Compare · EU AI Act compliance tools
Seven tools and Complipath on 15 things buyers ask, each read on the tool's own website. Every cell links to where we read it.
Choose Complipath if you use AI from other vendors and need each system classified with the article it rests on, from €499 a month. Prices exclude VAT. Choose a tool that monitors models in operation if you need that today: four of the seven say they do, in their words and not ours.
| What buyers ask | ComplipathRule engine | OneTrust25 pages read | Credo AI18 pages read | Holistic AI17 pages read | Legalithm17 pages read | Atheros AI8 pages read | Euridium8 pages read | Dossentia2 pages read |
|---|---|---|---|---|---|---|---|---|
| Price and start | ||||||||
| Price fromPrices exclude VAT. Lowest paid plan, in their words. | €499 a month[1] | Not stated | Not stated | Not stated | €1,500 per product, per year[2] | from €290 per month[3] | Starter €300–800 / month[4] | Not stated |
| Free startA free tier or a free tool | Yes[5] | Not stated | Yes[6] | Not stated | Yes[7] | Yes[8] | Yes[9] | Partly[10] |
| How it decides | ||||||||
| EU AI Act risk classificationEach system gets a risk class | Yes[11] | Yes[12] | Yes[13] | Yes[14] | Yes[15] | Yes[16] | Yes[17] | Yes[18] |
| The article behind each obligationSo you can check it yourself | Yes[19] | Not stated | Not stated | Not stated | Yes[20] | Not stated | Yes[21] | Not stated |
| The version of the law each answer usedWhich text an answer rested on | Yes[22] | Not stated | Not stated | Not stated | Yes[23] | Yes[24] | Not stated | Not stated |
| Documents and proof | ||||||||
| Annex IV technical documentationThe file a provider of a high-risk system keeps | Yes[25] | Not stated | Not stated | Not stated | Yes[26] | Yes[27] | Yes[28] | Yes[29] |
| Evidence linked to each requirementFile and page, per duty | Yes[30] | Not stated | Partly[31] | Yes[32] | Yes[33] | Partly[34] | Yes[35] | Not stated |
| Audit-ready reportsA pack you can hand over | Coming soon[36] | Yes[37] | Yes[38] | Yes[39] | Yes[40] | Yes[41] | Yes[42] | Not stated |
| Duties covered | ||||||||
| Obligations listed per systemWhat each system owes | Yes[43] | Not stated | Yes[44] | Yes[45] | Yes[46] | Not stated | Yes[47] | Not stated |
| AI literacy (Article 4)Applies whatever the risk class | Yes[48] | Not stated | Yes[49] | Not stated | Not stated | Yes[50] | Not stated | Not stated |
| Transparency duties (Article 50)Telling people they deal with AI | Yes[51] | Not stated | Not stated | Not stated | Yes[52] | Yes[53] | Not stated | Not stated |
| Post-market monitoring (Article 72)After a high-risk system is live | No[54] | Yes[55] | Not stated | Not stated | Not stated | Yes[56] | Not stated | Not stated |
| Monitoring of models in operationDrift and performance at run time | No[57] | Yes[58] | Yes[59] | Yes[60] | Not stated | Yes[61] | Not stated | Not stated |
| Data and trust | ||||||||
| Hosting in the EUWhere your records are stored | Yes[62] | Not stated | Not stated | No, UK by default[63] | Yes[64] | Yes[65] | Yes[66] | Yes[67] |
| ISO 27001 or SOC 2A third-party certificate | No[68] | Not stated | Not stated | Yes[69] | No[70] | Not stated | No[71] | Not stated |
Yes Partly No Not stated on the pages we read Coming soon (not live)[n] = the source, with its link and the date we read it, under “How we checked”
You use AI from other vendors, customers ask you for proof, and each system needs its class with the article it rests on.
Not for you ifYou need runtime control or monitoring of your own models.
What Complipath is →You run models in production and need them watched: OneTrust, Credo AI, Holistic AI and Atheros AI say they do this, in their words and not ours.
Not for you ifYou want a price you can read before a call: of these, Atheros AI states one on the pages we read.
How we checked →You want a price you can read before you call: Legalithm, Atheros AI and Euridium state one on their own sites.
Not for you ifYou need models watched in operation: of these, Atheros AI says it does.
