What Happened

Comp AI announced a $34 million Series A on September 17, 2026, led by Roo Capital and Grand Ventures, bringing the startup's total funding to $37.5 million. Founded in January 2025 by Lewis Carhart (CEO), Claudio Fuentes (COO), and Mariano Fuentes (CTO), the company builds an agentic platform for security and compliance work — drafting policies, collecting audit evidence, continuously monitoring compliance controls, and running AI-powered penetration testing.

This story was already covered by MasterNodeAI on September 17. No new developments have emerged since that initial coverage. The details below recap the original reporting.

The founders' prior venture, LeapAI, was a workflow platform that grew to over one million users before the team shut it down, citing a lack of sticky use cases. That experience directly informed Comp AI: the founders found SOC 2 compliance so tedious during LeapAI's enterprise push that they pivoted to build tooling for it. Carhart told TechCrunch that "for a lot of software companies, security and compliance are directly tied to revenue," noting customers frequently request SOC 2 reports before closing deals.

Why It Matters

This is the second compliance-automation funding round in a week. On September 11, HelmGuard raised $7.3M in seed funding for a similar agentic compliance platform. Two raises in seven days — one seed, one Series A — signals that investors see agentic compliance as a fundable category, not just a feature within established GRC tools like Vanta or Drata.

The operational gap Comp AI targets is real: a company completes a SOC 2 audit, then deploys a new AI agent two weeks later that can access customer data or change internal permissions. The audit doesn't become invalid — it simply wasn't designed to detect what changed afterward. As Carhart put it, the audit "wasn't designed to tell you in real time what changed."

But the value proposition has clear limits. Comp AI's agents draft policies and collect evidence, but humans still review and approve. The platform doesn't replace independent audit review. Operators evaluating these tools should expect efficiency gains in the compliance process, not elimination of the audit itself.

Who Is Affected

Startups pursuing enterprise sales who need SOC 2 or ISO 27001 certification are the primary market — Comp AI's founders built the product specifically because they lived this pain. Security and compliance teams at companies deploying AI agents with system access face a growing gap between point-in-time audits and real-time agentic risk. Investors and founders in regtech should note that agentic compliance is attracting capital at both seed and Series A stages, with multiple players entering simultaneously.

Strategic Implications

AI startup founder: If you're pre-SOC 2 and selling to enterprises, agentic compliance platforms like Comp AI and HelmGuard may compress the time and cost of initial certification. But human review remains a bottleneck — budget for it.

Developer/operator building with AI APIs: Continuous compliance monitoring is becoming operationally necessary, not optional, if your agents access customer data or modify permissions. You need tooling that tracks what agents accessed and whether they stayed within assigned boundaries.

Non-technical business owner evaluating AI tools: Don't assume SOC 2 certification covers agentic AI risks. A completed audit doesn't account for new agents deployed after the audit window. Ask vendors about continuous monitoring, not just point-in-time compliance snapshots.

What to Watch Next

Monitor whether Vanta or Drata respond with agentic features of their own, and whether Comp AI discloses customer count or revenue milestones in the coming months. Also watch for additional compliance-automation raises — two in a week suggests more are coming.

Frequently Asked Questions

Q: What does Comp AI's platform actually do?

A: Comp AI uses AI agents to draft security policies, collect evidence for audits like SOC 2, continuously monitor whether a company meets compliance controls, and run AI-powered penetration testing on codebases and infrastructure. Humans still review and approve agent-generated work.

Q: How is agentic compliance different from tools like Vanta or Drata?

A: Comp AI positions itself as built for the agentic era — where companies deploy AI agents that can access data, change permissions, or introduce vulnerabilities after a compliance audit is complete. The platform aims to monitor these risks continuously, rather than treating compliance as a point-in-time snapshot. However, Comp AI is early-stage and has not yet proven this at scale against incumbents.