Compare · Complipath vs Nordis.AI · Last checked 8 November 2026
Each Nordis.AI cell is a sentence from their own site, in their words and not ours, with the page it stood on; each Complipath cell is our own page or our status table. Complipath (complipath.io) is EU AI Act compliance software that classifies each AI system with the article behind the answer.
Software that does the work for you: we answer your customers' AI questionnaires, audit your AI vendors and set up your Trust Center. A person checks every answer. You keep the system.
Get my risk classes, freeBook a 20-min intro call20 minutes with the founder.
“Evidence you collect for AI Act Art. 10, 13 or 15 is automatically reusable for GDPR Art. 5, 25 and 32.” In their words and not ours.[70]
“Shared evidence, one control library, combined executive reports. Stop doing data-protection work twice.” In their words and not ours.[71]
“Our AI wizard guides you through a 15-minute questionnaire about your AI systems” In their words and not ours.[72]
Prices exclude VAT. Our price is the one on the pricing page.
Counts = requirements met in full. Partly counts as half. “Not stated” counts as zero and is never guessed. Nordis.AI: 19 of 50 stated on the 10 pages we read. Complipath: 50 of 50 answered by our own pages.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
“Discover and catalog all AI systems across your organization with our intelligent wizard. Get complete visibility in minutes, not weeks.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
Live. A person behind every system and every duty. The status table: what Complipath is.
Yes. Read-only connections to GitHub, GitLab, Azure, Datadog and the Claude or OpenAI API find AI in your code, services and logs and suggest it for the register, where a person adds it; an app list exported from Google Admin or Microsoft Entra can be uploaded, and the free readiness review suggests systems from your public web pages. The GitHub App that updates on every push is built and not yet switched on. Source.
With limits. Groups your systems by vendor and shows which papers you hold from each, which are missing and which have expired; for the AI vendors it knows it links the public terms and, where known, the data processing agreement; it quotes a sentence on personal data or training where one was found, with its link and the day read; each quoted page is read again once a month, and a sentence no longer on its page stops showing. The limit, in the app's own words: "Public terms are quoted for known vendors only, read again monthly; any other vendor is marked Unverified". The status table: what Complipath is.
Live. Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms. The status table: what Complipath is.
“AI-powered classification engine determines your risk level based on EU AI Act criteria. Know exactly where you stand.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Partly. Article 5(1), points (d), (e), (f), (g) and (h) are decided. Points (a), (b) and (c) turn on judgement and are flagged for legal review instead of being decided. Source.
Yes. A use case that appears in Annex III is high-risk under Article 6(2) unless the Article 6(3) exemption applies. Source.
Yes. If the use case appears in Annex III, Article 6(2) classifies it high-risk unless the Article 6(3) exemption applies, and profiling of natural persons blocks the exemption entirely. Source.
Partly. Which obligations follow from the role you stated is decided. Whether you are the provider or the deployer is asked, never inferred. Source.
With limits. Confirming a classification creates the requirements that follow from it, each with a status, a place for evidence and an owner you fill in: for high risk, the set for the system's role (provider, deployer or both, from its recorded type or confirmed role), and a row for each Article 50 transparency duty. The rows are made at a system's first confirmation; when a later high-risk classification, a role change or a newer catalogue leaves high-risk rows missing, Review proposes them and a person adds them. The limit, in the app's own words: "Rows appear once a person confirms the classification, and a person marks each one done, never the app". The status table: what Complipath is.
Live. Each reason behind a verdict names the provision it rests on, so a reader can check it herself. The status table: what Complipath is.
Live. Each obligation carries the date it applies from, derived from where the provision sits rather than written onto the row. The status table: what Complipath is.
Live. Records the measures you take to support AI literacy under Article 4 as amended: who was briefed on what, and when. It applies whatever your risk level. The status table: what Complipath is.
Yes. Article 50 makes some systems tell people they are dealing with AI, and a system can carry that duty and be high-risk at the same time. Source.
Live. Checks the provisions your confirmed records cite against amending acts, and emails everyone in the workspace once per act, naming each system it touches. The status table: what Complipath is.
“Track compliance status, get alerts on regulatory changes, and stay audit-ready 24/7 with automated monitoring.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Live. For a provider of a high-risk system: drafts of the EU declaration of conformity (Article 47, Annex V), the EU database registration (Article 49, Annex VIII), the post-market monitoring plan (Article 72), risk management (Article 9) from the risk register and the quality management system (Article 17), each point quoted from the law; a person completes and signs them The status table: what Complipath is.
