Cranium Bets EU AI Act Makes AI Safety a Necessity

Provides AI security and governance SaaS for large enterprises: automatically discovers and inventories all AI models, agents, and third-party AI suppliers within an organization, conducts red-team security testing, and generates compliance proof such as AI Cards.

Bets that enterprise AI adoption will grow explosively and regulations like the EU AI Act will make proving AI safety a procurement condition.

Cumulative $32M: 2023 seed round (backed by KPMG and SYN Ventures), 2023-10 Series A $25M (led by Telstra Ventures, with KPMG LLP and SYN Ventures participating).

Founded in 2022 inside KPMG’s startup incubator KPMG Studio, it was the first spin-out company incubated by KPMG, and all four founders came from KPMG’s cybersecurity and AI business; in 2023-04 it emerged from stealth and began independent operations, with seed funding from KPMG and SYN Ventures. Founder Jonathan Dambrot saw that after ChatGPT was released, every enterprise was deploying AI, but no one could clearly say what data these models were using, whether they could be attacked, or whether they were compliant.

In 2023-10 it completed a $25M Series A (led by Telstra Ventures), bringing cumulative funding to $32M; it launched AI Card (packaging an AI application’s safety, use, data, and governance into a shareable compliance profile) and AI Maturity Score. In 2025-05 it released the Arena red-team platform, focusing on LLM prompt injection testing and EU AI Act/NIST RMF audit readiness; the product line subsequently expanded to agent monitoring (AgentSensor), cloud and compliance modules, and the official website states that the Govern module directly maps to the EU AI Act.

Still running, and the regulatory dividend is being realized: the EU AI Act becomes fully applicable on 2026-08-02 (high-risk provisions were extended by the AI Omnibus to 2027-12/2028-08), turning “being able to prove AI safety” from a slogan into a legal obligation. A third-party profile says its 2025-09 annual recurring revenue was about $7.3M and that in 2026-05 it acquired agent AI security company Aiceberg; the official website claims recognition such as Gartner Cool Vendor 2025 and Fortune Top 50 Cybersecurity Companies 2025.

The EU AI Act turns AI governance from an optional item into a legal obligation and provides a phased effective-date timetable, forcing enterprises to buy tools now rather than wait.

Starting from KPMG incubation means having an enterprise client channel from day one, turning “compliance demand” directly into early revenue rather than doing market education from scratch.

The product first delivers lightweight items such as “inventory + AI Card proof,” then extends to red-team testing and agent monitoring, gradually expanding categories along enterprise demand.

The regulatory dividend comes in multiple waves: 2024 entry into force, 2025 prohibitions, 2026 applicability, and 2027 high-risk rules, with each deadline recreating procurement urgency.

Productize compliance early to lock in niche; Cranium used KPMG channel and time before regulations.

As of 2026-09, Cranium operates independently. EU AI Act fully applicable since 2026-08-02. Third-party data: 2025-09 ARR ~$7.3M, headcount ~62, acquired Aiceberg in 2026-05. Recognized by Gartner, Fortune 2025 Cybersecurity 50. Risks: competition and customer concentration.