39 questions about Maditon — the supplier register, the questionnaires, the EU AI Act module — each with an answer that stands on its own when it is lifted out of this page. Every answer names the regulation articles it rests on and, where one exists, the API endpoint that does the thing being described.
Last updated 2026-11-09 · llms.txt · OpenAPI
What Maditon is, who it is for, what the supplier register and the questionnaires do, and what it costs.
Maditon is an EU compliance assistant for startups and SMEs. It keeps the register of suppliers and systems, reads and quotes suppliers' published legal documents, watches them for changes, drafts answers to customers' security questionnaires and exports it all as PDF. The EU AI Act module classifies AI systems with citations from the regulation. Every output is a draft until a named person accepts it.
Maditon keeps a register of the services your company depends on and reads each supplier's published legal documents — privacy policy, terms, data processing agreement, sub-processor list, security page — reporting what they say and what they leave out, with every finding quoting its source passage. It then watches those documents and tells you when they change.
2 endpoints
It re-reads every watched document on a schedule, compares the new text with the last version paragraph by paragraph, and has a model judge whether the difference is material — a retention period, a transfer mechanism, a new sub-processor. You get one email a day listing what changed and what could not be read, and the app keeps the before-and-after text so you can check the summary against the supplier's own words.
1 endpoint
Maditon fetches a copy of the supplier's published page, extracts the text and has Mistral read it in three passes: what the document states, what it leaves out that a document of its kind owes, and a summary. The result is a list of findings, each quoting the passage it rests on and graded high, medium or low. A finding is a question to put to the supplier — Maditon never declares a supplier compliant.
3 endpoints
Yes, on paid plans. Maditon compares each supplier's legal name, registration number and country with the legal entities on the EU and UN consolidated sanctions lists — every night, when the supplier changes and on request — with fixed matching rules, no AI. A possible match is a resemblance for a person in your organisation to confirm or dismiss, never a finding that the supplier is sanctioned.
4 endpoints
Because silence is only a gap where that kind of document owes an answer. A DPA that never mentions deletion on termination has left something out; a terms page that never mentions it has not. Maditon keeps a list of what each document kind owes and raises a missing item only against that list, so a security page is not padded with GDPR clauses nobody expected it to contain.
1 endpoint
Upload the file the customer sent — XLSX, DOCX, CSV or PDF. Maditon keeps the question identifiers, sections and order, then drafts an answer to every question it can from your compliance profile, your supplier register, your systems and the answers you approved before, naming the source of each. You review, edit and approve; only approved answers go into the file you export back, in the customer's own format.
4 endpoints
The register of what your organisation runs and offers — internal tools, services you deliver, products you build — and which suppliers each depends on. A supplier can sit under several systems and a system can have several suppliers, each link with a role note. Systems can carry their own documents. AI systems in the EU AI Act module appear here automatically.
3 endpoints
One row per supplier, and one for each system's own documents: the availability commitment, service credits, maintenance windows, support channels and tiers read from the suppliers' documents, beside the support contacts your own people recorded. Every value names its origin — the document and the date it was read, or that it was recorded by hand — and both are shown when they differ.
3 endpoints
Maditon is built for European startups, scaleups and SMEs that fall under EU regulation but have no dedicated legal or compliance team. It is designed so a product manager or founder can run a classification without regulatory vocabulary, and it is B2B only — there is no consumer offering.
A private document is an uploaded file you have marked private — a signed agreement you would not quote to a prospect. It is read and compared like any other but never used for questionnaire drafts, and it is encrypted under a key that exists only for your organisation (AES-256-GCM): file, text, readings and translations are stored as ciphertext. Deleting the organisation deletes the key.
3 endpoints
No. Maditon keeps copies of documents to read and compare them — a supplier's page as it stood on a given day, or a file you uploaded. It is not an archive or a registry, and the originals are the supplier's pages and your own signed files. When you leave, the Data Act export hands you everything you put in and everything Maditon produced, copies included, in open formats.
2 endpoints
A system package holds the system, its suppliers with roles and support contacts, the SLA and contacts rows, every document's latest reading with findings and quotes, the contradictions among its suppliers, and the list of private documents. The register package does the same for every system and supplier. Both are generated on demand, never stored, and open by stating they are copies of what Maditon had read.
3 endpoints
Every account gets the supplier register, change watching, questionnaires, systems and services, and PDF packages. Modules add one regulation each; the EU AI Act module is the first, inventorying AI systems and classifying each with citations from Regulation (EU) 2024/1689. Every AI system in the module also appears in your systems register, so its suppliers, SLA and contacts live with everything else.
3 endpoints
Yes. A purchase project takes candidates from your register or from pasted addresses, reads their published documents and scores them against requirements — EU hosting, a DPA, no AI training on customer data, 72-hour incident notice, a transfer mechanism, plus your own. Every result shows the passage it was read from, and the decision you record closes the project and starts watching the chosen supplier.
4 endpoints
Maditon has a free plan with no card, then Starter at €49/month, Growth at €149/month and Scale at €349/month, each with a 14-day trial and priced by the suppliers in your register. Every plan includes one AI system; the EU AI Act add-on (€39/month) covers more. Annual billing gives two months free. Prices exclude VAT; https://maditon.com/pricing is authoritative (as of 9 November 2026).
2 endpoints
The EU AI Act (Regulation (EU) 2024/1689) module is live today. GDPR, NIS2, DORA and the Cyber Resilience Act are announced as coming, and the EU Data Act and CSRD are being monitored. The live list is machine-readable and public at https://api.maditon.app/api/modules — no authentication required.
3 endpoints · public access available
No. Maditon structures and accelerates compliance work but does not give legal advice. Every AI-generated assessment is a draft until a named person on your team accepts it, and that person takes the accountability. For genuinely contested questions — an edge-case classification, a novel use case, an enforcement conversation — you still want a lawyer.
How a classification is produced, and how to check it.
An AI-led interview asks plain-language questions about what the system does, who it affects and where it operates. Maditon maps the answers against every risk category in Regulation (EU) 2024/1689 — prohibited, high-risk, transparency-only and minimal — and returns a draft classification with the articles it rests on and the regulation text quoted verbatim.
4 endpoints
You check it against the law, and Maditon is built so you can. Every classification names the article it rests on and quotes the passage from Regulation (EU) 2024/1689 word for word, with the full source one click away. A separate verification pass then re-checks each conclusion against the retrieved text and reports any claim it could not support, alongside a confidence score.
3 endpoints
It says so. Maditon reports a confidence score and an explicit list of claims the verification pass could not support in the regulation text. Below the confidence threshold, or where a citation cannot be grounded, the classification is marked as requiring expert review rather than being presented as a settled answer.
Yes. You can override the risk classification outright, add reviewer notes to an accepted one, and flag any individual citation as incorrect. The override is recorded in the audit log with who made it, so disagreement becomes part of the documented record rather than something that happens outside it.
4 endpoints
No, and it cannot. Every AI-generated risk classification or compliance determination stays a draft until a named human explicitly accepts it, with their name and a timestamp recorded. No AI output reaches a cleared or compliant state on its own — this is enforced in the software, not just stated in the documentation.
1 endpoint
What a classification triggers, and how the proof is kept.
A classification generates the complete obligation checklist for that risk tier, drawn from the regulation rather than a generic template. Each checklist item can carry evidence files, tracks its own status, and rolls up into an organisation-wide compliance dashboard and a list of urgent actions.
4 endpoints
Evidence files are uploaded against an AI system and attached to the specific checklist items they substantiate, so each obligation carries its own proof. Everything can be downloaded in bulk as a ZIP — per system, or the whole organisation's evidence at once under EU Data Act Article 4.
4 endpoints
A dossier is a single PDF/A-1b file covering the organisation's AI systems: each system's accepted classification with the articles and quoted regulation text behind it, the obligation checklist and its status, the evidence attached to each obligation, and the acceptance record showing who accepted what and when.