How we checked →If you have someone who knows every system in the product and the time to sit with each one, in-house will get further, faster, than any tool will.
Not for you ifA spreadsheet has no law version.
Do we still need a lawyer? →Each numbered source below is the sentence the cell rests on, with its page and the day it was read. 71 sources in the table.
“Align AI risk assessments and tiering to global frameworks like the EU AI Act, NIST, and ISO 42001.”OneTrust, in their words and not ours. It was read on 9 October 2026 from onetrust.com.
“Automate model documentation, audit-ready evidence, and regulatory reporting outputs.”OneTrust, in their words and not ours. It was read on 9 October 2026 from onetrust.com.
“OneTrust operationalizes post‑market monitoring by turning runtime signals into governance action.”OneTrust, in their words and not ours. It was read on 9 October 2026 from onetrust.com.
“Continuously monitor performance, drift, safety, and quality signals across models and agents.”OneTrust, in their words and not ours. It was read on 9 October 2026 from onetrust.com.
“Full access to all 166 regulations, 80 risk categories, and 116 controls is free, with no gated tiers on the core mapping.”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai. About their AI Governance Insights Hub.
“EU AI Act Full alignment with European AI regulation including risk classification and conformity assessments”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai.
“They are responsible for proving that their system meets the policy pack requirements”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai. About vendors in their Vendor Portal.
“With our Responsible AI platform, organizations can generate artifacts to support and facilitate the auditing of their AI/ML Systems.”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai.
“It’s how the platform understands that a model used in EU healthcare requires different controls than one used in US financial services, and enforces those distinctions automatically.”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai.
“Executive education and hands-on workshops and AI Governance literacy programs”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai. Their advisory service.
“Continuous monitoring, drift detection and real-time alerts by connecting to your observability and monitoring tools”Credo AI, in their words and not ours. It was read on 9 October 2026 from credo.ai.
“Classify your AI systems by risk.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Automatically extract relevant information from your evidence bank and compare it against your specific obligations.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Generate compliance reports for EU AI Act, NIST, and ISO 42001”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Map obligations.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Once deployed, AI systems are monitored continuously for signals that indicate risk level changes—drift, degradation, violations, and anomalies.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Customer data is hosted in the UK by default.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Our information security management system was certified against ISO/IEC 27001:2022 following a Stage 2 audit by our certification body, with no nonconformities raised.”Holistic AI, in their words and not ours. It was read on 9 October 2026 from holisticai.com.
“Paid plans start at €1,500 per product, per year.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com. The same page says "Both paid doors end in a conversation, because there is nothing to check out yet."
“The assessment is free, with no account.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“Know if your AI system is unacceptable, high, limited, or minimal risk”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“45 AI Act obligations, each cited to the Article.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“The GitHub Action reports its findings into your pipeline: legal basis, corpus version, required action, and whether evidence was found.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“You can optionally create a free Legalithm account to get deeper analysis, track multiple AI systems, generate Annex IV documentation, and receive compliance monitoring alerts.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“Collect and organize evidence artifacts linked to obligations and review steps.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com. A card on their platform page.
“Primary output: A dated, cited compliance record you can show to auditors, customers, and investors.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“Track your whole AI inventory, get per-system obligations, and generate Article 50 disclosures.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“AI disclosure generator for any website”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“Core application data is stored in EU infrastructure, Frankfurt region.”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“No SOC 2, ISO 27001 or ISO 42001 certification”Legalithm, in their words and not ours. It was read on 9 October 2026 from legalithm.com.
“Free for one system, from €290 per month.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Explore is free for one AI system with no time limit.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Risk Classifier Assigns EU AI Act tiers based on use case and data flows.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“We version the regulatory content our assessments run against and date every deliverable, so you can always tell which text a conclusion was reached under.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Annex IV Automation Generates and maintains the technical file with every model version.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“A number hides missing evidence inside an average; the platform shows which criterion, at which level, and why.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“The platform produces the evidence and the report those processes rely on.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Role-based tracks for executives, technical teams and the wider workforce, delivered by PhD-level practitioners — including the Article 4 AI literacy duty.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com. Their training offer.
“Article 50 Transparency Pack”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com. The name of a one-off pack on their product page.
