Report: Dify vs LangFlow vs Flowise for Government AI Platforms

Overview

This report analyzes three open-source, low-code LLM application builders — Dify, LangFlow, and Flowise — as candidates for use in government and highly regulated environments. The focus is on:

• Security and vulnerability posture
• Deployment and data-isolation options
• Governance, observability, and operations
• Compliance readiness and real-world fit for public-sector use

A comparative analysis for Brazilian federal agencies evaluating these three tools provides a useful anchor for this assessment.¹ Additional evidence comes from vendor docs, security advisories, and AI-governance literature.

Bottom line: Dify is the only one of the three that currently looks close to an enterprise-/government-ready core platform from a security and compliance standpoint. LangFlow and Flowise can be useful components or prototyping tools, but their active vulnerabilities and missing governance features make them risky as primary government AI platforms unless they are very tightly isolated and wrapped with strong controls.

---

High-level Comparison

Dimension	Dify	LangFlow	Flowise
Primary role	Low-code AI app & agent platform	Visual orchestration IDE for LLM workflows	Low-code LLM/agent builder
Hosting model	SaaS plus open-source self-host (Docker, K8s, hybrid)2	Open-source; self-host (K8s, Docker) with best-practice guides3	Open-source; self-host; often fronted by AI gateways / proxies4
Security certifications	SOC 2 Type I & II, ISO 27001:2022, GDPR for Dify Cloud and security program5	No public SOC 2 / ISO 27001 / FedRAMP claims; relies on infra security controls	No public SOC 2 / ISO 27001 / FedRAMP claims; relies on infra + AI gateways
Major recent CVEs	None reported at the app layer in current research; depends on stack hardening	CVE-2025-3248 RCE (CVSS 9.8), missing auth on /api/v1/validate/code, actively exploited and on CISA KEV list67	CVE-2024-31621 (runtime exposure of private dashboards, keys)8 and CVE-2025-61913 (arbitrary file read/write → possible RCE)9; multiple data-leak incidents10
Built-in governance	Centralized app governance, API key encapsulation, workspace isolation, observability11	Visual versioning via integrations (Cake, etc.), no full-blown policy engine; external tools (Langfuse, LangWatch, Opik) for observability12	Some audit logging and policy hooks via integrations (TrueFoundry, gateways) but not a full AI-governance suite413
Public-sector positioning	General enterprise / production-ready, not explicitly marketed as a gov-only platform, but has strong infosec posture	Designed as a general-purpose dev tool; critical RCE makes direct exposure in gov networks high-risk	Designed as a lightweight builder; several real-world misconfigurations leading to AI data leaks; better as a lab / component than core gov backbone

---

Dify for Government and Regulated Environments

Capabilities and Architecture

Dify is an open-source AI-native application platform with a strong focus on production use:

• Deployment flexibility: SaaS (Dify Cloud) and self-hosted options (Docker, Kubernetes, templates for AWS and other clouds) enable hybrid and on-prem models.²¹⁴
• Feature set: Workflow builder, multi-model support, RAG, agent orchestration, prompt engineering, operational monitoring, and REST APIs.¹⁵
• Governance: Centralized management of LLM APIs, API keys, and app configs with workspace boundaries and observability.¹¹

These capabilities align with government requirements for segmented environments, controlled LLM access, and maintainable operations.

Security and Compliance Posture

Key security and compliance evidence:

• Formal certifications: Dify’s team reports SOC 2 Type I & II, ISO 27001:2022, and GDPR compliance for its product and security program, backed by an internal ISMS.⁵
• Secure design priorities: Reviews emphasize that Dify is built to be “production-ready from day one”, focusing on scalability, stability, and security rather than toy prototypes.¹⁶
• Encryption and key management: Documentation describes encrypted model keys and guidance on key-rotation; loss of encryption keys renders model keys unrecoverable, consistent with strong cryptographic practices.¹⁷
• Data protection controls: External analyses highlight Dify’s encapsulation of LLM APIs and secure centralized management of API keys plus support for hybrid deployments with end-to-end encryption.²¹⁸

This combination (formal audits plus open-source self-hosting) is rare among community LLM builders and is materially closer to what public-sector CISOs expect.

Strengths for Government Use

1. Certifications and governance:

   • SOC 2 and ISO 27001:2022 provide a baseline for controls over access, change management, logging, and incident response.⁵
   • GDPR focus improves privacy practices for EU public bodies.

