The EU AI Act for SaaS products

Most SaaS teams added AI features in the last three years: a copilot, a summariser, a support bot, a scoring model. The EU AI Act question for SaaS is rarely "does it apply" - if your users are in the EU, it almost certainly does, wherever you're incorporated. The real questions are which features carry duties, whose duties they are, and which are enforceable now.

Feature-level, not company-level

The Act regulates AI systems, not companies. A typical SaaS product is several systems with different tiers:

Inventory first: list your AI features, who each affects, and whether the subject of any evaluation is a natural person. Most SaaS products land in Limited/Minimal across the board - a defensible written position that takes a day to produce, and that enterprise procurement will eventually ask for.

"We just call OpenAI/Anthropic" - what that actually means

Calling a model through an API keeps Article 53 (GPAI duties) with the model provider, not you - including the training-data summary and copyright policy everyone worries about. A light in-domain fine-tune ordinarily keeps you downstream too. What API use does not do is remove your own system-level duties: your chatbot still discloses (Art 50(1)), your product still gets classified by what it does to its users, and a substantial retrain or new task domain can make you a GPAI provider after all. The threshold, in detail.

Role-wise, shipping AI features under your own brand makes you the provider of those features even though the model underneath is someone else's. Your customers are typically deployers - which means your documentation is their compliance input, and "AI Act position available on request" is quietly becoming a procurement filter. Provider vs deployer.

Live now vs December 2027

Since 2 August 2026: Article 50 (your user-facing bot says it's a bot, at first contact, not in the privacy policy), Article 4 (a recorded AI-literacy session for staff touching the systems), Article 5 (no emotion inference on employees or users in prohibited contexts). Deferred to 2 December 2027: the heavy Chapter III set, only if something you ship is genuinely high-risk - and check the Article 6(3) exemption before assuming it is.

US and UK SaaS selling into the EU: Article 2 reaches providers wherever established, when output is used in the EU. Delaware doesn't help. What the Act asks of a typical B2B SaaS is smaller than feared - but "we looked, here's our position, dated" is the deliverable, and its absence is what stalls enterprise deals.

The 90-minute version

• Inventory your AI features and who each affects
• Run the free check per feature that touches people - two minutes each, and keep the results in one AI inventory
• Add the one-line AI disclosure to your bot's greeting (this week - it's live law)
• Run and minute one AI-literacy session
• Write the one-page position, date it, and hand it to the next procurement questionnaire that asks

When a prospect's legal team wants more than a page, the full gap report is the defensible version: role, tier, obligations, deadlines and a fix list, referenced to your actual product - €59, once.

Frequently asked questions

Does the EU AI Act apply to my SaaS product?

If your users are in the EU it almost certainly does, wherever you are incorporated. Article 2 reaches providers wherever established when the output is used in the EU. The real questions are which features carry duties, whose duties they are, and which are enforceable now.

Is my whole SaaS product classified at once?

No. The Act regulates AI systems, not companies, so classification is feature-level. A typical SaaS product is several systems at different tiers - a support chatbot at limited risk, internal copilots at minimal, and anything scoring individual people's access to work, credit or essential services at high risk.

Does calling the OpenAI or Anthropic API remove my obligations?

It keeps Article 53 GPAI duties with the model provider, including the training-data summary and copyright policy, and a light in-domain fine-tune ordinarily keeps you downstream too. It does not remove your own system-level duties: your chatbot still discloses under Article 50, and your product is still classified by what it does to its users.

Am I a provider if the model is someone else's?

Yes, for your own features. Shipping AI features under your own brand makes you the provider of those features even though the underlying model belongs to someone else. Your customers are typically deployers, which makes your documentation their compliance input.

Does the EU AI Act apply to companies outside the EU?

Often, yes. Article 2 reaches providers irrespective of where they are established, and reaches providers and deployers in third countries where the output produced by the AI system is used in the Union. A US or UK company with EU users is normally in scope - though being in scope is not the same as being high-risk.