Compare · Complipath vs RiskOnyx · Last checked 14 October 2026
Each RiskOnyx cell is a sentence from their own site, in their words and not ours, with the page it stood on; each Complipath cell is our own page or our status table. Complipath (complipath.io) is EU AI Act compliance software that classifies each AI system with the article behind the answer.
Price. RiskOnyx is cheaper: its own comparison page, which was read on 14 October 2026, says Starter is €99 per month (€999 a year) for 5 AI systems and 1 user, and its next plans are €299 and €499, against Complipath Starter at €499 a month with the first system free; whether their prices include VAT is not stated on the pages we read.
Prices exclude VAT.
“Working access, clear limits and better value as capacity grows” In their words and not ours.[56]
“RiskOnyx is an AI compliance and governance platform that helps organisations register AI systems, classify them, organise evidence, track obligations, and stay more prepared for audits, procurement checks, and internal review.” In their words and not ours.[57]
“Yes, Public Beta available” In their words and not ours.[58]
Prices exclude VAT. Our price is the one on the pricing page.
Counts = requirements met in full. Partly counts as half. “Not stated” counts as zero and is never guessed. RiskOnyx: 5 of 50 stated on the 6 pages we read. Complipath: 47 of 50 answered by our own pages.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
Live. Every AI system you build or use, with its owner and risk class. The status table: what Complipath is.
Live. A person behind every system and every duty. The status table: what Complipath is.
Partly. The free readiness review suggests AI systems from your public web pages; a system your website does not describe is in it only if you name it. Source.
Live. Groups your systems by vendor and shows which papers you hold from each, which are missing and which have expired. The status table: what Complipath is.
Live. Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms. The status table: what Complipath is.
“Yes. RiskOnyx is built to support structured AI system classification and governance assessment against relevant regulatory and framework expectations.”RiskOnyx, in their words and not ours. It was read on 14 October 2026 from riskonyx.com. Answer to "Can RiskOnyx help classify AI systems?"; whether the classification is rule-based or AI/LLM-based is not stated on the pages we read.
Partly. Article 5(1), points (d), (e), (f), (g) and (h) are decided. Points (a), (b) and (c) turn on judgement and are flagged for legal review instead of being decided. Source.
Yes. A use case that appears in Annex III is high-risk under Article 6(2) unless the Article 6(3) exemption applies. Source.
Yes. If the use case appears in Annex III, Article 6(2) classifies it high-risk unless the Article 6(3) exemption applies, and profiling of natural persons blocks the exemption entirely. Source.
Partly. Which obligations follow from the role you stated is decided. Whether you are the provider or the deployer is asked, never inferred. Source.
With limits. Confirming a classification creates the obligations that follow from it, each with a status, a place for evidence and an owner you fill in, and high-risk rows need the system's role recorded. A later, stricter classification adds no new duties unless you change the system's type or role. The status table: what Complipath is.
Live. Each reason behind a verdict names the provision it rests on, so a reader can check it herself. The status table: what Complipath is.
Live. Each obligation carries the date it applies from, derived from where the provision sits rather than written onto the row. The status table: what Complipath is.
Live. Records the measures you take to support AI literacy under Article 4 as amended: who was briefed on what, and when. It applies whatever your risk level. The status table: what Complipath is.
Yes. Article 50 makes some systems tell people they are dealing with AI, and a system can carry that duty and be high-risk at the same time. Source.
Live. Checks the provisions your confirmed records cite against amending acts, and emails everyone in the workspace once per act, naming each system it touches. The status table: what Complipath is.
Not supported. We found no support for this in what we have built. MVP searched 245 shipped source files, 44 migrations, 14 obligation templates, 15 export columns and 12 Annex IV limbs, on the article number and on the provision's own words: nothing on any of the five. The status table: what Complipath is.
Live. Serious incidents, in the app's own words: it logs what went wrong with an AI system and shows the date a serious incident must be reported by and who is told, from Articles 73, 26(5) and 75(1a) as written; a person decides, and the owner is reminded. A Growth feature, included in Starter until Growth launches, live since 9 October 2026. The status table: what Complipath is.
No. Complipath does not monitor AI models while they run.
Partly. Each obligation has an owner, a status and a date it applies from. When an amending act touches a provision your records cite, you get an email per affected system. Source.
Live. A workspace for the technical documentation, section by section, saying which Annex IV points each one answers. The status table: what Complipath is.
Live. Drafts a documentation section from the facts in your register, and says which limbs it could not answer. The status table: what Complipath is.
Live. Two features. 'DPIA and FRIA: whether they apply' says for each confirmed system whether a fundamental rights impact assessment is required, likely or not, quoting Article 27(1). 'DPIA and FRIA documents', in the app's words, drafts the FRIA (Article 27(1)) from your register by rules, built on the DPIA, a source on every sentence, for a named person to confirm with a date: a Growth feature, included in Starter until Growth launches, live since 9 October 2026. The status table: what Complipath is.
