Your enterprise customers ask about your AI. Answer, prove and show it.
Questionnaires answered in 48 working hours, audit evidence ready and a Trust Center your customers can open, all from one record of your AI systems that Complipath builds and keeps current for you.
Built on the EU AI Act, with GDPR and ISO/IEC 42001 where they overlap.
Your risk classes in about 30 seconds. No account, no card.
- Done for you, not another tool to learn
- Rules decide. AI only drafts.
- Every AI Act answer cites the law
Answer your customers, prove it to them and show it any time.
Your customer's own Excel or Word file, answered. The AI Act questions with the article behind every answer, and the rest of the security review drafted from your own documents. Saved for the next one.
When a customer wants to check you, the evidence is already there: classifications, requirements, documentation and history, in one pack.
Every answer carries its source and the name of the person who confirmed it, in a report as PDF or Word.
A page your customers can open any time: how you use AI, what you have checked and documents they can request, released only when you approve.
On Growth. A requested file goes out on a seven-day link after your yes.
Built for software companies that sell to enterprises.
Built for software companies with 20 to 100 people that sell to enterprises or the public sector, use or build AI and get questionnaires and audits from their customers.
By enterprise customers we mean the companies that review their vendors before they buy:
- usually organisations with 250 or more employees and their own procurement, security or legal team;
- banks, insurers, healthcare and life science companies of any size, because their own rules require it;
- and the public sector, where it is written into the tender.
The simple test: if your customers send you security questionnaires or vendor assessments, Complipath is built for you.
Complipath isn't SOC 2 or ISO 27001 certified yet. If your customers require that of every vendor, we'll tell you straight on the first call.
Not selling to enterprises? Complipath still covers what the EU AI Act asks of any company that uses or builds AI, B2B or consumer-facing: your register, risk classification, requirements and documentation, done for you.
Most companies like that start on Starter.
By industry: HR tech · Life science and health tech · Fintech · Suppliers to the public sector.
Complipath helps software companies that sell to enterprises answer, prove and show their AI to customers: questionnaires, audits and a Trust Center from one record of their AI systems, built and kept current for them.
Complipath is EU AI Act compliance software for companies with 20–100 employees that use or build AI. A rule engine classifies each AI system and cites the article; AI only drafts from your own documents, and a person confirms.
Who it is for: Software companies with 20–100 people that build or use AI and answer security and compliance reviews from their customers.
Complipath never decides your risk level for you: it shows what the law says, where it says it and what follows, and the decision stays with you.
Done for you. Not another tool to run.
Send two files you already have: your sub-processor list and your GDPR record of processing.
We find every AI system and classify it by fixed rules, with the article behind it.
You confirm. Your register, requirements and plan are ready.
Every classification waits for a person: Complipath prepares and you confirm; the confirmation is what the record rests on. From then on the record answers questionnaires and audits, and fills your Trust Center.
See how it works in 73 seconds.
The app, shown with an example company. Turn the sound on, or read the captions.
See which of your AI systems the Act covers.
No account needed. The Free plan is for one AI system and one user.
Book a 20-min call20 minutes with the founder.Transcript
Your enterprise customer just sent an AI questionnaire. The deal waits until it's answered.
With Complipath, you send two files you already have: your sub-processor list and your GDPR record of processing.
We find every AI system and classify it by fixed rules, with the article of the EU AI Act behind every result.
On screen: Classified by fixed rules · Law version: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
You confirm. Nothing is decided without you.
Your customer's questionnaire comes back in their own file, every answer with its source, within 48 hours, with a money-back guarantee.
On screen: every answer confirmed by Sara Lind · written back into this file.
When they want to audit you, the evidence is already in one pack.
Your Trust Center shows customers how you use AI, any time they look.
On screen: On the Growth plan · Sent only after Northlane approves the request.
Connect GitLab, GitHub, Datadog, Azure Monitor and the Claude or OpenAI API, and Complipath keeps everything current on its own.
On screen: Starter: you run a check when you want, once a day. Growth: watched all the time.
Starter is €499 a month. Growth is €1,499. Both start with a 30-day free trial. Get your risk classes free at complipath.io.
On screen: €4,990 a year for Starter, €14,990 a year for Growth. The trial is of Starter, with no card. Prices exclude VAT.
Note: the voice says “48 hours”. The Service Terms count the Sprint's clock in working hours, Monday to Friday, Swedish time: the guarantee is 48 working hours.
Also on every plan: vendor profiles, each fact with its source. On Starter and up: customer security reviews answered in their own file, and read-only connections to GitHub, GitLab, Azure and Datadog.
Example company (fictional): Larkmoor and its system are invented.See every example →
Candidate Ranking
Ranks applicants for open roles. The rule engine names the provision; no model decides.
