EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35 million — or 7% of global annual turnover. That is the maximum penalty a B2B SaaS company can face for deploying a prohibited AI system under the EU Artificial Intelligence Act, which entered into force on August 1, 2024, and whose core obligations are rolling out in phased waves through 2027. For the thousands of SaaS vendors selling into European markets — whether headquartered in Berlin, Boston, or Bangalore — this is not a theoretical risk. It is a compliance clock already ticking.

The Act is the world's first comprehensive legal framework for AI, applying to any provider, deployer, or importer whose AI system is used within the EU, regardless of where the company is based. For B2B SaaS specifically, the obligations are nuanced, layered, and in many cases, genuinely novel. This article maps the practical requirements your product and legal teams need to act on — now.

Understanding the Risk-Based Tier System

!Compliance réglementaire EU AI Act pour les entreprises technologiques Photo: ALEXANDRE LALLEMAND / Unsplash

The EU AI Act does not regulate all AI equally. It establishes a four-tier risk pyramid that determines your obligations:

1. Unacceptable Risk (Prohibited) — Systems banned outright. Examples include real-time biometric surveillance in public spaces, social scoring by governments, and AI that exploits psychological vulnerabilities. No B2B SaaS product should fall here; if it does, shutdown is mandatory from February 2, 2025.

1. High Risk — The most operationally demanding tier for SaaS vendors. Covers AI used in hiring and HR (CV screening, candidate ranking), credit scoring, access to essential services, educational assessment, and critical infrastructure management. These systems require mandatory conformity assessments, CE marking, and registration in an EU database before market placement.

1. Limited Risk — Primarily transparency obligations. Chatbots must disclose they are AI. Deepfakes must be labeled. For most B2B SaaS with conversational AI features, this tier is the minimum floor.

1. Minimal Risk — Spam filters, AI-powered search ranking, recommendation engines for B2B content. No specific obligations beyond the general GPAI rules if applicable.

The critical strategic insight: many B2B SaaS tools sit in ambiguous territory. An ATS (Applicant Tracking System) that uses AI to rank candidates? High risk. A productivity tool that suggests email replies? Minimal risk. A credit-decisioning API embedded in a fintech SaaS? High risk. Classification errors carry existential consequences.

High-Risk Obligations: The Compliance Checklist

If your SaaS product — or any AI component within it — qualifies as high-risk, the Act mandates a comprehensive set of obligations before you can legally sell or deploy in the EU.

Technical Documentation (Article 11) You must produce and maintain detailed technical documentation covering: the system's intended purpose, the training data governance approach, architecture and model performance metrics, accuracy benchmarks across demographic subgroups, and known limitations. This documentation must be updated continuously and made available to national market surveillance authorities on request. Practically, this means engineering and product teams need a **living documentation pipeline**, not a one-off compliance PDF.

Risk Management System (Article 9) High-risk AI providers must implement and document a risk management system that runs throughout the entire product lifecycle — not just at launch. This includes iterative testing against foreseeable misuse scenarios, residual risk evaluation, and post-market monitoring. For a SaaS company running continuous deployment, this translates to **integrating AI risk gates directly into your CI/CD pipeline**.

Data Governance (Article 10) Training, validation, and test datasets must be subject to rigorous governance: examination for biases, relevance, completeness, and appropriate data collection practices. For vendors using third-party foundation models (OpenAI, Anthropic, Mistral, etc.), you bear responsibility for ensuring the model layer you expose meets these standards — even if you didn't train the underlying model. This creates significant **due diligence obligations upstream toward your AI providers**.

Human Oversight (Article 14) High-risk systems must be designed to allow human oversight. This means deployers (your B2B clients) must be able to understand, monitor, and override the AI's outputs. For SaaS vendors, this requires building **explainability features and override mechanisms** into the product UI — not as optional settings, but as core functionality.

Transparency and Instructions for Use (Article 13) You must provide your B2B customers with clear, accessible instructions covering: the system's capabilities and limitations, performance metrics by relevant population group, maintenance requirements, and cybersecurity measures. If you are selling an AI-powered HR tool to an enterprise client, they need enough information to fulfill *their* deployer obligations under the Act.

EU Database Registration Before placing a high-risk AI system on the EU market, providers must register in the **EU AI Act database** managed by the European AI Office. This public registry became operational in **early 2025**. Registration requires key technical characteristics, intended purpose, and conformity assessment details.

GPAI Models: New Rules for SaaS Built on Foundation Models

A landmark aspect of the Act — and one with massive implications for the SaaS industry — is the dedicated chapter on General Purpose AI (GPAI) models (Articles 51–56), applicable from August 2, 2025.

If your SaaS product integrates or fine-tunes a GPAI model (GPT-4, Claude, Gemini, Mistral, Llama, etc.), you are operating in a dual-obligation environment:

• Your upstream GPAI provider must provide technical documentation, cooperate with audits, and (for systemic risk models trained on >10²⁵ FLOPs) conduct adversarial red-teaming.
• You, as the downstream SaaS provider, inherit certain transparency obligations and must not use GPAI capabilities in ways that create prohibited or high-risk use cases without the corresponding compliance infrastructure.

