{"id":6895,"date":"2026-10-19T01:30:35","date_gmt":"2026-10-18T22:30:35","guid":{"rendered":"https:\/\/legalbit.top\/en\/ai-act-checklist-saas\/"},"modified":"2026-10-23T15:59:51","modified_gmt":"2026-10-23T12:59:51","slug":"ai-act-checklist-saas","status":"publish","type":"post","link":"https:\/\/legalbit.top\/en\/ai-act-checklist-saas\/","title":{"rendered":"EU AI Act checklist for IT companies and SaaS developers"},"content":{"rendered":"\n<div class=\"lbm\"><svg width=\"0\" height=\"0\" style=\"position:absolute\" aria-hidden=\"true\"><symbol id=\"i-list\" viewBox=\"0 0 24 24\"><path d=\"M9 6h11M9 12h11M9 18h11\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/symbol><symbol id=\"i-user\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21c0-4 3.6-7 8-7s8 3 8 7\"\/><\/symbol><symbol id=\"i-ban\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M5.6 5.6l12.8 12.8\"\/><\/symbol><symbol id=\"i-layers\" viewBox=\"0 0 24 24\"><path d=\"M12 3l9 5-9 5-9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/symbol><symbol id=\"i-eye\" viewBox=\"0 0 24 24\"><path d=\"M2 12s4-7 10-7 10 7 10 7-4 7-10 7S2 12 2 12z\"\/><circle cx=\"12\" cy=\"12\" r=\"3\"\/><\/symbol><symbol id=\"i-doc\" viewBox=\"0 0 24 24\"><path d=\"M7 3h8l4 4v14H7z\"\/><path d=\"M15 3v4h4M10 12h6M10 16h6\"\/><\/symbol><symbol id=\"i-pen\" viewBox=\"0 0 24 24\"><path d=\"M4 20l4-1 11-11-3-3L5 16z\"\/><path d=\"M14 6l3 3\"\/><\/symbol><symbol id=\"i-book\" viewBox=\"0 0 24 24\"><path d=\"M4 5a2 2 0 0 1 2-2h13v16H6a2 2 0 0 0-2 2z\"\/><path d=\"M4 19V5\"\/><\/symbol><symbol id=\"i-alert\" viewBox=\"0 0 24 24\"><path d=\"M12 3l10 18H2z\"\/><path d=\"M12 10v4M12 17.5h.01\"\/><\/symbol><symbol id=\"i-bulb\" viewBox=\"0 0 24 24\"><path d=\"M9 18h6M10 21h4\"\/><path d=\"M12 3a6 6 0 0 0-3.5 10.9c.6.5 1 1.2 1 2.1h5c0-.9.4-1.6 1-2.1A6 6 0 0 0 12 3z\"\/><\/symbol><symbol id=\"i-info\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 11v5M12 8h.01\"\/><\/symbol><\/svg><section class=\"lbm-intro\"><div class=\"lbm-intro-main\"><p class=\"lbm-lead\">If you have built an AI feature into a SaaS product (a chatbot, lead scoring, meeting summaries), the AI Act most likely applies to you even if the model is someone else\u2019s. Transparency rules have applied since 2 August 2026, while the heaviest high-risk obligations are postponed to December 2027. We go through the provider and deployer roles, the deadlines after the Digital Omnibus, fines and an eight-step checklist.<\/p><p class=\"lbm-verified\">Checked on 21 October 2026. Rules and sources are current as of this date.<\/p><ul class=\"lbm-toc\"><li><a href=\"#why\">Does it apply to you<\/a><\/li><li><a href=\"#dates\">Deadlines<\/a><\/li><li><a href=\"#roles\">Roles<\/a><\/li><li><a href=\"#steps\">Checklist<\/a><\/li><li><a href=\"#case\">Case analysis<\/a><\/li><li><a href=\"#fines\">Fines<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ul><\/div><\/section><section id=\"why\"><h2>\u201cWe just use an API\u201d is not a defence<\/h2><div class=\"lbm-cols\"><p>That is a misconception. Under Art. 3(3) of the AI Act, whoever places an AI system on the market under its own name or brand is a provider, whoever owns the underlying model. The provider carries most of the obligations.<\/p><p>The calendar was changed by the Digital Omnibus (Regulation (EU) 2026\/1744, in force since 27 July 2026). The general application date of 2 August 2026 stayed, but the heaviest high-risk obligations were postponed. Transparency did not move, and it is the part most often missed.<\/p><\/div><\/section><section id=\"dates\"><h2>AI Act deadlines after the Digital Omnibus<\/h2><div class=\"lbm-tl\"><div class=\"lbm-row\"><div class=\"lbm-d\">2 February 2025<\/div><div class=\"lbm-w\">Prohibited practices (Art. 5)<span class=\"lbm-chip done\">in force<\/span><\/div><div class=\"lbm-f\">Social scoring, untargeted facial scraping, emotion recognition at work and in education.<\/div><\/div><div class=\"lbm-row\"><div class=\"lbm-d\">2 August 2025<\/div><div class=\"lbm-w\">GPAI (general-purpose AI) model providers<span class=\"lbm-chip done\">in force<\/span><\/div><div class=\"lbm-f\">For those who release foundation models, not those who use their APIs.