How Complipath works · Written by Yobel Tzegai · Last checked 9 October 2026

How does Complipath decide an EU AI Act risk class?

Complipath (complipath.io) is an EU AI Act tool that uses rules, not an LLM, to classify risk: a rule engine in code reads your answers and returns the risk class with the provision it rests on. AI only writes drafts and suggestions, and a person confirms. Rules decide. AI only drafts. A person confirms.

Check your AI systems, free

Who decides the risk class?

A rule engine in the app's code. It reads your answers to the assessment questions, never your system's description. The same answers always give the same result.
No language model is in that path: AI only drafts, and a person confirms. The engine imports no database client and nothing from the code that handles model output, and a test in the app's suite fails if it ever does.
Each result names the provision it rests on, for example point 4(a) of Annex III, beside the answer that triggered it. The app names the provision; it does not link to EUR-Lex.
A provision your answers match that does not apply yet sets nothing: the record lists it with the date it starts to apply.
When no rule matches, the record says no risk level was determined and that a person must classify the system. It never falls back to minimal risk.
Every record stores the engine version that wrote it. A database trigger refuses any change to its outcome; running the assessment again adds a new record beside the old one.

Which law does it rest on?

Two pinned texts: Regulation (EU) 2024/1689 and the amending Regulation (EU) 2026/1744. Each file is pinned in the code by its sha256.
Today's pins begin d11c3df49be6 for 2024/1689 and 96671e393907 for 2026/1744, the 12 characters the public check shows as its law version. Exports carry the full sha256.
The engine version in force is the one on the bar at the top of this page, and the code records which pinned files each engine version was written against.
A test fails if either file changes by one byte, until a person re-derives the rules' coverage against the new text: how the rules are tested and updated.

What does the engine not decide?

The prohibitions in Article 5(1), first subparagraph, points (a), (b) and (c), which turn on judgements such as whether harm is significant. Answers that point there return Legal review required, never Prohibited.
The Annex I route in Article 6(1): the assessment asks no Annex I question, so a system on that route can come out minimal or limited. A person's Annex I declaration carries the route; the engine reads nothing from it.
A short registration triage does not evaluate Article 50 or those three Article 5 points, and the record lists what it did not evaluate.

What does AI write, and how is it checked?

Audit answer drafts: every sentence must name a source that was sent, and every number, date and period in it must stand in that source. The server checks; a failing sentence moves to Not proven yet.
That check cannot see whether a sentence means what its source says. The person who confirms the answer reads that.
Documentation drafts: every sentence names the register fact it rests on, or is marked a summary that may add no number, date, reference or name. A paragraph that fails is dropped and the part reads as not answered.
Files you add: every passage the model proposes must stand word for word on the page it names, or it is dropped. Nothing changes until you apply it.
Answer suggestions: a hint beside an option, never pre-selected. Answers that take a system out of a prohibition, a high-risk point or Article 50, and answers about human control, are never suggested.
No source per sentence in the assistant's answers. It checks every article it names, every quotation and every date, and keeps a sentence that only explains. It answers; it writes nothing to your records.
No source per sentence in the writing aid, which rewords your own answer and may add no fact, date or article number, or in the public check's website reading, where each suggested system must quote your site.

Who confirms, and where is it recorded?

A classification counts once a person in the workspace confirms it. The record stores who and when, and the page reads Confirmed by, with their name (or email, where no name is set) and the date.
Confirming creates the requirements that follow from the result and writes a line in the activity log with the class before and after.
An audit answer counts once a person confirms it, with their id and the time stored, and a rewritten draft clears an earlier confirmation. A documentation section is marked reviewed by a person, and cannot be stamped again.
Today any member of the workspace can confirm. Limiting confirmation to people you name is planned (Roles & approvals), not built.

What does Turn off all AI processing stop, and what not?

The switch is in Settings, under Data & privacy: Send data to our AI provider (Anthropic). Only the owner can change it, and each change is logged.
Off, every call to Anthropic made for someone signed in to the workspace is refused before it is built. Files are then searched on our own server, and the rule steps of Prepare everything still run.
No classification changes either way, because none used a model.
It does not cover the public check before sign-up: a visitor with no account has no workspace to read, so the check's website reading and answer suggestions call Anthropic. Signed in, your switch applies to those calls.
It does not stop Perplexity. When the check reads a website, the domain goes to Perplexity for a web search if the app has a Perplexity key, and that route never reads the switch, signed in or not.
Every party and what it receives: the subprocessors page. The switch in detail: Turn off all AI processing.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Does Complipath use an LLM to classify AI systems?

No. The risk class comes from a rule engine in the app's code, which reads your answers and names the provision it rests on. No language model is in that path, and the same answers always give the same result. AI writes drafts and suggestions elsewhere in the app, and a person confirms them.

Can AI change a classification?

No. A model can suggest an answer beside a question, but it is never pre-selected, and answers that would take a system out of a prohibition or a high-risk point are never suggested. When a file you add contradicts an answer in a way that would move the class, you are asked to run the assessment again.

What does the AI switch not turn off?

The public check before sign-up, because a visitor without an account has no workspace for the switch to belong to, and Perplexity, which receives the domain the check reads, signed in or not. Everything the app does for someone signed in to your workspace stops calling Anthropic while the switch is off.

Which plan includes it?

Every plan, the free one included: the rule engine decides on every plan, and the switch is in every plan. Free holds one AI system. Starter is €499 a month for up to 20 AI systems. Prices exclude VAT. Growth and Scale are not available yet, and nothing here waits for them.