About TrustPacket

The EU AI Act became enforceable in February 2025. Enterprise procurement teams started asking: "Is your AI system high-risk? Show us your Annex IV documentation."

For companies building on Annex III use cases (hiring, credit scoring, biometric ID), the answer determines whether they can close deals. The problem: getting that answer often means either hiring custom legal support or adopting a GRC platform built for enterprises with compliance teams.

We've been on both sides of this. As vendors, we've filled out hundreds of compliance questionnaires. As buyers, we've sent them. The AI Act questionnaire became the new SOC 2 — a table-stakes hurdle that shouldn't cost five figures to clear when you're a 15-person team.

A rule-based risk checker — no AI guessing your legal obligations. We implemented first-pass Annex I, Annex III and Article 50 classification branches from Regulation (EU) 2024/1689 as structured rules. Answer 7 questions, get your tier with article references, deadlines, and review flags where facts may need legal judgment.

Self-serve documentation — the five (or six) documents buyers actually ask for, generated from a structured questionnaire. Not perfect, not a substitute for counsel, but a structured first draft with company-specific evidence gaps clearly marked.

We charge $229–$499because the marginal cost of generating structured drafts is low, and we'd rather help more companies at self-serve prices than reserve this work for custom engagements.

TrustPacket is built and maintained by a small team with backgrounds in SaaS compliance, developer tools, and enterprise sales. We've navigated SOC 2, ISO 27001, GDPR, and now the AI Act — not as consultants, but as operators who had to ship compliant products on startup budgets.

We're not lawyers. We don't pretend to be. Everything we build is explicitly labeled "not legal advice" because that's honest: we're a self-assessment tool, not a law firm. For prohibited-tier systems or novel edge cases, you need qualified counsel. For systems that map cleanly to the rule-based questionnaire, our tool gets you documentation you can hand to a lawyer for review — at a fraction of the cost of starting from scratch.

Not a law firm.We don't provide legal advice, and we say so everywhere. Our tool helps you structure your self-assessment and generates documentation templates. A lawyer should review the output before you rely on it for high-stakes decisions.

Not a certification body.We don't issue certificates of conformity. Conformity assessment under Article 43 often uses internal control for Annex III points 2-8; notified bodies are involved only for specific routes and use cases. Either way, that's not us.

Not a GRC platform.If you're a 500-person company juggling SOC 2, ISO 27001, HIPAA, and AI Act, you probably need Vanta or OneTrust. We're for the small team that just needs AI Act drafts to unblock one immediate buyer review.

We sell documentation packs ($229–$499 one-time) and monitoring subscriptions ($49/month) for teams that want ongoing regulatory updates. The risk checker and guides are free forever — we believe the classification question should have a free answer.

We also earn affiliate commissions when we recommend GRC platforms to companies that outgrow self-serve tools. We're transparent about this: see our affiliate disclosure.

Questions, feedback, or partnership inquiries: hello@trustpacket.app

Regulatory updates are published on the updates page when there is a substantive AI Act or product-template change.