EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35,000,000 — that's the maximum fine a B2B SaaS company can face for deploying a prohibited AI system under the EU AI Act. Enacted on August 1, 2024, this landmark regulation affects every software vendor that embeds, sells, or operates AI features touching EU users or businesses. With full enforcement kicking in by August 2026 for most high-risk systems, the compliance clock is ticking. This article cuts through the legal noise and maps out exactly what your SaaS product team, legal counsel, and CTO need to do — now.

Understanding the Risk-Tier Framework

The EU AI Act does not apply a one-size-fits-all approach. Instead, it categorizes AI systems across four risk tiers, each triggering different compliance obligations:

• Unacceptable Risk (Banned): Social scoring by public authorities, real-time biometric surveillance in public spaces, subliminal manipulation. Prohibition applies from February 2, 2025.
• High Risk: AI in HR (CV screening, promotion decisions), credit scoring, access to education, critical infrastructure. Full obligations apply by August 2, 2026.
• Limited Risk: Chatbots, deepfake generators, emotion recognition tools. Transparency obligations only.
• Minimal Risk: Spam filters, AI-based spreadsheet tools, recommendation engines. No specific obligations.

For B2B SaaS, the critical battleground is the high-risk tier. According to the European Parliament's impact assessment published in March 2024, approximately 15% of AI systems currently deployed in enterprise software fall into the high-risk category — a figure that will grow as AI becomes more embedded in HR tech, legal tech, and financial SaaS platforms.

Key examples of high-risk B2B SaaS use cases: - ATS (Applicant Tracking Systems) with AI-based candidate ranking (e.g., Workday, Greenhouse AI features) - Credit decisioning APIs integrated into fintech platforms - Predictive policing or fraud scoring embedded in compliance SaaS - AI-assisted medical device management software (covered under Annex III)

Core Compliance Obligations for High-Risk AI Systems

If your SaaS product qualifies as a high-risk AI system — or if your platform deploys such systems on behalf of enterprise clients — the Act imposes eight distinct technical and organizational obligations (Article 9–17):

1. Risk Management System You must establish, document, and maintain a **continuous risk management system** throughout the AI system's lifecycle. This is not a one-time audit — it requires iterative evaluation as the model evolves. Think of it as ISO 9001 for AI risk.

2. Data Governance Training, validation, and testing datasets must meet strict quality criteria. They must be **relevant, representative, and free of biases** that could lead to discriminatory outcomes. For SaaS vendors using third-party foundational models (e.g., GPT-4o via Azure OpenAI), you remain responsible for downstream data governance — even if you didn't train the model.

3. Technical Documentation You must produce and maintain detailed technical documentation (Annex IV format) before placing the system on the EU market. This includes architecture diagrams, training data descriptions, performance benchmarks, and known limitations. Estimated documentation effort: **200–400 engineering hours** for a mid-size SaaS product, according to a 2024 Linklaters compliance study.

4. Record-Keeping & Logging High-risk systems must automatically log events enabling post-hoc traceability. Logs must be retained for a minimum of **6 months** (or longer if the system is used in regulated sectors like finance or healthcare). This has direct implications for your cloud infrastructure and data retention policies.

5. Transparency to Deployers As a provider (vendor), you must supply deployers (your enterprise clients) with clear instructions for use, intended purpose, performance characteristics, and human oversight requirements. This fundamentally changes how SaaS companies write **product documentation and contractual agreements**.

6. Human Oversight by Design High-risk systems must be designed to allow human operators to **understand, monitor, override, or shut down** the AI output. This is a product design constraint, not just a policy checkbox. Features like "AI-only autopilot" for hiring decisions would need a mandatory human review gate.

7. Accuracy, Robustness & Cybersecurity Systems must achieve appropriate levels of accuracy declared in technical documentation, and must be resilient to adversarial inputs and model poisoning. ENISA (EU Agency for Cybersecurity) has published draft guidelines specifically for AI robustness testing, anticipated to be finalized in Q2 2025.

8. Conformity Assessment & CE Marking Before deployment, most high-risk AI systems require a **conformity assessment** — either self-assessment (for most Annex III cases) or third-party audit by a notified body (for biometric and critical infrastructure AI). Upon passing, the system receives **CE marking**, just like a physical product.

The Provider vs. Deployer Distinction: Who Is Liable?

One of the most operationally significant aspects of the EU AI Act for B2B SaaS is the provider/deployer split. This distinction determines where compliance obligations sit in the value chain.

• Provider: The entity that develops or places an AI system on the market. In SaaS, this is typically the software vendor.
• Deployer: The entity that uses the AI system in a professional context. In B2B SaaS, this is your enterprise customer.

However, a deployer can become a de facto provider if they: - Substantially modify an AI system beyond its intended use - Integrate a general-purpose AI (GPAI) model into their own product - Deploy a system under their own brand without disclosing the original provider

This has major implications for white-label SaaS and API-first AI platforms. If you sell an AI API that a client embeds into their HR workflow, and the client customizes the model's decision logic, the client may inherit provider obligations — including conformity assessments.