Not supported. The Annex IV documentation asks for a copy of the declaration and you upload it; the plan says to issue it when the system is ready. The declaration itself is not drafted. The status table: what Complipath is.
Live. The whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against. The status table: what Complipath is.
Live. Upload a file once. We read it and use it everywhere it helps: proof for requirements, text for the documentation, and a flag when it disagrees with an earlier answer. The status table: what Complipath is.
Live. Shows who did what in the workspace, and when, as a list you can read and export. The status table: what Complipath is.
Yes. Confirming a classification stamps it with the person who confirmed it and when; a documentation section is marked reviewed by a named person on a date. Source.
Yes. Each assessment records which version of the legal text it was made against, and which provisions have been amended since. Source.
Live. One file with every classification, citation and confirmation — the one you hand to someone outside your company. The status table: what Complipath is.
Partly. A read-only connector (MCP) lets your own AI assistant read the register with a token your workspace creates and can revoke. There is no API for writing to it.
No. Complipath does not connect to ML or engineering tools.
No. Complipath does not connect to work tools.
Not stated publicly.
Yes. Upload the AI inventory template or your own sheet as an Excel (.xlsx) or CSV file of up to 200 rows, check every row in a preview and send what you import to Review. Risk levels in the file are not imported: the rules classify each system.
Yes. Your workspace is stored in Frankfurt: the database in Supabase's eu-central-1 region and the app's functions in Vercel's fra1 region, read on 8 October 2026. Source.
“✓ Yes, Spain”RiskOnyx, in their words and not ours. It was read on 14 October 2026 from riskonyx.com. Row "Fully EU-based", RiskOnyx column, answering "Is the provider legally and operationally EU-based?" This is where the company is established; where customer data is hosted is not stated on the pages we read.
Not stated publicly.
No. Complipath is not SOC 2 certified and not ISO 27001 certified. Source.
Live. A code from your phone after the email link. The owner can require it for everyone. The status table: what Complipath is.
No. Complipath runs only as the hosted service.
Starter is €499 a month. Prices exclude VAT. Pricing.
“Starter Monthly: €99/month Annual: €999/year when billed annually Capacity: 5 AI systems, 1 user”RiskOnyx, in their words and not ours. It was read on 14 October 2026 from riskonyx.com. Row "Entry price and capacity", RiskOnyx column; the FAQ (page 06) names three higher monthly plans, with annual options. Whether prices include or exclude VAT: not stated on the pages we read.
Yes. Your first system is free with no end date. The check needs no account. Source.
No card. Full access for 30 days, then it drops to the free plan — nothing is deleted and your export keeps working. Pricing.
“The free trial is designed as a 14-day trial for up to 5 AI systems and 1 user. A credit card is required at signup.”RiskOnyx, in their words and not ours. It was read on 14 October 2026 from riskonyx.com.
Starter includes 20 AI systems. Archived systems don’t count toward your limit. Pricing.
Yes. Your first system is free with no end date. You pay for your AI portfolio, not your number of employees. Source.
“RiskOnyx is included as a serious EU-based provider focused on practical EU AI Act compliance for SMEs.”RiskOnyx, in their words and not ours. It was read on 14 October 2026 from riskonyx.com. Same page, row "Best suited for", RiskOnyx column: "SMEs needing an operational EU AI Act compliance workspace".
Yes. The check needs no account, and the trial needs no card. Source.
Not stated publicly.
Not required. The check needs no account, and a walkthrough can be booked if you want one. Source.
Book 30 minutes and we set up your first AI systems with you. Pricing.
Not supported. The assistant answers questions about ISO/IEC 42001 next to the AI Act. There is no mapping of its controls to the Act, and Complipath certifies nothing. The status table: what Complipath is.
“Working access, clear limits and better value as capacity grows”RiskOnyx, in their words and not ours. It was read on 9 October 2026 from riskonyx.com.
“RiskOnyx is an AI compliance and governance platform that helps organisations register AI systems, classify them, organise evidence, track obligations, and stay more prepared for audits, procurement checks, and internal review.”RiskOnyx, in their words and not ours. It was read on 9 October 2026 from riskonyx.com.
“Yes, Public Beta available”RiskOnyx, in their words and not ours. It was read on 9 October 2026 from riskonyx.com.
The 6 pages of RiskOnyx's site we read, on 14 October 2026:
It is written by Complipath, so read it as ours. What keeps it checkable is the rule on both sides: each RiskOnyx cell is their own sentence with the page it stood on, and each Complipath cell is what our own pages say. Where a side's pages say nothing, the cell says so.
That none of the 6 pages of RiskOnyx's site we read on 14 October 2026 said it. It is a statement about those pages, listed below, not about the product: ask RiskOnyx before you rule anything out.
Start from the rows you need. Where RiskOnyx's own site states a requirement our pages mark as not supported, they are the closer fit on that row by what each side says publicly. For a European company that wants each classification with its article and the version of the law it used, at a public price, start with Complipath's free check.