2. Hybrid / on-prem flexibility:

   • Self-hosting on K8s with standard enterprise-hardening guidance means data can remain in sovereign environments.
   • Hybrid patterns (e.g., Dify control-plane in cloud, data-plane on-prem) resemble models used in healthcare/finance for compliance-sensitive workloads.¹⁹

3. Operations and observability:

   • Built-in monitoring and logging for workflows and agents allow integration with SOC/SIEM.
   • Agentic workflows and RAG pipelines live in a single governed platform, simplifying audit trails compared with ad hoc script stacks.

Limitations and Risks

Despite its strengths, Dify is not a dedicated gov-cloud product:

• No FedRAMP / national gov certifications (yet): There is no evidence of FedRAMP, StateRAMP, or EU-specific cloud certifications; these would still need to be achieved at the infrastructure layer (AWS GovCloud, Azure Government, etc.).
• Limited public gov case studies: Public evidence of actual government deployments is scarce. Most case studies reference commercial enterprises or consumer-electronics firms.²⁰
• Policy and risk tooling gaps: Dify does not ship with a full AI-governance suite (risk registers, impact assessments, bias testing). Agencies will still need overlay tools (e.g., VerifyWise, ModelOp, or bespoke governance frameworks).what-ai-governance-platforms-exist-for-government-use

In regulated environments, Dify is best treated as the LLM app layer inside a broader platform that includes hardened infrastructure, zero-trust networking, and dedicated AI-governance tooling.

---

LangFlow for Government and Regulated Environments

Capabilities and Intended Use

LangFlow is a visual IDE and orchestration tool for LLM workflows built on top of LangChain:²¹

• Drag-and-drop composition of chains, agents, tools, and vector stores.
• Integrations with major LLMs, vector databases, and external APIs.²²
• Deployable on Kubernetes and Docker with hardened container options and TLS frontends.³
• Integrations with observability stacks such as Langfuse, LangWatch, Opik, and OpenTelemetry.¹²

Its sweet spot is developer productivity and visualization, not being a full enterprise AI-governance platform.

Security Posture and CVEs

The most material issue for LangFlow in 2025 is CVE-2025-3248:

• A missing authentication vulnerability in /api/v1/validate/code allows remote unauthenticated code execution on vulnerable servers.⁷
• CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and instructing US federal agencies to patch to v1.3.0+ by a deadline.⁶
• Security research shows the endpoint compiled and executed arbitrary user-supplied Python without sandboxing or sanitization, enabling full system compromise and use in botnets (e.g., Flodrix).²³²⁴

This is a critical red flag: any government deployment exposing LangFlow to untrusted networks without strict controls is categorically unsafe until patched and further hardened.

Beyond this CVE:

• Security researchers and Horizon3 emphasize that LangFlow historically lacks sandboxing and strong privilege separation, making RCEs “by design” a recurring risk when code execution tools are misused.²⁵
• CISA and multiple advisories recommend no direct internet exposure for LangFlow; instances should be isolated behind VPN/ZTNA, WAFs, and RBAC layers.²⁴²⁶

Governance and Observability

On the governance axis, LangFlow offers building blocks rather than a turnkey solution:

• You can pair LangFlow with Langfuse, LangWatch, or Opik to collect traces, metrics, and evaluations using OpenTelemetry.¹²
• External tools (AgentOps, Arize, etc.) provide additional “glass-box” observability over agent behavior.²⁷
• Cake.ai and others integrate LangFlow into broader governance environments, adding versioning, approvals, and policy on top.²⁸

But none of this is native, opinionated governance focused on government risk categories (rights-impacting AI, high-risk use-cases, etc.). It’s closer to a developer toolbox that you can embed inside a more governed platform such as SmythOS, ModelOp, or dedicated AI-governance suites.how-do-government-ai-governance-platforms-work

Fit for Government Workloads

Where LangFlow can fit:

• As a visual dev tool inside a secure, non-production environment; e.g., an internal sandbox for prototyping flows that are later re-implemented in a more locked-down runtime.
• As a component inside a larger orchestrated stack that provides RBAC, network isolation, logging, and policy controls.

Where it is risky as a primary platform:

• Direct exposure to untrusted traffic (citizen-facing portals, cross-domain services) due to history of RCE vulnerabilities and lack of built-in sandboxing.
• Environments requiring strong assurance levels comparable to FedRAMP High, CJIS, or defense standards; LangFlow has no out-of-the-box certification story here.

