If you have built an AI feature into a SaaS product (a chatbot, lead scoring, meeting summaries), the AI Act most likely applies to you even if the model is someone else’s. Transparency rules have applied since 2 August 2026, while the heaviest high-risk obligations are postponed to December 2027. We go through the provider and deployer roles, the deadlines after the Digital Omnibus, fines and an eight-step checklist.
Checked on 21 October 2026. Rules and sources are current as of this date.
“We just use an API” is not a defence
That is a misconception. Under Art. 3(3) of the AI Act, whoever places an AI system on the market under its own name or brand is a provider, whoever owns the underlying model. The provider carries most of the obligations.
The calendar was changed by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026). The general application date of 2 August 2026 stayed, but the heaviest high-risk obligations were postponed. Transparency did not move, and it is the part most often missed.
AI Act deadlines after the Digital Omnibus
Provider or deployer
Provider
Develops a system or places it on the market under its own name. More obligations: classification, technical documentation, risk management, human oversight, post-market monitoring.
Deployer
Uses the system in its own activity. Fewer obligations: staff AI literacy, transparency and, for high-risk systems, logs.
If you substantially modify someone else’s high-risk system, fine-tune it or ship it under your brand, you become the provider with all the obligations.
We will review your situation and propose a solution for your project.
EU AI Act checklist: 8 steps for a SaaS company
Build an AI system register
Everything you develop, buy or embed, including features inside the tools your teams use. For each: owner, purpose, data, audience, vendor.
Start hereDetermine your role for each system
One company can be the provider of one system and the deployer of another.
Check for prohibited practices (Art. 5)
They have applied since 2025 and carry the highest fines. If anything like this is in your product, it is priority one.
UrgentClassify against Annex III
Most relevant: HR (candidate scoring, CV ranking), credit scoring and insurance, education, biometrics. If you fall under Annex III, prepare documentation for December 2027.
Meet the Art. 50 requirements
People must be able to tell they are interacting with AI unless it is obvious. Generated content must be marked in a machine-readable way and deepfakes disclosed. In practice, tell your clients which features use AI.
Applies nowFor high-risk, prepare Annex IV documentation
Functions and limits, training data, cybersecurity, post-market monitoring. You also need a conformity assessment and EU database registration.
Rework your contracts
With model vendors: roles, compliance warranties, documentation and incidents. With clients: liability for AI outputs and regulatory assurances. We help under Contracts and documents.
Ensure staff AI literacy (Art. 4)
After the Omnibus it is enough to take measures supporting it. Still, document training, policies and instructions.
Without an AI system register you cannot determine either your role or the risk class. Every other step builds on those two answers.
Case analysis
A SaaS company builds a chat assistant on a third-party API (application programming interface) into its product and sells it under its own brand to European customers. It considers itself merely an API user. A sensible order of action is to determine its role (provider or deployer), check its transparency obligations, ensure users are told they are talking to an AI, and record the allocation of responsibility with the API vendor.
What a mistake costs
Maximum fine for prohibited practices or 7% of worldwide turnover, whichever is higher. For SMEs and startups the lower of the two applies.
These are ceilings, not automatic penalties: proportionality is taken into account.
The AI Act does not ask whether your AI is good. It asks whether you can prove it.The LegalBit team
If you already have ISO 42001 or SOC 2
You are not starting from zero: risk management, data governance, transparency and oversight partly overlap with the AI Act.
But a certificate does not replace the Regulation’s requirements. Log retention for at least six months, Annex IV documentation, conformity assessment and registration for high-risk systems remain. More on our work: legal support for AI and ML projects.
Frequently asked questions
Does the AI Act apply if the company is outside the EU?
Yes, if your AI systems are used in the EU or affect people in the EU.
I use the OpenAI API: am I a provider or a deployer?
If you ship the feature under your own brand, you are generally the provider of that AI system.
When do the high-risk requirements start?
For Annex III systems: 2 December 2027. For those embedded in regulated products (Annex I): 2 August 2028.
Is ISO 42001 enough for AI Act compliance?
No, but it covers a significant part of the requirements and speeds up preparation. AI Act-specific requirements, such as Annex IV documentation and conformity assessment, remain.
See also: Terms of Service & Privacy Policy: Why “Copy & Paste” Is the Worst Strategy for Your Project; AI-Generated Content and Copyright: Who Owns the Rights to Generated Texts and Images?; Hiring a Software Contractor: Who Owns the Code. Services: legal services for IT and SaaS.
This is what we do
How we help projects with this topic:
