Compare · Complipath vs Maditon · Last checked 27 October 2026 · Maditon’s pages read 26 October 2026
Each Maditon cell is a sentence from their own site, in their words and not ours, with the page it stood on; each Complipath cell is our own page or our status table. Complipath (complipath.io) is EU AI Act compliance software that classifies each AI system with the article behind the answer.
Price. Maditon's own page, read on 26 October 2026, says "€49 billed monthly"; Complipath Starter at €499 a month or €4,990 a year, with the first system free.
Prices exclude VAT.
Maditon is among the checkers and templates. Its price, in its own words: €49 billed monthly
maditon.com. Complipath is €499 a month or €4,990 a year, up to 20 AI systems. Prices exclude VAT.
Complipath costs more than simple AI Act checkers because it also answers your customers' questionnaires with the source of every answer, builds the audit pack and keeps the evidence. Enterprise governance platforms mostly publish no price; the one we could read, Vanta on AWS Marketplace, lists $14,000.00 for 12 months of its Essentials package, against Complipath's €4,990 a year. The three tiers, side by side.
“You should not have to take our word for it. Every answer quotes the law it rests on.” In their words and not ours.[83]
“Maditon is the compliance assistant that does the heavy lifting: it classifies your AI systems under the EU AI Act, reads your suppliers' agreements, watches them for changes and drafts the answers when customers and auditors ask.” In their words and not ours.[84]
Prices exclude VAT. Our price is the one on the pricing page.
Counts = requirements met in full. Partly counts as half. “Not stated” counts as zero and is never guessed. Maditon: 32 of 50 stated on the 10 pages we read. Complipath: 47 of 50 answered by our own pages.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
“An inventory of AI systems, including the ones hiding in tools you already use.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Under '/ First module: EU AI Act' on the home page.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
“An inventory of AI systems, including the ones hiding in tools you already use.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Systems inside tools a company already uses are named; a separation of built and bought systems is not stated.
Live. A person behind every system and every duty. The status table: what Complipath is.
Partly. A read-only GitHub or GitLab connection finds AI libraries, calls to AI services and AI key names in the repositories you choose and suggests them for the register, where a person adds them; the free readiness review suggests systems from your public web pages. Source.
With limits. Groups your systems by vendor and shows which papers you hold from each, which are missing and which have expired; for the AI vendors it knows it links the public terms and, where known, the data processing agreement; it quotes a sentence on personal data or training where one was found, with its link and the day read; each quoted page is read again once a month, and a sentence no longer on its page stops showing. The status table: what Complipath is.
“Register a supplier and Maditon finds its published legal documents — privacy policy, terms, data processing agreement, security page, sub-processor list, AI policy and service level agreement — fetches a copy and reads it.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. FAQ; a supplier's published AI policy is read, but recording which AI each supplier uses is not stated.
Live. Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms. The status table: what Complipath is.
“Maditon is the compliance assistant that does the heavy lifting: it classifies your AI systems under the EU AI Act, reads your suppliers' agreements, watches them for changes and drafts the answers when customers and auditors ask.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Hero text; classification is by AI passes (see f05).
Partly. Article 5(1), points (d), (e), (f), (g) and (h) are decided. Points (a), (b) and (c) turn on judgement and are flagged for legal review instead of being decided. Source.
“Risk classification, Annex III assessment, GPAI obligations, transparency requirements, prohibited practices screening, and audit-ready documentation.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. EU AI Act module card on the modules page.
Yes. A use case that appears in Annex III is high-risk under Article 6(2) unless the Article 6(3) exemption applies. Source.
“Risk classification, Annex III assessment, GPAI obligations, transparency requirements, prohibited practices screening, and audit-ready documentation.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. EU AI Act module card on the modules page.
Yes. If the use case appears in Annex III, Article 6(2) classifies it high-risk unless the Article 6(3) exemption applies, and profiling of natural persons blocks the exemption entirely. Source.
Partly. Which obligations follow from the role you stated is decided. Whether you are the provider or the deployer is asked, never inferred. Source.