<\/div><\/div><div class=\"lbm-row now\"><div class=\"lbm-d\">2 August 2026<\/div><div class=\"lbm-w\">Transparency (Art. 50)<span class=\"lbm-chip on\">applies to you now<\/span><\/div><div class=\"lbm-f\">Affects almost every SaaS. This is what most often gets forgotten.<\/div><\/div><div class=\"lbm-row\"><div class=\"lbm-d\">2 December 2026<\/div><div class=\"lbm-w\">Content marking, new prohibitions<span class=\"lbm-chip soon\">soon<\/span><\/div><div class=\"lbm-f\">Grace period under Art. 50(2) for systems placed on the market before 2 August 2026. New prohibitions: intimate deepfakes and child abuse material.<\/div><\/div><div class=\"lbm-row\"><div class=\"lbm-d\">2 December 2027<\/div><div class=\"lbm-w\">High-risk, Annex III<span class=\"lbm-chip later\">later<\/span><\/div><div class=\"lbm-f\">HR, credit and education scoring. Was August 2026.<\/div><\/div><div class=\"lbm-row\"><div class=\"lbm-d\">2 August 2028<\/div><div class=\"lbm-w\">High-risk, Annex I<span class=\"lbm-chip later\">later<\/span><\/div><div class=\"lbm-f\">AI in regulated products.<\/div><\/div><\/div><\/section><figure class=\"lbm-brk\"><img decoding=\"async\" src=\"https:\/\/legalbit.top\/wp-content\/uploads\/2026\/10\/eu-ai-act-saas-checklist2.webp\" alt=\"Neural network, checklist document and shield inside a ring of EU stars: AI Act compliance\" width=\"1600\" height=\"497\" loading=\"lazy\"><\/figure><section id=\"roles\"><h2>Provider or deployer<\/h2><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>Provider<\/h3><p>Develops a system or places it on the market under its own name. More obligations: classification, technical documentation, risk management, human oversight, post-market monitoring.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Deployer<\/h3><p>Uses the system in its own activity. Fewer obligations: staff AI literacy, transparency and, for high-risk systems, logs.<\/p><\/div><\/div><div class=\"lbm-co dark\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><div><b>Trap<\/b><p>If you substantially modify someone else\u2019s high-risk system, fine-tune it or ship it under your brand, you become the provider with all the obligations.<\/p><\/div><\/div><\/section><div class=\"lbm-svc\"><div><b>Need help with this topic?<\/b><p>We will review your situation and propose a solution for your project.<\/p><\/div><a class=\"lbm-svc-btn popmake-4929\" href=\"#\" role=\"button\">Contact us<\/a><\/div><section id=\"steps\"><h2>EU AI Act checklist: 8 steps for a SaaS company<\/h2><ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-list\"\/><\/svg><\/span><div><h3>Build an AI system register<\/h3><p>Everything you develop, buy or embed, including features inside the tools your teams use. For each: owner, purpose, data, audience, vendor.<\/p><span class=\"lbm-tag\">Start here<\/span><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Determine your role for each system<\/h3><p>One company can be the provider of one system and the deployer of another.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><div><h3>Check for prohibited practices (Art. 5)<\/h3><p>They have applied since 2025 and carry the highest fines. If anything like this is in your product, it is priority one.<\/p><span class=\"lbm-tag must\">Urgent<\/span><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><div><h3>Classify against Annex III<\/h3><p>Most relevant: HR (candidate scoring, CV ranking), credit scoring and insurance, education, biometrics. If you fall under Annex III, prepare documentation for December 2027.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><div><h3>Meet the Art. 50 requirements<\/h3><p>People must be able to tell they are interacting with AI unless it is obvious. Generated content must be marked in a machine-readable way and deepfakes disclosed. In practice, tell your clients which features use AI.<\/p><span class=\"lbm-tag must\">Applies now<\/span><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><div><h3>For high-risk, prepare Annex IV documentation<\/h3><p>Functions and limits, training data, cybersecurity, post-market monitoring. You also need a conformity assessment and EU database registration.