Governance gap: nothing in the current ecosystem indicates that LangFlow alone can satisfy the public-sector needs for explainability, bias management, impact assessment, and structured human oversight. Those functions must be delivered by overlays and procedures.

how-to-harden-langflow-for-public-sector-use

---

Flowise for Government and Regulated Environments

Capabilities and Positioning

Flowise is an open-source visual builder for LLM apps and agent workflows:

• Drag-and-drop node editor similar to LangFlow.
• Targets use cases like document Q&A, summarization, and multi-step conversational flows.²⁹
• Often deployed alongside AI gateways or platforms such as TrueFoundry or SmythOS, which provide centralized auth, routing, and policy enforcement.⁴³⁰

It is widely adopted in the community but not designed as a security-first, compliance-certified platform.

Security Incidents and Vulnerabilities

Flowise has been directly linked to real-world data exposures and carries multiple notable vulnerabilities:

1. Misconfigurations leading to data leaks

   • UpGuard’s “Downstream Data” report documents cases where Flowise deployments leaked internal data and credentials via exposed endpoints.¹⁰

2. Exposed credentials and dashboards (CVE-2024-31621)

   • Security research found many Flowise instances exposing private dashboards, GitHub tokens, and OpenAI API keys due to insufficient access controls.⁸

3. Arbitrary file access (CVE-2025-61913)

   • NVD documents a vulnerability where Flowise’s WriteFileTool and ReadFileTool did not restrict file paths, allowing authenticated users to read/write arbitrary files on the host filesystem—potentially escalating to RCE.⁹

These patterns—security design weaknesses plus common misconfiguration—mirror the broader risk picture for ad hoc LLM tooling in government: one poorly configured instance can become a serious data-breach vector.

Governance and Compliance

Some ecosystem partners attempt to make Flowise more compliance-friendly:

• TrueFoundry positions Flowise-based flows behind an AI gateway that provides automatic audit logs, policy enforcement, and data controls to help pass reviews while still enabling experimentation.⁴
• Observability tooling (custom traces, external AI gateways) adds step-level metrics and guardrails.¹³

But Flowise itself:

• Does not advertise SOC 2, ISO 27001, HIPAA, or FedRAMP compliance.
• Does not include its own robust RBAC/ABAC framework, comprehensive policy engine, or risk registry comparable to AI-governance platforms like VerifyWise, MetricsLM, or Modulos.³¹³²

For government, that means Flowise should be considered a low-level UI component, not the compliance boundary.

Fit for Government Workloads

Where Flowise can be used with care:

• Internal R&D and prototyping in tightly segmented networks.
• As an embedded component behind hardened gateways that enforce:
  • Strong auth and RBAC
  • Data-loss prevention and redaction
  • Central logging and model registries

Where it is a poor primary choice:

• Citizen-facing systems handling PII, justice, welfare, or tax data.
• Any environment with strict data-localization or sector-specific regulations (financial, defense, healthcare) where platform-level compliance evidence is required.
• Workloads requiring formal assurance around explainability, bias, and rights-impacting decisions; these require dedicated governance layers and clear audit trails.

what-security-hardening-does-flowise-need-for-government-use

---

Governance, Observability, and AI-Risk Considerations

Across all three tools, modern government AI programs must address:

• AI-specific risks: hallucinations, prompt-injection, data exfiltration, model misuse.³³
• Governance gaps: many organizations lack clear accountability, inventories of AI use-cases, and robust oversight mechanisms.³⁴³⁵
• Explainability and rights protection: particularly in finance, justice, and law-enforcement contexts.³⁶

Dify, LangFlow, and Flowise do not solve these problems by themselves. Agencies need to combine them with:

1. AI-governance platforms

   • Tools like VerifyWise, ModelOp, Modulos, or MetricsLM track models, controls, and compliance evidence across multiple frameworks (GDPR, ISO 42001, EU AI Act, etc.).how-can-governments-meet-eu-ai-act-requirements

2. Observability stacks

   • Langfuse, LangWatch, AgentOps, etc. provide tracing, evaluation, and failure analysis for LLM agents.²⁷

3. Security overlays

   • Zero-trust networking, WAFs, DLP, strong K8s/container hardening, and continuous vulnerability scanning (including LLM-specific scanners like garak).³⁷

---

Practical Selection Guidance for Government AI Platforms

1. Treat all three as components, not entire “government AI platforms”

• Dify comes closest to a central AI app platform because of its certifications and governance features, but it still relies on:
  • Hardened cloud/on-prem infrastructure
  • External AI-governance, risk, and compliance tooling
• LangFlow and Flowise should be treated as developer tools that sit under a more secure and governed runtime layer.