With limits. Confirming a classification creates the requirements that follow from it, each with a status, a place for evidence and an owner you fill in: for high risk, the set for the system's role (provider, deployer or both, from its recorded type or confirmed role), and a row for each Article 50 transparency duty. The rows are made at a system's first confirmation; when a later high-risk classification, a role change or a newer catalogue leaves high-risk rows missing, Review proposes them and a person adds them. The status table: what Complipath is.
“The EU AI Act module is live: it inventories your AI systems, classifies each one with citations from Regulation (EU) 2024/1689, produces the obligation checklist and the audit-ready dossier.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. FAQ 'How does the EU AI Act module relate to the rest of Maditon?'.
Live. Each reason behind a verdict names the provision it rests on, so a reader can check it herself. The status table: what Complipath is.
“All modules follow the same methodology: source-referenced assessments, compliance checklists tied to specific articles, evidence management, and PDF/A-1b dossier export.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Foot of the modules page.
Live. Each obligation carries the date it applies from, derived from where the provision sits rather than written onto the row. The status table: what Complipath is.
Live. Records the measures you take to support AI literacy under Article 4 as amended: who was briefed on what, and when. It applies whatever your risk level. The status table: what Complipath is.
“The Service uses AI to generate draft risk classifications, document templates, learning content, and readings of suppliers' legal documents.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Privacy policy; 'learning content' is generated, Article 4 AI literacy is not named as a feature (it is the subject of a guide on 06).
Yes. Article 50 makes some systems tell people they are dealing with AI, and a system can carry that duty and be high-risk at the same time. Source.
“Risk classification, Annex III assessment, GPAI obligations, transparency requirements, prohibited practices screening, and audit-ready documentation.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. EU AI Act module card; the home page sample shows 'Art. 50 transparency'.
Live. Checks the provisions your confirmed records cite against amending acts, and emails everyone in the workspace once per act, naming each system it touches. The status table: what Complipath is.
Growth, opens at launch. Growth, opens at launch: For a provider of a high-risk system: drafts of the EU declaration of conformity (Article 47, Annex V), the EU database registration (Article 49, Annex VIII), the post-market monitoring plan (Article 72), risk management (Article 9) from the risk register and the quality management system (Article 17), each point quoted from the law; a person completes and signs them The status table: what Complipath is.
With limits. Logs what went wrong with an AI system and shows the date a serious incident must be reported by, from Article 73 (the shortest date that could apply while answers are Not sure), who is told under Article 73(1), Article 75(1a) and Article 26(5), and a GDPR 72-hour line where personal data is involved; a person decides whether it is serious, the owner is reminded; each incident also shows an internal first report within 24 hours and a cause report within two weeks, which are not dates from the Regulation. The status table: what Complipath is.
Partly. Complipath does not test models or watch their outputs; a connected Datadog account shows, from your logs, how often each AI service was called and its error rate. Source.
Partly. Each obligation has an owner, a status and a date it applies from. When an amending act touches a provision your records cite, you get an email per affected system. Source.
“Transactional email — the sign-in codes and magic links our identity provider sends, trial and billing notices, invitations, deadline reminders, the daily change email and weekly digest, and the CRA Readiness Scan report”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Processor table in the privacy policy; 'deadline reminders' are sent, a task or workflow feature is not described.
Live. A workspace for the technical documentation, section by section, saying which Annex IV points each one answers. The status table: what Complipath is.
Live. Drafts a documentation section from the facts in your register, and says which limbs it could not answer. The status table: what Complipath is.
“The Service uses AI to generate draft risk classifications, document templates, learning content, and readings of suppliers' legal documents.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Privacy policy section on AI processing (Mistral, EU endpoint).
Live. Two features. 'DPIA and FRIA: whether they apply' says for each confirmed system whether a fundamental rights impact assessment is required, likely or not, quoting Article 27(1). 'DPIA and FRIA documents', in the app's words, drafts the FRIA (Article 27(1)) from your register by rules, built on the DPIA, a source on every sentence, for a named person to confirm with a date: a Growth feature, included in Starter until Growth launches, live since 9 October 2026. The status table: what Complipath is.
