Gartner defines AI governance platforms as tools designed to ensure organizations adhere to organization policy, regulations and industry standards across common responsible AI principles. These platforms allow leaders responsible for AI and other technical or business leaders to streamline governance processes organization wide and serve as a central repository for trust, risk and security controls. They also automate workflow approvals for new AI use cases, applications and to streamline governance processes organization wide. AI governance platforms support a wide range of AI techniques across built, blended, embedded and bring-your-own-AI applications.
Consent and preference management (CPM) platforms support all aspects of collecting, consolidating, synchronizing and applying end-user choices about personal data. The intent is to extend visibility and control to data subjects, enabling them to self-determine how much of their data to expose, to whom and for what purpose. For organizations, CPM platforms provide a strong foundation for compliance-backed data usage, with detailed tracking and auditability. They contribute to a solid consent program, making data monetization easier and more profitable. CPM platforms are delivered via software. Central to most privacy laws is the challenge of giving users clarity around — and control over — their personal data. CPM platforms address this challenge by handling collection, consolidation, synchronization and usage of end-user choices. They empower data subjects with self-determination, enabling them to control how much personal data to expose, to whom and for what purpose. For organizations, CPM platforms provide a strong foundation for compliance-backed data usage, with detailed tracking and auditability. In more fundamental terms, CPM platforms contribute to a solid consent program, making data monetization easier and more profitable.
Data security posture management (DSPM) discovers previously unknown data across on-premises data centers and cloud service providers (CSPs). It also helps categorize and classify previously unknown and discovered unstructured and structured data. As data rapidly proliferates, DSPM assesses who has access to it to determine its security posture and exposure to privacy, security and AI-usage-related risks. DSPM is delivered as software or as a service.
A data and analytics governance platform is a set of integrated business and technology capabilities that help business leaders and users develop and manage a diverse set of governance policies and enforce those policies across business and data management systems. These platforms are unique from data management in that data management focuses on policy execution, whereas D&A platforms are used primarily by business roles — not only or even specifically IT roles — for policy management. Data and analytics (D&A) leaders who are investing in operationalizing and automating the work of D&A governance should evaluate this market. The work of D&A governance primarily includes policy setting and policy enforcement, and collaborates with data management (policy execution). Use cases are employed across numerous governance policy categories and multiple business scenarios and asset types (data, KPIs, analytics models). The intersection of use-case/business scenarios, policy categories and assets to be governed is then used to identify the technology capability. These capabilities may share similar names across policy categories, but may not mean the same thing, or may be used differently by various governance personas. For example, data classification in a data security implementation would be quite different from a data classification effort for creating trust models, which would be based on lineage and curation.
The IT risk management (ITRM) market focuses on solutions that support the ITRM discipline through automating common workflows and requirements. For the purposes of defining this market, IT risks are risks within the scope and responsibility of the IT department. These include IT dependencies that create uncertainty in daily tactical business activities, and IT risk events resulting from inadequate or failed internal IT processes, people or systems, or from external events.
Gartner defines IT vendor risk management (IT VRM) as the discipline of addressing the residual risk that businesses and governments face when working with external service providers, IT vendors and related third parties. The scope typically addresses risks related to data protection, business continuity, security and other risk domains as relevant to laws, regulation and industry practices.
Gartner defines Integrated risk management (IRM) as the combined technology, processes and data that serves to fulfill the objective of enabling the simplification, automation and integration of strategic, operational and IT risk management across an organization.
Gartner defines metadata management solutions as applications to enable the collection, analysis and orchestration of metadata related to organizational data assets. These solutions enable workflow and operational support to make data easy to find, use and manage. They do this by collating metadata in any form from within its own application and third-party systems, and providing the ability to search, analyze and make decisions on the collated results. They also provide transparent cross-referencing over all related metadata, and derive insights from data (such as usage patterns and performance) through analysis of metadata to support a wide range of data-driven initiatives.
Legislators motivated by aggressive digitalization and increased consumer concern about the handling of personal data — especially when it comes to AI workloads and data-sharing practices — have passed laws governing consumer privacy rights.1,2,3,4 These rights have become part of consumers’ basic expectations when engaging with commercial organizations or government entities. At the heart of the SRR automation market are three key capabilities: Discovery of existing information held on individuals, and continuous monitoring for changes to data stores and new systems that are being onboarded. Maintenance of the capacity to act on that information should the data subject request modification, deletion or restriction of processing. Tracking of request workflows and holding of detailed records to gauge effectiveness and demonstrate compliance. Organizations face great challenges in sifting through structured and unstructured data stores — whether on-premises, in the cloud, or with partners and subprocessors. In addition to the discovery and retrieval requirement, organizations must redact personal data that is associated with other individuals to ensure they are not violating one user’s rights in order to respond to another. For those reasons, request fulfillment must follow a repeatable and scalable process in order to remain manageable and efficient.
The third-party risk management (TPRM) technology market offers solutions to identify, assess, manage, monitor and report on third-party risks associated with vendors, suppliers, distributors, agents, partners or other third parties. Solutions in this market can support a wide range of TPRM workflows across various risk domains. TPRM platforms in this market address the needs of a diverse range of customers and risk domains, including legal, compliance, procurement, supply chain, IT, cybersecurity and other teams that work with or provide routine oversight of third parties. Some technology solutions offer enterprise third-party risk management workflow as a feature, along with risk tiering, due diligence, risk mapping, metrics and reporting mechanisms. Other platforms may facilitate integration with risk data subscriptions, data aggregators or other subscriptions. The TPRM technology market is a complex array of solutions servicing many business functions across an enterprise. TPRM solution providers can be categorized into technology platforms and tools, or risk-domain-specific data and insights.