Complipath vs Scytale

Complipath is EU AI Act compliance software for companies with 20 to 100 employees that build or use AI. Founder Yobel Tzegai builds it in Gothenburg, Sweden. Complipath says it is run by Complipath AB, a Swedish limited company (org. no. 559609-5835). Each AI system gets a row in an inventory with a named owner. A rule engine, not a language model, classifies each system's risk and cites the article and law version behind the result. Complipath says AI only drafts text from the customer's own documents and a person confirms it. The product tracks provider and deployer obligations with owners and dates, links evidence to each requirement, and drafts Annex IV technical documentation, Article 27 fundamental rights impact assessments and DPIAs. It also answers customer AI and security questionnaires, tracks changes to the Act and emails affected users, and produces audit packs, exports and an audit log. **AI compliance coverage** The EU AI Act (Regulation 2024/1689) is the core. Complipath lists Article 43 conformity assessment as not supported, and offers drafting support for some high-risk requirements (Articles 9, 10, 11 and 14) while others (Articles 12, 13, 15 and 17) are checklist rows only. It offers an ISO/IEC 42001 readiness mapping and draft statement of applicability on its Growth plan, and covers GDPR only where it meets the AI Act (DPIAs and the 72-hour breach deadline). It doesn't cover the NIST AI RMF, SOC 2 or ISO 27001. Complipath says it gives legal information, not legal advice, and certifies nothing. **Who it's for** Small software companies in the EU, especially SaaS firms without a compliance team, that need an AI register and a record of their AI Act decisions. Workspaces are hosted in Frankfurt. Complipath names no customers, case studies or deployments: the example companies on its site are fictional and it has no customer reviews yet. It is not ISO 27001 or SOC 2 certified and says it has had no external penetration test.

Scytale is a compliance automation (GRC) platform that pairs its software with a dedicated in-house compliance expert for each customer. Meiran Galis founded it in 2021 and leads it as CEO. The operating company is Scytale AI, Inc. Its press releases are datelined New York, and it lists offices in New York, Tel Aviv, Prague, Lisbon, Johannesburg and Cape Town. Calcalist reported in 2025 that its R&D center is in Tel Aviv. Scytale says it supports 80+ security, privacy and AI frameworks, with controls cross-mapped between them; its public framework library names 37, including SOC 2, ISO 27001, ISO 42001, the EU AI Act, PCI DSS, GDPR, HIPAA, SOX IT general controls, NIST CSF 2.0, DORA and NIS2. The platform automates evidence collection, continuous control monitoring, user access reviews, policy management, vendor risk and audit preparation. Scytale also sells penetration testing by its own team (web, mobile, API, network and cloud), AI-drafted answers to security questionnaires that an expert reviews, and a Trust Center for sharing compliance documents with customers. SOX ITGC automation came from its June 2025 acquisition of AudITech. Scytale describes a set of six AI agents but names two: Scy, a conversational assistant that checks control status, drafts remediation and creates policies, and an AI Governance Agent that finds unregistered AI systems and adds them to an AI inventory. Its page also shows agents validating evidence, flagging control gaps, redlining policies after a regulatory change and flagging vendors above a risk threshold. In September 2026 it added AI third-party risk management: vendor discovery through SSO, profile enrichment, dynamic risk scoring and breach monitoring. In October 2026 it launched Scytale MCP, which gives AI assistants read-only access to a customer's compliance data. **AI compliance coverage** Scytale supports ISO/IEC 42001, reusing controls it shares with ISO 27001 to stand up an AI management system (AIMS), and added the EU AI Act as a framework in 2025. Its AI Governance product discovers AI tools and agents across identity providers, cloud accounts, code repositories and SaaS apps, classifies their risk and runs assessments against the EU AI Act, ISO 42001, the NIST AI RMF and AIUC-1. It connects to OpenAI, Anthropic, Google Vertex AI and AWS Bedrock. Scytale's pages don't say which EU AI Act obligations its templates cover. We found no claim that Scytale itself holds ISO 42001 certification. **Who it's for** Startups and mid-market companies that need SOC 2 or ISO 27001 and want to add ISO 42001 or EU AI Act readiness on the same platform, with expert help rather than purely self-serve software. Customers shown on its homepage include monday.com, Deel, Fiverr, Payoneer, Taboola and ICL. Its published customer stories (SundaySky, Sport Alliance) cover security compliance; we found none about ISO 42001 or AI governance.