Growth, opens at launch. Growth, opens at launch: For a provider of a high-risk system: drafts of the EU declaration of conformity (Article 47, Annex V), the EU database registration (Article 49, Annex VIII), the post-market monitoring plan (Article 72), risk management (Article 9) from the risk register and the quality management system (Article 17), each point quoted from the law; a person completes and signs them The status table: what Complipath is.
Live. The whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against. The status table: what Complipath is.
“Classifications, quotes, evidence and the acceptance trail as archival PDF/A or JSON, whenever you want. Self-serve, no waiting.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. 'The file is yours to take' on the home page.
Live. Upload a file once. We read it and use it everywhere it helps: proof for requirements, text for the documentation, and a flag when it disagrees with an earlier answer. The status table: what Complipath is.
“New Cross-system Evidence page in the sidebar — search and manage every uploaded file across every AI system in one place.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Changelog 2026-02-12; evidence per AI system is stated, evidence linked to each requirement is not.
Live. Shows who did what in the workspace, and when, as a list you can read and export. The status table: what Complipath is.
“Every material action is logged: authentication events, permission denials, data exports, deletions, billing events, AI classifications and acceptances.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page, 'Logging and incident response'.
Yes. Confirming a classification stamps it with the person who confirmed it and when; a documentation section is marked reviewed by a named person on a date. Source.
“Every determination is a draft. Someone on your team accepts it by name, and the record keeps who and when.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. 'Nothing counts until a person accepts it' on the home page.
Yes. Each assessment records which version of the legal text it was made against, and which provisions have been amended since. Source.
Live. One file with every classification, citation and confirmation — the one you hand to someone outside your company. The status table: what Complipath is.
“From the EU AI Act module: PDF/A-1b audit dossiers with risk classifications, compliance assessments, source-referenced regulatory citations and human-accepted determinations with timestamps.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. FAQ 'What documentation does Maditon produce?'; the PDF dossier is on Starter, Growth and Scale, not Free.
Partly. A read-only connector (MCP) lets Claude, ChatGPT or another assistant that speaks MCP read the register, once an admin signs in to allow it or with a token your workspace creates; either can be revoked. There is no API for writing to it. Source.
“25 questions covering classification, the API, data residency and the regulation itself.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Foot of the FAQ, pointing to a knowledge base we did not read; the security page lists 'generating API keys' among sensitive actions. What the API does is not stated on the pages read.
Partly. Read-only connections to GitHub, GitLab, Azure and Datadog find AI in your code and read AI use from your logs, on Starter and up; there is no connection to ML platforms. Source.
No. Complipath does not connect to work tools.
Not stated publicly.
“OAuth providers: Google and Microsoft only. No SMS-based MFA — it's vulnerable to SIM-swapping.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page; sign-in through Google and Microsoft; SAML or organisation SSO is not stated.
Yes. Upload the AI inventory template or your own sheet as an Excel (.xlsx) or CSV file of up to 200 rows, check every row in a preview and send what you import to Review. Risk levels in the file are not imported: the rules classify each system.
Yes. Your workspace is stored in Frankfurt: the database in Supabase's eu-central-1 region and the app's functions in Vercel's fra1 region, read on 8 October 2026. Source.
“Every byte of the content you put into Maditon sits in European jurisdiction, on European-headquartered infrastructure.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page 'Where your data lives'; the next sentences name billing (Stripe) as the one exception that may reach the United States.
Not stated publicly.
“Database encryption at rest is enabled (UpCloud Managed PostgreSQL provides this natively).”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page 'Data in transit and at rest', beside 'TLS 1.2 minimum, TLS 1.3 preferred.'.
No. Complipath is not SOC 2 certified and not ISO 27001 certified. Source.