Confirmed by the Head of PeoplePoint 5 · Risk management
Three risks are on record for Candidate Ranking, each with its owner and what is done about it.
From your Risks registerDo you classify the AI systems you use under the EU AI Act?
Yes. Every system is classified by a rule engine that names the article it rests on.
Source: the classification record for Candidate Ranking
Download in their formatlarkmoor-supplier-review.xlsxEvery system gets one of four stamps.
A system can carry transparency duties and be high-risk at the same time. Then it gets both.
The use must stop. The ten practices the Act bans outright, from social scoring to emotion recognition at work.
The ten prohibited practices →The heavy duties. Risk management, data, documentation, logs and human oversight. From 2 Dec 2027 for Annex III, and from 2 Aug 2028 for Annex I.
The Annex III categories →Tell people it is an AI. For chatbots and generated content. This has applied since 2 Aug 2026; a generator already on the market before that date has until 2 Dec 2026 to mark its output.
The four Article 50 disclosures →Only the duties every system carries. AI literacy under Article 4 applies whatever the risk level. Keep it on the register anyway, so you can show why.
What minimal risk still owes →Then it keeps itself current.
No integrations needed to start. Connect GitHub, GitLab, Azure or Datadog when you're ready, and Complipath finds new AI systems, changes to your AI vendors' usage policies and changes in your code on its own. Every document stays ready to download, and the next questionnaire starts from what is already answered.
Complete EU AI Act compliance software, in one place.
Everything your customers can ask about: register, classification, requirements, evidence, Annex IV documentation, incidents, monitoring, questionnaires, audits and Trust Center. EU AI Act first, plus the GDPR and ISO/IEC 42001 work that overlaps.
Every AI system you use or build, classified by fixed rules, with the article behind it.
- The register of your AI systems · Every plan
- Risk classification · Every plan
- The Annex III categories
- AI systems found in your files · Every plan
- Live checks of your code and logs · Growth and up
Requirements per system, evidence, Annex IV documentation, your plan and incidents.
- Requirements per system · Every plan
- The evidence library · Every plan
- Annex IV, part by part · Every plan
- Serious incidents · Growth and up
- GDPR basics per system · Every plan
- GDPR and ISO/IEC 42001 readiness · Growth and up
Questionnaires in your customer's own Excel or Word file, audits and a Trust Center.
- Customer AI questionnaires · Starter and up
- Audit reports · Starter and up
- A Trust Center · Growth and up
- A whole security review · Starter and up
- Customer audits · Starter and up
The plan beside each link is the plan in the app's own feature list. "Every plan" includes the free plan, which holds one system.
See all 113 live features →An EU AI Act compliance platform: from a list of tools to a record you can hand an auditor.
- 1 · Discover →
Discover
Live Reads your website and suggests the AI systems it shows; paste a list, read a package.json, or let colleagues report a tool through a link.
- 2 · Classify →
Classify
Live A rule engine decides the level and names the article it rests on, including the Article 5 practices.
- 3 · Understand →
Understand
Live Every factor cites its provision, and the plan gives each system its next steps by role.
- 4 · Assign →
Assign
Live Each obligation has an owner, a status and a date it applies from.
- 5 · Fix →
Fix
Live The Annex IV documentation is drafted from your register, and says what it could not answer.
- 6 · Evidence →
Evidence
Live A file is linked to the requirements it proves, with the passage and its page.
- 7 · Monitor →
Monitor
Live When an amending act touches a provision your records cite, you get an email per affected system.
- 8 · Prove ↺
Prove
Live Export the register with the law texts it was assessed against. Share a read-only link and read the audit log.
Live Answer customer questionnaires from your own record; hand over the audit pack.
17 capabilities, and whether each is built.
A selection, not the whole app: of these 17, 14 are live today, and 3 work with limits the line beside them names, read in the app's own list and its code. The rest of this selection is not built yet, and the list says which. Every live feature in the app is on the features page.
The full list, grouped by what you want to do, is on the Complipath features page.
Why companies choose Complipath.
“… does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.”
Article 6(3) is not amended by Regulation (EU) 2026/1744, which inserts new paragraphs into Article 6. The 2024 wording is in force.
The same answers give the same outcome, every time.
Complipath decides with rules, not a language model. Every classification is made by a rule engine and cites the article, the engine version and the law version. AI only drafts text from your own documents. Every sentence links to its source, and a person confirms it.
