Statutory AI compliance.
Operationalize your duties.
Cut hours, not legal review.
Rulisto runs rules-based legal classification across your AI systems, identifies covered ADMTs under state law, and documents your required pre-use notice obligations, 30-day adverse outcome disclosure requirements, and meaningful human review duties in a signed technical dossier.
Self-Service Risk Triage
Interactive 3-question eligibility check
Built for teams deploying AI in regulated industries
"We needed statutory-level precision for our AI hiring tools — not another generic risk framework. Rulisto mapped our exact obligations under SB 26-189 in under 10 minutes."
— Early Access User, HR-Tech Startup (Colorado)
How Rulisto works
A three-step rules-based process — no guesswork.
Answer the Questionnaire
Answer structured questions about your AI system's decision domain, data handling, and human oversight. Takes under 5 minutes.
Deterministic Classification
Our rules engine applies the exact statutory thresholds from SB 26-189 and CPPA Article 11 to classify your system — no ambiguity.
Sealed PDF Dossier
Receive a payload-verified, documentation-ready Risk Assessment PDF with a SHA-256 canonical payload hash stored on our servers for tamper detection. with citations, obligation mapping, and a unique integrity fingerprint.
Architected specifically for legal scrutiny and high-stakes algorithmic audits
Deterministic Rules Engine
Deterministic classification. Computed using exact statutory thresholds encoded from SB 26-189 and CPPA Article 11 — Direct translation of statutory thresholds.
Audit-Logged PDF Work Products
Every dossier includes a SHA-256 canonical payload hash logged to our immutable audit trail. Independently verifiable for use in regulatory submissions, board packets, and outside counsel review.
Sector Carve-Out Identification
Identifies whether your organization qualifies for a statutory scope exemption (HIPAA, FDA, ECOA/FCRA, FERPA, or insurance sector carve-outs). These are scope exclusions from ADMT coverage — not documentation-earned defenses.
Multi-Jurisdiction Mapping
Simultaneously maps your controls across Colorado SB 26-189 and California CPPA ADMT frameworks, identifying conflicts and gaps.
Enterprise White-Label Portal
Law firms and compliance consultancies can manage client portfolios under their own branding. Isolated data partitions per client.
API Classification Access
POST your questionnaire payload to our REST API and receive a classification result synchronously. Integrate into your CI/CD or GRC platform.
Identify your required pre-use notice obligations and document them in a signed technical dossier — including 30-day adverse outcome disclosure requirements and meaningful human review duties
Under Colorado's AI Act, deployers face strict procedural obligations. Rulisto maps exactly what you owe and documents your obligations in a cryptographically-signed procedural record for outside counsel review.
Plans for every stage of compliance
A compliance lawyer bills $300–$500/hr. One ADMT assessment with Rulisto takes 5 minutes. Start free — upgrade when you need sealed PDF dossiers, multi-system portfolios, or the agency portal.
Starter
Free forever — no credit card required.
- 1 ADMT system
- Deterministic classification result
- On-screen risk summary
- Base Jurisdictions: US-CO, US-CA
- Free-check questionnaire (/check)
- Tamper-Evident PDF dossier
- Multi-system portfolio
- Expansion Jurisdictions (EU, etc)
Professional
- ADMT Systems5+$50/mo
- UI Assessments50+$0.50/ea
- PDF Dossiers20+$10/ea
- Team Seats5+$15/mo
- Jurisdictions2+$49/ea
- AI Remediation (requires human review)10+$5/ea
- API Calls500+$0.01/ea
Overages billed automatically via Dodo Payments.
Billed monthly. Replaces ~$1,200–$4,000 in legal fees.
- Up to 5 ADMT systems
- Verifiable PDF dossiers (SHA-256 Payload Hash)
- Vendor AI questionnaire portal
- Multi-system compliance portfolio
- Base Jurisdictions: US-CO, US-CA
- Automated Remediation Plans*
- Priority email support
Scale
- ADMT Systems15+$45/mo
- UI Assessments200+$0.30/ea
- PDF Dossiers60+$8/ea
- Team Seats20+$12/mo
- Jurisdictions4+$39/ea
- AI Remediation (requires human review)40+$4/ea
- API Calls5,000+$0.008/ea
Overages billed automatically via Dodo Payments.
Billed monthly. For mid-market teams.
- Up to 20 seats
- Up to 15 ADMT systems
- Everything in Professional
- 4 Jurisdiction Packs included
- Priority Slack support
Enterprise
- ADMT Systems50+$35/mo
- UI Assessments500+$0.15/ea
- PDF Dossiers200+$5/ea
- Team Seats50+$8/mo
- Jurisdictions10+$25/ea
- AI Remediation (requires human review)200+$2.50/ea
- API Calls50,000+$0.005/ea
- Client Partitions10+$50/mo
Overages billed automatically via Dodo Payments.
For scaling enterprises deploying multiple AI systems.
- Custom ADMT system volume
- Everything in Scale
- All global jurisdiction packs included
- REST API access (classify endpoint)
- SSO / SAML (contact us to configure)
- Dedicated onboarding & InfoSec review
One-Time PDF Dossier
Top SellerNeed a one-off compliance proof for an audit or funding round? Generate a statutory-aligned PDF with an independently verifiable SHA-256 hash dossier without committing to a monthly subscription. Ideal for urgent CCPA or Colorado documentation requests.
* Enterprise API usage defaults to a 100 assessments/month limit. Overage is billed incrementally per assessment. Contact sales for high-throughput API pricing.
Common questions from AI legal & compliance teams
What constitutes a "Covered ADMT" under Colorado SB 26-189?
SB 26-189 defines "covered ADMT" as any automated system that processes personal data and makes, or materially influences, consequential decisions concerning education, employment, financial/lending services, essential government services, healthcare, housing, or insurance.
How does California's final CPPA ADMT rule interact with Colorado law?
Colorado SB 26-189 focuses on transparency, disclosure, and consumer rights. It imposes four operative duties on covered deployers: (1) pre-use notice to individuals, (2) 30-day post-adverse-outcome disclosure, (3) data correction rights, and (4) meaningful human review of consequential decisions. California's final regulations (effective Jan 1, 2026, ADMT compliance Jan 1, 2027) emphasize pre-use notifications, explanation rights, and mandatory consumer opt-outs for ADMT profiling. Rulisto maps your controls against the applicable framework.
Does Rulisto require access to training data or proprietary model weights?
No. Rulisto works via questionnaire-based black-box evaluation. Your model architecture, hyperparameters, and customer datasets remain entirely on your infrastructure. We only process your answers to structured statutory questions.
What is the PDF dossier and is it admissible in regulatory proceedings?
The dossier is a structured PDF containing your questionnaire inputs, classification result with statutory citations, obligation mapping, and a SHA-256 integrity hash. It is designed to support outside counsel review and regulatory submissions — consult your attorney regarding admissibility in specific proceedings.
What is included in the free tier?
The free tier gives you classification for one system, with results shown on-screen. The sealed PDF dossier, multi-system portfolio management, vendor questionnaires, and the agency portal require a paid plan.