameworks while monitoring continuously. The company added Sentinel Agents that observe AI agent behavior, detect anomalies, score risk, and surface compliance gaps without interrupting operations.

The research lineage is part of the capability claim. Co-founder Adriano Koshiyama has published more than 70 papers and is credited with early research on AI auditing, assurance, and risk management, work cited by bodies including the OECD, which is external validation of the methods the product applies. The platform extends that auditing heritage from bias and robustness toward continuous oversight of agentic systems.

Public technical depth stays at marketing-page and blog level. Holistic AI describes its modules and recent product updates on its site, but no public documentation portal or independent benchmark is available to a buyer assessing the platform beyond the vendor's own claims, which is the gap that separates it from peers that publish docs or third-party evaluations. [s2, s1, s7]

Holistic AI looks to me like it competes on two fronts that most AI-security startups do not face at once. It contests the dedicated AI governance category against tracked rivals such as Credo AI, Cranium AI, and TrojAI, and it likely also competes against established governance-and-risk suites and advisory firms that tend to hold the compliance budget. Governance is work enterprises have historically staffed with people and policy, which suggests the incumbents in the room are often consultants and compliance vendors rather than other startups.

That dual exposure is also the company's structural advantage. Because governance resists being bundled into a cloud platform as quickly as runtime defenses can be, a standalone governance platform has more room to persist than a single-feature security tool. The cross-map guidance treats governance as consultant and policy territory, which both slows platform absorption and raises the bar for proving software is better than the people doing the job today.

The differentiator Holistic AI leans on is regulatory and research credibility. The company sells the EU AI Act readiness and audit methods its founders helped define, which gives it standing with compliance buyers, though that credibility is closer to expertise a rival could hire than a proprietary asset a rival cannot copy. [s2, s9, s1]

Holistic AI's clearest proof points are named enterprise customers. Its site carries an Allegis case study on managing AI risk and improving visibility, and a press interview with co-CEO Adriano Koshiyama names Allegis, Mapfre, Michelin, Unilever, and Wikimedia as enterprises using the platform. That is broader named-customer evidence than many same-stage rivals show.

The references come through the company's own channels rather than independent reporting. The case studies sit on Holistic AI's pages and the customer list appears in a vendor interview, so the proof is real and named but vendor-curated, and a buyer would still want a reference customer speaking on the record in independent press.

Investor backing adds an outside signal. Mozilla Ventures announced an investment in 2024, citing a shared vision for transparent and responsible AI, which is third-party validation of the mission even though the deal amount was not disclosed. What the public record does not yet show is disclosed revenue, customer counts, or a marketplace distribution motion. [s5, s7, s9]

Holistic AI's founders pair computational and ethical research backgrounds. Co-founder and co-CEO Adriano Koshiyama holds a PhD in computer science from University College London, where he remains an honorary research fellow, and co-founder and co-CEO Emre Kazim shares the leadership role, the pairing that started the company in 2020.

The research record is the strongest verifiable team signal. Koshiyama has published more than 70 papers in international conferences and journals, is credited with early research on AI auditing and assurance, and spent time at Goldman Sachs AI Labs and the Alan Turing Institute before founding the company. That is a sustained publication record rather than a single well-covered disclosure.

The standards-body engagement reinforces the pedigree. Koshiyama serves as an advisory member on the AI Risks and Accountability group at the OECD and the Global Partnership on AI, which places the founder inside the policy conversations that shape the regulations Holistic AI sells readiness for. What the public record lacks is a prior startup exit of the kind that lifts the strongest teams in this category. [s7, s9]

Holistic AI positions itself as the control layer enterprises use to make AI auditable. Its platform inventories an organization's AI systems, assesses them for risk and bias, and generates the compliance documentation that security, legal, and boards require, so the product itself is an assurance instrument aimed at procurement and audit scrutiny.

The platform's own sensitivity raises the readiness bar. Because Holistic AI inspects an enterprise's models, agents, and AI traffic to perform its audits, a security review will likely ask for the company's data-handling terms and its own attestations before granting that access. The homepage footer displays the table-stakes seals that begin to answer that question, an AICPA SOC 2 badge and a Sensiba ISO/IEC 27001 Certified badge, image-only with generic alt text. What it does not yet offer is an inspectable trust portal with downloadable reports, so a buyer can see that the attestations exist but would still request the actual SOC 2 report and ISO certificate under NDA.

