Compliance software: investors back an SME-first ISO 42001 push
Compliance teams and operations leaders at small and mid-sized businesses pay for tools that turn regulatory and certification work into repeatable workflows. Complaion is positioning itself as one of those workflow providers, using software plus services to guide companies through ISO certifications and newer EU regulatory areas such as NIS2 and the AI Act.
Milan-based Complaion, founded in 2024, has raised EUR 13.5 million in a funding round co-led by Eurazeo and Italian Founders Fund. The syndicate also includes Shapers, 2100 Ventures, Kfund, Sella Direct Ventures, Enzo Ventures, Vento, Ithaca, Eden Ventures, and Vesper, underscoring broad investor interest in a fragmented European compliance market.
Why this round fits the market trend
This financing lands squarely in a with-trend part of European B2B software: compliance is being pulled forward by overlapping requirements and the growing cost of getting it wrong. What makes Complaion’s angle timely is its explicit product line around ISO 42001, the international standard for AI management systems.
Unlike many compliance categories that hinge on direct legal mandates, Complaion frames ISO 42001 as voluntary but increasingly relevant for organisations that develop or use AI. That matters commercially because it creates demand driven by customer assurance, procurement requirements, and governance expectations, even when the standard is not required by law.
Complaion says it supports Italian and Spanish SMEs through the ISO 42001 certification journey, including gap analysis and the final audit. That end-to-end scope is important: certification pathways tend to be messy in practice, and vendors that combine structured software with hands-on execution can create higher switching costs than point-solution tooling.
Product and go-to-market implications
Complaion’s materials describe ISO 42001 as enabling a structured, responsible, and verifiable approach to AI governance across the full AI lifecycle, from design through decommissioning. If delivered as a repeatable workflow, that can translate into a clear value proposition for SMEs that lack in-house compliance depth but still need to satisfy customers, regulators, and auditors.
The company also positions its platform beyond ISO into broader compliance and emerging EU regulatory needs (including NIS2 and the AI Act). From a go-to-market perspective, this broad surface area can support a land-and-expand motion:
- Land on a defined event, such as an ISO certification project with a clear timeline and deliverables.
- Expand into ongoing governance, evidence collection, and additional standards or regulatory work as the customer’s obligations grow.
The competitive reality in European compliance is that it remains highly fragmented, with a mix of consultants, audit-adjacent service firms, and software vendors. A software-plus-services model can win early by reducing time-to-certification, but it must be careful not to become overly bespoke as it scales across countries and standards.
What the funding is likely to support
Coverage of the round repeatedly frames it as fuel for expansion across Europe, including Spain. While the company has not detailed a full operating plan in the available reporting, expansion typically requires three things in this category (inference):
- Localised delivery capacity for certification journeys, including partner networks and auditor relationships.
- Sales capacity that can sell into operations, security, and leadership stakeholders at SMEs, often via consultative sales cycles.
- Product depth in evidence management and audit readiness, where retention is won through implementation depth and ongoing usage.
The presence of multiple European and international investors alongside Eurazeo and Italian Founders Fund is also a signal that Complaion is being viewed as a cross-border compliance play rather than a single-country services business.
What this enables
- Faster geographic scaling beyond Italy, with Spain highlighted as an early focus
- A clearer AI-governance wedge via ISO 42001 that can sit alongside AI Act readiness work
- Potential land-and-expand packaging across ISO certifications plus adjacent regulatory programs
What to watch
- Whether Complaion can keep certification delivery standardised while expanding into multiple countries
- How much of the motion is product-led versus services-led, and the impact on margins and scalability
- Customer retention drivers: ongoing governance workflows versus one-off certification projects
- Partner strategy: auditors, consultancies, and channel relationships that can accelerate distribution