Your customer just added 30 AI Act questions to their vendor form.
| Question | Example answer | Source |
|---|---|---|
| Does your product use AI systems covered by the EU AI Act? Which risk category? | Yes. Our in-app chat assistant talks to users, so it has transparency duties under Article 50(1). It is not a high-risk use listed in Annex III. | Article 50(1); Annex III |
| Do you use AI to make decisions about employees or job candidates? | No. None of our AI systems is used for recruitment or selection, for decisions about workers' terms, promotion or termination, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate their performance and behaviour: the uses listed in point 4 of Annex III. | Point 4 of Annex III |
| How do you ensure AI literacy among your staff? | Staff who build or operate our AI systems complete AI literacy training, our measure to support their AI literacy under Article 4(1), as amended in 2026. Completion is recorded in our register. | Article 4(1) |
The high-risk rules moved. Most of the rest did not.
392 daysuntil the Annex III rules applyThe prohibitions, the transparency duties and the rules for general-purpose models kept their dates, with the exceptions noted under each. Pick what fits you:
- Prohibited practices and AI literacy Articles 4 and 5 Applies now Points added to Article 5 by 2026/1744: 2 Dec 2026
- General-purpose AI models Chapter V Applies now Models already on the market: 2 Aug 2027, Article 111(3)
- Transparency duties and most other rules Article 50 Applies now Article 50(2) for generators already on the market: 2 Dec 2026, Article 111(4)
- High-risk systems in Annex III Article 113 Articles 43 and 49 keep 2 Aug 2026
- High-risk systems in Annex I Article 113
That is what the check is for. No account needed, and every answer cites its article.
Your customers are starting to ask. See your risk classes first.
We read your website and suggest your AI systems. No account yet.
What it owes, from which date and the article behind each answer.
Create an account. 30 days of Starter, up to three systems, no card. Exports carry a small "Trial" mark. The first system stays free. After 30 days the workspace is on the free plan, which has one AI system: nothing is deleted; systems above it are paused until you buy a plan or archive others.
Get your free readiness review: what the check reads and returns, and what it leaves to you.
Send the questionnaire and two files you already have. Get the AI Act section back within 48 working hours, every answer with its source.
48 working hours or your money back.Nothing waiting yetQuestionnaire-Ready StartWe set up your whole workspace before the questionnaire arrives: every AI system classified, your AI policy, your plan and your Trust Center.
Ready in 72 working hours or your money back.If we miss it, the whole service fee is refunded the same day without discussion. You do not have to ask: the deadline passing is enough. We still finish the work at no cost, you keep everything delivered and the included Growth period to its date, and the deduction no longer applies. The sprint covers the AI Act part of up to 60 AI Act questions in one questionnaire. A larger questionnaire gets its own delivery time, written in its Order Form before the working-hour clock starts.
We run one sprint and one start at a time, so every deadline holds. If the slot is taken, we tell you the next start date on the call.
5 founding places for each service. Founding customers get a founding price in return for a short video or a written case study, if they're happy with the result.
- Step 1Book a 20-minute call.
- Step 2You get the Order Form by email. It is valid for 14 days.
- Step 3Accept it, and pay the invoice within 7 days.
- Step 4You get an upload link for your two files.
- Step 5The clock starts. AI Act Answer Sprint: The sprint's 48 hours start when the kickoff is marked done and your questionnaire is in. Questionnaire-Ready Start: Hours count Monday to Friday in Swedish time and start when payment and both files are in.
Done-for-you questionnaire: for an existing customer, one questionnaire answered for you, the same way as in the sprint, whenever the next one arrives, on a 48-hour working clock that starts when the questionnaire is in. It carries no guarantee and includes no Growth period. Price on request.
Prefer to try it alone? Start the 30-day free trial of Starter.
€0
1 system, 1 userStarter
€499 a month or €4,990 a year
Up to 20 systems, 10 usersGrowth
€1,499 a month or €14,990 a year
Up to 50 systems, 25 usersScale
Talk to us
Sold through a conversation
Prices exclude VAT. Everything each plan includes.
Stop paying lawyer rates for the groundwork.
Listing systems, reading articles and writing the same documents again is groundwork. That part is what Complipath does.
Check us before you trust us.
No SOC 2 or ISO 27001 yet. Here is what we have instead.
Complipath is built by Yobel Tzegai in Gothenburg, Sweden. Every question to hello@complipath.io is read and answered by him.
What people ask before they book.
More answers in the FAQ →Is Complipath a questionnaire tool?
No. Complipath is the record of your AI systems and everything the EU AI Act asks of you, built and kept current for you. Answering your customers' questionnaires and audits is what most companies need first, so that is where we start.
What do you mean by enterprise customers?
By enterprise customers we mean the companies that review their vendors before they buy: usually organisations with 250 or more employees and their own procurement, security or legal team; banks, insurers, healthcare and life science companies of any size, because their own rules require it; and the public sector, where it is written into the tender. The simple test: if your customers send you security questionnaires or vendor assessments, Complipath is built for you.
Is Complipath only for companies that sell to enterprises?