Regulatory alignment is the company's trust narrative. Holistic AI sells readiness against the EU AI Act, NIST AI RMF, and ISO 42001, so its credibility with buyers rests on demonstrating that its assessments hold up to the same regimes its customers must satisfy, which makes independent validation of its methods the readiness item most likely to surface in procurement. [s2, s9, s1, s11]

Add analyzed competitors to compare them side by side with Holistic AI.

Holistic AI sells to the enterprise team accountable to regulators and boards for the AI a company builds, buys, and runs. The cited pages name governance leads, risk and compliance, data and machine-learning engineers, business owners, and information-security and third-party-risk teams as platform users, and the homepage separately says security, legal, and boards require compliance proof, without establishing who owns the purchase or that board approval gates deployment. Mozilla Ventures describes the company as serving Fortune 500 corporations, SMEs, governments, and regulators with AI trust, risk, security, and compliance.

The segment depends on regulation that already exists rather than a coined category. Holistic AI maps its testing and reporting to the EU AI Act, the NIST AI RMF, and ISO 42001, regimes compliance and legal teams already track, so the mapping targets budget lines those teams already track. That grounding suggests the approval gate rather than the engineering team is where the product enters, though the cited pages do not document the sales entry point.

The named demand spans large regulated enterprises. A case study quotes a senior IT leader at Allegis Group on managing AI risk and visibility across the enterprise, and the company describes working closely with the Wikimedia Foundation to support a Digital Services Act audit of Wikipedia. The open question is how much of that roster is in production versus early deployment, since the proof comes through the company's own channels rather than independent reporting.

The Holistic AI platform spans discovery, testing, and enforcement rather than a single point feature. It discovers shadow AI across the environment and maintains a continuously updated inventory, runs more than 40 specialised tests covering bias, fairness, toxicity, hallucination, prompt injection, and adversarial attacks, and maps the risk scores to EU AI Act, NIST AI RMF, and ISO 42001 requirements. The company frames the three pillars as identify, protect, and enforce.

The research lineage is part of the capability claim. Co-founder Adriano Koshiyama published more than 70 papers and is credited with the early research on AI auditing, assurance, and risk management, work cited and co-published by the UK CDEI and the OECD. That heritage is credibility for the team the company leans on, though no cited body is shown evaluating the product's audit methods, and it stands in place of a public docs portal or a third-party benchmark.

The technical depth a buyer can inspect stays at marketing-page level. Holistic AI describes its modules, its red-teaming with jailbreak and prompt-injection detection, and its continuous monitoring on its site, but the pages reviewed here are marketing and interview material rather than technical documentation, and the analyst placements the homepage displays are vendor-selected references rather than fetched evaluations. The reasoning behind the tests is expertise the founders hold rather than a corpus the company owns.

Holistic AI's clearest proof points are named enterprise customers. Its site carries an Allegis case study in which a senior IT leader is quoted on managing AI risk and improving visibility, and the customer-stories page lists Allegis, the Wikimedia Foundation, MindBridge, and Bryq, with the Wikimedia entry covering a Wikipedia Digital Services Act audit Holistic AI supported. That is concrete named-customer evidence for the company's stage.

The references are named but vendor-curated through Holistic AI's own case-study pages and customer quotes. The case studies sit on Holistic AI's pages rather than in independent reporting, and the Mozilla Ventures investment, reported by FinSMEs (s8), supplies investor validation rather than a customer speaking on the record, so a buyer would still want a reference customer in independent press.

Investor backing adds an outside signal short of revenue. Mozilla Ventures announced an investment in 2024 citing a shared vision for trustworthy AI. What the public record does not yet show is disclosed revenue, a customer count, or a marketplace distribution motion.

Holistic AI publishes no pricing in the fetched pages, so the charged unit and list price stay private. A vendor that hides prices usually targets large negotiated enterprise deals, which fits the Fortune 500 and regulated-enterprise buyer the company names. The absence withholds the budget-anchoring signal some peers publish.

The unit of value reads as the governed AI estate rather than a single seat, an inference from what the platform does: a product that inventories an organization's AI systems and produces compliance evidence would price against the breadth and risk of what the buyer must govern. What the platform charges by, models, systems, or assessments, is not stated publicly.

