EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35 million or 7% of global annual turnover — that is the maximum fine a B2B SaaS company can face for deploying a prohibited AI system under the EU AI Act. With the regulation officially entering into force on August 1, 2024, and its most critical provisions applying progressively through 2027, the compliance window is narrowing faster than most product teams realize. This article breaks down what the Act actually requires, who it targets, and how SaaS vendors should act right now.

What the EU AI Act Actually Covers — and Who It Targets

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive horizontal AI regulation. Unlike the GDPR, which followed data across all sectors, the AI Act follows risk levels across AI system types. It applies to:

• Providers who develop or place AI systems on the EU market
• Deployers (often called operators) who use AI systems in professional or commercial contexts
• Importers and distributors of AI systems

For B2B SaaS companies, the critical distinction is between provider and deployer. If your platform embeds an AI feature — a scoring engine, a recommendation model, a document classifier — and you sell access to that feature to business clients, you are a provider under the Act, regardless of whether the underlying model was built in-house or sourced from a third party (e.g., OpenAI, Anthropic, Google).

According to Gartner, by 2025, over 70% of new enterprise SaaS applications will contain embedded AI functionality, meaning the vast majority of B2B SaaS vendors will fall under the Act's scope.

The Risk Pyramid: Four Tiers with Radically Different Obligations

!Pyramide de gestion des risques pour les systèmes IA Photo: Imagine Buddy / Unsplash

The Act structures obligations around a four-tier risk classification. Understanding where your AI features land is the first compliance task every product team must complete.

Unacceptable Risk — Prohibited Systems

A small but critical set of AI applications are banned outright from August 2, 2025. These include: - Social scoring systems by public authorities - Real-time remote biometric identification in public spaces (with narrow exceptions) - AI systems that exploit psychological vulnerabilities to manipulate behavior - Predictive policing based solely on profiling

For most B2B SaaS vendors, direct exposure here is limited — but watch for edge cases. An HR SaaS platform using behavioral inference to flag employees for termination risk, or a sales intelligence tool that assigns "manipulation scores" to prospects, could attract scrutiny under these provisions.

High-Risk AI Systems — The Heaviest Burden

This is where most compliance work concentrates. Annex III of the Act lists eight domains where AI systems are classified as high-risk by default:

1. Biometric identification and categorization
2. Critical infrastructure management
3. Education and vocational training (e.g., AI that grades exams, filters applications)
4. Employment and HR (e.g., CV screening, performance evaluation, promotion decisions)
5. Access to essential private and public services (e.g., credit scoring, insurance underwriting)
6. Law enforcement
7. Migration and border control
8. Administration of justice

The implications for B2B SaaS are concrete and immediate. A recruitment SaaS platform using AI to rank candidate profiles is high-risk. A fintech SaaS running credit risk models for lending decisions is high-risk. An LMS platform using AI to assess student competence is high-risk.

High-risk providers must comply with a mandatory framework that includes:

• Risk management system: Continuous, documented identification and mitigation of risks throughout the AI lifecycle
• Data governance: Training data must be relevant, representative, and free of discriminatory patterns
• Technical documentation: Detailed system cards, model architecture descriptions, performance metrics — maintained and kept up to date
• Logging and traceability: Automatic logging of events sufficient to trace system outputs post-deployment
• Transparency to deployers: Clear usage instructions, capabilities, limitations, and data requirements
• Human oversight by design: The system must be designed to allow meaningful human intervention
• Accuracy, robustness, cybersecurity: Minimum performance thresholds documented and tested
• Conformity assessment: Either self-assessment or third-party audit before market placement
• EU Declaration of Conformity + CE Marking
• Registration in the EU AI database (a public registry maintained by the European AI Office)

Compliance with this framework is estimated to cost between €193,000 and €330,000 per high-risk AI system for initial compliance, according to a 2021 European Commission impact assessment — figures likely higher today given the full regulatory text.

Limited Risk — Transparency Obligations

Systems like chatbots, deepfake generators, and emotion recognition tools face lighter but still mandatory transparency rules. Users must be clearly informed they are interacting with an AI. B2B SaaS platforms deploying AI assistants, virtual agents, or generative content tools must implement disclosure mechanisms by August 2, 2026.

Minimal Risk — Largely Unregulated

AI spam filters, AI-powered search ranking within your product, and similar low-stakes features fall here. No mandatory obligations apply, though voluntary codes of conduct are encouraged.

GPAI Models: A New Layer for SaaS Built on Foundation Models

One of the most commercially significant provisions concerns General-Purpose AI (GPAI) models — large language models, multimodal models, and similar foundation models that underpin a growing share of B2B SaaS AI features.

If your SaaS product is built on top of a GPAI provider (OpenAI, Anthropic, Mistral, Google Gemini), your obligations shift depending on whether the underlying model is classified as a systemic-risk GPAI. A GPAI model is presumed to pose systemic risk if trained with more than 10^25 FLOPs of compute — a threshold that currently covers GPT-4, Claude 3, Gemini Ultra, and similar frontier models.

