EU AI Act for B2B SaaS: Roles, Dates and Fines as of November 2026

As of 12 November 2026, the EU AI Act (Regulation (EU) 2024/1689) applies to B2B SaaS companies in several layers: prohibitions and AI-literacy duties since 2 February 2025, general-purpose AI (GPAI) obligations since 2 August 2025, and Article 50 transparency duties since 2 August 2026. High-risk obligations have been deferred. This analysis covers scope, role determination, dates, obligations and penalty tiers, drawing on EU institutional sources first and secondary commentary where institutions are silent.

The facts

• The Regulation was adopted on 13 June 2024 and entered into force on 1 August 2024, applying to providers, deployers, importers, distributors and other operators placing or using AI systems in the EU market [EUR-Lex, Regulation 2024/1689] [AI Act, European Commission].
• It also applies to providers and deployers established outside the EU where the output produced by the AI system is used in the Union [AI Act Service Desk, Article 2].
• The Digital Omnibus on AI was proposed by the European Commission on 19 November 2025 [DLA Piper GENIE]. According to aiacto.eu, it became Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The official Commission pages in the research do not restate these dates; the legal text of the Omnibus itself was not retrieved.
• A consolidated version of Regulation 2024/1689 dated 27 July 2026 is available on EUR-Lex.

Role determination for SaaS vendors

Obligations depend on the role a vendor holds for each AI feature and on the system's risk classification [Regulation 2024/1689, EUR-Lex] [Council of the EU].

• A SaaS company is a provider if it develops an AI system or markets it under its own name, and a deployer if it uses an AI system for its own business activities [AI Act Service Desk, Article 2] [Council of the EU].
• According to deepinspect.ai, a vendor that integrates a foundation model and resells it under its own brand becomes a provider under Article 25, even without training the model.
• According to Vision Compliance, a deployer can become the provider of a system by applying its name or trademark, making a substantial modification, or changing the intended purpose so that the system becomes high-risk.
• According to nwlextech.com, a SaaS product powered by a third-party model makes its vendor a deployer or downstream provider, responsible for its own obligations and for verifying that the model provider meets its Chapter V duties.

Application dates after the Digital Omnibus

The European Commission's AI Act Service Desk gives the following milestones: definitions, AI literacy and prohibitions from 2 February 2025; GPAI governance from 2 August 2025; Article 50 transparency and enforcement from 2 August 2026; Annex III high-risk obligations from 2 December 2027; and Annex I embedded high-risk systems from 2 August 2028 [AI Act Service Desk, timeline].

Sources diverge on how some of these dates came about:

• According to technology.org, the original dates were 2 August 2026 for Annex III and 2 August 2027 for Annex I, moved by the Omnibus to 2 December 2027 and 2 August 2028 respectively.
• Some practitioner guides still describe 2 August 2026 as the high-risk deadline for deployers [sota.io]. This differs from the dates given by the Commission's AI Act Service Desk and by the post-Omnibus reporting above.
• On Article 50, one source states that the Omnibus does not amend it [Usercentrics], while another notes that most transparency obligations remained where they were [Jones Walker]. A further source reports a grace period to 2 December 2026 for generative systems placed on the market before 2 August 2026 [technology.org].

Obligations already in application

Prohibited practices and AI literacy. The Commission states that definitions, AI-literacy duties and the prohibitions on unacceptable-risk practices applied from 2 February 2025 [AI Act Service Desk, timeline]. Providers and deployers must ensure a sufficient level of AI literacy among staff and other persons operating AI systems on their behalf [Navigating the AI Act]. Two further prohibitions, on non-consensual sexual deepfakes and AI-generated child sexual abuse material, are reported to apply from 2 December 2026 [technology.org].

Article 50 transparency. According to the Commission's Article 50 FAQ, systems interacting directly with people, such as chatbots, must inform users that they are interacting with AI, and providers of generative systems must use machine-readable markings so that outputs can be detected as AI-generated or manipulated. According to the consolidated Regulation text and the Commission's enforcement material, disclosure is not required where it is obvious from context, and marking applies where technically feasible [EUR-Lex consolidated text] [Enforcement framework of the AI Act]. According to Cyberaccord, deployers of deepfakes must disclose them under Article 50(4).

