Feature · Inventory · Written by Yobel Tzegai · Last checked 9 October 2026
How do you find the AI systems your company already runs?
In Complipath (complipath.io), you can paste a dependency file to see which packages call or run a model, paste a list of names, tick from twelve categories, or share an intake link colleagues use without an account. Every system arrives unassessed: these ways add or suggest, they never classify. On Free each way stops at the first system.
Reads a package.json you paste and names the AI libraries in it, with the line each one sits on, for you to accept or ignore.
Illustration · not your dataFile A package.json · 42 dependencies readFound A model SDK · dependencies · line 14Why On the list of packages that call or run a model
What it does
Dependency reading: paste a package.json and it names each package on its list of model packages, or whose name has a part such as AI or LLM standing as a whole word, with its section, line and reason.
On Starter and the trial, a requirements.txt or go.mod is read the same way, each candidate with its line number. The format is told from the text you paste.
The file is read in your browser, with no model. Only the name of a candidate you add is sent to the server.
Each candidate has its own "Add this to my register" button. Nothing is pre-ticked and there is no add-all.
Bulk registration: paste one system per line, optionally "name, business owner", check the preview, then add up to 200 at once.
Category intake: tick from twelve categories, add a second row for a second system in the same category, or type your own under "Something else".
You name every category row yourself. You can note whether you built it or bought it; that note never answers a question for you.
Intake link: anyone holding the link can report a tool by name and description, with no account. They see the form and a thank-you, never the register.
Reports wait on the AI Inventory page. Take one into the register as an unassessed system, or set it aside with a reason that is kept with it.
Who it is for
The person building the first register: a compliance lead or CTO who knows some systems by name and suspects others sit in code or in other teams' tools.
Developers can hand over a dependency file without explaining their stack. Colleagues outside the product can report a tool through the intake link without an account.
How you use it, step by step
Open AI Inventory. Under "Missing one?" choose "Paste a dependency file and see what's in it" or "Add several systems".
For a file: paste it, or pick a package.json, press "Read the file", and add the candidates that are systems, one at a time.
For a list: paste one name per line and press the add button. The twelve categories sit under the same form.
For the intake link: an admin creates it in Settings and shares it. The full link is shown once, when it is made.
Then answer each new system's questions. Its class follows from your answers, not from the file, the tick or the report.
Which plan
Reading a package.json, pasting a list, the categories and the intake link are on every plan. Reading a requirements.txt or go.mod is Starter and up, the trial included.
Free holds one AI system, and every way of adding a system here checks the count first. Once Free has one active system, these pages show the plan wall instead of the form, and a list of two or more is refused.
The trial and Starter get the same check at their own ceiling. The intake link still collects reports at the ceiling; taking one into the register waits for room.
Where it sits in the law
Whether a package or a tool is an AI system turns on the definition in Article 3, point (1). A dependency file names packages, not systems, so the list is a starting point and the call is yours.
The built-or-bought note on a category row is a fact you record. It is not the provider or deployer role defined in Article 3, points (3) and (4); the questions reach that.
Adding a system here builds your own inventory. It is not the registration in the EU database that Article 49 provides for.
What it does not do
It does not connect to your repository or code host. You paste or pick one file.
Its package lists are curated and incomplete. A system called through an API, built in-house or described elsewhere will not show, and an empty result says so rather than clearing you.
The file picker offers .json files only, so a requirements.txt or go.mod has to be pasted.
Nothing here classifies. No risk class, answer or citation is set from a file, a tick or a report.
The intake link is not limited to your company: anyone holding it can report, up to 20 reports per IP address and 200 per link a day. An admin can close it.
A report set aside is not answered: the person who sent it is not told.
On Free, none of these ways adds a second system.
Where it is in the app
AI Inventory, under "Missing one?": "Paste a dependency file and see what's in it" and "Add several systems". The twelve categories sit inside "Add several systems", and behind "Start from a category" on the form for registering one system.
Intake links are created and closed in Settings, by an admin. Reports wait on the AI Inventory page, with "Take into the register" and "Not for this register".
Does Complipath upload or keep my dependency file?
No. The file is read by code running in your browser, with no model; nothing about it is saved. Only the name of a package you choose to add is sent, and it becomes an unassessed system in your register. The reason it was suggested stays on the screen and is not stored with the system.
Which files can it read?
A package.json on every plan: its dependencies, devDependencies, peerDependencies and optionalDependencies. A requirements.txt or go.mod on Starter and the trial: requirement lines, and go.mod require lines. Option lines such as -r or -e are passed over. The format is told from the text, so paste the file as it is.
Can people outside my company use the intake link?
Yes, if they have the link. It is not tied to your company's accounts: anyone holding it can report a tool by name and description, up to 20 reports per IP address and 200 per link a day. They never see your register. An admin can close the link, and a closed link says so.
Which plan includes it?
A package.json, pasted lists, the categories and the intake link are on every plan; requirements.txt and go.mod need Starter or the trial. Free holds one AI system, so on Free each way stops at the first. Starter is €499 a month for up to 20 AI systems. Prices exclude VAT. Growth and Scale are not available yet.