EU AI Act for SaaS

If you SHIP an AI system or feature in your SaaS — you're a PROVIDER (Article 3(3)). If you USE someone else's AI system in your business — you're a DEPLOYER (Article 3(4)). If you train + ship a foundation/general-purpose model — you're a GPAI provider (Articles 51-55). Most B2B SaaS with AI features land squarely in PROVIDER role for their own model + DEPLOYER for any third-party model they integrate. You can be all three at once.

Article 4 (literacy) since 2 February 2025 — your staff need a documented AI training programme. Article 5 (prohibited practices) — fully in force, no manipulative AI / social scoring / etc. GPAI obligations 51-55 — if you ship a foundation model. Article 50 (watermarking) — 2 Aug 2026 if you ship generative outputs. NIS2 (where transposed) — Germany 17 Oct 2026, depends on member state.

Probably not — most B2B SaaS with AI features (productivity tools, CRM AI, dev tools, design tools) is NOT Annex III high-risk. Annex III(1)-(8) covers specific use-cases: biometric ID, critical infrastructure, education, employment, essential services, law enforcement, migration/border control, justice. If your SaaS is used by customers IN those domains, you may face deployer-side obligations downstream — your customers will push them back through contract.

Annex III high-risk obligations now apply 2 December 2027 (was 2 August 2026). Annex I product-safety AI now 2 August 2028. Article 50 watermarking applies 2 August 2026. Article 4, Article 5, and GPAI 51-55 are already in force. For most SaaS the only thing that changed is that the high-risk classification work has 16 more months — which means you have time to GET classified properly + ship evidence on day one when obligations bite.

Free 90-second readiness scorecard at /scorecard with signed attestation. Article 50 watermark starter kit £99 if you ship generative outputs. /transparency £399/mo for instructions-for-use + decision-trace logging. /audit-prep-bundle £4,950 if you need full evidence pack for enterprise customer due-diligence. All MIT-licensed MCPs on PyPI you can self-host.