We’re delighted to share that we’ve invested in Complir’s $11m Seed round, led by General Catalyst, marking our second investment in Denmark this year.

Here’s why we were excited to back Gustav, Tine and Marc on their mission to reduce the cost, time and complexity of product compliance for retailers and brands globally.

Regulation is good in theory, but a nightmare in practice

Europe is creating one of the most ambitious product safety and sustainability regulatory frameworks.

Over the past decade, Europe has led the world in setting the standards for what can safely and responsibly be sold to consumers. The General Product Safety Regulation (GPSR), the incoming Digital Product Passport, REACH, toy safety and cosmetics rules, packaging law, and so on. Together they form a comprehensive consumer- and environmental-protection regime. We think that’s fundamentally positive - safe products for consumers and the planet has to be a good thing in the long-run for all of us.

However, the rulebook has grown so complex that staying on top of it is a growing operational headache for any company that makes or sells physical products. The process is costly and time-consuming, the pace of new product launches slows and the fines for non-compliance are steep: in 2026, the European Commission issued a landmark €200m fine against a major marketplace over unsafe products.

Rules are only effective if they can actually be followed and the system is coming under increasing pressure. That’s where Complir comes in.

Complir is building the technology infrastructure that makes the rulebook workable at scale.

Complir is an AI platform helping global retailers and brands automate product compliance including risk assessments, labeling, testing, and documentation. Complir monitors regulatory and compliance requirements and changes down to the individual SKU, automatically reassessing affected products and tracing every flag back to its source.

Working with Complir, Compliance teams can replace spreadsheets and consultants with one connected system of record: cutting repetitive manual work by up to 90%, speeding up time to market, and saving millions in operational and compliance costs.

For years there was simply no good way to solve this problem at scale.

The body of regulation is too large, too fragmented and too fast-changing for any individual or software tool to keep up with. AI changes that.

The good thing about regulations is that they are written down in excruciating detail: codified in a way that LLMs love. AI can read, structure and apply this sprawling, constantly-shifting web of rules in near real-time, in a way that humans simply cannot. This technology inflection point creates a non-linear jump in value and capability, in the context of a world becoming increasingly complex. The timing is perfect.

Market opportunity is necessary, but not sufficient. Who captures that opportunity, and why?

The answer, in our view, is a European company generally - and Complir specifically.

For all its charms, Europe is synonymous with complexity and fragmentation: 25+ countries, 25+ languages, and a sophisticated (and complicated) web of rules. Domestic markets are smaller than the US, so retailers and brands have to look internationally more often. That only compounds the problem: adding new languages, rules and cultural contexts to deal with. We believe a European company in close proximity to the customers for whom this is a massive and present problem is best placed to tackle it.

As for Complir specifically, there were a few things that stood out for us.

First, and most importantly, the team. Gustav, Tine and Marc bring complementary skills with common obsession around solving this problem. Their backgrounds across AI-native tech (including Legora, an AI-native decacorn), product and technology combined with passion and intensity make them well-placed to build a category defining company.

Second, they proved it. Working closely with development partner Flying Tiger, they built a market-leading product capable of solving extraordinary complexity: thousands of products across tens of markets globally. Since that first contract, the team has continued to land major enterprise customers across multiple categories, proving the scale of the problem and the applicability of Complir’s solution.

Finally, the ambition. We bought into the team’s vision that what begins as AI-enabled compliance software has the potential to become critical technology infrastructure for retailers and brands across the world. The applicability of AI and other new technologies to unlock opportunity across the compliance space in fundamentally different ways is massive, and we believe Complir will be front and centre of capturing the opportunity.

We're excited to work closely with Gustav and the Complir team to bring True’s sector-specialist expertise and network to support the long-term mission, including opening doors to our network of corporate partners and retailers, many of whom are wrestling with GPSR, the Digital Product Passport and whatever comes next.

If you’re facing this problem yourself and/or are keen to hear more about Complir and why we backed them, please get in touch at vc@true.global.

Product compliance has become an increasingly complex and expensive challenge for retailers and brands across Europe's fragmented regulatory landscape. Yet the tools to keep pace with the sheer volume and complexity of the rules simply haven't existed. That is exactly the gap that Complir are closing and why we at True are excited to back the company. 

