Does the EU AI Act Apply to Your SaaS Company — and in What Role?

The EU AI Act applies to you the moment you place an AI system on the EU market or use one in a professional context. For SaaS companies, the more useful question is not whether it applies — it almost certainly does — but in which role and at what intensity.

The Act carves your potential obligations into two primary roles: Provider and Deployer. Which one you occupy determines whether you must produce Annex IV technical documentation, run a conformity assessment under Article 43, or simply follow the instructions your vendor supplies. Getting the role wrong at the outset sends every subsequent compliance effort in the wrong direction.

---

Provider or Deployer? The Decision That Drives Everything

Under Article 16, a provider is an organisation that develops an AI system and places it on the market or puts it into service under its own name or trademark. If you have shipped a feature — a candidate-ranking module, a credit decisioning engine, a document-parsing assistant — under your product's brand, you are the provider of that system. The Act does not care whether you trained the underlying model yourself or built on top of a third-party API. You put your name on it; you own the obligations.

Under Article 26, a deployer is an organisation that uses a third-party AI system in a professional context. If you run another vendor's model inside your internal operations — using a recruitment tool built by someone else to screen your own candidates, for example — you are the deployer of that system.

Most SaaS companies are both simultaneously: providers of the AI features they ship to customers, deployers of the AI tools they use internally. Classify each AI system separately.

The Article 25 Trap

Article 25 converts a deployer (or distributor, or importer) into a provider the moment they:

• put their name or trademark on a high-risk AI system, or
• substantially modify a high-risk system (changing its intended purpose, retraining it, or altering it so that its risk profile changes — "substantial modification" is defined in Article 3(23)), or
• change the intended purpose of a system so that it falls into a different risk category.

The practical implication for SaaS companies: if you call an OpenAI or Mistral GPAI API and expose the resulting system to customers under your brand name, you are the provider of that system under Article 25. The GPAI model vendor stays responsible for its own Chapter V obligations (Article 53 — technical documentation, downstream information, copyright policy, training-data summary), but the system you have built on top of it is yours to classify, document, and comply with. This catches founders who assume that using a third-party model means the model vendor handles compliance. It does not.

---

What Risk Tier Does Your AI Feature Sit In?

Once you know your role, you need to know the risk tier. The Act has four:

Unacceptable risk (Article 5) — banned. A short list of practices prohibited since 2 February 2025: subliminal manipulation, exploitation of vulnerabilities, social scoring, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions), certain predictive policing, and emotion recognition in workplaces and educational settings. These are hard stops. No compliance path — do not build or deploy them.

High risk (Article 6 + Annex III) — the heavy-obligation tier. If your AI system falls into one of Annex III's eight categories, the full provider or deployer obligation stack applies. For SaaS companies, the most relevant Annex III areas are:

• Point 4 — Employment, workers management and access to self-employment: recruitment and CV screening, promotion and termination recommendations, performance monitoring, task allocation. A 30-person HR-tech company selling a CV-ranking module is squarely here.
• Point 5 — Access to essential private and public services: creditworthiness assessment and credit scoring (excluding fraud detection), health and life insurance risk assessment and pricing. A fintech embedding a credit decisioning model is here. Note that point 5 also covers emergency services dispatch and eligibility for public benefits.
• Point 3 — Education and vocational training: admission and assignment, evaluation of learning outcomes, exam-proctoring systems.
• Point 1 — Biometrics: biometric categorisation, emotion recognition (where not already prohibited), and remote biometric identification.

Article 6(3) filter: even if your system's use case touches an Annex III area, it is not high-risk if it does not pose a significant risk of harm to health, safety, or fundamental rights. The Act lists four ways to qualify for this filter: the system performs a narrow procedural task; it improves the output of a previously completed human activity; it detects decision patterns without replacing or influencing human judgment; or it performs preparatory work only. However — and this is the provision that matters most in practice — any system that profiles natural persons is always high-risk, regardless of these conditions. Providers relying on the Article 6(3) exemption must document their reasoning and still register the system under Article 49.

Limited risk (Article 50) — transparency obligations only. Chatbots, systems generating synthetic text or audio, emotion-recognition systems not already prohibited, and deepfake-generating tools must disclose that users are interacting with AI or that content is AI-generated. These obligations apply from 2 August 2026. For SaaS companies, a customer-facing AI assistant is almost certainly limited-risk at minimum; the disclosure requirement is real but straightforward.

