diff --git a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go
index e0740a86e..b2621cc3e 100644
--- a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go
+++ b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go
@@ -976,10 +976,6 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
 		return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
 	}
 
-	if err := r.requireCompletedNDA(ctx); err != nil {
-		return nil, err
-	}
-
 	if _, err := visitorService.RequestPortalAccess(
 		ctx, scope,
 		&visitor.PortalAccessRequest{
@@ -1029,10 +1025,6 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
 		return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
 	}
 
-	if err := r.requireCompletedNDA(ctx); err != nil {
-		return nil, err
-	}
-
 	if _, err := visitorService.RequestPortalAccess(
 		ctx, scope,
 		&visitor.PortalAccessRequest{
@@ -1082,10 +1074,6 @@ func (r *mutationResolver) RequestCompliancePortalFileAccess(ctx context.Context
 		return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
 	}
 
-	if err := r.requireCompletedNDA(ctx); err != nil {
-		return nil, err
-	}
-
 	if _, err := visitorService.RequestPortalAccess(
 		ctx, scope,
 		&visitor.PortalAccessRequest{
@@ -1117,10 +1105,6 @@ func (r *mutationResolver) RequestAccesses(ctx context.Context, input types.Requ
 		return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
 	}
 
-	if err := r.requireCompletedNDA(ctx); err != nil {
-		return nil, err
-	}
-
 	if len(input.DocumentIds) == 0 && len(input.ReportIds) == 0 && len(input.CompliancePortalFileIds) == 0 {
 		return nil, gqlutils.Invalidf(ctx, "at least one document, report, or file id is required")
 	}
diff --git a/pkg/server/api/complianceportal/v1/nda.go b/pkg/server/api/complianceportal/v1/nda.go
index c0fb4d553..9d8f455c5 100644
--- a/pkg/server/api/complianceportal/v1/nda.go
+++ b/pkg/server/api/complianceportal/v1/nda.go
@@ -32,7 +32,8 @@ import (
 
 // requireCompletedNDA enforces portal NDA completion for the signed-in identity.
 // No-ops when there is no viewer or the portal membership has no NDA signature.
-// Callers own authentication and PUBLIC-resource skips.
+// Call from protected (non-PUBLIC) export resolvers after authentication.
+// Access-request mutations must not call this — requesting is allowed before signing.
 func (r *Resolver) requireCompletedNDA(ctx context.Context) error {
 	identity := authn.IdentityFromContext(ctx)
 	if identity == nil {