For SaaS providers building on these models: - You must receive and pass on technical documentation from the GPAI provider - Your system must respect the model's terms of use and usage policies - If you fine-tune the model on your own data, you may take on additional provider responsibilities

This creates a contractual compliance chain that many SaaS legal and procurement teams have not yet mapped. Reviewing API agreements with foundation model providers through an AI Act lens is now a legal necessity.

The Compliance Timeline: When Do Obligations Kick In?

The Act introduces a staggered implementation schedule that provides some runway — but less than many assume:

• February 2, 2025: Prohibited AI provisions apply — training and awareness obligations for all deployers
• August 2, 2025: GPAI obligations, governance rules for providers and deployers, and penalties framework go live
• August 2, 2026: High-risk obligations for most Annex III systems; transparency rules for limited-risk systems
• August 2, 2027: High-risk obligations extend to AI systems regulated under existing product safety legislation (medical devices, machinery, etc.)

The implication: If your product roadmap includes a high-risk AI feature launching in 2026, compliance documentation and conformity assessment must begin now, given the 12-18 month lead time for rigorous risk management frameworks.

Strategic Implications for B2B SaaS Product and GTM Teams

### 1. AI Feature Audit — Your Immediate First Step

Every B2B SaaS company should conduct a structured inventory of all AI-powered features across their product suite. For each feature, assess: - What decision does this AI inform or automate? - Does the output affect people's rights, safety, or access to services? - Who is the user of this feature — a business professional or an individual affected by the output?

This audit maps directly to the Act's risk classification criteria and forms the backbone of your technical documentation.

2. The "AI by Design" Shift in Product Development

High-risk compliance cannot be bolted on after launch. Teams need to embed logging, explainability, and human override mechanisms into the architecture from the start. This requires upskilling ML engineers on regulatory requirements and introducing compliance checkpoints into your sprint cycles — what practitioners are calling "Responsible AI by Design."

3. Contractual Renegotiation with Customers and Suppliers

B2B contracts must now address AI Act roles explicitly. When your client deploys your AI feature to screen employees, who bears deployer obligations? Model contracts should define: - Which party is provider vs. deployer for each AI component - How technical documentation is shared and updated - Liability allocation for non-compliance

This is especially urgent for enterprise SaaS deals in HR tech, fintech, legaltech, and edtech — verticals with heavy Annex III exposure.

4. Competitive Differentiation Through Compliance Readiness

Counter-intuitively, the AI Act creates a trust premium for early compliers. Enterprise procurement teams — especially in financial services and healthcare — are already adding AI Act compliance questionnaires to RFP processes. A vendor with a CE mark, a public Declaration of Conformity, and transparent model cards gains a measurable edge in competitive bids. Compliance is not just a cost; it is an enterprise sales asset.

5. The SME Challenge — and EU Support Programs

For smaller SaaS vendors, the compliance cost is disproportionate. The Act acknowledges this: SMEs and startups benefit from reduced fees for conformity assessments, access to regulatory sandboxes run by national competent authorities, and simplified documentation templates. France's CNIL, Germany's BNetzA, and the new European AI Office are all building sandbox programs. SaaS startups should proactively engage with these programs in 2025 — they provide both guidance and a degree of regulatory protection during development.

Real-World Examples: What Compliance Looks Like in Practice

HireVue (video interview AI): Would be classified as high-risk under Annex III (employment). Required actions: bias audits on training data, candidate disclosure requirements, explainability reports for HR deployers, logging of all scoring decisions.

Salesforce Einstein Scoring: Lead and opportunity scoring features that influence commercial decisions likely fall in the limited or high-risk zone depending on the use case. Salesforce's published AI transparency framework gives a model for what vendor-side compliance documentation looks like at scale.

Cohere (enterprise LLM API): As a GPAI provider below the systemic-risk threshold, Cohere must publish model documentation and comply with EU copyright law — obligations already reflected in its enterprise API terms updated in Q1 2025.

Doctolib AI (healthcare scheduling): AI features that inform medical appointment prioritization may touch both AI Act high-risk provisions and the Medical Device Regulation, requiring dual-track compliance — a growing challenge for health-tech SaaS platforms.

Conclusion

The EU AI Act is not a distant regulatory horizon — it is an operational reality that B2B SaaS companies must build into their product, legal, and commercial strategies today. The risk pyramid is clear: most commodity AI features require only transparency measures, but AI tools that touch hiring, credit, education, and similar domains carry obligations as demanding as any product safety regulation in EU history.

The companies that will thrive are those that treat compliance not as a legal checkbox but as a product quality signal — embedding traceability, human oversight, and data governance into their AI architecture from day one, and leveraging that rigor as a competitive differentiator in enterprise markets increasingly hungry for trustworthy AI.

The 7% fine headline will grab attention. But the real strategic question is simpler: do you know exactly what your AI features do, and can you prove it to a regulator? If not, the time to find out is now.

— Équipe éditoriale InekIA