Credo AI is a leading AI governance platform, but its policy pack configuration for specific regulatory frameworks is poorly documented. This guide covers what Credo AI actually does, how to map it to EU AI Act and NIST RMF requirements, and what it does not cover.
This article is based on publicly available Credo AI documentation and community knowledge as of Q1 2026. Platform features evolve. Always verify current capabilities in the Credo AI product and documentation before making purchasing decisions.What Credo AI Actually Does
Credo AI is an AI governance platform designed to help organisations assess, monitor, and report on AI systems against regulatory requirements and internal policies. Its core workflow is:
- Register an AI use case (the business context, intended use, and risk tier).
- Define a governance policy (a set of requirements mapped to a regulatory framework or internal standard).
- Connect an AI model or dataset for automated technical assessment.
- Generate evidence and reports showing compliance status against the policy.
Credo AI's strength is bridging technical AI metrics (fairness, robustness, performance) with governance and compliance documentation. It is not a model training or monitoring tool — it sits above your ML pipeline and translates technical results into compliance evidence.
The Policy Pack Model
Credo AI organises governance requirements into 'policy packs' — sets of controls grouped by regulatory framework or standard. Out-of-the-box policy packs typically include:
- NIST AI RMF (core functions and sub-categories).
- EU AI Act (high-risk system requirements).
- ISO/IEC 42001 (AI management system controls).
- OECD AI Principles.
- Sector-specific frameworks (financial services, healthcare).
- Internal policy templates for organisations without a specific external standard to follow.
Each policy pack contains individual controls — specific requirements that must be evidenced. Controls can be satisfied by automated technical assessments (Credo AI runs the assessment) or by uploaded evidence (you provide a document, screenshot, or record).
Setting Up a Project: Step by Step
Step 1: Register the AI use case
Every governance project in Credo AI starts with a use case registration. This is not optional — the platform's risk scoring and policy mapping are driven by the use case metadata.
Required fields for a complete use case registration:
- Use case name and description.
- Intended purpose and context of deployment.
- User types (internal employees, external customers, regulated individuals).
- Geographic deployment scope (determines which regulatory frameworks apply).
- Output type (decision, recommendation, prediction, content generation).
- Sensitivity level of inputs (contains personal data? biometric data? financial data?).
Fill in the use case metadata carefully. Credo AI's risk tier suggestion and automatic policy recommendation are driven by this metadata. A vague use case description will result in a policy pack that is too broad or misaligned with your actual regulatory exposure.Step 2: Select and configure the policy pack
After registering the use case, select the policy pack(s) that apply. For most commercial AI products in the EU:
- Select EU AI Act if the use case involves any Annex III category (employment, credit, education, law enforcement, etc.).
- Select NIST AI RMF if your organisation follows or reports to the NIST framework (US federal context, or as a governance baseline).
- Consider ISO 42001 if you are pursuing certification.
When you select a policy pack, you will see a list of controls. Each control is pre-configured with a description, the regulatory source, and the type of evidence required. You can customise which controls are in scope for your specific use case.
Step 3: Run technical assessments
Credo AI can connect to your model and data to run automated assessments. Connection methods include:
- Direct Python SDK integration (credoai-lens library) — run assessments programmatically and push results to Credo AI.
- CSV or dataset upload — upload your model's predictions and ground truth labels for offline assessment.
- API integration — for real-time or batch production model assessment.
The technical assessments Credo AI can run automatically include: performance metrics (accuracy, F1, RMSE), fairness metrics across protected attributes, data quality checks, and model robustness tests. These results are mapped to the relevant policy controls automatically.