Why We Invested in Complir 

A question has quietly moved from science fiction to board agenda in the space of one summer. What happens to your security model when the attacker is not a person, does not sleep, does not get bored, and can try ten thousand things before your team has finished its morning stand-up? 

Until July, that question was hypothetical. It isn't any more. 

In July, OpenAI was benchmarking its frontier models' hacking skills inside ExploitGym, a sealed evaluation environment that scores AI systems on their ability to find and exploit software vulnerabilities. One model worked out that solving the challenges honestly was harder than stealing the answers. It reasoned that Hugging Face, the platform where much of the AI world hosts its models and datasets, probably held the benchmark's reference solutions. The model escaped its sandbox, reached the open internet, and went for a joyride. 

By chaining stolen credentials with software flaws nobody knew existed, the agents gained remote access to Hugging Face's live production systems, sharing the vulnerabilities they found with one another as they went, so that a door opened by one became a door open to all. They operated for four days and logged roughly 17,600 actions before they were detected and contained. No human directed any of it. 

Retailers do not need the cost of failure explained in the abstract, because 2025 already provided the demonstration. 

One campaign by bad actors saw ransomware infect several UK retail giants, not through sophisticated code, but through vulnerabilities in the human elements of their business. The attacks halted contactless payments, suspended online orders for weeks and forced core systems offline. The total impact of the campaign across retailers and suppliers was estimated at £270m to £440m. However, the true cost of a breach is not just the incident response bill. It is market share, handed to your rivals in the weeks your systems were dark, plus the cost to win those customers back. 

And here is the uncomfortable connection between the two stories. The 2025 damage was done by human attackers using a telephone. The July incident shows what is coming next. Every AI tool a retailer deploys widens the surface those machine-speed attackers can probe. 

As retailers wire AI into customer service, search, supply chains and stores, three categories of attack deserve particular attention. 

 The Hugging Face incident is the template. Software that discovers exploits, maps vulnerabilities between systems and adapts to defences faster than any human team can respond. This time it was an accident. Criminal groups have now watched a public demonstration of what autonomous agents can do against hardened, security-literate technology firms. They will not need asking twice. 

 If your business runs a chatbot, product advisor or AI shopping assistant, it can be talked to. Which means it can be talked around. In its direct form, a user simply instructs the model to ignore its rules. A Chevrolet dealership's chatbot was famously manipulated into "agreeing" to sell a $76,000 SUV for one dollar and declaring the offer legally binding. The indirect form is more dangerous, hiding malicious instructions inside content the AI reads, such as a product review, an email or a webpage, so the system is compromised without the attacker ever touching it. For AI agents that can browse the web, issue refunds or amend orders, everyday content becomes a potential attack vector. It now tops the Open Web Application Security Project’s (OWASP) list of AI application risks for good reason. 

 The technique that felled UK retail in 2025 is itself being upgraded. The groups behind those attacks specialise in impersonating employees to IT helpdesks, and security researchers now track their adoption of AI voice cloning to make the impersonation near-perfect. The phone call that cost hundreds of millions is becoming cheaper, more scalable and harder to detect by ear. 

Where technology can help: four defensive levers

The good news is that a genuine defensive stack has emerged, much of it purpose-built in the last two years. Four levers matter most for retail. 

1. Give every AI agent an identity you control

 Bounded, expiring access for every AI agent, so a compromised or misbehaving one cannot become a master key. 

The organising principle is to treat every AI agent as an identity in your business, like a new employee with keys. Most enterprises already hold many times more machine identities than human ones, and most have never counted them. A new class of identity platform now does exactly this. These tools discover the AI agents and service accounts already operating across an estate, map what each one can access, flag the ones with excessive privileges, and replace long-lived static credentials with short-lived, tightly scoped ones that expire before stolen keys can be used. 

2. Put guardrails around your AI applications

 Catch prompt injection, data leakage and rogue outputs in real time, before they reach customers or core systems. 

