EU AI Act: Practical Obligations for B2B SaaS Companies

# EU AI Act: Practical Obligations for B2B SaaS Companies

€35 million or 7% of global annual turnover — that's the maximum fine a B2B SaaS company can face for deploying a prohibited AI system under the EU AI Act. Enacted on August 1, 2024, and entering phased enforcement from February 2025, the Act is the world's first comprehensive horizontal AI regulation. For B2B SaaS vendors selling into European markets — or processing data of EU persons — the compliance clock is already ticking.

This article breaks down the practical obligations, risk tiers, documentation requirements, and strategic moves your product, legal, and engineering teams need to make right now.

Understanding the Risk-Based Architecture

!Legal and compliance teams reviewing AI regulation documentation Photo: Igor Omilaev / Unsplash

The EU AI Act does not apply a one-size-fits-all approach. Instead, it segments AI systems into four risk tiers, each triggering a different level of obligation:

• Unacceptable Risk (Prohibited): AI systems that manipulate human behavior subconsciously, exploit vulnerabilities, enable social scoring by public authorities, or perform real-time remote biometric identification in public spaces. These are banned outright as of February 2, 2025.
• High Risk: AI systems embedded in critical infrastructure, HR processes (CV screening, interview scoring), credit scoring, educational assessment, or law enforcement tools. These face the heaviest compliance burden.
• Limited Risk: Chatbots, deepfake generators, and emotion-recognition systems must meet transparency obligations — users must know they're interacting with AI.
• Minimal Risk: Spam filters, AI-powered search, recommendation engines for B2C entertainment. No new obligations beyond existing law.

For B2B SaaS, the key battlefield is High Risk. According to the European Parliament's own impact assessment (2023), approximately 15% of enterprise SaaS applications currently in deployment touch at least one high-risk use case as defined in Annex III of the Act. This share is expected to grow as AI features become standard across CRM, HR tech, and financial platforms.

Who Is Obligated: Provider vs. Deployer

One of the most operationally significant distinctions in the Act is between providers (those who develop or place AI systems on the market) and deployers (those who use AI systems in a professional context). B2B SaaS companies will frequently occupy both roles simultaneously — a reality that multiplies compliance obligations.

As a Provider, you must: - Establish a quality management system (QMS) covering the entire AI lifecycle - Conduct conformity assessments before market launch - Register high-risk AI systems in the EU database (mandatory from August 2026) - Implement post-market monitoring and incident reporting (serious incidents within 15 days to market surveillance authorities) - Maintain technical documentation for 10 years after the system is placed on the market - Appoint an EU-based representative if headquartered outside the EU

As a Deployer, you must: - Ensure AI is used according to the provider's instructions of use - Perform a Fundamental Rights Impact Assessment (FRIA) for certain high-risk contexts (public sector deployers and regulated private entities) - Maintain logs of high-risk AI system operation (where technically feasible) - Inform employees when AI systems affect them (e.g., performance monitoring tools) - Designate an internal point of contact for AI governance

For a SaaS vendor selling an AI-powered applicant tracking system (ATS) to enterprise HR teams, for example: the vendor is the provider subject to QMS, documentation, and conformity assessment requirements, while each enterprise customer is the deployer responsible for FRIA and operator-level logging. Contractually, this must be made explicit — and many standard SaaS MSAs are not yet fit for purpose.

High-Risk Categories Most Relevant to B2B SaaS

Annex III of the Act lists eight domains where AI systems are presumed high-risk. For B2B SaaS vendors, four domains are particularly critical:

1. Employment, Workers Management, and Access to Self-Employment Any AI used to **screen CVs, rank candidates, monitor employee performance, analyze behavior or movement**, or make promotion/termination decisions is high-risk. Vendors like Workday, SAP SuccessFactors, and dozens of HR tech startups are actively auditing their AI features in response. A 2024 survey by Littler Mendelson found that **62% of European HR tech vendors** had identified at least one product feature that may qualify as high-risk under this category.

2. Access to Essential Private Services and Public Benefits AI used in **credit scoring, insurance risk assessment, or prioritization of financial services** falls here. Fintech SaaS platforms that embed AI-powered underwriting or behavioral credit models must prepare for full conformity assessment obligations.

3. Education and Vocational Training AI systems that determine access to education, assess students, or detect prohibited behaviors during exams are high-risk. EdTech SaaS vendors (proctoring software, adaptive learning platforms) are squarely in scope.

4. Critical Infrastructure Management AI used in managing electricity grids, water systems, transport, or digital infrastructure is high-risk. SaaS platforms serving utilities, smart building operators, or network management are affected.

