Kertos bets the EU AI Act makes AI-native compliance a must-buy; €14M Series A

Kertos is a Munich-based AI-native compliance platform that automates asset discovery, risk assessment, documentation and continuous monitoring across European regulations such as GDPR, NIS2, DORA and the AI Act.

That Europe's multiplying rules — GDPR, NIS2, DORA, the AI Act — would push companies to buy AI-native compliance automation instead of auditors.

€14M Series A (Sep 2025); €20M+ total funding

Kertos was founded in Munich in November 2021 by Kilian Schmidt, Johannes Hussak and Alexander Prams. Schmidt, who holds a doctorate in law and spent nearly a decade on operational data protection at scaleups such as Home24, Tier Mobility and Gorillas, started from the manual grind of GDPR requests and audits. The startup raised a Redstone-led €4M seed in May 2023 with Seed + Speed and Pi Labs, then received nearly €800,000 in German federal funding for its E2ESec project in fall 2023 inside CISPA's incubator.

In September 2025 Kertos closed a €14M Series A led by global fintech investor Portage, with existing investors Redstone, 10x Founders, Seed + Speed and Pi Labs participating — the largest investment in a CISPA incubator startup since 2019 and its first Series A — bringing total funding above €20M. The company said its AI agents cut audit-readiness time from months to days, integrate with more than 100 business applications, and count Personio, Blacklane, NeoTaste and Pliant among hundreds of customers.

Still operating and expanding across Europe; no exit or distress.

The EU AI Act entered into force in August 2024 and its obligations began phasing in from 2025, handing compliance officers a hard deadline with no playbook.

GDPR, NIS2, DORA and the AI Act stack on top of each other, so manual compliance cost keeps growing while audit readiness still takes months.

Kertos was founded by someone who had done the manual grind — Schmidt's GDPR legal experience became the product spec.

European buyers want local, always-updated compliance infrastructure, which US-centric tools like Vanta and Drata were not built to provide.

New regulation creates compliance budget only when it has teeth — Kertos timed its Series A to the AI Act's obligations landing, selling audit-readiness in days to a market handed a deadline.

As of September 2025 Kertos was scaling across Europe with hundreds of customers, planning to expand its AI offerings and a peer-to-peer compliance network that lets businesses share verified controls. No outcome was yet determined: the AI Act obligations it sells against were still phasing in, and the company had not reported revenue or profitability.