28 questions about Maditon and the EU AI Act, each with an answer that stands on its own when it is lifted out of this page. Every answer names the regulation articles it rests on and, where one exists, the API endpoint that does the thing being described.
Last updated 2026-09-21 · llms.txt · OpenAPI
What Maditon is, who it is for, and what it costs.
Maditon is an EU regulatory compliance assistant for European startups and SMEs. It inventories a company's AI systems, classifies each one under Regulation (EU) 2024/1689 with citations from the text, produces the obligation checklist that classification triggers, and packages the result as an audit-ready dossier. It works across the regulatory stack: the EU AI Act is the first module, not the whole product.
Maditon keeps a register of the services your company depends on and reads each supplier's published legal documents — privacy policy, terms, data processing agreement, sub-processor list, security page — reporting what they say and what they leave out, with every finding quoting its source passage. It then watches those documents and tells you when they change.
2 endpoints
It re-reads every watched document on a schedule, compares the new text with the last version paragraph by paragraph, and has a model judge whether the difference is material — a retention period, a transfer mechanism, a new sub-processor. You get one email a day listing what changed and what could not be read, and the app keeps the before-and-after text so you can check the summary against the supplier's own words.
1 endpoint
Maditon is built for European startups, scaleups and SMEs that fall under EU regulation but have no dedicated legal or compliance team. It is designed so a product manager or founder can run a classification without regulatory vocabulary, and it is B2B only — there is no consumer offering.
Maditon has a free Solo plan that runs a real classification with no card, then Starter at €49/month and Pro at €129/month, with a custom Enterprise tier. Annual billing is available on the paid plans. The pricing page at https://maditon.com/pricing is the authoritative source; the figures here were current on 28 August 2026.
2 endpoints
The EU AI Act (Regulation (EU) 2024/1689) module is live today. GDPR, NIS2, DORA and the Cyber Resilience Act are announced as coming, and the EU Data Act and CSRD are being monitored. The live list is machine-readable and public at https://api.maditon.app/api/modules — no authentication required.
3 endpoints · public access available
No. Maditon structures and accelerates compliance work but does not give legal advice. Every AI-generated assessment is a draft until a named person on your team accepts it, and that person takes the accountability. For genuinely contested questions — an edge-case classification, a novel use case, an enforcement conversation — you still want a lawyer.
How a classification is produced, and how to check it.
An AI-led interview asks plain-language questions about what the system does, who it affects and where it operates. Maditon maps the answers against every risk category in Regulation (EU) 2024/1689 — prohibited, high-risk, transparency-only and minimal — and returns a draft classification with the articles it rests on and the regulation text quoted verbatim.
4 endpoints
You check it against the law, and Maditon is built so you can. Every classification names the article it rests on and quotes the passage from Regulation (EU) 2024/1689 word for word, with the full source one click away. A separate verification pass then re-checks each conclusion against the retrieved text and reports any claim it could not support, alongside a confidence score.
3 endpoints
It says so. Maditon reports a confidence score and an explicit list of claims the verification pass could not support in the regulation text. Below the confidence threshold, or where a citation cannot be grounded, the classification is marked as requiring expert review rather than being presented as a settled answer.
Yes. You can override the risk classification outright, add reviewer notes to an accepted one, and flag any individual citation as incorrect. The override is recorded in the audit log with who made it, so disagreement becomes part of the documented record rather than something that happens outside it.
4 endpoints
No, and it cannot. Every AI-generated risk classification or compliance determination stays a draft until a named human explicitly accepts it, with their name and a timestamp recorded. No AI output reaches a cleared or compliant state on its own — this is enforced in the software, not just stated in the documentation.
1 endpoint
What a classification triggers, and how the proof is kept.
A classification generates the complete obligation checklist for that risk tier, drawn from the regulation rather than a generic template. Each checklist item can carry evidence files, tracks its own status, and rolls up into an organisation-wide compliance dashboard and a list of urgent actions.
4 endpoints
Evidence files are uploaded against an AI system and attached to the specific checklist items they substantiate, so each obligation carries its own proof. Everything can be downloaded in bulk as a ZIP — per system, or the whole organisation's evidence at once under EU Data Act Article 4.
