Primarily companies at this point, with some ongoing input from individual contributors or universities / research organisations. I'm at Igalia (an open source software consultancy), so contributions from me and my colleagues are paid for by companies within the ecosystem. Vendors like SiFive and Rivos have particularly active contributors on the RISC-V backend, but there's many more.