Minimal risk — no mandatory obligations. A backend anomaly-detection model that never makes autonomous decisions affecting natural persons, an internal data-processing pipeline, an infrastructure optimiser — these carry no specific Act requirements, though good governance practices still apply.

---

What GPAI Vendors Owe You — and What They Don't

If you build on a general-purpose AI model (OpenAI, Mistral, Google, Meta), that model vendor is the GPAI provider. Under Article 53, GPAI providers must give downstream companies like you technical documentation, information needed to identify and address risks in your system, and a copyright policy. You are entitled to that information; request it.

What GPAI vendors do not handle: the obligations that attach to the AI system you build. Your system's classification, your technical documentation, your conformity assessment — those are yours. The model vendor cannot comply on your behalf, and their compliance with Article 53 does not satisfy your obligations as a provider under Article 16.

---

A Practical Decision Flow

Run this for each AI system your company builds or uses:

1. Is the system's practice prohibited under Article 5? If yes, stop. Do not build or deploy.
2. Does the system's intended use fall into Annex III? Check points 1–8. Be specific about sub-point and sub-letter (a recruitment ranker is point 4(a); credit scoring is point 5(b)).
3. If yes to step 2, does the Article 6(3) filter apply? Document your reasoning. If the system profiles natural persons at any level, the filter does not apply.
4. What is your role? Did you ship this under your name (provider, Article 16)? Are you using a third-party system professionally (deployer, Article 26)? Did you build on a third-party model and expose it to customers (provider via Article 25)?
5. For limited-risk systems not caught by Annex III: does the system generate synthetic content or interact with users as a chatbot? If yes, Article 50 disclosure applies from 2 August 2026.

---

Obligation Summary by Role

As a provider of a high-risk system (Article 16 + Annex III):

Establish a risk management system (Article 9). Document training and validation data (Article 10). Compile technical documentation in the format of Annex IV (Article 11). Maintain logs (Article 12). Ensure transparency information reaches deployers (Article 13). Design human oversight into the system (Article 14). Meet accuracy and robustness requirements (Article 15). Run a conformity assessment before placing the system on the market (Article 43 — self-assessment via Annex VI for most Annex III categories; notified body via Annex VII for biometrics where harmonised standards are not applied). Issue an EU Declaration of Conformity (Article 47). Apply CE marking (Article 48). Register the system in the EU AI database (Article 49). Run post-market monitoring (Article 72). Report serious incidents to the relevant national market-surveillance authority (Article 73 — within 15 days of becoming aware, 2 days if critical infrastructure or irreversible harm, 10 days if a fatality).

The deadline for stand-alone Annex III systems: 2 December 2027, under the Digital Omnibus agreed in May 2026 (which deferred the original 2 August 2026 date). For AI embedded in regulated products under Annex I (machinery, medical devices, etc.), the deadline is 2 August 2028.

As a deployer of a high-risk system (Article 26):

Follow the provider's instructions for use. Ensure human oversight. Monitor the system in your operational context. Keep logs for at least six months (Article 26). Inform workers' representatives before workplace deployment (Article 26). For public bodies, and for deployers of creditworthiness or life/health insurance systems (Annex III points 5(b) and 5(c)), run a Fundamental Rights Impact Assessment before going live (Article 27). Report incidents and risks upward to the provider. Do not use the system for purposes other than its intended use.

---

Enterprise Buyer Questionnaires

Enterprise procurement teams in regulated sectors — banking, insurance, HR technology, healthcare — are increasingly sending AI vendor questionnaires before signing contracts. These questionnaires ask whether you have classified your AI system under Article 6, whether you hold an Article 11 technical documentation package, and whether you have run a conformity assessment under Article 43. If you cannot answer these questions, you will lose deals in regulated verticals.

The underlying logic is straightforward: under Article 26, a deployer must verify that the system they use complies with the Act. Your enterprise buyers are doing their deployer due diligence. Your compliance package is part of your sales motion, not only a legal obligation.

---

Penalties

Non-compliance with high-risk obligations — as a provider under Article 16 or a deployer under Article 26 — carries a fine ceiling of €15,000,000 or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)).

Breaching the Article 5 prohibitions raises the ceiling to €35,000,000 or 7% (Article 99(3)).

For companies that fall under the Act's definition of SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage-based or the fixed-amount figure — a meaningful proportionality protection, though not a licence to ignore the rules.