For companies building on open-source GPAI models (like Meta's Llama 3), the obligations shift entirely to the deployer — meaning your SaaS company becomes responsible for what the foundation model layer does within your product context. This is a watershed shift from the current norm, where SaaS builders often treat the model as a black-box utility with zero regulatory accountability.

The European AI Office published its first Code of Practice for GPAI in draft form in November 2024, with final adoption expected mid-2025. Participation in the Code of Practice is voluntary but signals compliance posture to regulators and enterprise buyers alike.

The Provider vs. Deployer Distinction: Who Is Liable?

One of the Act's most operationally significant concepts is the provider/deployer split — and in B2B SaaS, this line is almost always blurred.

• Provider: The entity that develops the AI system and places it on the market. In SaaS, this is typically the software vendor.
• Deployer: The entity that uses the AI system in a professional context. In B2B SaaS, this is your enterprise customer.

Here is where it gets complex: if a B2B customer substantially modifies your AI system — changes its intended purpose, retrains the model, or integrates it into a new workflow — they may legally become the provider. This means your enterprise clients could inherit high-risk compliance obligations they are completely unprepared for.

Strategic implication: Your SaaS contracts, Terms of Service, and customer onboarding must explicitly define permissible use cases and flag when customer modifications trigger their own provider obligations. Legal and product teams must align on this architecture.

Furthermore, deployers (your B2B clients) have specific obligations under the Act: - Ensure human oversight measures are implemented - Log system usage (Article 26) - Conduct fundamental rights impact assessments for certain public-sector deployers - Inform workers when AI systems are used to monitor or evaluate them

As a SaaS vendor, your enterprise success and implementation teams effectively become compliance enablement resources. Failure to support deployer obligations creates churn risk and potential joint liability exposure.

Timeline and Enforcement: What Is Live Right Now

The Act's implementation is phased, and understanding what is already in force versus upcoming is critical for prioritization:

| Date | What Kicks In | |---|---| | August 1, 2024 | Act enters into force | | February 2, 2025 | Prohibited AI systems banned; GPAI governance chapter applies | | August 2, 2025 | GPAI model obligations fully applicable | | August 2, 2026 | High-risk AI obligations (Annex I) apply | | August 2, 2027 | High-risk AI in Annex II (embedded in regulated products) apply |

Enforcement is handled by national market surveillance authorities in each EU member state, coordinated by the European AI Office (established within the European Commission). The AI Office has direct supervisory authority over GPAI model providers.

Penalty structure: - Prohibited AI violations: up to €35M or 7% of global turnover - High-risk violations: up to €15M or 3% of global turnover - Incorrect information to authorities: up to €7.5M or 1% of global turnover - SMEs face proportionally scaled penalties, but the percentages are identical

As of Q1 2025, the European AI Office has opened preliminary investigations into several large GPAI providers over data governance practices. While no formal enforcement actions against SaaS companies have been publicly concluded, national authorities in France, Germany, and the Netherlands have issued compliance guidance signaling active market surveillance intent.

Strategic Playbook: Five Actions for B2B SaaS Leaders

Compliance is not just legal defense — it is increasingly a commercial differentiator. Enterprise procurement teams in regulated sectors (finance, healthcare, HR) are adding AI Act compliance to vendor due diligence questionnaires. Here are five concrete actions:

1. Conduct an AI inventory audit. Map every AI feature, model integration, and automated decision-making component in your product. Classify each against the four risk tiers. This is the foundational step — without it, no downstream action is coherent.

2. Build a technical documentation framework. Even if you are not yet high-risk, establishing a documentation culture now reduces remediation costs later. Tools like model cards, data sheets, and system cards (popularized by Google and Hugging Face) provide a practical starting structure.

3. Negotiate AI Act clauses into vendor and customer contracts. Your contracts with foundation model providers should include explicit representations about their GPAI compliance status. Your customer agreements should define intended use, prohibited use, and customer obligations as deployers.

4. Assign an AI compliance owner. This does not need to be a dedicated FTE immediately — but responsibility must be named. In most SaaS companies, this sits with the VP of Engineering, Chief Legal Officer, or Chief Product Officer. Some companies are creating a dedicated AI Governance Lead role, particularly at Series B and beyond.

5. Engage with the EU AI Office's regulatory sandboxes. Member states are required to establish regulatory sandboxes for innovative AI systems. These offer a controlled environment to test high-risk systems with reduced enforcement risk and direct regulator dialogue — a significant strategic asset for early movers.

Conclusion

The EU AI Act is not a distant regulatory abstraction — it is an operational reality that B2B SaaS companies must integrate into their product, legal, and commercial strategies today. The phased timeline creates a false sense of distance; the foundational work of AI inventory, risk classification, documentation, and contractual realignment takes 12 to 18 months for a mid-size SaaS company, even under ideal conditions.

The companies that treat compliance as a competitive signal — embedding transparency, explainability, and human oversight as product features rather than legal burdens — will be better positioned to win enterprise deals in regulated sectors, particularly as procurement teams intensify their AI governance scrutiny.

The clock started on August 1, 2024. The question is not whether your SaaS product will need to comply. It is whether your team will be ready before enforcement catches up.

— Équipe éditoriale InekIA