For small companies · Written by Yobel Tzegai · Last checked 9 October 2026

What is the best EU AI Act compliance software for a small company?

EU AI Act compliance software for small companies: what it should do, what Complipath does and does not do today, the SME rules in the Act and the price.

Check your AI systems, free Book a 30-minute walkthrough

The answer, in detail

What does the AI Act give small companies?

Less than people hope.
The duties follow each system and your role in it, not your headcount.
What size changes is narrower, and an SME and a small mid-cap enterprise (SMC) are defined by two Commission recommendations (Article 3, points (14a) and (14b), inserted by Regulation (EU) 2026/1744).

Fines: for SMEs, including start-ups, each fine is capped at the percentage or the amount, whichever is lower (Article 99(6)). For SMCs the lower cap applies to the fines in paragraphs 4 and 5, not to the prohibited-practice fines in paragraph 3 (Article 99(6a), inserted by Regulation (EU) 2026/1744).
Technical documentation: SMEs, start-ups and SMCs may provide the Annex IV elements in a simplified manner, on a form the Commission is to establish (Article 11(1), second subparagraph, as replaced). Whether that form has been published was not checked for this page.
Quality management: a high-risk provider's system is proportionate to the size of the organisation, and the degree of rigour and the level of protection still apply (Article 17(2), as replaced).
AI literacy: the Commission and the Member States support SMEs in meeting the duty, and the duty does not require a guaranteed level of literacy for any individual (Article 4(1) and (2), as replaced).

When is a spreadsheet enough?

When you have one or two systems, none of them is high-risk and nobody outside the company asks for proof.
A row per system with its classification, the article and the date you decided is a fair record.
It stops being enough when the law changes under it, as it did when Regulation (EU) 2026/1744 replaced Article 4 and moved the high-risk dates, or when a customer's questionnaire asks you to show rather than tell: how to answer AI questions in a supplier questionnaire.

Why not an enterprise GRC platform?

An enterprise GRC platform is built to run many frameworks with a compliance team behind it.
A small company with a handful of AI systems needs the AI Act part done: each system classified with its article, the duties with an owner and a date, and the evidence linked to each duty.
That is the one job Complipath does.
If you already run a GRC platform, ask it the questions in how to choose EU AI Act compliance software before you buy anything else.

Do we still need a lawyer?

For judgment, yes.
Use your lawyer for judgment.
Use Complipath for the groundwork.
The classification comes from rules in code, and each answer names the article it rests on, the engine version and the version of the law, so a lawyer can check the groundwork instead of redoing it.
What a lawyer still decides.

Your customer asks. You answer with proof.

1List every AI system
Illustration · not your dataSystem Customer support chatbotClass Limited risk · Article 50(1)
Add the AI you use. Each system gets a role, a risk class and the article it rests on.
Live
2Attach the proof
Illustration · not your dataDuty Article 26(6), keep the logsProof logging-policy.pdf · page 3
Link each duty to a file and the page it stands on: a policy, a log setting, a training record.
Live
3Answer their questionnaire
Illustration · not your dataQuestion Do you log AI decisions?Answer drafted from your own proof
Answering a customer's questionnaire inside the app, from the proof you already linked.
Coming soon

What Complipath does

AI inventory Every AI system you build or use, with its owner and risk class
Risk classification Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms.
Article mapping Each reason behind a verdict names the provision it rests on, so a reader can check it herself
Obligations per system Confirming a classification creates the obligations that follow from it, each with an owner, a status and a place for evidence
Deadlines Each obligation carries the date it applies from, derived from where the provision sits rather than written onto the row
Evidence management A file linked to the requirements it proves, with the passage and its page
Export (PDF, JSON, spreadsheet) The whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against
AI literacy (Article 4) Records who was trained on what and when, against the Article 4 duty to support AI literacy, which applies whatever your risk level
Regulatory change monitoring Checks the provisions your confirmed records cite against amending acts, and emails you per affected system

Rules decide. AI only drafts. A person confirms.

What it does not do yet

Audit pack Coming soon One file for an auditor: every system, its classification, evidence, the audit log and a fingerprint. Not available yet.
Customer questionnaires (audit room) Coming soon Coming soon: answering a customer's AI questionnaire from your own register.
Conformity assessment (Article 43) Not supported We found no support for this in what we have built. The same search found the number in one file — a comment using it as an example of the Official Journal's citation form — and the words in six, every one of them quoting Article 6(1), point (b)'s third-party condition, an Article 5 sentence or a section name. No template, no column, no limb.
Full risk-management lifecycle Not supported Article 9 is listed as a duty with its date. There is no risk register to run the cycle in.
ISO/IEC 42001 mapping Not supported The assistant answers questions about ISO/IEC 42001 next to the AI Act. There is no mapping of its controls to the Act, and Complipath certifies nothing.

What is live today

Checked against the app on 8 October 2026

AI inventoryLive
Risk classificationLive
Article mappingLive
Obligations per systemLive
DeadlinesLive
Annex IV documentationLive
Documentation draftingLive
Regulatory change monitoringLive
Named ownersLive
Export (PDF, JSON, spreadsheet)Live
Evidence managementLive
DashboardLive
AI literacy (Article 4)Live
Two-factor sign-inLive
Audit logLive
Audit packComing soon
Customer questionnaires (audit room)Coming soon
Domain-specific guidanceNot supported
Full risk-management lifecycleNot supported
Conformity assessment (Article 43)Not supported
Post-market monitoring (Article 72)Not supported
Serious incident reporting (Article 73)Not supported
Fundamental rights impact assessment (Article 27)Not supported
Declaration of conformity (Article 47)Not supported
EU database registration (Article 49)Not supported
ISO/IEC 42001 mappingNot supported
Vendor managementLive

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Every duty, deadline and article
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

What does EU AI Act compliance software cost a small company?

Complipath's Starter plan is €499 a month. Prices exclude VAT. Your first system is free with no end date, so you can classify one system and read the articles behind it before you pay. Growth and Scale are not available yet. We do not print other vendors' prices; each vendor's own pricing page is the source.

Does a small company have fewer AI Act duties?

Mostly not. The duties follow each system and your role, as provider or deployer, not your headcount. Size lowers the fine caps (Article 99(6)), lets SMEs provide Annex IV documentation in a simplified manner (Article 11(1)) and makes a high-risk provider's quality management system proportionate (Article 17(2)).

Can Complipath certify that we comply with the AI Act?

No. Complipath certifies nothing. It does the groundwork: the register, each classification with its article, the duties, the evidence and the version of the law each answer rests on. A person confirms every classification, and the record says who and when. Use your lawyer for judgment. Use Complipath for the groundwork.

What happens when the law changes?

Each assessment names the version of the law it was made against. When an amending act touches a provision your confirmed records cite, Complipath checks it and emails you for each affected system, so you can decide whether the classification still holds. The record of the earlier answer stays as it was.

Book 30 minutes and we set up your first AI systems with you. The booking link is on the pricing page.