“Post-market monitoring & incident log”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. A list item in the column headed "REG. 2024/1689" / "EU AI Act".
With limits. Logs what went wrong with an AI system and shows the date a serious incident must be reported by, from Article 73 (the shortest date that could apply while answers are Not sure), who is told under Article 73(1), Article 75(1a) and Article 26(5), and a GDPR 72-hour line where personal data is involved; a person decides whether it is serious, the owner is reminded; each incident also shows an internal first report within 24 hours and a cause report within two weeks, which are not dates from the Regulation. The limit, in the app's own words: "Shows the reporting deadline and who must be told; it never reports to an authority for you". The status table: what Complipath is.
“Post-market monitoring & incident log”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. A list item in the column headed "REG. 2024/1689" / "EU AI Act"; Article 73 is not named.
Partly. Complipath does not test models or score their outputs. On Growth, Live checks your code and logs every hour and after each push and names what breaks the AI Act or GDPR, such as personal data sent to a model or a chatbot with no AI notice; a connected Datadog account shows how often each AI service was called and its error rate, and the Claude or OpenAI API shows the models used in the last 30 days. Source.
Yes. Each obligation has an owner, a status and a date it applies from; the step-by-step plan breaks your next steps into small steps with an owner where one is recorded, Review lists everything that waits for a person, a short email each Monday sums up your register, and when an amending act touches a provision your records cite, you get an email per affected system. Source.
“Receive deadline reminders and actionable recommendations”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Live. A workspace for the technical documentation, section by section, saying which Annex IV points each one answers. The status table: what Complipath is.
“Generate audit-ready technical documentation, CE declarations, and compliance reports. Professional quality in seconds.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. "technical documentation"; Annex IV is not named in this sentence.
Live. Drafts a documentation section from the facts in your register, and says which limbs it could not answer. The status table: what Complipath is.
Live. Two features. 'DPIA and FRIA: whether they apply' says for each confirmed system whether a fundamental rights impact assessment is required, likely or not, quoting Article 27(1). 'DPIA and FRIA documents', in the app's words, drafts the FRIA (Article 27(1)) from your register by rules, built on the DPIA, a source on every sentence, for a named person to confirm with a date: included in Growth. The status table: what Complipath is.
Live. For a provider of a high-risk system: drafts of the EU declaration of conformity (Article 47, Annex V), the EU database registration (Article 49, Annex VIII), the post-market monitoring plan (Article 72), risk management (Article 9) from the risk register and the quality management system (Article 17), each point quoted from the law; a person completes and signs them The status table: what Complipath is.
“Generate audit-ready technical documentation, CE declarations, and compliance reports. Professional quality in seconds.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. "CE declarations"; Article 47 is not named.
Live. The whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against. The status table: what Complipath is.
Live. Upload a file once. We read it and use it everywhere it helps: proof for requirements, text for the documentation, and a flag when it disagrees with an earlier answer. The status table: what Complipath is.
“Centralized repository for all compliance documents. Organized, searchable, and audit-ready when you need it.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Live. Shows who did what in the workspace, and when, as a list you can read and export. The status table: what Complipath is.
“Immutable audit logs”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Standard plan feature.
Yes. Confirming a classification stamps it with the person who confirmed it and when; a documentation section is marked reviewed by a named person on a date. Source.
Yes. Each assessment records which version of the legal text it was made against, and which provisions have been amended since. Source.
Live. One file with every classification, citation and confirmation — the one you hand to someone outside your company. The status table: what Complipath is.
Partly. A read-only connector (MCP) lets Claude, ChatGPT or another assistant that speaks MCP read the register, once an admin signs in to allow it or with a token your workspace creates; either can be revoked. There is no API for writing to it. Source.
“API access”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Enterprise plan ("Custom Pricing").
Partly. Read-only connections to GitHub, GitLab, Azure, Datadog, any log system and the Claude or OpenAI API find AI in your code and read AI use from your logs and AI accounts, on Starter and up; there is no connection to ML platforms. Source.
Partly. Claude and ChatGPT can read your register once an admin allows it, and an app list exported from Google Admin or Microsoft Entra can be uploaded. Source.
Partly. You can sign in with your Google account, and the owner can require a two-step sign-in for everyone; SAML single sign-on is not in the app's list. Source.
Yes. Upload the AI inventory template or your own sheet as an Excel (.xlsx) or CSV file of up to 200 rows, check every row in a preview and send what you import to Review. Risk levels in the file are not imported: the rules classify each system.
