90 free compliance generators — and why we built them
When we started ComplyKit, the premise was simple: compliance documentation is a barrier for every SaaS founder who is not also a lawyer. A GDPR Privacy Notice. A SOC 2 Gap Assessment. An ISO 27001 Risk Assessment. These are not optional — enterprise customers require them, investors ask for them, and regulators enforce against their absence. But engaging a compliance consultant costs $200–$500/hour, and specialist legal advice is even more expensive.
We believed that AI — trained on the full text of regulations, ESMA guidelines, FCA supervisory publications, and EDPB guidance notes — could generate a document that, for most founders and most situations, is 80–90% of the way there. Not a replacement for a lawyer when it matters, but a genuine head-start that saves days of work and removes the cost barrier that keeps early-stage companies non-compliant by default.
Today, we have published our 90th free generator. This is a milestone worth pausing on.
What 90 generators covers
The 90 generators span 15+ compliance frameworks:
- GDPR / UK GDPR (14 generators): Privacy Policy, DPIA, Record of Processing Activities, Data Processing Agreement, Data Breach Notification, Cookie Policy, Cookie Consent Audit, CCPA/CPRA Checklist, CCPA Notice, GDPR DPA, Privacy by Design Assessment, Sub-Processor List, Children's Privacy Policy, EU-US DPF Guide
- SOC 2 (7 generators): Gap Assessment, Management Assertion, System Description, Evidence Pack, Trust Centre, Remediation Tracker, Vendor DDQ
- ISO 27001 (6 generators): Risk Assessment, SoA, Internal Audit, Management Review, Asset Management Policy, Vulnerability Management Policy
- HIPAA (3 generators): Security Risk Assessment, BAA Template, Privacy Notice
- EU AI Act (3 generators): AI PIA, AI Model Card, AI AUP
- DORA (2 generators): Technical Standards Compliance Checklist, ICT Risk Policy
- MiFID II (1 generator): MiFID II / MiFIR Compliance Checklist — new
- Supply Chain / CSDDD (1 generator): Supplier Code of Conduct — new
- FedRAMP (1 generator): Authorization Roadmap
- HITRUST (1 generator): CSF Readiness Assessment
- APRA CPS 234 (1 generator): Compliance Checklist for Australian financial entities
- NIS2, PCI DSS, CIS Controls, Cyber Essentials and 30+ general security policy generators
What our users are building with ComplyKit
The use cases we see most frequently:
- Enterprise sales unblocking: "Our procurement team requires a HIPAA BAA, a SOC 2 System Description, and a completed Vendor DDQ before we can sign." ComplyKit generates all three in under an hour.
- Investor diligence: Series A/B investors increasingly ask for a compliance maturity snapshot. A SOC 2 Gap Assessment with scored readiness gives them something concrete to review.
- Regulatory preparation: Founders preparing for first GDPR DPA interactions. DORA implementation for EU fintech. FedRAMP ATO for SaaS companies entering the federal government market. MiFID II compliance for fintech expanding into investment services.
- EU expansion: US-based SaaS companies entering the EU and needing GDPR documentation. CSDDD preparation for supply chain teams. MiFID II compliance for investment services.
- Compliance catch-up: Companies that have been operating without formal policies and need everything documented before a security audit or certification assessment.
What makes ComplyKit different
There are other policy generators on the internet. Most produce generic text that looks like it was written by a legal department in 1998. The SOC 2 gap assessment that does not reference the 2022 TSC update. The GDPR privacy notice that does not mention UK GDPR or the EU-US Data Privacy Framework. The ISO 27001 checklist based on the 2013 standard that does not reflect the 2022 revision.
We built ComplyKit to be regulation-specific and current. Every generator references the actual articles, clauses, and regulatory guidance applicable to the regulation it covers. The DORA generator references Regulation (EU) 2024/1772 for incident classification thresholds. The MiFID II generator references Commission Delegated Regulation (EU) 2021/1253 for ESG suitability preferences. The APRA CPS 234 generator references CPG 234 guidance and the specific APRA supervisory approach.
We also believe the assessment format matters. Most of our generators use a two-step flow: a guided assessment of your current posture, followed by a generated document that reflects your specific situation — not a generic template. The HITRUST generator knows whether you are targeting e1, i1, or r2 certification. The FedRAMP generator knows whether you are targeting Agency ATO or JAB, and at what impact level.
What's next: building towards 100
We are building towards 100 generators. The next batch will include:
- CSRD (Corporate Sustainability Reporting Directive) gap assessment
- EU AI Act High-Risk System Conformity Assessment
- More sector-specific generators for healthcare, fintech, and regulated industries
- EU Taxonomy Regulation alignment tool
If there is a regulation you need compliance documentation for that we do not yet cover, tell us. We build based on what founders and compliance teams actually need.
Browse all 90 free generators at ComplyKit Generators. No account, no paywall — generate, download, use.