Buy the platform for reproducibility and lineage. Buy the approval workflow separately, because only the three specialists here actually sell you one.
Every MLOps platform on this list will tell you it does model governance. What almost all of them mean is a registry — a versioned list of model artifacts with tags and permissions. Your examiner does not want a list. They want to know who approved this model for production, what the second line of defence challenged it against, and whether you can rebuild the exact artifact that scored a declined loan applicant fourteen months ago. That is a workflow with signatures on it, and most of these platforms do not have one.
If you are a model risk or platform owner in a bank, an insurer or a health system, the short answer is: Domino Data Lab if governance is the reason you are buying, and if you need a real air gap. Databricks or Amazon SageMaker AI if the lakehouse or the AWS account already exists and you accept that you will bolt a sign-off layer on top. DataRobot if auto-generated validation documentation is the bottleneck. Google Vertex AI is the weakest option in this category and it is not close.
Normalised to one workload, because vendors otherwise each recite their favourite metric: one Annex III-class credit-scoring model, three validators in an independent second line, quarterly revalidation, and a regulator who wants the evidence pack in five business days.
| Platform | Inventory + lineage | Approval workflow | Reproducibility evidence | True air gap | Audit export | List price |
|---|---|---|---|---|---|---|
| Domino Data Lab | Purpose-built system of record | Yes — templates, checklists, policy gates | Guaranteed and automatic | Yes — on-prem, self-managed | Generated evidence + audit trail | Contact sales |
| DataRobot | Registry + deployment records | Registry approval + champion/challenger | Per-model, inside the platform | Self-managed available | DOCX compliance doc, editable | Contact sales |
| Dataiku | Govern node, separate licence | Yes — blueprints and sign-off | Project-level | Self-managed available | Via Govern node | Contact sales |
| Amazon SageMaker AI | Model Cards + Registry | Approval flag, no named approver | Training job + container lineage | GovCloud only, not disconnected | Model card → PDF, immutable versions | No extra charge over compute |
| Databricks | Unity Catalog lineage — the best here | Tag-based approval task, Public Preview | Job snapshot + UC lineage | No. Control plane is always SaaS | Audit logs, no evidence pack | DBU-metered, tier negotiated |
| Azure Machine Learning | Registry + job snapshot | None — tags and Event Grid | Code, data and compute snapshot | Inference only, via Azure Local | Metadata, roll your own | Compute-metered |
| Google Vertex AI | Versions, aliases, labels | None | Weakest of the seven | Registry not in the air-gapped SKU | None to speak of | Compute-metered |
Both Rules You Were Buying Against Changed This Year
The two regulatory anchors under a regulated MLOps purchase both moved in 2026, and most vendor compliance pages have not caught up.
SR 11-7 no longer exists. On 17 April 2026 the Federal Reserve issued SR 26-2, Revised Guidance on Model Risk Management, which "supersedes and replaces" the April 2011 guidance that had governed bank model risk for fifteen years, and is aimed most directly at banking organisations above $30 billion in total assets. It is roughly half the length of its predecessor and, per Sia Partners' comparison, narrows the definition of a model, drops default annual revalidation in favour of a materiality-based cadence, and keeps the requirement for objective review by qualified independent personnel.
Then it removes the thing you are probably buying for. Domino's reading of the new guidance quotes it directly: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." Out of scope is not the same as unregulated — the guidance tells institutions to fall back on their own risk management practice for anything it does not cover. Practically, that means the examiner still asks, and you no longer have a federal document to point at when you answer.
The EU AI Act's high-risk deadline moved too. Credit scoring of natural persons and risk pricing for life and health insurance are Annex III points 5(b) and 5(c) — squarely high-risk, squarely this reader. The Digital Omnibus on AI deferred those obligations from 2 August 2026 to 2 December 2027, and product-embedded high-risk systems to 2 August 2028. Article 50 transparency duties were not deferred and applied on schedule.
Do not read the deferral as fifteen spare months. Read Annex IV, which is what you will eventually have to produce: datasheets describing training methodologies and datasets, their provenance and labelling procedures, validation and testing procedures with the metrics used, and — the clause that decides this entire buying decision — "test logs and all test reports dated and signed by the responsible persons." Article 12 adds automatic event logging over the lifetime of the system. Signed reports and lifetime logs are not things you retrofit in a quarter.
