Compliance in order – no in-house legal team.
Maditon is the compliance assistant that does the heavy lifting: it classifies your AI systems under the EU AI Act, reads your suppliers' agreements, watches them for changes and drafts the answers when customers and auditors ask. You make the decisions.
Three steps. Then Maditon works while you do something else.
Add your suppliers
A name and a web address are enough. Maditon finds the terms, DPA and privacy policy on their site and proposes them.
We read and watch
Every document is read with the quote behind each finding, compared with the sanctions lists and watched. If the text changes, you get an e-mail.
Answer and show
Your customer's security questionnaire gets drafts from your own record. The register and the findings export as PDF when the auditor asks.
Maditon does the heavy lifting – you make the decisions.
Supplier register
The register customers and auditors ask for, always current.
Document reading with quotes
What the agreement says, what it leaves out, and the passage behind every finding.
Change watching
If a supplier changes the text you get the difference in your inbox, not a guess.
Questionnaires
Drafts for your customers' security and privacy questionnaires; you approve.
Purchases
Compare candidates against the same requirements before you sign, with the decision on record.
Sanctions screening
Every supplier is compared with the EU and UN lists, every night. You judge the match.
Plus SLA levels and support contacts in one view, and everything as PDF when needed.
Know which AI systems you have, and what the law asks of them.
A chatbot here. An AI screening tool there. Is any of it high-risk?
Describe your AI system in plain language. Maditon maps it against every risk category in the regulation, flags what applies and explains exactly why, with the articles behind each determination. No guessing, no billable hours.
You should not have to take our word for it. Every answer quotes the law it rests on.
A consultant gives you a conclusion. A chatbot gives you a confident paragraph. Maditon shows its reasons by default.
The quote is the evidence
The sentence itself from Regulation (EU) 2024/1689, on screen beside the conclusion. The full source one click away, or flag it if we are wrong.
It marks its own weak points
A second pass checks each conclusion against the legal text and lists what it could not support. The uncertain is raised for expert review.
Nothing counts until a person accepts it
Every determination is a draft. Someone on your team accepts it by name, and the record keeps who and when.
The file is yours to take
Classifications, quotes, evidence and the acceptance trail as archival PDF/A or JSON, whenever you want. Self-serve, no waiting.
Second pass: 3 of 3 conclusions supported in the text. Confidence high.
European data sovereignty. Your data stays in Europe, always.
Hosted entirely in Europe
Everything you put in is processed and stored within European borders, by providers headquartered in Europe.
GDPR-native architecture
Built for data minimisation, purpose limitation and data subject rights.
No vendor lock-in
Export your entire documentation bank in audit-ready formats at any time.
Multilingual
Swedish and English today, more languages coming shortly.
Answers for SMEs and public authorities.
How do I classify an AI system under the EU AI Act?
Start with the system’s purpose, users, data, sector, and effect on people. Maditon turns that into a structured EU AI Act risk assessment, checks the prohibited, high-risk, limited-risk and minimal-risk categories, and explains the classification with article references. The result is a documented classification your team can review and sign off.
Does the EU AI Act apply to startups, SMEs and public authorities?
Yes. The EU AI Act applies by your role (provider or deployer) and your system’s risk tier, not by the size of the organisation. A ten-person startup deploying a high-risk AI system carries the same core obligations as a large enterprise. Some duties are lighter and fines are capped for smaller companies. Maditon helps you find out exactly which tier each of your systems falls into.
Do I need a legal team to comply with the EU AI Act?
No. Maditon is built for organisations without a dedicated legal or compliance team. It runs a plain-language interview, drafts a risk classification with specific article references, and generates audit-ready documentation. A named person on your team accepts each determination. Accountability stays with you, but the heavy lifting does not.
How do I know a classification is correct?
Check it against the law. Maditon names the article behind every classification and quotes the passage from Regulation (EU) 2024/1689 word for word, beside the conclusion, with the full source one click away. A second pass checks each conclusion against the legal text and reports any claim it could not support. Nothing leaves draft until a named person on your team accepts it.
When are the EU AI Act deadlines?
Prohibited practices have applied since February 2025 and general-purpose AI model obligations since August 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744) postponed the high-risk obligations to 2 December 2027 and the rules for AI in regulated products to 2 August 2028. Classify your systems now to know which obligations will apply to you.
What does Maditon do with my suppliers' documents?
It fetches copies of what each supplier has published, reads them with Mistral on an EU endpoint, and returns findings that each quote the passage they came from. A finding is a question to put to the supplier, not a verdict. The documents are re-read on schedule, and a daily e-mail tells you what changed and whether it matters.
Can Maditon answer my customers' security questionnaires?
Yes. Upload the questionnaire as XLSX, DOCX, CSV or PDF and Maditon drafts answers from your compliance profile, your supplier register and the answers you approved before, naming the source of each. Only approved answers go into the file you send back. Documents you mark private are never used for drafts.
Is my data kept in the EU?
Yes. Everything you put into Maditon is processed and stored in Europe by European-headquartered providers, and no US-headquartered cloud service processes it. The one exception concerns billing only: Stripe may transfer billing details to its US affiliate. The privacy policy, section 5, describes the safeguards.
Start with five suppliers, free.
No card. Add a supplier and see what Maditon finds in their documents within minutes.
Create an account