The deadline of 2 December 2027 is not as distant as it sounds. Technical documentation under Annex IV alone requires months of systematic work — tracing training data, documenting model architecture, running human-oversight tests, completing the conformity assessment. Companies that begin in late 2027 will not finish before the deadline.

---

How Confir Helps

Confir's intake walks through the provider/deployer distinction with plain-English scenarios — no EU regulation vocabulary required. For each AI system you register, the rule-based classification engine derives your role (Provider Article 16 / Deployer Article 26 / both via Article 25) and determines the risk tier (Unacceptable / High / Limited / Minimal). If your system lands in Annex III, the relevant obligation set activates automatically. The engine is deterministic: same answers produce the same output every time, which makes the classification reproducible and audit-defensible.

For providers of high-risk systems, Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V Declaration of Conformity. For deployers, it runs the Article 27 FRIA and tracks the Article 26 log-retention obligation. Pricing starts at €600 per year.

---

Frequently Asked Questions

Does the EU AI Act apply to my SaaS company if I only use AI internally, not in my product?

Yes, if you use AI in a professional context — for example, using a third-party recruitment tool to screen candidates for your own open roles — you are a deployer under Article 26. If that tool is classified as high-risk (Annex III point 4), deployer obligations apply: following instructions, human oversight, six-month log retention (Article 26), and in some contexts an Article 27 FRIA. The Act does not limit itself to AI systems sold to customers; it covers internal professional use too.

I built an AI feature using a GPAI API. Am I the provider or is the API vendor?

You are the provider. Under Article 25, when you put your name on a system — even one built entirely on a third-party model — you assume the provider obligations under Article 16. The GPAI vendor retains its own Chapter V obligations (Article 53 documentation, downstream information, copyright policy), which it must supply to you on request. But those do not substitute for your Article 11 technical documentation, your Article 43 conformity assessment, or your Article 49 registration. You build on their model; you own your system.

My AI feature touches employment decisions — is it definitely high-risk under Annex III?

Probably, but check the Article 6(3) filter first. An Annex III point 4 system is not high-risk if it performs only a narrow procedural task, improves a previously completed human activity, detects decision patterns without influencing human judgment, or does purely preparatory work. The key exception: if your system profiles natural persons at any stage, the filter does not apply and the system is high-risk regardless. Document your reasoning either way — providers claiming the Article 6(3) exemption must still register under Article 49.

What is the high-risk compliance deadline?

Under the Digital Omnibus agreed in May 2026, the deadline for stand-alone Annex III high-risk AI systems is 2 December 2027 — deferred from the original 2 August 2026 date. For high-risk AI embedded in regulated products under Annex I (machinery, medical devices, etc.), the date is 2 August 2028. Limited-risk transparency obligations under Article 50 were not deferred and apply from 2 August 2026.

What do enterprise buyers need from me as an AI vendor?

Procurement teams in regulated sectors increasingly require evidence of EU AI Act compliance before signing. They will typically ask for: your Article 6 risk classification (and supporting documentation), your Article 11 / Annex IV technical documentation pack, your Article 47 Declaration of Conformity, and confirmation of Article 43 conformity assessment completion. Under Article 26, deployers must verify that the systems they use comply — so your buyers are doing their legal duty when they ask. Treating your compliance documentation as a sales asset, not just a regulatory chore, shortens enterprise deals.

What are the penalties for non-compliance?

For breaches of high-risk obligations — provider duties under Article 16 or deployer duties under Article 26 — the maximum fine is €15,000,000 or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)). Violations of the Article 5 prohibitions carry a higher ceiling: €35,000,000 or 7% (Article 99(3)). For SMEs and start-ups, Article 99(6) caps fines at the lower of the fixed-amount or percentage-based figure.

Do I need a notified body for the conformity assessment?

For most Annex III categories (employment, education, essential services, law enforcement, migration, justice, critical infrastructure), internal self-assessment under Annex VI is sufficient — you do not need an external notified body. The notified-body route (Annex VII under Article 43) applies primarily to biometric identification systems (point 1) where you cannot rely on harmonised standards. For all other Annex III categories, a rigorous internal assessment documented in your Annex IV technical file meets the requirement.

---

Related guides

• SMB compliance obligations guide
• deployer obligations under Article 26
• Article 3 key definitions
• EU AI Act fundamentals
• provider obligations under Article 16