On a Tuesday morning, a small business can sit down, answer plain questions about how it operates, and stand up an hour later holding a documented compliance position for GDPR, for NIS2, for the AI Act, for any of more than eighty other EU and UK instruments. That is what compliancesme.com was built to do. For every small firm that has been told compliance is a consultant's game, it changes the arithmetic.

The old arithmetic was brutal. A regulation arrives as a long stretch of legal drafting, the EU AI Act at 144 pages of the Official Journal, and a consultant translates it by the hour. A small firm looks at both numbers and does nothing. That works until the customer questionnaire arrives, until the tender requirement follows, until the regulator's letter lands, and at that point doing nothing has become the most expensive option of all.

ComplianceSME attacks that translation cost directly: every obligation in an instrument is named, tied to its article, matched to the duty holder it binds and to the evidence it demands. The customer never reads those pages, because the toolkit has already read them, and running one needs no software beyond a Claude account. The customer opens a section, and it interviews them about their own operation. How do you record consent? Who manages your suppliers? Where do incident reports go? One question comes at a time, and each answer is tested against what the regulation demands of them.

What comes out the other end is the thing regulators keep asking small firms for, and the thing small firms keep failing to produce. There is a register of every obligation with a status recorded against each one. There is a gap analysis graded by severity. There is a report that cites the article behind every requirement, ready to hand to a bank or an insurer, ready for a lead customer, ready for an inspector. It is also what the law tells an enforcer to weigh: when a supervisory authority decides whether to impose a GDPR fine and how large it should be, it must give due regard to the technical and organisational measures the firm had in place.

The range, though, is very much the point.

One hundred and sixteen agent toolkits and counting: data protection, cyber security, AI, product safety, environmental rules, corporate governance, ISO standards. Each one is built the same way from the same discipline.

There is a caveat to all of this, and it belongs in print. These are documentation tools, not lawyers. They generate a compliance position from the customer's own answers, and where a business faces genuine legal ambiguity, counsel still earns its fee. Most small firms are not in that position. They do not need an argument. They need the list, the evidence and the paperwork, and producing that paperwork has become a job software does better and faster than the hourly model ever did, and more consistently as well.

Small firms face the same instruments as the multinationals with none of the in-house counsel, and the market's answer was to sell them fear at day rates. compliancesme.com exists because the founder refused to accept that a small business should pay enterprise prices to find out what the law already says in public.

The regulations are not getting simpler, and the tools for meeting them, after years of the old arithmetic, finally are.

compliancesme.com

More from ComplianceSME

Every claim and its source

A regulation arriving as a long stretch of legal drafting, the EU AI Act running to 144 pages as published in the Official Journal: Regulation (EU) 2024/1689, OJ L, 2024/1689, 12 July 2024. More than eighty European Union and United Kingdom instruments covered, every obligation extracted from the legal text and tied to its article number, the duty holder it binds and the evidence it demands: ComplianceSME obligation register, 116 agent toolkits and 10,313 obligations catalogued at article level. The register with a status against each obligation, the gap analysis graded by severity, and the report citing the article behind every requirement: ComplianceSME published toolkit files, read 3 September 2026. A supervisory authority being required, when it decides whether to impose an administrative fine and on its amount, to give due regard to the degree of responsibility of the controller or processor taking into account the technical and organisational measures implemented under Articles 25 and 32: Regulation (EU) 2016/679, Article 83(2), point (d). The toolkit and agent counts stated on this site: ComplianceSME agent count definition of 1 September 2026, counted from the dashboard manifests on disk.