Yes. Your workspace is stored in Frankfurt: the database in Supabase's eu-central-1 region and the app's functions in Vercel's fra1 region, read on 8 October 2026. Source.
“Your data is primarily stored in EU data centers (Supabase hosted on AWS EU regions). However, some service providers may process data outside the EU:”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Privacy policy; it continues "For transfers to the US (Stripe, OpenAI, Anthropic), we ensure compliance with GDPR Chapter V requirements and implement supplementary measures where necessary."
Yes, at our database provider: Supabase's own security page says “All customer data is encrypted at rest with AES-256 and in transit via TLS.” We read it there on 28 October 2026. Source.
“Your data is encrypted end-to-end, stored in EU data centers, and handled with the highest security standards. We never share your data with third parties.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
No. Complipath is not SOC 2 certified and not ISO 27001 certified. Source.
Live. A code from your phone after the email link. The owner can require it for everyone. The status table: what Complipath is.
No. Complipath runs only as the hosted service.
Starter is €499 a month or €4,990 a year. Prices exclude VAT. Pricing.
“€49”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Standard plan; the next line on the page is "/month". The same page lists a Basic plan at no charge, Pro, Enterprise ("Custom Pricing") and a one-time service, "Express Audit". The page says "Prices shown in your local currency, rounded to nearest 50 units"; it was rendered from Frankfurt (fra1), so another location may see another currency.
Yes. The Free plan covers one AI system and one user, with no end date. The check needs no account. Source.
“Perfect for getting started with basic AI Act assessment”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Basic plan at no charge, "Up to 3 AI systems".
No card. The trial lasts 30 days and gives you Starter, with up to 20 AI systems. After 30 days the workspace is on the free plan, which has one AI system: nothing is deleted and your export keeps working; systems above the free plan's one are paused until you buy a plan or archive others. Pricing.
“No credit card required • 14-day free trial • Cancel anytime”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai. Home page; the plan buttons on the same page and on /pricing read "Start 7-Day Free Trial →": the two pages state different trial lengths.
Starter includes 20 AI systems. Archived systems don’t count toward your limit. Pricing.
Yes. The Free plan covers one AI system and one user, with no end date. You pay for your AI portfolio, not your number of employees. Source.
“Automating EU AI Act compliance for European SMBs with intelligent risk assessment, automated documentation, and expert guidance.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Yes. The check needs no account, and the trial needs no card. Source.
Yes. Your risk classes in about 30 seconds, with no account and no card: in five timed runs of the free check on 30 October 2026 the median until every suggested system had its class was 15.7 seconds. The AI Act Answer Sprint returns the AI Act section within 48 working hours. Source.
“Know your compliance status in 2 minutes.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Not required. The check needs no account, and a walkthrough can be booked if you want one. Source.
Book 20 minutes and we set up your first AI systems with you. Pricing.
“Connect with EU AI Act specialists when you need human guidance. Book consultations directly in the platform.”Nordis.AI, in their words and not ours. It was read on 8 November 2026 from nordis.ai.
Live. Under Frameworks, beside the EU AI Act: the GDPR duties each AI system brings, quoted from the regulation, with what Complipath prepares and what stays yours, and how far your AI management is from ISO/IEC 42001, with a draft statement of applicability; readiness only, never a certificate The status table: what Complipath is.
“Evidence you collect for AI Act Art. 10, 13 or 15 is automatically reusable for GDPR Art. 5, 25 and 32.”Nordis.AI, in their words and not ours. It was read on 9 October 2026 from nordis.ai.
“Shared evidence, one control library, combined executive reports. Stop doing data-protection work twice.”Nordis.AI, in their words and not ours. It was read on 9 October 2026 from nordis.ai.
“Our AI wizard guides you through a 15-minute questionnaire about your AI systems”Nordis.AI, in their words and not ours. It was read on 9 October 2026 from nordis.ai.
The 10 pages of Nordis.AI's site we read, on 8 November 2026:
It is written by Complipath, so read it as ours. What keeps it checkable is the rule on both sides: each Nordis.AI cell is their own sentence with the page it stood on, and each Complipath cell is what our own pages say. Where a side's pages say nothing, the cell says so.
That none of the 10 pages of Nordis.AI's site we read on 8 November 2026 said it. It is a statement about those pages, listed below, not about the product: ask Nordis.AI before you rule anything out.
Start from the rows you need. Where Nordis.AI's own site states a requirement that Complipath's pages answer no or not yet, Nordis.AI is the closer fit on that row, by what each side says publicly. If you want each classification with its article and the version of the law it used, at a public price, start with Complipath's free check.