Most organizations have moved past asking whether to use AI. The harder question now is whether they can prove the AI they run is doing what it should.

That gap is why we are writing this together. Today, Collibra announced the acquisition of Trail ML, the Munich-based AI governance company founded in 2023 by Anna Spitznagel, Nikolaus Pinger and Sven Hölzel. Trail's capabilities will become part of Collibra AI Command Center. Here is what that means, and why we believe it matters for anyone responsible for AI in a large organization.

When AI lived in pilots, governance could live in documents. A team would map the Governance Framework to a set of requirements, write the policies, conduct a manual assessment and file the results. It was never an exciting task, but it was manageable because systems changed slowly and the people assessing them could keep up.

That is no longer the world. Models are retrained. Agents call tools, touch systems and act on data without a human in each loop. Regulations keep evolving. A requirement recorded in a spreadsheet does nothing to stop an agent from taking an action it should not take, and an assessment completed in March says little about a system that was redeployed in June.

Knowing which rules apply is table stakes. The organizations that will scale AI with confidence are the ones that can continuously answer four questions: what AI is running, which controls should apply, whether those controls are working and whether they are being enforced where the AI operates. Answering those questions by hand, across hundreds of models and agents, does not sca+69-le and leads to the prominent problem of "I can build my agent in a day, but wait months to get it approved by compliance." We would argue it never really did.

From regulatory requirements to continuous enforcement

Trail was founded on the belief that AI governance has to be technical and operational, not administrative. Governance teams were spending most of their time collecting evidence, interpreting frameworks and chasing updates, and very little of it exercising judgment.

Trail's agents take on that repetitive work. They analyze an AI system and its surroundings, determine which frameworks and controls apply, and complete multi-step governance workflows. Based on the risk profile of a given system, the relevant requirements from regulations and standards such as the EU AI Act, ISO 42001 and the NIST AI Risk Management Framework are identified and turned into concrete governance actions.

Instead of recording that a requirement exists, the agents read the evidence, including documents, spreadsheets, technical documentation and code. They assess whether a control is in place and effective, explain their reasoning and link every finding back to its source. Every assessment is traceable and auditable, with human review and approval where required, ensuring that automation doesn’t come at the expense of accountability. As underlying evidence changes, assessments can be automatically updated, keeping governance accurate and relevant over time.

From paper policies to enforceable governance

Enforcement follows governance into production. Trail’s runtime capabilities turn governance requirements into controls on what an AI agent can access and do. Organizations can define which tools an agent may use, restrict specific actions and enforce policies based on risk, data and other factors, including securely blocking an action when a condition is violated. This turns governance from a static set of policies into actionable safeguards, helping organizations scale AI adoption while maintaining control, accountability and trust.

Automated AI visibility, control and compliance

Automation is only as good as what it knows. An agent assessing an AI system needs to understand the data that system touches, the systems it connects to, who owns it and which policies and regulatory requirements apply. Trail did not have that enterprise-wide view. Collibra has spent eighteen years building it.

Collibra AI Command Center gives organizations one place to understand, govern and control AI across data, models, applications and agents. It holds the information that gives AI meaning: which use cases exist, which models and agents serve them, what data they touch, who owns them and which rules apply.

Trail adds automation that puts that information to work. Knowing what an AI system is, what data it touches and who owns it can trigger the right frameworks, risks, controls and workflows for that system. Trail agents can assess controls against real evidence, surface gaps and keep assessments current as systems and requirements change. In production, Trail augments Collibra's existing policy enforcement with runtime controls over agent tools and actions.

The result is that policies, regulations and standards become operational inputs into how AI is governed, rather than a documentation layer around it.

Building the control plane for enterprise AI

The principle behind all of this is that AI governance cannot stop at defining policies or assessing risk. As AI becomes more autonomous, those policies have to become controls that are continuously applied and enforced. That is the direct line we are building, from what we know about each AI system, through regulatory requirements and policy, to runtime behavior.

A few things we want to be clear about.

Humans stay in charge. Agents take on the repetitive parts of governance, such as analyzing evidence, assessing controls and orchestrating workflows. Oversight and approval remain with people. We think that division of labor is the only credible way to govern autonomous systems, and it is how both of our teams have always approached the problem.

Governance becomes continuous. Instead of a point-in-time assessment that is stale by the time it is signed, organizations get an ongoing loop: identify gaps, assess controls, enforce requirements, monitor change and adapt as AI evolves.

And organizations should not have to choose between moving quickly with AI and keeping control of it. That belief brought our two teams together, and it is what we are now building toward as one.

If you are responsible for AI in your organization, we would welcome the conversation. To learn more about Collibra AI Command Center and our approach to AI governance and control, visit collibra.com.