ComplyIQ AI Transparency Assessment
Your organization has already made public claims about its AI — in a privacy notice, a product page, a chatbot disclaimer. ComplyIQ tests those claims against documentable evidence and tells you where they don't hold up. No tenant connection. No Graph permissions. No admin consent.
What ComplyIQ reads
Policies, AI notices, model cards, prior assessments — versioned and stored write-once.
Public pages you list, and the same-domain pages they link to. Robots-aware; a dated snapshot is retained as evidence.
Facilitated sessions with your teams after your Report of Findings readout. Scoped to your organization.
No directory, no Graph, no mailbox, no admin consent, nothing behind a login.
What you claimed publicly, against what you can evidence — met, partial, or gap, per obligation.
Regulators, customers, and counterparties read the same pages your prospects do. The exposure isn't usually the AI — it's the distance between what the website says and what the organization can actually show.
An AI notice written by marketing in 2024, a chatbot shipped by product in 2025, a vendor clause signed by procurement. No single person can tell you whether they still agree with each other.
EU AI Act Article 50 and GDPR attach to who you serve, not where you're incorporated. Most US organizations discover the exposure through a customer questionnaire, not a lawyer.
Most compliance tooling wants admin consent before it can say anything. That puts a security review, a procurement cycle, and a nervous CISO between you and your first answer.
Everything a regulator or a customer can see about your AI is already public. ComplyIQ works from that same surface — reconciling what you published against what you can evidence — so the assessment needs nothing from your environment to be useful.
ScaleIQ-hosted with zero customer-tenant access. ComplyIQ never connects to your Microsoft tenant, directory, or Graph.
No tenant connection, no Graph scopes, no admin consent. There is no security review standing between you and your first finding, because there is nothing to review.
Each result cites the source document and version, or a dated, hashed snapshot of the page it came from. A later edit to your site cannot quietly change the record a finding rests on.
Most exposure isn't a missing policy — it's a policy that no longer matches the website. ComplyIQ compares the two lanes directly and reports where they diverge.
ComplyIQ runs entirely on evidence you hand over or authorize. Nothing executes inside your environment, so there is nothing for your security team to approve before you start.
A structured intake captures your footprint, your AI systems, and your data. You never pick regulations — the classification engine identifies the candidate obligations and shows the trigger that fired, for you to confirm with counsel.
Upload your policies and list the public pages we may review. Every document is versioned; every page retrieval is snapshotted and hashed so the record can't drift.
AI-assisted analysis compares your declared position against your published position, obligation by obligation. Every finding carries its evidence. A human reviews before anything ships.
A one-hour expert readout walks your team through findings, disputes, and sequencing — then hands you a 90-day roadmap ordered by exposure, not alphabet.
Not a score and not a dashboard. Each output names a gap, cites the evidence behind it, and states what would close it.
The engagement deliverable. Met, partial, or gap against each candidate obligation — with the evidence, the retrieval date, and the trigger that made the obligation apply. Written to be handed to counsel without translation. Every Report of Findings is reviewed and approved by ScaleIQ, with sign-off recorded through DocuSign, before it is delivered to you.
Sequenced by exposure and effort, with an owner-shaped task for each gap. Every item names the artifact that would close it, so progress is verifiable rather than asserted.
A facilitated hour with the people who ran the assessment. Challenge findings, mark items out of scope, and leave with an agreed sequence — not a PDF nobody opens.
ComplyIQ assesses obligations by theme, across four bodies of law. Every result is returned as a candidate with the trigger that fired, for your counsel to confirm.
Industry obligations surface from the sector and systems you declare, and appear in the Report of Findings only where the assessment evidences them. EU AI Act Article 50 is the baseline; extended frameworks are added by scope band. The catalog grows as regimes take effect.
A scoped assessment starts with a structured intake and a list of URLs. No security review, no admin consent, no tenant connection — you can begin this afternoon. Start free if you want to see the shape of it first, or schedule a compliance consult to scope a Baseline.
Free
A quick check of the AI disclosure signals on one public domain. One scan per domain every 30 days.
The output is a Transparency Snapshot, a signal check. It is not an assessment, a Report of Findings or legal advice. Review any compliance question with your legal counsel.
Scan my site$5,000 one-time
A structured assessment of your AI systems against the EU AI Act, GDPR Article 22, the Colorado AI Act, BIPA and COPPA. You receive a written Report of Findings with a prioritized remediation roadmap, walked through with you on a readout call.
Optional independent legal review by outside counsel, but recommended.
Schedule Compliance ConsultScoped to your organization
What you say publicly about your AI should match how it actually runs. After your Report of Findings readout, we facilitate internal focus groups with the teams who build, buy and operate your AI systems. Together we compare your public statements with day-to-day practice and identify where they diverge, so you can decide what to change: the disclosure or the practice.
Available to Baseline clients after the readout call. Sessions are facilitated discussions, not legal advice. Review any conclusions with your legal counsel.
Schedule your readoutOngoing quarterly reassessment and custom engagements are available. Contact us.
ComplyIQ provides an independent, AI-assisted assessment for informational purposes only. It is not legal advice, does not create an attorney-client relationship, and is not a conformity assessment under the EU AI Act. Findings are a readiness and posture indicator, not a guarantee of any compliance outcome. Review all findings with your own legal counsel before acting on them. You remain responsible for your organization's compliance decisions.
A domain and your work email is everything we need to run the complimentary scan. No admin consent, no security review, no tenant connection — about five minutes.