2. Security and vulnerability management

• Dify: Favor self-hosted deployments on government-approved clouds; integrate with agency vulnerability scanners and enforce standard DevSecOps pipelines.
• LangFlow:
  • Only use versions ≥ 1.3.0 and monitor for new CVEs.
  • Do not expose LangFlow directly to the internet; isolate via VPN/ZTNA and apply RBAC at the gateway.
• Flowise:
  • Enforce strong auth and network segmentation; disable or strictly constrain generic file tools.
  • Audit for exposed endpoints and credentials regularly.

3. Governance and compliance overlay

For each platform:

• Maintain an AI use-case inventory that classifies use-cases as safety-/rights-impacting per government guidance.³⁸
• Add RBAC, data-protection, and audit logging at the gateway and infra level, not just in the app.
• Use external AI-governance platforms or internal frameworks to:
  • Document data flows and legal bases (GDPR, sector laws).
  • Perform impact assessments (e.g., EU AI Act high-risk systems).
  • Track mitigations for fairness, bias, and explainability.

4. Role of dedicated government AI platforms

There is a growing class of government-specific AI platforms (e.g., GovAI, GovTrust, Essert’s public-sector governance solutions) purpose-built with:

• Sector-specific governance templates
• Policy playbooks for AI and privacy
• Integrations with public-sector case-management and document systems

These platforms can wrap Dify or a similar orchestrator while keeping LangFlow/Flowise in non-production or tightly controlled roles.

which-government-specific-ai-platforms-compete-with-dify-langflow-and-flowise

---

Compliance Notes for This Organization

Your organization’s stated compliance requirements currently include only:

• “Hi” (no other standard names were provided)

There is no recognized security or privacy framework named “Hi,” so it is not possible to positively verify whether Dify, LangFlow, or Flowise “meet” this requirement. What can be said based on public evidence:

• Dify: demonstrably aligns with mainstream frameworks (SOC 2, ISO 27001:2022, GDPR) and thus has a stronger general compliance posture than the other two.
• LangFlow: has an actively exploited critical RCE (CVE-2025-3248) and no visible formal certifications. In any reasonable compliance regime, using unpatched versions would be noncompliant with basic secure-development and vulnerability-management expectations.
• Flowise: has multiple data-leak and vulnerability findings and no formal certifications, making it inappropriate as a sole platform-of-record in sensitive or high-assurance environments.

Because your compliance requirement is underspecified, any adoption decision should map “Hi” to concrete standards (e.g., ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA) and re-evaluate each platform against those standards.

⚠️ Compliance Alert: Given the absence of a clearly defined “Hi” standard

• None of Dify, LangFlow, or Flowise can be confirmed as compliant with your organization’s named requirement.
• LangFlow (pre-1.3.0) and Flowise (with known CVEs and misconfigurations) should be considered noncompliant with basic security hygiene in any regulated-government context until fully patched, segmented, and wrapped with independent governance and monitoring.

---

Summary

• Dify: Best candidate of the three as a core AI application layer for government use, due to formal security certifications, hybrid/on-prem deployment, and built-in governance and observability. Still needs external AI-governance and infra-level compliance.
• LangFlow: Excellent visual orchestration tool, but the critical RCE vulnerability and lack of out-of-the-box governance make it unsuitable as a primary government AI platform. Use only in isolated, well-hardened environments as a developer tool.
• Flowise: Useful low-code builder with strong community traction, but documented data leaks and multiple CVEs mean it should not be treated as the main platform for government workloads. Best kept behind strong gateways and used for prototyping or non-sensitive internal workflows.

For a government AI platform strategy, these tools are best deployed as modular building blocks underneath a more comprehensive stack that includes:

• Hardened cloud/on-prem infrastructure and zero-trust networking
• Dedicated AI governance, risk, and compliance tooling
• Continuous observability, red-teaming, and vulnerability scanning for both infra and LLM agents.