A Model Registry Is an Inventory, Not an Approval Workflow
A model registry answers "which artifact is in production." An approval workflow answers "who is accountable for putting it there." Most of these platforms do not do the second one.
The most misread case is Databricks. The open-source MLflow registry deprecated model stages as of MLflow 2.9.0, replacing them with aliases and tags. Databricks then carried that into Unity Catalog and went further: the documentation states plainly that stages are not supported and webhooks are not supported for models in Unity Catalog. The recommended pattern is to reassign an alias such as @champion and restrict who holds the CREATE MODEL VERSION privilege on the production schema — after which, the documentation says, "you can perform any necessary pre-deployment validation." It does not say where that validation happens or who signs it off, and it is explicit that nothing further is expected of the platform: "You don't need to configure any other rules or policies to govern model promotion and deployment."
That unspecified elsewhere is where most model risk processes still live, in Jira and SharePoint, which is what you were trying to fix.
There is one more mechanism, and it is easy to miss because it does not appear in the registry documentation at all. MLflow 3 deployment jobs — in Public Preview, not GA — fire automatically when a new model version is created and can carry an explicit approval task: a privileged user reviews the evaluation metrics, approves in the model version UI, and the run is kept in an activity log on the model page. Check the mechanism before you credit it. Approval is implemented as a Unity Catalog tag set to Approved, gated by who is permitted to apply that tag. That is a permission-controlled flag with a log behind it — the same shape as Amazon's, better for keeping the log, worse for being a preview feature you cannot yet point an examiner at. It is not a named signature from an independent validator, and Databricks does not claim it is.
To be fair to Databricks, Unity Catalog has the best lineage of anything here — it traces provenance from training datasets through to the registered model version, and that is genuinely hard to build. The gate it now offers is a preview feature that sets a tag.
Amazon ships the same idea, generally available and better documented, and the distinction is worth understanding precisely. SageMaker Model Registry has a real state machine: PendingManualApproval transitions to Approved or Rejected, and Approved can initiate CI/CD deployment. But it is a field on an API call — anyone holding the update_model_package IAM permission can flip it, the comment box is optional, and there is no notion of a named approver or enforced segregation between the person who built the model and the person who blessed it. That is an approval flag with an IAM policy behind it. If your policy says a validator independent of development must sign, you are enforcing that in IAM and CloudTrail, not in SageMaker.
Azure Machine Learning does not claim more than it has. Its registry is name, version and tags, with lineage metadata and Event Grid events you can wire into Azure Pipelines. There is no sign-off step; there is a good event bus you can build one on.
Vertex AI is the floor. Its Model Registry offers versioning, aliases and labels — organisational features, with no governance state machine and no promotion gate at all.
The three that ship a sign-off workflow rather than a flag are the specialists. Domino's model risk management is built as a single system of record with templates, checklists and policy enforcement, and names SR 26-2 and the EU AI Act as its targets. Dataiku Govern provides blueprints and sign-off — but note it is a separate node with its own Standard or Advanced licence, not something included in the platform you may already own. DataRobot pairs registry approval with champion/challenger comparison, which matters because effective challenge against alternative models has been the load-bearing part of US model validation practice since the 2011 guidance and survives into the new one.
What Goes Into the Air Gap Is the Inference, Not the Governance
All three hyperscalers can now run models inside a disconnected environment. None of them puts the model registry, the lineage graph or the approval record in there with it. This is the single most misread capability in the category.
Databricks is the cleanest case, because it does not pretend. There is no on-prem, bare-metal or disconnected Databricks — the control plane, including the UI, the scheduler, Unity Catalog and model serving, is Databricks-operated SaaS, and no supported mode works without a live connection to it. The "air-gapped Databricks" architectures circulating in forums are private networking: PrivateLink, Private Service Connect, no public egress. A private line to a vendor's control plane is not an air gap. If your control requirement is that no third party can see model metadata or orchestrate your workloads, Databricks fails it by design, and no amount of network topology changes that.
Google is subtler and easier to get wrong in a vendor meeting. Vertex AI is available on Google Distributed Cloud air-gapped — but what ships is a subset: generative AI, Online Prediction (in preview), OCR, Speech-to-Text, Translation and Workbench. Model Registry, Model Monitoring, Pipelines and Model Evaluation are not on that list. You can serve a model in the enclave. You cannot govern its lifecycle there.
