Doing the EU AI Act yourself means one person's time and a spreadsheet. That is not a criticism — a spreadsheet is where most first assessments belong, and this page says what it does well before it says where it stops.
A spreadsheet costs nothing to start and bends to any shape you need, which is exactly why it is where this work begins. What it is not is a system. It has no idea what it contains, and it can tell you nothing you did not already type into it.
The first classification is the easy half: you have the context, the reasons are fresh and the person who decided is at the desk. Later, the questions are different — who made this call, against which version of the law, and what has changed since. A spreadsheet answers none of them unless somebody thought to add a column for each one, every time, without being asked.
Regulation (EU) 2026/1744 amended the 2024 text in force. Among other things it moved the high-risk application dates to 2 December 2027 and 2 August 2028 (Article 113, third paragraph, point (c), as amended). No spreadsheet re-runs itself when that happens. A register that records which version of the law each assessment answered can list exactly which entries cited a provision that moved — and which did not. One is a filing cabinet. The other is a question you can ask.
Article 26(2) requires deployers of high-risk systems to assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Separation is the first thing a reviewer looks for: a decision, a named person who confirmed it and a record neither of them can quietly edit afterwards. When one person holds all three roles nothing is wrong with the work — there is just nothing to show for it.
You know your systems and we do not.
The hardest part of a classification is not the law, it is stating what a system is actually for — its intended purpose, in one sentence, honestly. Nobody outside your company can do that for you, and no tool can either: we ask, you answer — and the verdict is only as good as the answer. If you have someone who knows every system in the product and the time to sit with each one, in-house will get further, faster, than any tool will.
Runtime enforcement is a real capability, and one we do not have.
A control layer that sits at inference time — inspecting, blocking or rewriting what a model does as it runs — is a different product from a register that classifies systems and holds the evidence. Complipath does not do it and is not going to pretend the gap is a scoping decision. On 17 August 2026 we said as much to Kosmoy, in writing: anyone who needs a control layer at inference time should be looking at them and not at us.
What Kosmoy is, in their words and not ours: “Kosmoy is the AI management platform for the regulated enterprise.” That sentence was read on kosmoy.com on 22 August 2026, by hand, on a machine outside this build — this site's own environment cannot reach their website, and two attempts on 19 and 20 August 2026 failed the same way, so it is the one reading here that no tool can re-run. Everything else in this section is about us. Read their pages, not this paragraph. kosmoy.com.
How many hours anything saves. We have not measured it. The day a customer has, that number goes here with the measurement behind it — and not before.
Nothing here describes a tool nobody at Complipath has used or read — and that is a sentence you would have to take from us, which is why what you can check about us before you believe any of it is set out on its own page. What our own engine will and will not decide is stated as a limit rather than a feature list. What this check can and cannot decide lists both sides, and a complete example assessment shows one run end to end. What the product is, in plain language, is here. If you are further along than choosing, the twelve questions a reviewer would ask us are answered in public, and what we cover of the Act is a table with three empty rows in it. The other version of this question — why not just ask a model, or build an agent — is a table too. And if the answer in the room was “we need a lawyer, then”: you do, and this is the division of labour.
Complipath is EU AI Act compliance software for AI-heavy software companies without a compliance team — an AI system register, deterministic risk classification, the obligations that follow, and the evidence behind every decision.
Complipath is built by Yobel Tzegai in Gothenburg, Sweden.
Complipath provides legal information, not legal advice. Every guide cites its source on EUR-Lex — Regulation (EU) 2024/1689, and Regulation (EU) 2026/1744 where that has amended it; where the law is still settling, the guide says so.
We measure page views with Vercel Web Analytics. It uses no third-party cookies. Visitors are identified by a hash derived from the incoming request, which is discarded after 24 hours, and no identifier is stored that could follow a visitor to another site. What is collected: the time of the visit, the URL, the referring page, filtered query parameters, city-level location, operating system, browser and device type.