No. It is built for them, but any company that uses or builds AI, B2B or consumer-facing, gets the same register, classification, requirements and documentation. Most of them start on Starter. Growth adds what enterprise customers check: the Trust Center, the audit room shared with the customer and Live checks every hour.
Does it cover more than the EU AI Act?
Yes. Questionnaires and audits rarely stop at the AI Act. Complipath answers the rest of a security review on 17 common topics from what you have confirmed and your own documents; any other question is marked for you. It also covers the GDPR and ISO/IEC 42001 work that overlaps: GDPR basics for every system, and on Growth the DPIA and FRIA documents and your ISO/IEC 42001 readiness, never a certificate.
What do you need from us?
Two files you already have: your sub-processor list and your GDPR record of processing. For the sprint, also the questionnaire.
Do we have to connect any tools?
No. Connections such as GitHub or GitLab are optional and only add detail.
What happens after the included period?
You choose Growth, Starter or to stop. No lock-in. If you stop, your workspace moves to the Free plan, the files you received are yours, your Trust Center closes 30 days later, and nothing is deleted. If you choose Growth yearly before the period ends, what you paid for the sprint or start is deducted from the first year once, at exactly the amount you paid and never more; a start moved up to a sprint counts as a sprint, and Growth starts the day after the included period ends.
What if you miss the deadline?
Sprint: If we miss the 48 hours, or any AI Act answer is missing its source, you get your money back. If we miss it, the whole service fee is refunded the same day without discussion. You do not have to ask: the deadline passing is enough. We still finish the work at no cost, you keep everything delivered and the included Growth period to its date, and the deduction no longer applies. The sprint covers the AI Act part of up to 60 AI Act questions in one questionnaire. A larger questionnaire gets its own delivery time, written in its Order Form before the working-hour clock starts. Hours count Monday to Friday, Swedish time. The sprint's 48 hours start when the kickoff is marked done and your questionnaire is in. The guarantee covers the AI Act questions. Other security questions we answer from your documents where they allow it; the rest are marked 'for you to answer'. Start: Your workspace is ready within 72 hours after we receive your two files, or you get your money back. If we miss it, the whole service fee is refunded the same day without discussion. You do not have to ask: the deadline passing is enough. We still finish the work at no cost, you keep everything delivered and the included Growth period to its date, and the deduction no longer applies. Hours count Monday to Friday in Swedish time and start when payment and both files are in.
What if you miss the guarantee?
You get your money back. If we miss it, the whole service fee is refunded the same day without discussion. You do not have to ask: the deadline passing is enough. We still finish the work at no cost, you keep everything delivered and the included Growth period to its date, and the deduction no longer applies.
Is there a limit on questionnaire size?
The sprint covers the AI Act part of up to 60 AI Act questions in one questionnaire. A larger questionnaire gets its own delivery time, written in its Order Form before the working-hour clock starts.
How does buying work?
Book a 20-minute call. You get the Order Form by email. It is valid for 14 days. Accept it, and pay the invoice within 7 days. You get an upload link for your two files. The clock starts. Sprint: The sprint's 48 hours start when the kickoff is marked done and your questionnaire is in. Start: Hours count Monday to Friday in Swedish time and start when payment and both files are in.
How do we reach you?
After payment, questions and rescheduling go by e-mail to hello@complipath.io, answered within one working day. Official documents (Order Form, invoice, terms) come by email.
How do I answer the EU AI Act section of a customer's security questionnaire?
Classify every AI system you build or use first, because most questions turn on the risk class. Then answer each question with the article it rests on, and keep the record behind every answer so the next questionnaire starts from it. How Complipath answers AI questionnaires.
Do you have SOC 2 or ISO 27001?
Not yet. Here is what we have instead: the security pack, with a source on every row.
Is Complipath legal advice?
No. It gives legal information and a place to document your answers. A named person on your team confirms each classification, and that confirmation is what the record rests on.
What happens when the law changes?
Market and Law shows what has landed since you last looked, in plain language, with the source. When an amending act touches a provision your confirmed records cite, you get an email for each system it affects.
Do we need this if none of our systems are high-risk?
Often, yes. A provider who decides that an Annex III system is not high-risk must document that assessment before the system is placed on the market or put into service, under Article 6(4). AI literacy under Article 4 binds providers and deployers whatever the risk level, and chatbots and generated content carry the duties in Article 50.
Is it launched, or is there a waiting list?
It is open. The check runs without an account and the Free plan is for one AI system and one user. Starter and Growth can be bought today; Scale is sold through a conversation with us.
Do I need an account to run the check?
No. Nothing is saved to an account unless you choose to keep your result.
What happens after the thirty days?
The account drops to the free plan, which holds one system and one person. Nothing is deleted: your first system keeps working, and the systems beyond it are paused, still readable and exportable. There is no card to cancel.
The 30 AI Act questions your enterprise customers will ask, with what a good answer includes.