The modular framing shapes the entry point. Holistic AI presents discovery, testing, and compliance as distinct capabilities, so a narrower first purchase is plausible, but with no published price a smaller team cannot size the commitment in advance, and a governance-and-risk suite the buyer already licenses can compete on bundled cost. The cited pages do not establish the commercial model or the sales cycle.

Holistic AI delivers a governance platform, whose hosting, tenancy, and operating model the fetched pages do not state, that integrates with the systems a customer already runs. It connects to the technology environment, discovers AI systems including shadow AI, tests them before production, and monitors deployed models continuously for drift, degradation, and adversarial threats, so the operational value is an ongoing inventory and evidence trail rather than a one-time scan.

The platform's own access raises the diligence question. Because Holistic AI inspects an enterprise's models, agents, and AI traffic to run its tests, a security review will ask for the company's data-handling terms, tenancy model, and attestations before granting that access. The fetched record describes the operating model at product-page level rather than with published service-level commitments.

Holistic AI offers the software platform alongside documented audit and assessment engagements, including the third-party MindBridge audit, the Bryq NYC Bias Audit assessment, and the Wikipedia Digital Services Act work with the Wikimedia Foundation. The cited pages do not establish the day-to-day operating split between customer teams and Holistic AI, the weight of services in the revenue mix, or where accountability for governance decisions contractually rests.

Holistic AI positions itself as the control layer enterprises use to make AI auditable, so the product itself is an assurance instrument aimed at procurement and audit scrutiny. It inventories an organization's AI systems, tests them for risk and bias, and generates the compliance documentation that security, legal, and boards require before an AI project ships.

The company's own attestations begin to answer the access question. The homepage footer displays two image-only badges with generic alt text, identified as an AICPA SOC 2 seal and a Sensiba ISO/IEC 27001 Certified seal in the rendered pixels of the s9 capture. No inspectable trust portal or downloadable reports appear in the fetched record, so a buyer can see the attestations exist but would still request the SOC 2 report and ISO certificate under NDA.

Regulatory alignment is the trust narrative the product sells. Holistic AI maps its assessments to the EU AI Act, NIST AI RMF, and ISO 42001, regimes its regulated customers commonly face.

Holistic AI positions itself as the neutral governance layer across an enterprise's AI rather than a feature inside one vendor's stack. It connects to the technology environment, discovers every AI system, and governs models, agents, and applications from one platform, so it sits above the AI systems it inventories rather than inside them.

That neutrality is the platform claim and the limit at once. Holistic AI governs AI regardless of which models or clouds a customer runs, which widens reach, but the same breadth means it depends on the systems it ingests from and holds no infrastructure those systems cannot run without. The platform claim rests on module breadth and integration, not an external builder network.

The ecosystem reach is integration and program affiliation rather than a marketplace. Holistic AI is part of Microsoft's Founders' Hub and Nvidia's Inception program, which signal partner proximity, and its site lists a 15-plus integrations inventory across cloud, code, data, LLM, and SaaS surfaces (s2), while no third-party developer marketplace appears in the fetched pages, so the platform effect is internal coverage rather than a network other builders extend.

Holistic AI's credibility centers on a research-rooted founding pair. Co-founder and co-CEO Adriano Koshiyama holds a computer-science PhD from University College London, where he remains an honorary research fellow, and co-founder and co-CEO Emre Kazim shares the leadership role, the pairing that started the company in 2020.

The research and standards record is the strongest verifiable team signal. Koshiyama published more than 70 papers, is credited with the early research on AI auditing and assurance, and spent time at Goldman Sachs AI Labs and the Alan Turing Institute. He is an advisory member on the OECD AI Risks and Accountability group, and the founders sit on the Assessment and Mitigation working groups for the EU AI Act GPAI Code of Practice. That is a sustained record rather than a single well-covered disclosure.

That standing places the founders inside the rule-making the product sells readiness for. Koshiyama advises the OECD AI Risks and Accountability group, and the company says it collaborates with NIST and the UN AI Advisory Body, ties that connect Holistic AI to the regulations its buyers must answer to. What the public record lacks is a prior startup exit of the kind that lifts the strongest teams in this category.