EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35 million or 7% of global annual turnover — that's the maximum fine a B2B SaaS company faces for deploying a prohibited AI system under the EU AI Act. As of August 2024, the world's first comprehensive AI regulation has entered into force, and its compliance deadlines are not theoretical. For B2B SaaS vendors, distributors, and deployers operating in the European Union, the clock is ticking.

Yet a 2024 Gartner survey found that fewer than 25% of organizations have even begun mapping their AI systems to the Act's risk tiers. That gap between regulatory ambition and operational readiness represents both a compliance risk and a competitive opportunity.

This article breaks down exactly what the EU AI Act requires of B2B SaaS companies — from risk classification to technical documentation — and outlines a practical roadmap to achieve compliance.

Understanding the Risk-Based Architecture of the EU AI Act

!Équipe juridique et technique analysant les obligations de conformité IA pour un produit SaaS B2B Photo: ALEXANDRE LALLEMAND / Unsplash

The EU AI Act does not apply uniformly to all software. Its obligations scale with potential harm, organized into four risk tiers:

1. Unacceptable Risk (Prohibited): AI systems that manipulate human behavior subconsciously, exploit vulnerabilities of specific groups, or enable social scoring by public authorities. These are banned outright as of February 2, 2025. B2B SaaS vendors must audit their feature sets immediately — dark-pattern recommendation engines or emotion-inference tools used in hiring could trigger this category.

2. High Risk: Systems used in critical infrastructure, employment decisions (CV screening, performance monitoring), credit scoring, biometric identification, and access to education or essential services. These carry the heaviest compliance burden and must comply by August 2, 2026.

3. Limited Risk: Chatbots and systems that interact with humans. These require transparency obligations — users must know they're talking to an AI — enforced by August 2, 2026.

4. Minimal Risk: The vast majority of AI applications, including spam filters, AI-powered search, and recommendation engines in low-stakes contexts. No mandatory obligations, though voluntary codes of conduct are encouraged.

For most B2B SaaS companies, the critical question is: does our AI feature qualify as High Risk? The answer determines the difference between a transparency notice and a full conformity assessment.

Who Is Affected? Roles and Responsibilities Under the Act

The EU AI Act introduces a layered responsibility model that cuts across the SaaS supply chain. Understanding your role is foundational to determining your obligations.

Providers are companies that develop an AI system and place it on the EU market or put it into service — this includes most B2B SaaS vendors embedding AI into their products. Providers bear the heaviest obligations: technical documentation, conformity assessments, CE marking (for high-risk systems), registration in the EU database, and post-market monitoring.

Deployers are organizations that use an AI system in a professional context. A mid-market HR tech firm licensing an AI-powered screening tool and deploying it to evaluate candidates is a deployer. Deployers must conduct fundamental rights impact assessments for high-risk systems, implement human oversight mechanisms, and ensure staff are trained in AI literacy.

Importers and Distributors face verification duties — they must confirm that providers have met their obligations before making systems available in the EU market.

The critical wrinkle for B2B SaaS: a SaaS vendor can be both a provider and a deployer simultaneously. A company that builds an AI-driven sales forecasting tool for internal use and also licenses it to clients wears both hats — with distinct obligations in each role. Legal teams must map every AI touchpoint across both dimensions.

Notably, companies with fewer than 10 employees and annual turnover under €2 million (micro-enterprises) enjoy reduced obligations, particularly around high-risk system documentation. However, they are not exempt from prohibited use rules or general transparency requirements.

High-Risk AI in B2B SaaS: The Most Impacted Verticals

For B2B SaaS vendors, the high-risk classification is where legal and product teams will spend the most time. Annex III of the Act lists the specific use cases that trigger high-risk status. Here are the verticals most directly impacted:

HR & Recruitment Technology: AI used for CV sorting, candidate scoring, employee performance evaluation, promotion decisions, or workforce monitoring is explicitly listed as high-risk. Tools like Workday's Skills Cloud, HireVue's video interview analysis, or any custom ML model that influences hiring decisions falls here. Providers must implement bias testing, maintain detailed training data logs, and ensure human override capability.

Financial Services & Credit: AI systems used in creditworthiness assessment or credit scoring for retail and SMB clients. Embedded lending decisioning engines in fintech SaaS must comply with Article 10's data governance requirements — training datasets must be representative, free of discriminatory patterns, and fully documented.

Legal Tech & Compliance: AI tools used to assist in judicial or administrative decisions. Contract analysis platforms that produce binding recommendations — not just summaries — may enter high-risk territory, depending on deployment context.

Healthcare SaaS: Medical device software using AI for diagnosis support, triage, or treatment recommendation is regulated as high-risk. This overlaps with the EU MDR (Medical Device Regulation), creating a dual compliance burden.

Education & Professional Certification: AI used to determine access to educational institutions or professional opportunities — adaptive testing platforms, automated essay scoring with consequential outcomes — triggers high-risk classification.

A striking example: Eightfold AI, a talent intelligence platform, explicitly acknowledged in 2024 that its core ranking and matching algorithms qualify as high-risk under the Act and began publishing conformity roadmaps for EU clients — a model of proactive compliance that others should study.

Core Technical and Operational Obligations for High-Risk Systems

If your B2B SaaS product contains a high-risk AI system, the following obligations become mandatory by August 2026. Each represents a concrete engineering, legal, or operational action item.