4 endpoints
A dossier is a single PDF/A-1b file covering the organisation's AI systems: each system's accepted classification with the articles and quoted regulation text behind it, the obligation checklist and its status, the evidence attached to each obligation, and the acceptance record showing who accepted what and when.
1 endpoint
Yes. Maditon holds a registration record per high-risk AI system, covering the information Article 49 of the EU AI Act requires before a high-risk system is placed on the market or put into service. The registration deadline moved to 2 December 2027 under the Digital Omnibus on AI.
2 endpoints
Calling Maditon programmatically, including as an AI agent.
Yes. Maditon's backend is a REST API with an auto-generated OpenAPI specification at https://api.maditon.app/openapi.json, browsable at https://api.maditon.app/docs. It publishes 86 product endpoints covering AI systems, risk classification, compliance checklists, evidence, dossiers, billing and data export. Operator-only endpoints are deliberately excluded from the specification.
1 endpoint · public access available
Four things are public: the health check, the regulatory module list (GET /api/modules and /api/modules/{code}), and the transparency endpoints that serve organisations' published AI transparency pages. Everything touching customer data requires a bearer token — an unauthenticated call to those returns 401.
3 endpoints · public access available
With an OIDC bearer token issued by Zitadel, sent as an Authorization: Bearer header. The API validates it against Zitadel's JWKS endpoint on every request. Access tokens are short-lived — 15 minutes — with refresh tokens handling renewal, and every call is scoped to the organisation in the token.
Yes. GET /api/compliance/dashboard returns the organisation-wide picture, /api/compliance/systems/{system_id} the detail for one system, and /api/risk-classification/{system_id}/latest the current classification with its citations, confidence score and unsupported claims. All return JSON and require a bearer token.
4 endpoints
Where the data lives, which models see it, and how to take it back.
Entirely in the EU and by European-headquartered providers. Compute runs on Hetzner in Finland and Germany, the database is UpCloud Managed PostgreSQL in Finland, the CDN is BunnyCDN on EU-only edge nodes, and identity is Zitadel in Switzerland. No US-headquartered cloud service processes customer data.
Maditon uses Mistral, a French AI provider, with self-hosted models on EU infrastructure as the alternative. No customer data is sent to US-headquartered AI providers. Personal data is stripped from prompts before they leave the application, so the model receives the compliance question without the identifying details it does not need.
Everything Maditon sends to AI — what your company typed or uploaded, and the published legal documents of your suppliers — is read by Mistral in France, on an EU endpoint, with training on submitted data switched off. No other AI provider is involved, and nothing leaves the EU-only path.
Two self-serve endpoints. GET /api/data-act/export returns all organisation-level data as machine-readable JSON under EU Data Act Article 4, and GET /api/data-act/evidence returns every evidence file as a ZIP. There is no approval step, no support ticket and no waiting period — and a separate GDPR export covers an individual user's personal data.
3 endpoints
DELETE /api/gdpr/delete requests deletion under GDPR Article 17. There is a 30-day grace period during which the request can be cancelled, after which data is hard-deleted or fully anonymised — soft-deleted records do not keep personal data in any field. Export first if you want to keep anything.
2 endpoints
The regulation itself — deadlines, roles, and the high-risk tiers.
The prohibited practices in Article 5 have applied since February 2025 and the general-purpose AI model obligations since August 2025. The Digital Omnibus on AI moved the high-risk obligations, including EU database registration, from August 2026 to 2 December 2027, and the rules for AI in regulated products to 2 August 2028.
You are a provider if you develop an AI system and place it on the EU market under your own name, and a deployer if you use one under your own authority in a professional capacity. Most European companies are deployers. The roles are not exclusive — putting your name on a third-party model, or substantially modifying one, can make you a provider of it.
Two routes. A system is high-risk if it is a safety component of a product covered by the EU harmonisation legislation in Annex I, or if it falls into one of the eight standalone use-case categories in Annex III — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice or democratic processes.
Not here? The FAQ covers the basics and the Resource Center goes deeper on the regulation itself.
Run a free classification