EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35 million — that is the maximum fine a B2B SaaS company can face for deploying a prohibited AI system under the EU AI Act, which entered into force on August 1, 2024. With the first hard deadlines hitting in February 2025 and full applicability by August 2026, most software vendors are still alarmingly unprepared. A survey by the law firm Linklaters found that only 17% of European tech companies had begun formal AI Act compliance programs as of Q1 2024. For B2B SaaS providers — the backbone of enterprise AI adoption — the obligations are both nuanced and urgent.

This article breaks down the Act's risk-based architecture, maps its requirements to the SaaS product lifecycle, and offers concrete compliance actions your legal, product, and engineering teams can take right now.

Understanding the Risk-Based Framework

!European Parliament building representing EU AI Act legislation Photo: Frederic Köberl / Unsplash

The EU AI Act does not regulate 'AI' as a monolith. It classifies systems into four tiers, each with radically different compliance burdens:

• Unacceptable risk (banned): Social scoring by public authorities, real-time biometric surveillance in public spaces, subliminal manipulation. No SaaS vendor should be anywhere near this tier.
• High risk: AI systems used in employment, credit scoring, educational assessment, critical infrastructure management, HR recruitment tools, and law enforcement support. This tier carries the heaviest compliance obligations.
• Limited risk: Chatbots, deepfake generators, emotion recognition tools. These require transparency disclosures but not full conformity assessments.
• Minimal risk: Spam filters, AI-powered search suggestions, most recommendation engines. Voluntary codes of conduct apply.

For B2B SaaS, the critical battleground is high-risk classification. If your product is used by a customer to make or assist consequential decisions about people — shortlisting job applicants, scoring loan eligibility, evaluating student performance, or triaging medical cases — you are almost certainly operating in high-risk territory, regardless of whether you built the underlying model or simply integrated a third-party API.

The Act also introduces a separate regime for General-Purpose AI (GPAI) models (Article 51-55), targeting foundation model providers like OpenAI, Anthropic, and Mistral — but B2B SaaS companies that fine-tune or deploy these models at scale may also inherit obligations under this chapter.

High-Risk Obligations: The Compliance Checklist

If your SaaS product qualifies as high-risk under Annex III of the Act, you face a demanding set of obligations. Here is what they translate to in engineering and product terms:

1. Risk Management System (Article 9) You must maintain a **continuous, documented risk management system** throughout the AI system's lifecycle. This is not a one-time audit; it requires iterative testing, incident logging, and regular reassessment. Think of it as an ISO 31000 process, but AI-specific.

2. Data Governance (Article 10) Training, validation, and test datasets must be subject to **documented governance practices**. This includes relevance checks, bias audits, and data lineage documentation. If you are using customer data to train or fine-tune your models, your DPA (Data Processing Agreement) and this requirement intersect significantly.

3. Technical Documentation (Article 11 + Annex IV) You must produce and maintain **technical documentation** covering the system's purpose, architecture, training methodology, performance metrics, and known limitations. This document must be available to national market surveillance authorities on request. Expect 40–60 pages of structured documentation for a mature product.

4. Record-Keeping and Logging (Article 12) High-risk systems must be capable of **automatic logging** of events throughout their operational lifetime — 'to the extent technically feasible.' Logs must allow post-hoc traceability of decisions. For SaaS architectures, this typically means instrumenting your inference pipeline with immutable audit logs stored for a minimum period (the Act references the system's lifetime plus applicable sector-specific rules).

5. Transparency to Deployers (Article 13) You must provide your B2B customers (called 'deployers' in the Act) with **clear instructions for use**, including the system's capabilities and limitations, performance metrics across different demographic groups, and circumstances that may affect reliability. Your product documentation and onboarding flows must be substantially more rigorous than today's standard Terms of Service.

6. Human Oversight (Article 14) High-risk AI systems must be designed so that **natural persons can effectively oversee** their operation, intervene, override, or shut down the system. For B2B SaaS, this means building override mechanisms, confidence thresholds, and escalation workflows into your UX — not as optional features, but as non-negotiable product requirements.

7. Accuracy, Robustness, and Cybersecurity (Article 15) Systems must achieve appropriate levels of accuracy for their intended purpose, must be resilient against adversarial attacks, and must not degrade from errors or inconsistencies. You need documented benchmark performance and a process for handling model drift.

8. Conformity Assessment Before placing a high-risk system on the EU market, providers must complete a **conformity assessment**. For most SaaS AI systems listed in Annex III (excluding biometric identification), this can be a **self-assessment** — but it must be documented, signed off, and result in an EU Declaration of Conformity. Systems must also be registered in the EU's forthcoming **AI database** (operationalized by the European AI Office).

The Provider vs. Deployer Distinction: Why It Matters for SaaS

One of the most consequential — and most misunderstood — aspects of the EU AI Act for B2B SaaS is the provider/deployer split.