Technical Documentation (Article 11): Providers must maintain comprehensive documentation covering system purpose, capabilities and limitations, training data characteristics, performance benchmarks, and known risks. This must be updated continuously throughout the product lifecycle — not a one-time PDF artifact.

Data Governance (Article 10): Training, validation, and testing datasets must be governed by documented protocols. Datasets must be examined for biases and relevant statistical properties must be recorded. For SaaS companies that fine-tune foundation models on client data, this creates complex data provenance requirements.

Transparency and User Information (Article 13): High-risk systems must come with instructions for use that allow deployers to understand the system's purpose, level of accuracy, human oversight mechanisms, and any known risks. This translates to a new category of mandatory product documentation — AI system cards — that go beyond standard API docs.

Human Oversight (Article 14): Systems must be designed to allow natural persons to monitor, understand, override, or halt AI outputs. For SaaS UX designers, this means building explicit override controls, audit trails, and confidence-score displays into product interfaces — not optional features.

Accuracy, Robustness, and Cybersecurity (Article 15): Systems must achieve appropriate levels of accuracy for their intended purpose and be resilient to adversarial manipulation. Providers must document accuracy metrics and degradation under distribution shift — a significant MLOps maturity requirement.

Conformity Assessment: Depending on the system type, this is either a self-assessment (most high-risk categories) with documented evidence, or a third-party audit (biometric identification systems, critical infrastructure AI). Self-assessment still requires rigorous internal processes — companies should expect regulators to request documentation during market surveillance.

EU Database Registration: High-risk systems must be registered in the European Commission's public database before market deployment. This database went live in early 2025 at ai-act-database.eu.

AI Literacy (Article 4): Providers and deployers must ensure sufficient AI literacy among staff who operate or oversee AI systems. This isn't defined prescriptively, but regulators have indicated it includes basic training on AI decision-making, bias recognition, and override procedures. SaaS companies should document training programs as evidence of compliance.

The General-Purpose AI (GPAI) Layer: What It Means for SaaS Builders

Among the Act's most consequential provisions for modern SaaS architecture is Title VIII on General-Purpose AI Models — which applies to any company that trains or fine-tunes large foundation models and makes them accessible to others via API or integration.

GPAI providers must: - Maintain technical documentation of model architecture, training methodology, and evaluation benchmarks - Comply with EU copyright law and publish summaries of training data - Implement policies to identify and mitigate systemic risks

For GPAI models with systemic risk — defined as models trained with compute exceeding 10^25 FLOPs (currently affecting GPT-4 class models and above) — additional obligations include adversarial red-teaming, incident reporting to the European AI Office, and cybersecurity measures.

The practical implication: B2B SaaS companies that embed OpenAI, Anthropic, Google, or Mistral models via API are deployers, not providers of those models. Their obligation is to ensure they use GPAI outputs in compliant ways within their products. However, companies that fine-tune these models on proprietary data and re-expose them via their own APIs become downstream GPAI providers and face a proportionate share of GPAI obligations.

This creates a new category of due diligence: AI supply chain auditing. Before embedding a third-party AI model, B2B SaaS legal teams should request GPAI compliance documentation from their AI vendors — something that will quickly become a standard procurement requirement in enterprise sales cycles.

Strategic Compliance Roadmap: A Phased Approach

Given the tiered deadlines, B2B SaaS companies should structure compliance as a phased program rather than a point-in-time audit.

Phase 1 — Immediate (Now through February 2025): Conduct an AI inventory across all products and internal tools. Map each AI feature to a risk tier. Identify any features that could be classified as prohibited use cases and initiate product decisions accordingly. Assign an AI compliance owner (or delegate to legal/CTO office).

Phase 2 — Foundation (Q1–Q2 2025): For high-risk systems, begin technical documentation under Article 11 standards. Engage a legal counsel specializing in EU AI regulation to assess conformity assessment pathways. Begin data governance review for training datasets. Audit AI-related contractual clauses with enterprise clients to ensure deployer obligations are properly allocated.

Phase 3 — Implementation (Q3 2025–Q1 2026): Deploy human oversight mechanisms in product. Build AI system cards into product documentation infrastructure. Implement AI literacy training for internal teams and provide deployer guidance for clients. Conduct conformity self-assessment with documented evidence. Register qualifying systems in the EU AI database.

Phase 4 — Continuous Compliance (Post-August 2026): Establish post-market monitoring protocols. Implement serious incident reporting workflows. Integrate AI Act compliance into product development lifecycle (AI by design). Prepare for National Competent Authority market surveillance.

Companies that treat compliance as a product feature — not a legal tax — will find that AI Act documentation, transparency controls, and human oversight mechanisms are increasingly demanded by enterprise procurement teams as standard requirements.

Conclusion: Compliance as Competitive Advantage

The EU AI Act is not merely a compliance burden — it is a market-shaping force that will define which B2B SaaS companies earn enterprise trust in the coming decade. With €35 million maximum fines, an active European AI Office conducting market surveillance, and procurement teams increasingly demanding AI compliance documentation, the cost of inaction vastly outweighs the cost of early compliance investment.

The companies that move now — inventorying their AI systems, building documentation infrastructure, embedding human oversight into product design — will enter the 2026 compliance deadlines with a defensible posture and a competitive differentiator: certified, auditable AI that enterprises can deploy without legal risk.

For B2B SaaS leadership, the strategic question is not whether to comply, but how fast to turn compliance into a product advantage.

— Équipe éditoriale InekIA