Stop debating with consultants. Classify your AI system, map the obligations that bind it and print a Compliance Snapshot — free. Annex IV documentation and expert sign-off come with paid plans, now in private beta. Prohibited-practice rules already apply and Article 50 transparency has applied since 2 August 2026; the Digital Omnibus (Reg. (EU) 2026/1744, in force 27 July 2026) moved standalone high-risk documentation obligations to 2 December 2027.
Free tier: classify up to 3 AI systems end to end, no card required.
If two of these three describe you, the EU AI Act applies. Article 50 transparency has applied since 2 August 2026; standalone high-risk documentation is now dated to 2 December 2027 under Reg. (EU) 2026/1744. The deferral bought you time, not a pass — procurement questionnaires ask today.
Provider, deployer, importer, or distributor under Article 3. If your AI touches an EU user, you're in scope.
Hiring, credit, education, medical, biometric, infrastructure, law enforcement — Annex III high-risk categories cover most B2C and many B2B AI products.
If you did, you'd be using OneTrust at €50K/year. iCOMPLY is built for the founder, the CTO, or the part-time risk owner doing this on a Tuesday afternoon.
Real time budgets, no four-week consulting projects. Classification is free; documentation and specialist sign-off come with paid plans (private beta).
Our AI asks 8–12 targeted questions about your system and returns a risk tier with full Article 6 reasoning. You see exactly which articles apply and why.
Generate Annex IV technical documentation, risk management plan, classification report, and compliance roadmap. Real DOCX files with article references and gap markers — not a checklist.
Every paid-tier output is reviewed by a compliance specialist before delivery. You get the verified document, the reviewer's annotations, and a clear approval audit trail.
We're explicit about what we do and don't do — because compliance buyers in 2026 deserve more honesty than the average SaaS landing page.
The EU AI Act explicitly allows providers to self-assess conformity via the internal-control procedure (Article 43(1), Annex VI) for Annex III points 2–8. Annex III point 1 (biometrics) is the main notified-body exception. iCOMPLY produces the documentation this self-assessment regime expects — it is compliance advisory, not a substitute for legal counsel in enforcement or notified-body engagements.
Every paid-tier output is reviewed by a human compliance specialist before delivery — not auto-approved, not sampled. We're compliance specialists, not lawyers, and we're explicit about that boundary.
Everything you put into iCOMPLY — hosting, database, storage and AI inference — runs on OVHcloud in France: EU-sovereign by design, no transfer to a US sub-processor. GDPR controls are documented in our RoPA and DPIA. Full audit trail on every action. We never train models on your data and we don't share it with anyone. (The optional chat bubble on this page is a separate assistant; see the Privacy Policy.)
We don't publish an accuracy figure until we can regenerate it: a committed evaluation run against the production prompts, with the method and sample size beside the number. What every classification runs through today:
Every line names something the product does today. There is no roadmap in this list.
Risk classification
A guided conversation walks the full Article 6 decision tree and returns a risk tier with the reasoning that produced it.
Grounded Advisor chat
A free chat advisor grounded in the same EU AI Act knowledge base as the paid classification path.
Citation bounds-checking
Every article and annex citation is bounds-checked server-side, and a citation that fails reaches the screen as a visible warning.
Compliance Snapshot
A print-ready snapshot of a classified system — tier, reasoning, obligations, estate and dated next actions — built entirely from stored records.
Obligation mapping and gap register
Maps a classified system to the obligations that bind it and names the specific evidence that would close each gap.
Evidence ingestion API
Your systems push compliance evidence to an org-scoped API key; the deployment estate is declarative, so a cloud migration is expressible rather than additive.
27-control compliance evaluation
Evidence is scored against 27 controls, each returning pass, automatic fail, or needs-human-review — and missing evidence fails honestly rather than being imputed.
Onboarding without a push
A system can declare its deployment estate from the interface, so monitoring works before any machine integration exists.
MCP server
An MCP server exposing 11 EU AI Act knowledge resources and 21 tools over stdio or Streamable HTTP, with Bearer-key auth.
Hash-chained audit log
Every action is written to a hash-chained, append-only audit log, so a record altered after the fact is detectable.
Multi-tenant isolation and roles
Four roles across an org-scoped schema, with every query tenant-scoped and cross-tenant access limited to reviewer and platform-admin roles.
Annex IV technical documentation
Generates the nine-section Annex IV technical file as a real DOCX, with article references and explicit markers where evidence is still missing.
GDPR Article 35 DPIA
A dedicated DPIA conversation mode and document generator for the data protection impact assessment GDPR Article 35 requires.
Expert review gate
Every paid-tier document is reviewed by a human compliance specialist before delivery — not sampled, and never auto-approved.