Mapping Credo AI to EU AI Act Requirements
The EU AI Act requires high-risk AI systems to satisfy Articles 8 through 15. Here is how Credo AI's capabilities map to each:
| EU AI Act requirement | Credo AI coverage | What Credo AI does not cover |
|---|---|---|
| Article 9: Risk management system | Partial — Credo AI provides a structured risk register and evidence collection framework | Does not generate the full risk management system documentation. You must write the risk treatment plans and risk acceptance decisions externally. |
| Article 10: Data governance | Good — data quality and bias assessments are automated via the Lens SDK. Dataset cards can be linked as evidence. | Does not manage or audit your actual data pipelines. It assesses datasets you provide. |
| Article 11: Technical documentation (Annex IV) | Partial — Credo AI generates compliance reports that serve as input to technical documentation, but the full Annex IV documentation must be assembled externally. | Not a documentation system. Reports from Credo AI are inputs, not the final technical file. |
| Article 12: Record-keeping / logging | Partial — Credo AI logs assessment results and evidence. Does not capture operational logs from the deployed AI system. | Operational system logs must be maintained separately (your infrastructure, not Credo AI). |
| Article 13: Transparency | Partial — Credo AI can generate model cards and use-case summaries that support transparency documentation. | Deployer-facing documentation and user-facing disclosures must be produced separately. |
| Article 14: Human oversight | Minimal — Credo AI assesses whether your system design includes human oversight indicators, but cannot implement oversight mechanisms itself. | Human oversight is a product design requirement. Credo AI can assess evidence of it but cannot build it. |
| Article 15: Accuracy, robustness, cybersecurity | Good for accuracy and robustness — automated test suites. Cybersecurity testing is out of scope. | Cybersecurity assessment requires separate tools (penetration testing, adversarial attack testing at infrastructure level). |
Mapping Credo AI to NIST AI RMF
NIST AI RMF support in Credo AI focuses primarily on the MEASURE function, with lighter coverage of the others:
| AI RMF function | Credo AI support level |
|---|---|
| GOVERN | Low — Credo AI can store governance policies and ownership assignments, but does not actively support the organisational and cultural dimensions of GOVERN. |
| MAP | Medium — Use case registration and risk tiering support the context identification and risk categorisation work of MAP. Risk taxonomy is guided by the framework. |
| MEASURE | High — Automated technical assessments for fairness, robustness, and performance map directly to MEASURE sub-categories. Dashboard views show metric trends. |
| MANAGE | Medium — Risk register and evidence tracking support MANAGE documentation. Workflow triggers for metric breaches can be configured. Does not replace an incident response process. |
Common Configuration Mistakes
- Using the default policy pack without customising the control scope. Many controls in the default EU AI Act pack are not relevant to every use case. Leaving irrelevant controls in scope creates unnecessary compliance overhead and dilutes attention from what matters.
- Running Lens assessments on unrepresentative test sets. Credo AI is only as good as the data you give it. Fairness assessments on unbalanced or non-representative evaluation datasets will produce misleading compliance results.
- Treating Credo AI reports as complete EU AI Act technical documentation. The Credo AI compliance report is an input to your technical documentation file, not the file itself. Annex IV requires more context than any automated tool can provide.
- Not configuring protected attributes before running fairness assessments. Fairness metrics require you to specify which demographic groups to assess. Leaving this unconfigured produces aggregate metrics that miss group-level disparities.
- Using Credo AI only at pre-deployment. The platform's value increases significantly with continuous production monitoring. Set up automated assessments on a cadence, not just before each release.
What Credo AI Does Not Replace
Credo AI is a governance tool, not a compliance solution. Understanding what it does not cover is as important as understanding what it does:
- Legal analysis: Credo AI does not tell you whether your system is legally compliant. It shows whether your technical controls evidence the specified requirements. Legal determination requires qualified counsel.
- EU AI database registration: Credo AI does not register your system in the EU AI systems database. This must be done directly via the official EU platform.
- Notified body conformity assessment: For Annex III categories requiring third-party assessment (some biometric and critical infrastructure cases), Credo AI reports can support but do not substitute for notified body review.
- Incident reporting: Post-deployment serious incident reporting to national authorities is not handled by Credo AI. Your incident response process must cover this.
- Supplier governance: While Credo AI can document AI supply chain policies, active monitoring of third-party AI model compliance requires direct engagement with suppliers.
Credo AI works best as the compliance evidence layer that sits on top of your existing ML infrastructure (MLflow, Weights and Biases, or any model registry) and governance processes. It is a documentation and measurement platform, not a governance programme in a box.