The basics you need to know before you get started

Maditon is an EU compliance assistant for startups and SMEs. It keeps the register a small company is asked for — the suppliers you depend on and the systems that depend on them — fetches copies of your suppliers' published legal documents, reads them and reports what they say and leave out with every finding quoting its passage, watches them for changes, drafts answers to your customers' security questionnaires from your own record, and exports it all as PDF. On top of that sit regulation modules; the EU AI Act module is live and classifies your AI systems with audit-ready documentation. Everything is hosted in the EU and the reading is done by Mistral in France.

Startups, scaleups, and SMEs that use AI systems in Europe but don’t have a full-time compliance team. If your product manager or CTO is the one trying to figure out what the EU AI Act means for your business, Maditon is built for you.

Register a supplier and Maditon finds its published legal documents — privacy policy, terms, data processing agreement, security page, sub-processor list, AI policy and service level agreement — fetches a copy and reads it. The result is a set of findings, each quoting the passage it came from, graded high, medium or low. A finding is a question to put to the supplier, never a verdict: Maditon never states that a supplier is compliant. Silence counts as a finding only where that kind of document owes an answer — a privacy policy that never mentions retention, not a terms page that does not.

Every watched document is re-read on schedule — daily checks, each document at least weekly. When a supplier changes its terms, the change is recorded with the difference between the old and the new copy and an AI reading of whether it matters, and the people in your organisation who turned notifications on get one e-mail in the morning with everything that changed. A page that can no longer be fetched is reported as unreachable rather than quietly dropped.

Yes, on Starter, Growth and Scale. Every supplier in your register is compared with the legal entities on the EU consolidated financial sanctions list and the UN Security Council consolidated list — by legal name, alias and registration number, with fixed matching rules rather than AI. The lists are fetched every night. A possible match is shown in the register and on the supplier page with the reasons behind it, and an owner or admin in your organisation records whether it is confirmed or not the same; nothing is decided automatically, and new matches arrive in the daily change e-mail. It is an aid that saves you the lookup, not a guarantee: it can miss a match or flag a resemblance, a clear result is not proof, and your sanctions compliance remains your own responsibility.

Upload the questionnaire your customer sent — XLSX, DOCX, CSV or PDF. Maditon keeps the identifiers, sections and order, then drafts an answer to every question it can from your compliance profile, your supplier register and your systems, and the answers you approved before. Each draft names its source; a question the record cannot answer is marked as needing input rather than guessed. You review, edit and approve, and only approved answers go into the file you export back. Private documents are never used for drafts.

Maditon keeps copies of documents to read and compare them — a supplier's published page as it stood on a given day, or a file you uploaded. It is not an archive, a case system or a registry: the originals are the supplier's pages and your own files, and you keep your signed originals in your own records. When you leave, the Data Act export gives you everything you put in and everything Maditon produced from it, copies included, in open formats.

An uploaded document you mark as private — a signed agreement you would not quote to a prospect. Its content is read and compared like any other, but it is never used when drafting answers to a questionnaire, and it is encrypted under a key that exists only for your organisation: the file, its text, the readings of it and their translations are stored as ciphertext. Deleting your organisation deletes the key. Any member or admin can mark a document private or make it public again.

Every account gets the supplier register, change watching, questionnaires, systems and services, and PDF packages. Modules add one regulation each. The EU AI Act module is live: it inventories your AI systems, classifies each one with citations from Regulation (EU) 2024/1689, produces the obligation checklist and the audit-ready dossier. An AI system registered in the module also appears in your systems register, so its suppliers, SLA and contacts live in the same place. GDPR and NIS2 modules follow on the same foundation.

The EU AI Act is the world’s first comprehensive regulation for artificial intelligence. It entered into force on 1 August 2024 and classifies AI systems into risk tiers — prohibited, high-risk, limited, and minimal — each with different compliance obligations. Prohibited practices have applied since February 2025 and general-purpose AI model obligations since August 2025. The Digital Omnibus on AI moved the high-risk obligations to 2 December 2027 and the rules for AI in regulated products to 2 August 2028.

Maditon uses a plain-language interview to understand what your AI system does, who it affects, and where it operates. It then maps your answers against every risk category in the EU AI Act and produces a classification with specific article references. When the AI isn’t certain, it flags the uncertainty — auditors trust transparency over false confidence.

You check it, and Maditon is built so that you can. Every classification names the article it rests on and quotes the passage from Regulation (EU) 2024/1689 word for word, next to the conclusion it produced — not a reference to look up later, but the sentence itself, with the full source one click away and a way to flag it if you disagree. A separate verification pass then checks each conclusion back against the retrieved legal text and reports any claim it could not support, alongside a confidence score you can see. Anything below the confidence threshold is raised for expert review instead of being presented as settled. And nothing counts until a named person on your team accepts it, with their name and a timestamp on the record.

No. Maditon accelerates and structures the compliance process, but it does not provide legal advice. Every AI-generated assessment is treated as a draft until a human on your team explicitly accepts it — with their name and timestamp recorded. Maditon makes the work 95% faster, but accountability stays with your organisation.

Two kinds. From the supplier register: a PDF package for one system or for the whole register — the suppliers with their contacts and SLA, every document's latest reading with its findings and quotes, where each was processed and when it was read, contradictions between a supplier's documents, and the private documents marked as such — generated on demand and never stored, plus the questionnaire you export back to your customer. From the EU AI Act module: PDF/A-1b audit dossiers with risk classifications, compliance assessments, source-referenced regulatory citations and human-accepted determinations with timestamps.

Yes. Everything you put into Maditon — your systems, suppliers, documents and readings — is processed and stored in Europe by European-headquartered providers, and no US-headquartered cloud service processes it. This is a core architectural decision, not a configuration option. The one exception concerns billing only: Stripe, our payment processor, may transfer billing details (organisation name, billing email, country and VAT number) to its US affiliate. The privacy policy, section 5, describes the safeguards.

Yes. You can export your entire documentation bank, compliance assessments, and audit packages in standard open formats at any time. There is no vendor lock-in — your data is always yours to move.

GDPR, NIS2, and the Cyber Resilience Act (CRA) are on our roadmap. They will follow the same source-referenced, audit-ready methodology as the EU AI Act module. The goal is a unified compliance view across the full European regulatory stack.

Maditon is available in English, Swedish and German. French, Spanish and Italian are coming soon.

Most companies go from first login to a complete audit-ready dossier within 48 hours. The AI-led interview takes minutes, and the classification and documentation generation is automatic.

Visit our pricing page for current plans. Maditon is designed to be accessible to startups, scaleups, and SMEs — significantly less than hiring a compliance consultant or building an in-house regulatory team.