1 endpoint
Yes. Maditon holds a registration record per high-risk AI system, covering the information Article 49 of the EU AI Act requires before a high-risk system is placed on the market or put into service. The registration deadline moved to 2 December 2027 under the Digital Omnibus on AI.
2 endpoints
Calling Maditon programmatically, including as an AI agent.
Yes. Maditon's backend is a REST API with an auto-generated OpenAPI specification at https://api.maditon.app/openapi.json, browsable at https://api.maditon.app/docs. It publishes 86 product endpoints covering AI systems, risk classification, compliance checklists, evidence, dossiers, billing and data export. Operator-only endpoints are deliberately excluded from the specification.
1 endpoint · public access available
Four things are public: the health check, the regulatory module list (GET /api/modules and /api/modules/{code}), and the transparency endpoints that serve organisations' published AI transparency pages. Everything touching customer data requires a bearer token — an unauthenticated call to those returns 401.
3 endpoints · public access available
With an OIDC bearer token issued by Zitadel, sent as an Authorization: Bearer header. The API validates it against Zitadel's JWKS endpoint on every request. Access tokens are short-lived — 15 minutes — with refresh tokens handling renewal, and every call is scoped to the organisation in the token.
Yes. GET /api/compliance/dashboard returns the organisation-wide picture, /api/compliance/systems/{system_id} the detail for one system, and /api/risk-classification/{system_id}/latest the current classification with its citations, confidence score and unsupported claims. All return JSON and require a bearer token.
4 endpoints
Where the data lives, which models see it, and how to take it back.
Everything you put into Maditon is hosted in the EU by European-headquartered providers. Compute, the database (UpCloud Managed PostgreSQL) and object storage run on UpCloud in Frankfurt, Germany, the CDN is BunnyCDN on EU-only edge nodes, and identity is Zitadel in Switzerland. The one exception is billing: Stripe may transfer billing details to its US affiliate.
Maditon uses Mistral, a French AI provider, with self-hosted models on EU infrastructure as the alternative. No customer data is sent to US-headquartered AI providers. Personal data is stripped from prompts before they leave the application, so the model receives the compliance question without the identifying details it does not need.
Everything Maditon sends to AI — what your company typed or uploaded, and the published legal documents of your suppliers — is read by Mistral in France, on an EU endpoint, with training on submitted data switched off. No other AI provider is involved, and nothing leaves the EU-only path.
Two self-serve endpoints. GET /api/data-act/export returns all organisation-level data as machine-readable JSON under EU Data Act Article 4, and GET /api/data-act/evidence returns every evidence file as a ZIP. There is no approval step, no support ticket and no waiting period — and a separate GDPR export covers an individual user's personal data.
3 endpoints
DELETE /api/gdpr/delete requests deletion under GDPR Article 17. There is a 30-day grace period during which the request can be cancelled, after which data is hard-deleted or fully anonymised — soft-deleted records do not keep personal data in any field. Export first if you want to keep anything.
2 endpoints
The regulation itself — deadlines, roles, and the high-risk tiers.
The prohibited practices in Article 5 have applied since February 2025 and the general-purpose AI model obligations since August 2025. The Digital Omnibus on AI moved the high-risk obligations, including EU database registration, from August 2026 to 2 December 2027, and the rules for AI in regulated products to 2 August 2028.
You are a provider if you develop an AI system and place it on the EU market under your own name, and a deployer if you use one under your own authority in a professional capacity. Most European companies are deployers. The roles are not exclusive — putting your name on a third-party model, or substantially modifying one, can make you a provider of it.
Two routes. A system is high-risk if it is a safety component of a product covered by the EU harmonisation legislation in Annex I, or if it falls into one of the eight standalone use-case categories in Annex III — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice or democratic processes.
Not here? The FAQ covers the basics and the Resource Center goes deeper on the regulation itself.
Run a free classification