A new category of runtime protection, often described as an AI firewall, sits between your AI applications and the world. It inspects what goes into a model and what comes out. Inputs are screened for injection attempts. Outputs are checked before they leave, blocking responses that would leak sensitive data, breach policy or commit the business to something it never intended. The same layer constrains what actions an agent can take with its tools, so a manipulated chatbot cannot suddenly start issuing refunds. This is the control that stands between an amusing screenshot and a legally awkward one. 

3. Take identity decisions away from human judgement

 Make "talking your way in" fail, even when the voice on the phone sounds exactly right. 

The answer emerging is to stop asking pressured support staff to make high-stakes identity calls by ear. Helpdesk verification tools now require a caller requesting a password or multi-factor authentication reset to prove they are a real, present human matching a genuine identity document, with deepfake detection built in, before any credential changes hands. 

 Assume something will eventually go wrong and make sure it cannot take the whole business with it. 

This lever has little to do with AI, which is rather the point. Resilience is what separates a bad week from a lost quarter. Separate your systems so that one breach cannot take tills, website and warehouse down together. Segmentation is what turns weeks of outage into hours. Rehearse the outage, not just the breach. Most incident plans stop at containment, but the expensive part is everything after. Who sells, ships and serves if screens go dark tomorrow? Retailers that have rehearsed trading through an outage recover in days. Those that haven't discover their dependencies live. 

Then sort the money out in advance. Cyber insurance needs stress-testing against a realistic scenario, because policies vary enormously in how they treat business interruption, and the moment to discover an exclusion is not day 12 of an outage. Some boards are going further and formally allocating recovery capital, a pre-agreed war chest that can fund emergency response, temporary infrastructure and customer win-back without a crisis budget negotiation. Recovery costs mount fastest precisely when revenue has stopped. 

Looking ahead: balance is the advantage 

None of this is a case for slowing down: The opportunity in AI for retail is real, and the competitive penalty for sitting out is growing fast. 

With great opportunity comes great risk. An AI breakout, a £350m lesson, and what retailers must do to defend themselves. 

Accelerating innovation, defensibly.

After more than decade of backing companies across consumer (b2c) and retail (b2b), here's our work-in-progress answer to the question we get asked most.

We get asked a version of the same question a lot: 

"What do you actually look for in a founder?"

It’s difficult to have a rigid set of rules or a checklist – just like hiring, there is subjectivity in understanding people and human behaviour.

However, we believe it’s important to have a set of guiding principles, as it helps us benchmark the ~3,000 Founders a year that we meet.

We’ve pulled together a work-in-progress version of those opinions. As always, we'd love to know if you think we’ve missed something critical.

The founders who build category-defining companies aren't primarily motivated by money. That might sound counterintuitive -venture capital exists to generate financial returns, after all - but the evidence is consistent: the best outcomes come from founders who are driven by something bigger than the exit.

 they are making it their life’s work to build this company.

Someone with a long-term orientation - one who thinks in years and decades, not funding rounds.

It's the kind of conviction in the mission that will attract great early employees, wins early customers, and sustains a team through the inevitable hard chapters, when a mercenary might have already moved on.

Paul Graham put it well: missionaries build products they'd want to exist in the world regardless. Mercenaries build products they think will sell.

Closely related - but distinct - from the missionary trait is how deeply a founder understands the specific problem they're solving. The ones who build enduring companies aren't solving problems they've read about in a market report. They're solving problems they've 

, or that they've watched others struggle with up close, for long enough to understand the nuance that outsiders miss.

We're looking for founders who have developed a genuinely differentiated, first-principles view of their problem space. Do they light up talking about the problem? Do they know things about their customer that no survey could reveal? Can they explain not just 

Company-building is hard. The journey from conception to meaningful scale is defined by rejection, setbacks, and an almost relentless requirement to hold things together when everything seems to be going wrong simultaneously. The odds are stacked against you from day one.

Founders who navigate that journey well share a specific type of resilience: not the capacity to absorb pain passively, but an active, almost stubborn refusal to accept "no" as a final answer. The best ones are comfortable being uncomfortable - they've chosen to spend their professional lives in a state of managed uncertainty, and they've found a way to thrive in it.