“ISO 27001 certification: not yet. We build to ISO 27001 Annex A standards but the formal certification is on the roadmap for 2027.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page 'What we do not have (yet)'; the next line says 'SOC 2 Type II: not on the roadmap.'.
Live. A code from your phone after the email link. The owner can require it for everyone. The status table: what Complipath is.
“Multi-factor authentication available for end users (TOTP, WebAuthn / passkeys). Organisation admins can enforce MFA for all members.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Security page 'Authentication and access'.
No. Complipath runs only as the hosted service.
Starter is €499 a month or €4,990 a year. Prices exclude VAT. Pricing.
“€49 billed monthly · excl. VAT”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Starter card.
Yes. Your first system is free with no end date. The check needs no account. Source.
“Start free — 5 suppliers and 1 AI system, no card.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Pricing intro.
No card. Full access for 30 days, then it drops to the free plan — nothing is deleted and your export keeps working. Pricing.
“Paid plans add change watching, customer questionnaires, PDF reports and room to grow, each with a 14-day free trial (card required at the start).”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Pricing intro; card required.
Starter includes 20 AI systems. Archived systems don’t count toward your limit. Pricing.
“Every plan includes one AI system: risk classification against the EU AI Act, with article citations and the obligation checklist, and on Starter, Growth and Scale the PDF dossier. On those plans the module covers 3, 15 or 50 AI systems.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. EU AI Act module box; the plans themselves are tiered by suppliers in the register (5, 25, 100, 400) and assessments a month.
Yes. Your first system is free with no end date. You pay for your AI portfolio, not your number of employees. Source.
“For a small team putting its suppliers in order.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com.
Yes. The check needs no account, and the trial needs no card. Source.
“No card. Add a supplier and see what Maditon finds in their documents within minutes.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Closing call to action 'Start with five suppliers, free.'.
Not stated publicly.
“Most companies go from first login to a complete audit-ready dossier within 48 hours.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. FAQ 'How long does it take to get my first compliance report?'.
Not required. The check needs no account, and a walkthrough can be booked if you want one. Source.
Book 30 minutes and we set up your first AI systems with you. Pricing.
“Email support and the in-app chatbot”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. Starter; Free has 'Docs and the in-app chatbot'; onboarding help as such is not stated.
Growth, opens at launch. Growth, opens at launch: Under Frameworks, beside the EU AI Act: the GDPR duties each AI system brings, quoted from the regulation, with what Complipath prepares and what stays yours, and how far your AI management is from ISO/IEC 42001, with a draft statement of applicability; readiness only, never a certificate The status table: what Complipath is.
“GDPR, NIS2, and the Cyber Resilience Act (CRA) are on our roadmap.”Maditon, in their words and not ours. It was read on 26 October 2026 from maditon.com. FAQ; these are other EU laws as modules, ISO/IEC 42001 and NIST AI RMF are not offered (ISO 42001 is only the subject of a guide on 06).
“You should not have to take our word for it. Every answer quotes the law it rests on.”Maditon, in their words and not ours. It was read on 9 October 2026 from maditon.com.
“Maditon is the compliance assistant that does the heavy lifting: it classifies your AI systems under the EU AI Act, reads your suppliers' agreements, watches them for changes and drafts the answers when customers and auditors ask.”Maditon, in their words and not ours. It was read on 9 October 2026 from maditon.com.
The 10 pages of Maditon's site we read, on 26 October 2026:
It is written by Complipath, so read it as ours. What keeps it checkable is the rule on both sides: each Maditon cell is their own sentence with the page it stood on, and each Complipath cell is what our own pages say. Where a side's pages say nothing, the cell says so.
That none of the 10 pages of Maditon's site we read on 26 October 2026 said it. It is a statement about those pages, listed below, not about the product: ask Maditon before you rule anything out.
Start from the rows you need. Where Maditon's own site states a requirement our pages mark as not supported, they are the closer fit on that row by what each side says publicly. For a European company that wants each classification with its article and the version of the law it used, at a public price, start with Complipath's free check.