General-Purpose AI (GPAI) Models — A Special Layer The Act introduces a separate regime for **General-Purpose AI models** (like large language models). GPAI providers must provide technical documentation, cooperate with downstream providers, and publish summaries of training data. For **systemic risk GPAI** (models trained with over 10^25 FLOPs), obligations include adversarial testing and incident reporting to the European AI Office. SaaS companies that fine-tune or deploy foundation models via API must assess whether they become downstream providers with their own obligations.

The Documentation and Technical Requirements in Practice

For high-risk AI systems, the Act mandates a specific technical file that must be compiled and maintained. This is not a one-time checkbox — it's a living document that must be updated throughout the system's lifecycle.

Key components include:

• General description of the AI system and its intended purpose
• Design specifications: architectural choices, training methodologies, data sources and preprocessing
• Performance metrics: accuracy, robustness, and cybersecurity assessments across the full range of intended users
• Risk management documentation: identification of foreseeable risks, mitigation measures, and residual risk assessment
• Human oversight measures: how human intervention is enabled and documented
• Post-deployment monitoring plan: KPIs, thresholds for retraining, and incident escalation procedures
• Instructions for use: a clear manual for deployers covering capabilities, limitations, and prohibited use cases

From an engineering standpoint, this demands MLOps maturity. Companies without proper model versioning, data lineage tracking, or automated drift detection will face significant retrofitting costs. A 2024 study by McKinsey estimated that enterprises with immature MLOps practices face €800K–€2.5M in one-time compliance remediation costs per high-risk AI system.

Timeline: Key Compliance Milestones

The Act follows a phased enforcement calendar:

• February 2, 2025: Prohibited practices ban enters force. All unacceptable-risk AI systems must be decommissioned or modified.
• August 2, 2025: GPAI model obligations apply. Codes of practice for GPAI expected to be finalized.
• August 2, 2026: High-risk AI obligations (Annex III) fully apply. EU database for high-risk systems opens. Notified body conformity assessments begin.
• August 2, 2027: High-risk AI systems already on the market before August 2024 must be brought into compliance (transitional provision for legacy systems).

For B2B SaaS companies, August 2026 is the critical deadline. With typical enterprise product cycles of 12–18 months, teams that haven't started gap assessments by Q1 2025 risk missing the window.

Strategic Implications: Turning Compliance into Competitive Advantage

The companies that will win in the post-Act landscape are not those that merely comply — they're the ones that operationalize compliance as a product signal.

1. Compliance as a sales differentiator. Enterprise procurement teams, especially in financial services, healthcare, and the public sector, are already issuing AI governance questionnaires to SaaS vendors. A documented QMS, a clear GPAI disclosure policy, and a published AI model card become RFP advantages.

2. Contractual repositioning. Vendors must rewrite data processing agreements and master service agreements to clearly allocate provider vs. deployer obligations. Ambiguity creates liability. Legal teams at companies like Salesforce and ServiceNow have already published AI-specific addenda to their enterprise contracts.

3. Product architecture decisions. The Act creates a strong incentive to disaggregate high-risk AI features into optional, clearly scoped modules rather than embedding them deeply in core workflows. This makes conformity assessment more tractable and allows customers to make explicit opt-in decisions — reducing deployer liability exposure.

4. Investment in explainability infrastructure. Human oversight requirements and the right to explanation for consequential decisions push toward interpretable AI architectures. SaaS companies that invest in SHAP/LIME explanations, audit trails, and override interfaces will be better positioned for both compliance and enterprise trust.

5. The EU as global standard-setter. The Brussels Effect is real. Just as GDPR reshaped global data practices, the AI Act will shape AI product development globally. US-headquartered SaaS companies selling to European customers — or processing EU persons' data — are fully in scope. Building for EU AI Act compliance is effectively building for the most stringent AI governance framework worldwide, which creates exportable trust credentials.

Conclusion

The EU AI Act is not a distant regulatory horizon — it's an active compliance mandate with phased obligations already in effect. For B2B SaaS companies, the calculus is clear: the cost of non-compliance (up to 7% of global turnover) dwarfs the investment required for a structured compliance program. More importantly, the companies that move fastest to implement robust AI governance will transform regulatory burden into defensible competitive moats in enterprise markets where trust is the ultimate currency.

The practical starting point: conduct a full inventory of your AI features against Annex III risk categories, assess your QMS readiness, and begin drafting your technical file templates. The deadline is 2026 — but the window to act without disruption to your product roadmap is now.

— Équipe éditoriale InekIA