We look for founders who have run through walls and experienced real adversity (not necessarily in business).

In early-stage company building, the rate of learning matters as much as anything else. The founders who pull ahead aren't always the ones who started with the best idea — they're the ones who learned the fastest, iterated quickest, and held themselves and their teams to standards that most people would find uncomfortable.

We look for founders with an ingrained bias for action: people who default to doing rather than deliberating, who ship and learn rather than planning to perfection. It means having the confidence to move before everything is certain, and the discipline to extract learning from every move you make.

The intensity piece is equally important. The best founders we've backed hold themselves and their teams to genuinely high expectations - not in a way that burns people out, but in a way that ensures everyone is moving the company forward with a winning mindset. They create an environment where everyone has clarity of expectations and how high the bar is, because 

The best founders we've backed share something that's harder to name but unmistakable in person: a deep, almost visceral desire to win - and an equally visceral reaction to losing.

This often comes with what people call a "chip on their shoulder": a point to prove, a slight to avenge, an underestimation to correct. Some of the most successful founders in our portfolio were people who had been told their idea wouldn't work, their market was too small, or they weren't the right person to go after it. That external scepticism, internalised as fuel rather than doubt, can be extraordinarily powerful.

We're looking for a genuine obsession with being the best at what they do: an intolerance for mediocre output, a relentless focus on beating the alternatives in their customer's life (whether that's a competitor, a spreadsheet, or doing nothing), and the hunger to keep raising the bar even when things are going well.

Selling is a non-negotiable skill that founders need at every stage of company-building. You're selling your vision to investors, employees, customers, and potentially a eventual buyer. The best founders are doing all of this simultaneously, and doing it well, from the very beginning.

Storytelling is a big part of selling that’s often underrated. The best founders we've backed can take a complex problem space and make it immediately, viscerally understandable to someone who has never thought about it before. They have a gift for the right analogy, the right anecdote, the right moment of specificity that makes an abstract opportunity feel real and urgent.

The listening piece is equally important, and often missing. The founders who sell best are they the ones who pay enough attention to know exactly which version of the story to tell, and adjust in real time based on what they're hearing.

Why Consumer Is Its Own Category - and What We Look for Specifically

Everything above applies to every founder we back. But here's what we specifically look for in consumer founders:

Intuition for where consumer behaviour is going, not just where it is.

 We want to back founders who see inflection points before they're consensus. The best consumer founders are typically six months to two years ahead of a trend, in a way they can articulate clearly.

Product genius paired with genuine human empathy.

 There's a meaningful difference between a good product and one people 

. Love shows up in the data: word-of-mouth referrals, retention curves, NPS scores. The best consumer founders pair product talent with deep human insight — because product genius without empathy produces technically impressive things that nobody uses.

 Consumer is a social category. People buy things, use apps, and subscribe to services in the context of their identities and communities. The best consumer founders build community into the product architecture from the start, as a structural element that drives down CAC, increases LTV, and creates the emotional moat that contributes to defensibility. The question we ask: 

"Tell us about your most passionate users. What do they have in common? How do they talk about you to their friends?"

 In consumer, retention earned through genuine product love is fundamentally different from retention earned through friction or lock-in. If a founder's retention strategy relies on making it annoying to cancel, that's a warning sign. If it relies on the product being irreplaceable in someone's daily life, that's what we want to back.

If you're building something in consumer or retail tech - and you think you’d be a good fit with us - we'd love to hear from you.

We invest at the earliest stages - pre-seed/seed, across consumer software, consumer services, retail tech, and B2B tools for the consumer & retail ecosystem. We bring sector expertise, a deep network across the global consumer and retail landscape, and a genuine interest in building something alongside you for the long term.

. And if you disagree with anything above, tell us where we're wrong!

What makes a great founder? In this blog we explore answers to the question we get asked the most. 

Hello, we’re True. We’re reimagining business through advisory and investment.

A unique model for investing, innovating & growing

Meet the changemakers

A portfolio that excites us. Every day.

True stories

News

Why We Invested in Complir

Insight

Accelerating innovation, defensibly.

Insight

What We Look for in Founders