Complipath VS GitHub Surf

Complipath's answer

• Rules decide, not a language model. Every EU AI Act classification comes from a rule engine written from the text of the Act. The same answers always give the same result, and every result cites the exact article it relied on.
• Pinned to the law's version. Every classification records which version of the Regulation it rests on. When the law changes, Complipath shows which assessments rest on text that has since moved.
• AI only drafts, a person confirms. AI helps draft documents and answers from your own register and files. Nothing counts until someone on your team confirms it.
• Answers in the customer's own file. When a customer sends an AI or security questionnaire, Complipath fills in their own Excel or Word file from your register, with a source on every answer, and saves the answers so the next audit does not start from zero.
• We apply it to ourselves. We treat our own classification engine as an AI system under Article 3(1) and publish the assessment.

Complipath's answer

Most compliance platforms are built for large enterprises: broad GRC suites where the EU AI Act is one module among many, priced and scoped for big teams. Complipath is EU AI Act first and built for companies with one or two people doing compliance on the side.

• Priced for SMEs: Starter is €499 a month for up to 20 AI systems, with a 30-day free trial and no card.
• Law-linked, not guesswork: every classification and every questionnaire answer has a source you can show an auditor.
• Built for the moment that costs you deals: a big customer's AI or security questionnaire, answered in their own file in hours instead of weeks.
• EU-hosted: data stays in the EU (Frankfurt), operated by Complipath AB, a Swedish company.

Complipath's answer

Companies with roughly 20–100 employees that build or use AI and sell to larger customers. Usually the CTO or CISO, who gets the AI and security questionnaires from those customers and has no full-time compliance team. They need to know which of their AI systems the EU AI Act covers, what they must do and by when, and to prove it when a customer asks.

Complipath's answer

Complipath started in Gothenburg in 2026. Almost every company now uses AI somewhere, in a chatbot, a CRM, a hiring tool or a coding assistant, and their bigger customers have started asking about it. The EU AI Act made those questions formal, but the answers still lived in spreadsheets and consultants' slides.

The first version was built around one idea: a classification you can't trace back to the law is worth nothing in an audit. So every result cites its article and records which version of the Regulation it rests on. That idea was tested early: when an amending regulation entered into force on 27 July 2026, our own build failed until every affected rule was updated.

Since then the product has grown from a classifier into a full register, plan, questionnaire and audit tool, shaped by conversations with CTOs and CISOs who answer customer audits for a living. On 28 October 2026 the company was registered as Complipath AB.

Complipath's answer

• Next.js and TypeScript
• Supabase (PostgreSQL), hosted in the EU (Frankfurt)
• Vercel
• Stripe for billing
• A deterministic rule engine for EU AI Act classification
• Claude (Anthropic) for drafting only, never for classification decisions