Serious incident register
An Article 73 incident register with the reporting clocks tracked, for incidents you must report yourself.
These correct the assumptions people most often arrive with. They are part of the product description, not fine print.
Monitoring means we watch your model in production.
Monitoring here means compliance governance, not model observability. There is no connector to your cloud account, no telemetry ingestion, no scheduler and no alert delivery. Alerts derive from records already in our database and materialise when someone opens the dashboard. The only inbound path is evidence you push to us; we never pull.
The platform ingests regulatory sources and alerts you when the law changes.
Deadline and obligation alerts are generated from your systems, but nothing ingests regulatory sources automatically. Regulatory briefings are curated by a human compliance specialist.
Anything the platform produces has been checked by a specialist.
Only paid-tier output is expert-reviewed. On the free tier you carry responsibility for your own conformity assessment, exactly as you would if you had written the documents yourself.
The platform files with regulators for you.
It does not. You sign the declaration of conformity, you register in the EU database under Article 49, you operate post-market monitoring under Article 72, and you report serious incidents under Article 73. We produce the documentation and track the clocks; the filing is yours.
This is legal advice.
It is compliance advisory. We are compliance specialists, not lawyers, and outputs are not legal advice or regulator defence.
The platform certifies your system.
No product can. We do not perform Annex VII conformity assessments, and EN 18286:2026 is published but not cited in the Official Journal, so no one has a presumption of conformity and 'AI Act certified' is not a statement anyone can truthfully make. For biometric systems under Annex III point 1, our output prepares the file a notified body then assesses.
The reviewer holds a formal privacy or governance credential.
The reviewing compliance specialist does not currently hold the AIGP credential, and we do not describe the review tier as AIGP-certified.
Versus the consulting engagement you were quoted last month.
Start free with up to 3 classifications. On Reviewed, a compliance specialist checks every output before you rely on it. On Managed, we run your documentation, monitoring, and reviews for you. Enterprise is a custom plan. Paid tiers are in private beta.
Free, no card required
Private beta
Private beta
Custom plan
Six questions every panic-buying CTO asks us. Real answers, not marketing copy.
It produces the exact technical documentation Annex IV requires (all nine points), with explicit article references and gap markers showing what's missing. expert review on paid tiers catches anything the AI missed. Will it pass *every* audit? No tool can promise that — your auditor will form their own judgment. But the documents iCOMPLY generates are structurally complete and reference the same articles a regulator would check.
Better to know than guess. Our classification walks the full Article 6 decision tree (Article 5 prohibited → Annex III high-risk → Article 6(3) exception → Article 50 transparency → GPAI → minimal). If you're limited or minimal risk, the obligations are lighter and we tell you exactly what's needed — usually just transparency disclosures. If you're high-risk, you'll know in minutes instead of finding out the hard way.
Almost certainly you're a deployer, not a provider, of the foundation model — but you may be a provider of the integrated *system* that uses it. The classification flow walks through this distinction explicitly. Most SaaS companies that wrap GPT-4 fall under deployer obligations (Articles 26–27, FRIA in some cases) plus your integrated system's own classification. We map both.
Yes. Paid plans are in private beta and will bill monthly with no long-term lock-in; cancelling takes effect at the end of the billing period. If you cancel, your generated documents remain yours; you can download them as DOCX before your subscription ends.
Honest answer: that's what expert review exists to catch. The Free tier is not reviewed — you classify, map obligations and get a Compliance Snapshot, but you carry responsibility for your own conformity assessment, the same as if you'd written the docs yourself. On every paid tier, each output is reviewed by a human specialist before delivery, which is the meaningful difference: a specialist checks the output before you rely on it. For genuinely contested classifications (biometric ID systems, enforcement defense), we'll refer you to an external lawyer, but those are edge cases, not the 95% mainstream.
Right now — the free tier is open, no invite and no card. Sign up and classify up to 3 AI systems, 5-10 minutes each. Document generation with expert review comes with a paid plan; those onboard in batches, and review turnaround is normally 24 hours.
iCOMPLY is built by Gediminas at AimRank AI Innovation Labs, who also reviews the paid-tier output — the same person who built the platform signs off on the documents it produces. No outsourcing, no offshoring, no junior reviewers. He is a compliance specialist, not a lawyer, and does not hold the AIGP credential.
Every week you delay is a week of risk. Start free — classification takes minutes, and 3 systems cost you nothing. Documentation and expert review come with a paid plan.
Free tier live · 3 classifications free · No card required
The free tier is open: sign up and classify up to 3 systems. Paid tiers (Reviewed and Managed) onboard in batches; leave your details and we'll reach out.