Footnotes

1. Comparative Analysis of Dify, LangFlow and Flowise for a Government AI Platform (Brazilian federal agencies) evaluates ease of no-code, deployment simplicity, scalability, security, and licensing.[https://www.scribd.com/document/876528820/Comparative-Analysis-of-Dify-Langflow-And-Flowise-for-a-Government-AI-Platform] ↩

2. Dify supports SaaS (Dify Cloud) and self-hosted deployments via Docker and Kubernetes, with hybrid and on-prem options and end-to-end encryption for on-prem data.[https://aixsociety.com/comparing-dify-ai-and-leading-low%E2%80%91code-llmops-platforms/] ↩ ↩² ↩³

3. LangFlow documents production K8s deployment patterns with hardened runtime (e.g., readOnlyRootFilesystem: true) and TLS via reverse proxy.[https://docs.langflow.org/deployment-kubernetes-prod] ↩ ↩²

4. TrueFoundry describes Flowise-based agent flows fronted by an AI gateway that provides centralized auth, policy, and logging; they highlight “compliance ready: automatic audit logs, policy enforcement, and data controls” for Flowise experimentation.[https://www.truefoundry.com/blog/building-low-code-ai-agent-flows-with-flowise-on-the-truefoundry-ai-gateway] ↩ ↩² ↩³ ↩⁴

5. Dify reports SOC 2 Type I, SOC 2 Type II, ISO 27001:2022, and GDPR certification for its information security and privacy program, emphasizing adherence to industry standards from design onward.[https://docs.dify.ai/en/policies/agreement/get-compliance-report] ↩ ↩² ↩³

6. CISA added LangFlow’s missing-auth RCE CVE-2025-3248 to its Known Exploited Vulnerabilities catalog and explicitly urged US federal agencies and enterprises to update to v1.3.0 or later.[https://www.cisa.gov/news-events/alerts/2025/05/05/cisa-adds-one-known-exploited-vulnerability-catalog] ↩ ↩²

7. NVD description of CVE-2025-3248: missing authentication on /api/v1/validate/code allows remote unauthenticated code execution via crafted HTTP requests.[https://nvd.nist.gov/vuln/detail/CVE-2025-3248] ↩ ↩²

8. Wiz reported a Flowise vulnerability that exposed private AI dashboards and sensitive data (GitHub tokens, OpenAI keys) on hundreds of servers.[https://www.wiz.io/vulnerability-database/cve/cve-2024-31621] ↩ ↩²

9. CVE-2025-61913: Flowise WriteFileTool/ReadFileTool allow arbitrary path access, so authenticated users can read/write files anywhere on the filesystem, potentially leading to RCE.[https://nvd.nist.gov/vuln/detail/CVE-2025-61913] ↩ ↩²

10. UpGuard’s “Downstream Data” report documents AI data-exposure cases involving Flowise deployments.[https://www.upguard.com/blog/downstream-data-investigating-ai-data-leaks-in-flowise] ↩ ↩²

11. Dify is described as production-ready with workflow building, RAG, agents, operational monitoring, and centralized governance over LLM capabilities and API keys.[https://www.baytechconsulting.com/blog/what-is-dify-ai-2025] ↩ ↩²

12. LangFlow integrates with observability systems (Langfuse, LangWatch, Opik) using OpenTelemetry, enabling trace collection, evaluations, and auditing of agent behavior.[https://www.langflow.org/blog/llm-observability-explained-feat-langfuse-langsmith-and-langwatch] ↩ ↩² ↩³

13. Flowise can emit detailed traces for each step in a workflow, enabling performance and error analysis.[https://medium.com/@ShawnBasquiat/observability-in-flowise-traces-you-can-trust-b5d5997e6026] ↩ ↩²

14. AWS sample templates for Dify on AWS use managed services like Aurora Serverless v2, ElastiCache, and Fargate, emphasizing high availability and managed security.[https://github.com/aws-samples/dify-self-hosted-on-aws] ↩

15. A 2025 technical review highlights Dify’s robust workflow, RAG, agent customization, monitoring, and API integration as key to building and deploying LLM apps.[https://www.baytechconsulting.com/blog/what-is-dify-ai-2025] ↩

16. Business analysis notes that Dify is not a toy but designed for production with emphasis on security and reliability.[https://www.baytechconsulting.com/blog/what-is-dify-ai-2025] ↩

17. Dify’s install FAQ explains that encryption keys used to secure large-model secrets are critical and that losing the key file is irreversible.[https://docs.dify.ai/en/learn-more/faq/install-faq] ↩

