Skip to main content
ComplianceAI
Sign inCreate account

Website compliance auditing

Every requirement you chose, accounted for

ComplianceAI examines a website against public requirements — the obligations an authority actually imposes — and reports what it observed for every requirement in the set you picked. Each one is either decided by the scanner or put in front of a person, with the reason. None is left out.

Create an accountSign in

Scans are read-only. Pages are loaded and read; nothing is submitted, purchased, changed or deleted on your site.

Why this is an evidence system

  • Every rule names what binds it

    A requirement is asserted as binding only when the rule can name the instrument that makes it apply — an article of a directive or a regulation, a national regulation — never a blog post or a vendor checklist. 135 of the 135 rules shipping today carry at least one legal or standards reference, and the report shows them.

  • Nothing is silently skipped

    Automated testing decides roughly a third of WCAG 2.2 Level AA. The rest does not disappear: every criterion a machine cannot decide produces a finding that says so, with the reason and its source. A clean report that means “nobody checked” reads exactly like “you passed”, so this system never produces one. Of the 135 rules shipping today, 40 are decided by the scanner and 95 are put in front of a person.

  • The question is frozen before it is asked

    A Test Plan pins the rule-pack versions and the scanner versions, and is then immutable. Changing the modules, the jurisdiction, the scope or a pinned version creates a new version rather than editing the old one, so a re-run months later asks the same question and an earlier result stays reproducible.

Every finding says who decided it

A reader must always be able to tell a proof from a signal from a question. That is not a footnote in the report — it is a field on every single finding.

DeterministicDETERMINISTIC
The scanner observed the thing the rule is about, and decided it.
HeuristicHEURISTIC
The scanner observed a strong signal rather than the thing itself. Read it as a lead, not a verdict.
Manual reviewMANUAL_REVIEW
No machine can decide this from a page. A person has to look, and the finding says at what.
Legal reviewLEGAL_REVIEW
The answer is a legal judgement about your organisation, not an observation about your site. It reaches your own counsel with the question already framed.

There is no score, and that is deliberate

No percentage. No letter grade. No “you are 87 % compliant”.

Compliance is a legal conclusion; this system observes a website. A “checks passed” ratio would be a ratio over the subset a machine can decide, so it is biased upward by construction — and it would rise every time a rule pack more honestly declares something un-automatable. A single reassuring number is the one thing this product refuses to sell.

What you get instead: the requirements in the set you chose, what was observed for each, which pages were reached and which were not, and what a person still has to decide.

The requirement sets that ship today

Each set is a published rule pack, and they are selected independently: a WCAG-only plan invokes zero GDPR rules, and the reverse. That is an acceptance test in this codebase rather than a promise on a marketing page.

How a scan works

  1. Choose the requirement sets

    Pick the audit products you are obliged to meet. Ticking one never ticks another, and a plan runs only the modules you chose.

  2. The plan is pinned, then frozen

    Rule-pack versions, scanner versions and scope go into an immutable Test Plan. Any change creates a new version, so two runs of the same plan answer the same question.

  3. The site is observed, never touched

    Pages are loaded and read. Every address is checked against a safety guard before it is fetched — on every navigation, not only the one you typed — and nothing is submitted, purchased, changed or deleted.

  4. Coverage is reported, not assumed

    Which pages were reached, which were not, and why. A scan that reached three pages out of two hundred says so on its face instead of reading as authoritative.

  5. Findings arrive with their evidence

    Each finding carries its rule, the instrument behind it, its automation class and the evidence the result rests on. Run it again later and known findings are reconciled rather than re-reported as new.

Who it is for

  • Public sector bodies in the EEA

    Directive (EU) 2016/2102 requires an accessible website — and, in Article 7, a detailed accessibility statement, a feedback mechanism through which anyone can report a barrier, and a link to the enforcement procedure. Those three are not WCAG success criteria, so a site can meet every criterion and still be in breach. The Norwegian public-sector set checks them, alongside the national regulation.

  • Any site that reaches people in the EU

    GDPR Article 3(2) reaches controllers outside the Union that offer goods or services to, or monitor, people inside it — so filtering by the site’s own country would produce silence where a finding belongs. The core privacy set applies everywhere, and national law is carried in overlays that name the provision binding it here.

  • Teams who have to show their work

    In-house teams, agencies and auditors who need a document stating what was examined, what was observed, what was not reached and what is still open — with a named person attached to every question a machine could not answer.

In seven languages

Norwegian bokmål is not an afterthought here: this product’s first market is the Norwegian public sector. Report and interface language are presentation only — they never change which requirements apply, and never affect what a Test Plan pins.

  • Norsk bokmål
  • English
  • Svenska
  • Dansk
  • Español
  • Deutsch
  • Italiano

What this is not

  • Not a certification. No authority endorses the verdicts of any tool in this market, this one included.
  • Not legal advice. The system observes a website; the legal conclusion stays with you and your counsel.
  • Not a guarantee of compliance. It reports what it observed and what it could not decide, and refuses to convert that into a verdict.
  • Not an exploit test. Security checks read headers, transport and page content. Nothing is attacked.
  • Not a substitute for the human review it asks for. When a rule says a person must decide, that is the finding — not a gap in the report.

Start with one requirement set

Create an account, add the site you are responsible for, and choose the requirements you have to meet. You can add another set later without changing what an earlier plan asked.

Create an accountSign in