“Post-Market Monitoring Drift, incident, and usage telemetry tied to your obligations.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Drift and incident monitoring”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“ComplianceEngine runs on EU-hosted infrastructure or inside your own environment.”Atheros AI, in their words and not ours. It was read on 9 October 2026 from atherosai.com.
“Starter €300–800 / month”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu. The same page says "Prices are hypotheses until the first pilots confirm them, and we say so."
“Or start with the free check”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Each system gets a risk tier, and the reason is written out.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Article by article, with the proof expected.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“The Annex IV documentation, ready to hand over.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“A policy, a supplier contract, a model card, a training-data sheet: each item is dated and attached to every obligation it supports.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Export the Annex IV documentation and the audit trail.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Euridium holds, for each AI system, the obligations that apply, the evidence, the signatures and the audit trail.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Your workspace data is stored on EU-based cloud infrastructure.”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“We do not currently hold formal third-party certifications such as SOC 2 or ISO/IEC 27001”Euridium, in their words and not ours. It was read on 9 October 2026 from euridium.eu.
“Three questions, no sign-up.”Dossentia, in their words and not ours. It was read on 9 October 2026 from dossentia.com. The home page's check, headed "Is your AI high-risk?"
“Register every AI system and classify it under the Act.”Dossentia, in their words and not ours. It was read on 9 October 2026 from dossentia.com.
“Inventory your AI systems, generate Annex IV technical documentation, and register with the EU database, all in one place.”Dossentia, in their words and not ours. It was read on 9 October 2026 from dossentia.com.
“Dossentia is hosted on Hetzner infrastructure in Finland via Coolify.”Dossentia, in their words and not ours. It was read on 9 October 2026 from dossentia.com.
compliact.ai served a 2,352-byte page whose text loads through JavaScript, which our reader does not run. Complipath vs CompliAct →
We have not tested other tools and we will not claim anything about them. The right-hand column is what we would ask.
Doing the EU AI Act yourself means one person's time and a spreadsheet. That is not a criticism — a spreadsheet is where most first assessments belong, and this page says what it does well before it says where it stops.
The same answers give the same outcome, every time — and the record says which engine version produced it.
“Run the same system twice. Do you get the same answer?”
Five of the ten prohibited practices in Article 5(1) come back as prohibited. The other five it does not decide, and says which.
“Which of the ten prohibited practices does your tool decide, and which does it refuse?”
It never proposes that a system is exempt.
“Can your tool tell me I am exempt?”
Each answer is quoted from a copy of the Act published with its sha256.
“Which copy of the Act was this read against, and can I check it?”
The record says the answers are self-reported and that nobody has confirmed them.
“Does the report say who confirmed this?”
No example assessment is on show here at the moment. The space is left empty rather than filled with an invented one.
The hardest part of a classification is not the law, it is stating what a system is actually for — its intended purpose, in one sentence, honestly. Nobody outside your company can do that for you, and no tool can either: we ask, you answer — and the classification is only as good as the answer.
Article 6(3) can take an Annex III system back out of high-risk. The engine does not apply it, and this is the provision it is declining to reach a conclusion on.
Our limit, not a reading of them: Complipath classifies AI systems and drafts Annex IV documentation under the EU AI Act, and stops there — no post-market monitoring, no incident reporting, no conformity assessment, no SOC 2 or ISO framework. Where they do any of those, they do something we do not.
“Systems were classified based on declared use cases, business domains, and deployment characteristics, using keyword-matching and semantic analysis against the EU AI Act's risk categories.”section 7, "Methodology & Glossary" — their description of their own method
“4. Annex IV starter outline … Use the outline below as the starting skeleton — SetAIComply Growth can generate the complete document from your live portfolio.”section 4, "Annex IV starter outline", followed by nine headings each marked "○ Not started" — What we read: nine headings, each marked "Not started", in the free report. What their paid plan does is not read and is not asserted.
Read by Yobel Tzegai on 2026-09-02 — section 7, "Methodology & Glossary" — their description of their own method. Our build's own fetch of the address we had on record returned 403 on 2026-09-01; that address is unverified and is not shown.
“Pre-built policy packs, automated evidence generation, and audit-ready documentation for every major AI regulation”2026-10-08, the product page
“Risk Classification”2026-10-08, a feature name in a list on the home page, www.credo.ai
Read by Complipath's build session on 2026-10-08 — 2026-10-08, the product page. Our build's own fetch of credo.ai returned 403 on 2026-09-01.
