What Complipath is

What is live today, and what is not

Every capability buyers ask about, with its status in the product. 29 live, 4 live with limits, 0 in progress, 6 not supported. Status on 14 October 2026. Rules decide. AI only drafts. A person confirms.

• AI inventoryLiveEvery AI system you build or use, with its owner and risk class.
• Risk classificationLiveAnswers go through rules in code, never a language model, so the same answers always give the same result.
• Article mappingLiveEach reason behind a verdict names the provision it rests on, so a reader can check it herself.
• Obligations per systemWith limitsConfirming a classification creates the obligations that follow from it, each with a status, a place for evidence and an owner you fill in, and high-risk rows need the system's role recorded. A later, stricter classification adds no new duties unless you change the system's type or role.
• DeadlinesLiveEach obligation carries the date it applies from, derived from where the provision sits rather than written onto the row.
• Annex IV documentationLiveA workspace for the technical documentation, section by section, saying which Annex IV points each one answers.
• Documentation draftingLiveDrafts a documentation section from the facts in your register, and says which limbs it could not answer.
• Regulatory change monitoringLiveChecks the provisions your confirmed records cite against amending acts, and emails everyone in the workspace once per act, naming each system it touches.
• Named ownersLiveA person behind every system and every duty.
• Export (PDF, JSON, spreadsheet)LiveThe whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against.
• Evidence managementLiveUpload a file once. We read it and use it everywhere it helps: proof for requirements, text for the documentation, and a flag when it disagrees with an earlier answer.
• DashboardLiveWhere every system stands, and what needs you this week.
• AI literacy (Article 4)LiveRecords the measures you take to support AI literacy under Article 4 as amended: who was briefed on what, and when. It applies whatever your risk level.
• Two-factor sign-inLiveA code from your phone after the email link. The owner can require it for everyone.
• Audit logLiveShows who did what in the workspace, and when, as a list you can read and export.
• Audit packLiveOne file with every classification, citation and confirmation — the one you hand to someone outside your company.
• Customer questionnaires (audit room)LiveAnswers a customer's security or AI questionnaire from your own register and files, each answer with its source, and a person confirms it.
• Audit reportLiveTurns a finished audit into one report with every answer, its source and who confirmed it, as PDF.
• Answers in the customer's own formatLiveWrites your confirmed answers back into the customer's own Excel or Word file, keeping their layout.
• Annex I checkWith limitsAsks whether a system is a safety part of a regulated product, like a machine or a medical device, and records your answers with the line of Annex I they rest on. When all three answers are yes, its high-risk requirements take 2 August 2028; it does not change the class or create Annex I requirements.
• DPIA and FRIA: whether they applyLiveSays whether a data protection or fundamental rights impact assessment is required, likely or not for each system, quoting the article it rests on.
• Step-by-step planWith limitsYour next steps from a fixed list of 38, ordered for your own systems, each broken into small steps with a time, the proof it needs and an owner where one is recorded. The steps for Articles 53, 54 and 55 appear once a system is marked as a general-purpose AI model you place on the market.
• Review: what still needs youLiveShows what on a system still needs a person, each with its source, and quotes both sides where your own texts disagree.
• View full documentLiveOpens a system's Annex IV documentation as one document, and downloads it as PDF or Word.
• AI literacy briefingsLiveSends each person a briefing built from the law and your register, and records when they read it.
• Usage policy watchLiveReads the public usage policies of Anthropic, Google, Microsoft, Mistral AI and OpenAI once a day and tells the owner when the text has changed; the vendor card says when a policy could not be read or is not watched.
• Turn off all AI processingLiveOne switch in Settings stops every call to our AI providers, Anthropic and Perplexity, for the whole workspace.
• Vendor managementLiveGroups your systems by vendor and shows which papers you hold from each, which are missing and which have expired.
• Full risk-management lifecycleNot supportedArticle 9 is listed as a duty with its date, and the risk register records each risk with a level a person gives it, the reason, an owner, an action and a status. Testing and the cycle through the lifecycle are not in the app's list.
• Conformity assessment (Article 43)Not supportedWe found no support for this in what we have built. The same search found the number in one file — a comment using it as an example of the Official Journal's citation form — and the words in six, every one of them quoting Article 6(1), point (b)'s third-party condition, an Article 5 sentence or a section name. No template, no column, no limb.
• Post-market monitoring (Article 72)Not supportedWe found no support for this in what we have built. MVP searched 245 shipped source files, 44 migrations, 14 obligation templates, 15 export columns and 12 Annex IV limbs, on the article number and on the provision's own words: nothing on any of the five.
• Serious incident reporting (Article 73)LiveSerious incidents, in the app's own words: it logs what went wrong with an AI system and shows the date a serious incident must be reported by and who is told, from Articles 73, 26(5) and 75(1a) as written; a person decides, and the owner is reminded. A Growth feature, included in Starter until Growth launches, live since 9 October 2026.
• Fundamental rights impact assessment (Article 27)LiveTwo features. 'DPIA and FRIA: whether they apply' says for each confirmed system whether a fundamental rights impact assessment is required, likely or not, quoting Article 27(1). 'DPIA and FRIA documents', in the app's words, drafts the FRIA (Article 27(1)) from your register by rules, built on the DPIA, a source on every sentence, for a named person to confirm with a date: a Growth feature, included in Starter until Growth launches, live since 9 October 2026.
• Declaration of conformity (Article 47)Not supportedThe Annex IV documentation asks for a copy of the declaration and you upload it; the plan says to issue it when the system is ready. The declaration itself is not drafted.
• EU database registration (Article 49)Not supportedListed as a duty with its date. The registration itself is yours.
• ISO/IEC 42001 mappingNot supportedThe assistant answers questions about ISO/IEC 42001 next to the AI Act. There is no mapping of its controls to the Act, and Complipath certifies nothing.
• Roles and approvalsWith limitsLegal sees everything in the workspace, and once you name an approver only an approver can confirm a classification. The rule counts the people working in the workspace at that moment: while every named approver has switched to another of their workspaces, anyone who can edit can confirm.
• Risk registerLiveEach risk your AI systems carry, with the level a person gives it — low, medium or high — the reason in words, an owner, an action and a status; never a score.
• DPIA and FRIA documentsLiveDrafts the DPIA (GDPR Article 35(7)) and the FRIA (Article 27(1)) from your register by rules, a source on every sentence, the FRIA built on the DPIA (Article 27(4)); a named person confirms it with a date, as PDF and Word, and it becomes a source in the audit room.