Microsoft's Azure Local disconnected operations, now generally available for fully offline environments, has the same shape: Foundry Local runs models on your hardware with no cloud dependency. Azure Machine Learning's registry and workspace lineage are not what runs there.
Domino is the outlier and it is why it wins this criterion outright. It installs in your own infrastructure — on-premises, in your VPC, or in a managed subaccount with single-tenant isolation, and carries the certification set a regulated buyer actually gets asked for: SOC 2 Type II, ISO 27001:2022, ISO 9001:2015, HIPAA, GDPR, GxP and 21 CFR Part 11. That last pair is why Domino keeps showing up in pharma as well as in banks and insurers.
Reproducibility Is the Evidence, and It Is Not Uniformly Real
Reproducibility means one thing to an examiner: hand me a decision from fourteen months ago and I will rebuild the exact model that made it, from the exact data, in the exact environment. Version control on the artifact is not enough — you need the code, the data snapshot, the container image and the parameters, bound together and immutable.
Azure Machine Learning is quietly strong here. Its job history stores a snapshot of the code, data and compute used to train a model, and its environments reproduce pip and conda dependencies without manual configuration. Databricks gets you most of the way through Unity Catalog lineage plus job history. Domino makes reproducibility the product claim, automatically recording model metadata, code changes and data lineage as evidence and marketing the audit trail as a reduction in examination preparation time.
On export — the artifact you actually hand over — the ranking inverts, and Amazon does something genuinely useful for free. SageMaker Model Cards capture intended uses, a High/Medium/Low/Unknown risk rating with a written justification, training job ARN and datasets, evaluation results and ethical considerations, and export to PDF. Better, any edit other than an approval status change creates a new model card version, "in order to have an immutable record of model changes." That is a defensible audit artifact, and it costs nothing beyond the compute you were already paying for.
DataRobot goes furthest on the document itself. Its compliance documentation generator produces evidence that the model's components work as intended and that it is "conceptually sound" — the exact vocabulary of US validation practice — as an editable Microsoft Word file from customisable templates, and names the Fed guidance as the use case. If your validators spend six weeks writing a document nobody reads twice, that is the feature you are buying. Note the boundary: it does not cover external or custom global models, so a portfolio full of third-party vendor models gets less benefit than a portfolio you built yourself.
Vertex AI has no comparable export. That is the third strike.
What This Costs, and Which Vendors Will Even Tell You
The governance layer is the contact-sales layer, at every single vendor that has one. That is the actual pricing finding, and it is consistent enough to be a rule.
Prices below were checked on the vendors' own pages on 31 August 2026 and will drift.
The hyperscalers publish. AWS charges nothing extra for governance — SageMaker AI pricing is compute and storage on demand with no minimum, at rates such as $0.23 per hour for ml.m5.xlarge and $0.7364 for ml.g4dn.xlarge, and Model Registry, Model Cards and Model Dashboard carry no separate line item. Azure ML and Vertex AI are likewise metered on compute, with governance features included.
Databricks quotes in DBUs, not dollars, which is a real obstacle to comparison. Model Serving lists 10.48 DBU per hour for a T4-class GPU and 800 DBU per hour for an 8×H100 configuration — but the dollar value of a DBU depends on cloud, region, instance type and your tier, and Enterprise-tier pricing, which is where the compliance certifications live, is negotiated rather than published.
Domino publishes three editions — Domino Cloud, Premium and Enterprise, the latter two self-managed for regulated organisations — with tiered service-account and admin allocations, unlimited consumer licences, and no published price. Dataiku publishes none, and its Govern node is separately licensed on top. DataRobot publishes none.
For a reference point on what a dedicated governance layer costs when someone does list it: IBM watsonx.governance as a Service publishes a $42,000 12-month Standard contract covering one instance, five AI use cases, 25 concurrent users and 12,000 evaluations, with each additional use case listed at $15,960. Treat it as an order of magnitude: governance for a handful of models is a five-figure annual line, not a rounding error, and it is priced per use case rather than per seat.
