Can Complipath draft audit answers from what our connections read?

What it does

• Vendors and models: for each audit system a code read is linked to, the vendors and up to four models seen in its code. A system with no code read is listed as not seen.
• AI notice and personal data: an open problem of that kind is stated, with up to five places. With none open, a clean answer comes only for systems a log connection covers.
• Vendor training: the vendor's own terms, quoted with the day they were read, where Complipath has read them.
• Human review: a draft only when an open problem says a decision may run without one.
• Every draft names its source, such as From GitHub, checked 16 Oct. Rules write it from what was read, and it stays a draft until a person confirms it.

What it does not do

• It never answers for a system nothing read. Code alone gives possible problems, never a clean yes on AI notice or personal data.
• Human review never gets a yes. With no open problem there is no draft.
• Training is only what a vendor's own terms say, as quoted. Today a quoted sentence exists for one vendor, Anthropic; for any other, the draft says Complipath has not read their terms.
• It does not override your own answers. An answer confirmed in an earlier audit, your data answers and the GDPR basics come first.
• It reads nothing itself. It uses what a connection has already read, so a draft is as old as the last read.

Which plan

Growth, which is not for sale yet: open today to pilot workspaces with a connection. Starter has the audit room but no connections, so it gets no drafts from this.

Where it sits in the law

It is not an EU AI Act duty. It helps you answer a customer's audit with facts your connections read; a draft is not a statement that you comply.

Its AI notice, personal data and human review drafts use the same reads as Live, whose checks name Article 50(1) and Articles 14 and 26 of Regulation (EU) 2024/1689, and point (c) of Article 5(1) of the GDPR.