• Provider: The entity that develops and places an AI system on the market (typically the SaaS vendor).
• Deployer: The entity that uses the AI system in the context of its professional activities (typically the SaaS customer, i.e., the enterprise buyer).

This distinction creates a shared compliance architecture. Providers bear the heaviest burden (conformity assessments, technical documentation, EU registration), while deployers are responsible for using the system within its intended purpose, implementing human oversight, and monitoring performance in context.

However, the Act contains a critical clause: if a deployer substantially modifies a high-risk AI system, they become the new provider and inherit all provider obligations. For B2B SaaS customers who fine-tune your model on their own data, or who configure your system in ways not covered by your documentation, this could inadvertently shift regulatory liability onto your customer — a commercial risk that your sales and legal teams must proactively address in contract negotiations.

Practical implication: your MSA (Master Subscription Agreement) templates need to be updated to clearly delineate who is the provider, what constitutes 'substantial modification,' and which compliance obligations flow to the deployer.

Timeline and Enforcement Deadlines

The Act's rollout is phased, and understanding the timeline is essential for prioritization:

• February 2, 2025: Prohibited practices (unacceptable risk) become enforceable. Providers of banned systems face immediate penalty exposure.
• August 2, 2025: GPAI model rules apply. Foundation model providers and those building on top of them must comply with transparency and technical documentation requirements.
• August 2, 2026: Full application of high-risk obligations for new systems. Conformity assessments required for all new high-risk SaaS AI deployments.
• August 2, 2027: Extended deadline for high-risk AI systems that are components of existing regulated products (medical devices, machinery, etc.) already on the market.

Enforcement will be conducted by national competent authorities designated by each EU member state, coordinated by the newly established European AI Office within the European Commission. The Office will have direct oversight authority over GPAI model providers.

Strategic Implications for B2B SaaS Vendors

Compliance as a Competitive Moat Forward-thinking SaaS vendors are already repositioning compliance as a **trust signal** in enterprise sales cycles. In regulated industries — financial services, healthcare, HR tech, legal tech — procurement teams and CISOs are already asking for AI Act readiness documentation. Companies like Workday, SAP SuccessFactors, and Salesforce have publicly committed to EU AI Act compliance roadmaps, signaling to enterprise buyers that their AI features are safe to deploy. For mid-market SaaS players, being **first to certification** in a vertical niche could be a meaningful differentiator.

The Cost of Compliance Do not underestimate the investment required. A McKinsey analysis of comparable regulatory frameworks (GDPR, SOC 2) suggests that **mid-market SaaS companies spend €150,000–€500,000** in initial compliance setup costs, plus ongoing operational overhead. However, the cost of non-compliance — fines up to 3% of global turnover for documentation failures, 6% for high-risk violations, and 7% for prohibited systems — dwarfs this investment for any company with meaningful EU revenue.

Vendor Due Diligence Cascades Downstream If you consume AI APIs (OpenAI, Google Vertex, Cohere, etc.) to build your product, your compliance posture depends partly on **your upstream vendor's obligations**. GPAI providers must provide technical documentation and usage policies to downstream integrators. You should be requesting and reviewing this documentation now, and ensuring your contracts include representations about their own Act compliance — because your deployer customers will be asking you for the same.

Product Roadmap Implications Several high-value AI features common in B2B SaaS may require significant redesign: - **AI-driven hiring tools** (resume scoring, interview analysis) are explicitly listed in Annex III as high-risk. - **Performance management AI** that influences employment decisions falls in the same category. - **Credit risk models** offered as SaaS to lenders are high-risk under the creditworthiness assessment category. - **AI-powered proctoring tools** used in education are high-risk.

Product managers must audit every AI-powered feature against Annex III, not just the flagship product, because individual features within a broader platform can trigger high-risk classification.

What to Do Right Now: A 90-Day Action Plan

1. Conduct an AI systems inventory (Days 1–15): Catalog every AI feature in your product, whether built in-house or via third-party APIs. Tag each by use case and data input type.
2. Risk classification audit (Days 15–30): Map each system against the four-tier framework and Annex III. Engage legal counsel familiar with the Act for borderline cases.
3. Gap analysis (Days 30–45): For any high-risk systems identified, benchmark current documentation, logging, and governance practices against Articles 9–15.
4. Contract review (Days 45–60): Update your MSA templates to reflect the provider/deployer distinction, define 'intended purpose,' and address the substantial modification clause.
5. Technical remediation roadmap (Days 60–90): Prioritize engineering sprints for logging infrastructure, human override UX components, and bias testing pipelines.
6. Documentation sprint (Days 60–90): Begin drafting Annex IV technical documentation for high-risk products, and prepare your EU Declaration of Conformity template.

The EU AI Act is not GDPR 2.0 — it is more operationally complex, more technically demanding, and more consequential for product architecture. But it also represents an opportunity: companies that operationalize compliance early will be better positioned to win regulated enterprise deals, expand into EU public sector contracts, and build the kind of institutional trust that is increasingly a prerequisite for AI-powered B2B software.

— Équipe éditoriale InekIA