Who Should Not Buy Each of These
- Do not buy Domino if you are a cloud-native team with a dozen models and no independent validation function. You will pay a self-managed platform's operating cost — Kubernetes, upgrades, capacity — for a governance apparatus you have nobody to staff. Domino earns its keep when a second line of defence exists and is the bottleneck.
- Do not buy Databricks for governance if a control requirement says a third party cannot orchestrate your workloads or hold your metadata. Buy it because Unity Catalog lineage and the lakehouse are worth it, and budget for a governance layer on top. Do not let anyone sell you PrivateLink as an air gap.
- Do not buy SageMaker if you need enforced segregation of duties out of the box. You are building that in IAM, SCPs and CloudTrail, and someone has to own it. Also skip it if you are not already an AWS shop; the governance primitives are good but they are not a reason to move clouds.
- Do not buy Azure ML as your model risk system. It is a strong reproducibility and automation platform with an excellent event bus and no opinion about approval. If your team will not build the sign-off workflow on Event Grid, nobody will.
- Do not buy Vertex AI for a regulated model portfolio at all. It is a capable training and serving platform; it is not a governance product, and its air-gapped SKU excludes the registry entirely.
- Do not buy DataRobot if most of your models are third-party or externally hosted — the compliance document generator, its strongest feature, does not cover external models.
- Do not buy Dataiku assuming governance is included. Confirm the Govern node and its licence tier are in the quote, in writing, before you sign.
The Four Criteria That Predict Regret
Everything else is noise. These are the questions where the wrong answer costs you a remediation programme two years out.
- Can the platform record a named human approving a specific model version, immutably? If the answer is "you can set a tag" or "you can restrict the permission," that is a no. Design the compensating control now, not during an exam.
- Where does the control plane run? If it is the vendor's SaaS and your requirement is a genuine air gap, no network architecture fixes it. This is a binary, and it eliminates options rather than ranking them.
- Can you produce the evidence pack in five business days without a person writing prose? SageMaker's PDF model card and DataRobot's DOCX generator are the two answers that survive contact with a real deadline.
- Does the governance capability come with the platform or as a separately licensed node? Dataiku Govern is the explicit case, but Databricks Enterprise tier and Domino's editions are the same question wearing different clothes.
What changes the answer: if your generative AI portfolio is growing faster than your classical model portfolio, weight the workflow and the evidence export harder and the training platform less — SR 26-2 has explicitly declined to cover those systems, so the standard you are held to is the one you wrote down yourself.
Do This in the Next 90 Days
This month: Pull your model inventory and mark every entry that is generative or agentic. Under SR 26-2 those sit outside the guidance, which means your internal policy is the only control document, and someone should read it against what you are actually running.
This quarter: Run the five-day test on one real model. Pick a production model, ask the owning team to produce the full evidence pack — training data snapshot, environment, validation results, approval record, monitoring history — and time it. Whatever the platform's brochure says, that number is your capability.
Before your next renewal: Get the governance licence line itemised in every quote you are holding. If a vendor cannot tell you what the governance node costs separately from the platform, you do not yet have a price.
The Bottom Line
The MLOps category grew up serving data science velocity, and it is very good at that. Model risk management is a different discipline with a different customer — the validator, the auditor, the examiner — and it wants signatures, immutability and evidence, none of which make a model ship faster. That gap is why the specialists still exist a decade in, and why Databricks can have the best lineage graph in the industry and still not be a model risk system.
The deferral of the EU high-risk deadline to December 2027 and the rescission of SR 11-7 both read like slack in the schedule. They are not. One removed a document you used to be able to hand an examiner; the other pushed back a deadline for producing signed test reports you still cannot produce today.
Buy the platform for what it is good at. Then go buy the signature.
Continue Reading
Best RAG Platforms for Regulated Industries: Permissions First EU AI Act Governance Tools: Buy Inventory, Not Policy Packs Snowflake Cortex vs Databricks Mosaic AI: Pick on Exit Cost Socure Bought Fravity. Your Examiner Reads 70% Backwards. Anthropic's Evals Maxed Out. Stop Inheriting Its Assurance. Britain Regulated Four Clouds. Not the Models Inside. Hospitals Test Vendor AI. Fewer Than Half Have a Sandbox. Tricentis Bought Tabnine's Context Engine, Not Your IDE