GPAI models. Providers of GPAI models must prepare technical documentation, adopt a copyright-compliance policy and publish a summary of training content [General-purpose AI obligations]. A model trained with more than 10^25 floating-point operations is presumed to present systemic risk, triggering notification to the Commission and added risk-mitigation duties [General-purpose AI obligations]. Providers integrating a GPAI model into their own system must obtain the information needed to comply [Navigating the AI Act]. According to the Commission's GPAI guidelines page, enforcement of GPAI obligations, including fines, starts on 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027.

High-risk systems

B2B SaaS can be high-risk where its AI is used in regulated product-safety contexts or in specified areas including employment and worker management, education, biometric identification and essential services [Council of the EU] [AI Act, European Commission].

Before placing a high-risk system on the market, providers must implement risk management, data governance, logging, technical documentation, user information, human oversight, and accuracy, robustness and cybersecurity controls [AI Act, European Commission]. Providers must also run post-market monitoring and report serious incidents [AI Act, European Commission]. Deployers must use systems according to the provider's instructions, assign human oversight, monitor operation, retain logs within their control and report serious incidents [AI Act, European Commission].

A company claiming that a system is not high-risk under an applicable exception must document that assessment before market placement or deployment, and authorities may request it [EUR-Lex, Commission proposal COM(2025) 836].

Penalties

The Commission and EUR-Lex sources set out the fine tiers [Enforcement framework of the AI Act] [Regulation 2024/1689, EUR-Lex]:

• Prohibited practices: up to EUR 35 million or 7% of worldwide annual turnover for the preceding financial year, whichever is higher (The enforcement framework of the AI Act; EU AI Act Fines, Art. 99).
• Other breaches, including GPAI obligations: up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (The enforcement framework of the AI Act; Navigating the AI Act).
• Incorrect, incomplete or misleading information: up to EUR 7.5 million or 1% [Navigating the AI Act].

Sources diverge on one point: the text of the Commission enforcement page quoted in one search attributes the EUR 7.5 million or 1% cap to AI systems generally, while the Commission FAQ and secondary sources assign it to misleading information, with EUR 15 million or 3% for most other breaches. This article follows the latter reading. Fines are calculated on worldwide turnover of the undertaking for the preceding financial year, not EU turnover [regulation-ai.eu]. For SMEs, including start-ups, the lower of the percentage or the fixed amount applies [euai.app].

Procurement and contracting signals

According to NatLawReview, customers buying AI can require vendors to state the AI Act risk classification and whether the system relies on a GPAI model; for high-risk purchases, this extends to the declaration of conformity, CE-marking confirmation, EU database registration and instructions for use. According to regulation-ai.eu, contracts can also address update commitments, incident-notification channels and data-governance terms. A Hacker News post titled "Early signals that EU AI Act compliance is becoming a sales blocker for AI SaaS" (11 February 2026, 1 point, 1 comment) is an unverified community signal, not a verified fact [Hacker News].

On the demand side, Eurostat reported that 8.0% of EU enterprises with at least 10 employees used AI in 2023 [Eurostat, 2024], and 13.5% in 2024 [Eurostat, 2025]. These figures do not establish compliance status under the Act.

What is not known yet

• The Official Journal text of Regulation (EU) 2026/1744 was not retrieved for this analysis; its dates rest on secondary reporting.
• Sources diverge on whether the Omnibus touched Article 50, and on the exact scope of the 2 December 2026 grace period for generative systems.
• The research does not state how national market-surveillance authorities will apply Article 50 to B2B SaaS in practice.
• The research does not establish how many B2B SaaS products fall into Annex III categories.

Timeline

• 1 August 2024: Regulation enters into force [AI Act Service Desk, timeline].
• 2 February 2025: prohibitions, definitions and AI literacy apply [AI Act Service Desk, timeline].
• 2 August 2025: GPAI and governance provisions apply [AI Act Service Desk, timeline].
• 19 November 2025: Commission publishes the Digital Omnibus on AI proposal [DLA Piper GENIE].
• 24 and 27 July 2026: Omnibus published and in force, per aiacto.eu.
• 2 August 2026: Article 50 and enforcement begin [AI Act Service Desk, timeline].
• 2 December 2026: end of the reported grace period for legacy generative systems and start of two new prohibitions [technology.org].
• 2 August 2027: deadline for GPAI models placed on the market before 2 August 2025 [Guidelines on GPAI providers].
• 2 December 2027: Annex III high-risk obligations [AI Act Service Desk, timeline].
• 2 August 2028: Annex I embedded high-risk obligations [AI Act Service Desk, timeline].

Evidence

— InekIA Editorial Team