“Classify your AI systems by risk”2026-10-08, the EU AI Act readiness page
Read by Complipath's build session on 2026-10-08 — 2026-10-08, the EU AI Act readiness page. Our build's own fetch of holisticai.com returned 403 on 2026-09-01.
As written to Kosmoy on 17 August 2026, and kept as promised: "runtime enforcement is a real capability and one we do not have. Anyone who needs a control layer at inference time should be looking at you, not at us."
Read by Yobel Tzegai on 2026-08-22 — the home page, as the site's own description of what it is. Our build's own fetch of kosmoy.com returned 403 on 2026-09-01.
Eight domains refused our fetch on 2026-09-01, and no person has read them for us since: Vanta, Drata, OneTrust, IBM watsonx.governance, Saidot, trail, Modulos, LatticeFlow COMPL-AI. We write about no one we have not read.
You know your systems and we do not.
If you have someone who knows every system in the product and the time to sit with each one, in-house will get further, faster, than any tool will.
A spreadsheet has no law version. Regulation (EU) 2026/1744 amended the 2024 text in force. Among other things it moved the high-risk application dates to 2 December 2027 and 2 August 2028 (Article 113, third paragraph, point (c), as amended). No spreadsheet re-runs itself when that happens. A register that records which version of the law each assessment answered can list exactly which entries cited a provision that moved — and which did not. One is a filing cabinet. The other is a question you can ask.
Complipath is not a GRC suite. It is EU AI Act compliance, and nothing else: the inventory of your AI systems, the classification with the article behind it, the obligations, the Annex IV documentation and the evidence. It does not map ISO/IEC 42001 controls to the Act and it runs no risk register for Article 9. Where another tool carries your other frameworks, the AI Act record stays in Complipath and exports as a spreadsheet, as JSON or as a PDF.
A consultant brings judgment and the hours to apply it. Complipath does the groundwork those hours otherwise go to: the inventory, the classification with the article behind it, the obligations and the evidence, each with the person who confirmed it. Use your lawyer for judgment. Use Complipath for the groundwork.
Runtime enforcement is a real capability, and one we do not have.
A control layer that sits at inference time — inspecting, blocking or rewriting what a model does as it runs — is a different product from a register that classifies systems and holds the evidence. Complipath does not do it and is not going to pretend the gap is a scoping decision. On 17 August 2026 we said as much to Kosmoy, in writing: anyone who needs a control layer at inference time should be looking at them and not at us.
What Kosmoy is, in their words and not ours: “Kosmoy is the AI management platform for the regulated enterprise.” That sentence was read on kosmoy.com on 22 August 2026, by hand, on a machine outside this build — this site's own environment cannot reach their website, and two attempts on 19 and 20 August 2026 failed the same way, so it is the one reading here that no tool can re-run. Everything else in this section is about us. Read their pages, not this paragraph. www.kosmoy.com.
How many hours anything saves. We have not measured it. The day a customer has, that number goes here with the measurement behind it — and not before.
Nothing here describes a tool nobody at Complipath has used or read — and that is a sentence you would have to take from us, which is why what you can check about us before you believe any of it is set out on its own page. What our own engine will and will not decide is stated as a limit rather than a feature list. What this check can and cannot decide lists both sides. The plain-language answer to what the product is: what Complipath is. If you are further along than choosing, the twelve questions a reviewer would ask us are answered in public, and what we cover of the Act is a table with five empty rows in it. The other version of this question — why not just ask a model, or build an agent — is a table too. Six vendors read from their own sites, in their own words and dated: EU AI Act compliance software compared, with the checklist to take into any demo. One vendor at a time, on 50 requirements: Complipath vs OneTrust, Complipath vs Credo AI, Complipath vs Holistic AI, Complipath vs CompliAct, Complipath vs Legalithm, Complipath vs Atheros AI, Complipath vs Euridium and Complipath vs Dossentia. And if the answer in the room was “we need a lawyer, then”: you do, and this is the division of labour.
See which of your own AI systems the EU AI Act covers.
a short set of questions, more if your answers open follow-ups. No account needed. Nothing is saved unless you choose to keep your result.