18. Tenten’s developer guide stresses that Dify encapsulates LLM APIs and provides secure, centralized access to models.[https://developer.tenten.co/everything-you-need-to-know-about-difyai?source=more_articles_bottom_blogs] ↩

19. Hybrid deployment patterns are widely used to balance latency, sovereignty, and control; they are recommended in data-integration contexts for regulated industries.[https://airbyte.com/data-engineering-resources/essential-use-cases-hybrid-deployment-models] ↩

20. Dify’s own blog describes large private-sector deployments but no named central government references.[https://dify.ai/blog/how-dify-ai-powers-the-company-that-is-powering-the-world] ↩

21. LangFlow is described as a visual programming platform on top of LangChain for rapidly building pipelines and agents.[https://randomresearchai.medium.com/mastering-langflow-a-no-code-framework-to-build-powerful-llm-apps-in-minutes-3010d38f5b61] ↩

22. IBM and others note that LangFlow supports the same wide set of connectors and tooling as LangChain.[https://www.ibm.com/think/topics/langflow] ↩

23. Trend Micro details how the missing-auth endpoint allows arbitrary Python execution, being exploited in the wild to deploy Flodrix botnet malware.[https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html] ↩

24. Zscaler’s analysis of CVE-2025-3248 recommends restricting access to LangFlow, segmenting networks, and implementing sandboxing.[https://www.zscaler.com/blogs/security-research/cve-2025-3248-rce-vulnerability-langflow] ↩ ↩²

25. Horizon3 notes poor privilege separation, no sandbox, and a history of RCE issues “by design,” and recommends avoiding direct-exposure deployments.[https://horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/] ↩

26. Singapore’s CSA and other advisories warn that LangFlow instances on public networks are being exploited for DDoS and botnet activity.[https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-059/] ↩

27. Technical surveys of agent observability highlight Langfuse, AgentOps, and similar tools as the primary observability layer for LLM agents, not LangFlow itself.[https://medium.com/@adnanmasood/establishing-trust-in-ai-agents-ii-observability-in-llm-agent-systems-fe890e887a08] ↩ ↩²

28. Cake integrates LangFlow to provide collaborative design, versioning, and deployment automation for agent pipelines.[https://www.cake.ai/component-listing/langflow] ↩

29. Intro tutorials portray Flowise as a revolutionary low-code/no-code builder to quickly create LLM apps.[https://tonylixu.medium.com/flowise-ai-llm-app-builder-introduction-0bcce69279c4] ↩

30. A comparison by SmythOS frames Flowise as a lightweight builder vs. SmythOS as a vertically integrated agent OS for regulated enterprises.[https://smythos.com/developers/agent-comparisons/smythos-vs-flowise-report/] ↩

31. MetricsLM describes itself as a comprehensive AI-governance platform with 50+ metrics for security, compliance, and bias mitigation.[https://metricslm.com] ↩

32. Modulos positions its platform as “the ultimate enterprise AI governance and risk management platform,” automating compliance.[https://www.modulos.ai/] ↩

33. US federal guidance highlights hallucinations, explainability gaps, and security vulnerabilities as key GenAI risks in government systems.[https://fedtechmagazine.com/article/2025/04/4-primary-security-risks-mitigate-genai-solutions] ↩

34. ModelOp documents that many organizations lack formal AI-governance frameworks, leading to compliance and operational risks.[https://www.modelop.com/ai-governance/ai-governance-challenges] ↩

35. Civil-society reviews of US federal AI compliance plans find vague, high-level documentation and lack of concrete controls in many agencies.[https://epic.org/federal-agencies-largely-miss-the-mark-on-documenting-ai-compliance-plans-as-required-by-ai-executive-order/] ↩

36. Research on AI governance stresses that lack of explainability and transparency is a key concern in regulated domains such as finance, health, and law enforcement.[https://unu.edu/article/algorithmic-problem-artificial-intelligence-governance] ↩

37. NVIDIA’s garak is an LLM vulnerability scanner/red-team toolkit for probing model and agent exposures.[https://www.garak.ai] ↩

38. Analyses of US federal AI usage show agencies must inventory and characterize safety- and rights-impacting AI use-cases and document mitigation measures.[https://stackarmor.com/an-analysis-of-ai-usage-in-federal-agencies/] ↩