Contractual recommendation: B2B SaaS vendors should update their MSAs (Master Service Agreements) and DPAs to: 1. Clearly define the intended use scope of AI features 2. Explicitly allocate compliance responsibilities 3. Require clients to notify vendors of any modifications that might trigger high-risk reclassification

General-Purpose AI (GPAI) Models: A Separate Compliance Layer

The EU AI Act introduces a distinct regime for General-Purpose AI Models (GPAI) — the large foundation models like GPT-4, Claude, Gemini, or Llama that power many SaaS AI features. This regime applies from August 2, 2025.

For GPAI providers with over 10^25 FLOPs of training compute (roughly equivalent to GPT-4 scale), the Act imposes: - Adversarial testing (red-teaming) requirements - Incident reporting to the AI Office - Model evaluation against systemic risk benchmarks

For B2B SaaS vendors using GPAI models via APIs (e.g., OpenAI, Anthropic, Mistral), you are not the GPAI provider — but you are responsible for: - Ensuring the GPAI model you use has compliant documentation available - Not deploying the GPAI in ways that create high-risk applications without proper assessment - Maintaining transparency with your own enterprise clients about underlying model provenance

As of January 2025, the EU AI Office — the newly established regulatory body under DG CONNECT — is developing a Code of Practice for GPAI providers, with final adoption expected by April 2025. SaaS legal teams should monitor this closely.

Timeline and Enforcement Milestones

Understanding the phased enforcement schedule is critical for SaaS product roadmap planning:

| Date | Milestone | |------|----------| | August 1, 2024 | EU AI Act enters into force | | February 2, 2025 | Prohibited AI systems banned | | August 2, 2025 | GPAI obligations apply; AI literacy training required for staff | | August 2, 2026 | High-risk AI obligations fully enforceable | | August 2, 2027 | High-risk AI systems already in use before 2026 must comply |

Enforcement is delegated to national market surveillance authorities (e.g., CNIL in France, BNetzA in Germany). Fines are tiered: - €35M or 7% of global annual turnover for prohibited AI violations - €15M or 3% of global annual turnover for high-risk non-compliance - €7.5M or 1.5% of global annual turnover for providing incorrect information to authorities

For a SaaS company with €50M ARR, a 3% fine equals €1.5M — enough to wipe out a quarter's EBITDA.

Strategic Implications: Turning Compliance Into Competitive Advantage

Compliance is a cost — but it can also be a market signal. Here's how forward-thinking B2B SaaS companies are repositioning EU AI Act compliance as a growth lever:

Build a Compliance-as-Feature Narrative Enterprise procurement teams in regulated industries (banking, insurance, healthcare) are already including **AI Act compliance status** in RFP questionnaires. SaaS vendors who can demonstrate CE marking, technical documentation, and human oversight mechanisms **win deals faster** in these verticals.

Establish an AI Governance Function Early Leading SaaS companies (Salesforce, SAP, Workday) have appointed dedicated **AI Ethics Officers** or **Responsible AI Leads**. For scale-ups, embedding AI governance into your existing security/compliance team is a cost-effective first step. Budget estimate: **€80,000–€150,000/year** for a dedicated AI compliance manager in Western Europe.

Leverage the EU AI Act for Export Markets Just as GDPR became a global de facto standard, the EU AI Act is influencing AI governance frameworks in the UK (AI Safety Institute), Canada (AIDA), and Brazil (AI Bill). Building EU-compliant AI systems now positions your SaaS product for **global enterprise sales** without major re-engineering.

Audit Your Third-Party AI Stack Most B2B SaaS products now embed AI from multiple vendors — OpenAI for text generation, AWS Rekognition for image analysis, Cohere for RAG pipelines. Conduct a **full AI component inventory** and map each component to the risk tier framework. Tools like **Credo AI** and **Holistic AI** offer automated AI governance platforms to assist with this.

Practical First Steps for SaaS Teams (Q1–Q2 2025)

Here is a concrete 90-day action plan:

1. Week 1–2: Conduct an AI inventory — list every AI feature in your product and classify it by risk tier.
2. Week 3–4: Map the provider/deployer boundary across your top 20 enterprise clients.
3. Month 2: Engage legal counsel to audit MSAs and DPAs for EU AI Act alignment.
4. Month 2–3: Assign an AI compliance owner and begin technical documentation for any high-risk features.
5. Month 3: Assess whether your GPAI model vendors (OpenAI, etc.) have published compliant model cards and documentation.
6. Ongoing: Subscribe to the EU AI Office newsletter and track the GPAI Code of Practice publication.

The EU AI Act is not merely a compliance checkbox — it is a structural shift in how AI products are built, sold, and governed in the world's largest single market. B2B SaaS companies that treat it as such will be better positioned than those scrambling to retrofit compliance six months before the enforcement deadline.

The regulatory landscape for AI is evolving rapidly. This article reflects information available as of January 2025. Always consult qualified legal counsel for compliance decisions specific to your product and jurisdiction.

— Équipe éditoriale InekIA