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-pen\"\/><\/svg><\/span><div><h3>Rework your contracts<\/h3><p>With model vendors: roles, compliance warranties, documentation and incidents. With clients: liability for AI outputs and regulatory assurances. We help under <a href=\"\/en\/legal-documents\/\">Contracts and documents<\/a>.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-book\"\/><\/svg><\/span><div><h3>Ensure staff AI literacy (Art. 4)<\/h3><p>After the Omnibus it is enough to take measures supporting it. Still, document training, policies and instructions.<\/p><\/div><\/li><\/ol><div class=\"lbm-co soft\"><span class=\"lbm-ico\"><svg><use href=\"#i-bulb\"\/><\/svg><\/span><div><b>Tip<\/b><p>Without an AI system register you cannot determine either your role or the risk class. Every other step builds on those two answers.<\/p><\/div><\/div><\/section><section id=\"case\"><h2>Case analysis<\/h2><div class=\"lbm-co soft\"><span class=\"lbm-ico\"><svg><use href=\"#i-bulb\"\/><\/svg><\/span><div><b>Hypothetical example, not a real case<\/b><p>A SaaS company builds a chat assistant on a third-party API (application programming interface) into its product and sells it under its own brand to European customers. It considers itself merely an API user. A sensible order of action is to determine its role (provider or deployer), check its transparency obligations, ensure users are told they are talking to an AI, and record the allocation of responsibility with the API vendor.<\/p><\/div><\/div><\/section><section id=\"fines\"><h2>What a mistake costs<\/h2><div class=\"lbm-fig\"><div class=\"lbm-n\">35<small>M \u20ac<\/small><\/div><p><b>Maximum fine for prohibited practices<\/b> or 7% of worldwide turnover, whichever is higher. For SMEs and startups the lower of the two applies.<\/p><div class=\"lbm-bars\"><div><div class=\"lbm-bh\"><div>Prohibited practices (Art. 5)<\/div><span>\u20ac35M \u00b7 7%<\/span><\/div><div class=\"lbm-bar \"><i style=\"width:100%\"><\/i><\/div><\/div><div><div class=\"lbm-bh\"><div>Other obligations, including Art. 50<\/div><span>\u20ac15M \u00b7 3%<\/span><\/div><div class=\"lbm-bar m\"><i style=\"width:43%\"><\/i><\/div><\/div><div><div class=\"lbm-bh\"><div>Incorrect information to the regulator<\/div><span>\u20ac7.5M \u00b7 1%<\/span><\/div><div class=\"lbm-bar l\"><i style=\"width:21%\"><\/i><\/div><\/div><\/div><\/div><p style=\"margin:18px 0 0;max-width:64ch\">These are ceilings, not automatic penalties: proportionality is taken into account.<\/p><\/section><figure class=\"lbm-pull\"><q>The AI Act does not ask whether your AI is good. It asks whether you can prove it.<\/q><cite>The LegalBit team<\/cite><\/figure><section><h2>If you already have ISO 42001 or SOC 2<\/h2><div class=\"lbm-cols\"><p>You are not starting from zero: risk management, data governance, transparency and oversight partly overlap with the AI Act.<\/p><p>But a certificate does not replace the Regulation\u2019s requirements. Log retention for at least six months, Annex IV documentation, conformity assessment and registration for high-risk systems remain. More on our work: <a href=\"\/en\/ai-ml-legal-services\/\">legal support for AI and ML projects<\/a>.<\/p><\/div><\/section><section id=\"faq\"><h2>Frequently asked questions<\/h2><div class=\"lbm-faq\"><details><summary>Does the AI Act apply if the company is outside the EU?<\/summary><p>Yes, if your AI systems are used in the EU or affect people in the EU.<\/p><\/details><details><summary>I use the OpenAI API: am I a provider or a deployer?<\/summary><p>If you ship the feature under your own brand, you are generally the provider of that AI system.<\/p><\/details><details><summary>When do the high-risk requirements start?<\/summary><p>For Annex III systems: 2 December 2027. For those embedded in regulated products (Annex I): 2 August 2028.<\/p><\/details><details><summary>Is ISO 42001 enough for AI Act compliance?<\/summary><p>No, but it covers a significant part of the requirements and speeds up preparation. AI Act-specific requirements, such as Annex IV documentation and conformity assessment, remain.<\/p><\/details><\/div><p class=\"lbm-more\"><b>See also: <\/b><a href=\"\/en\/terms-of-service-privacy-policy\/\">Terms of Service &#038; Privacy Policy: Why \u201cCopy &#038; Paste\u201d Is the Worst Strategy for Your Project<\/a>; <a href=\"\/en\/ai-kontent-i-avtorskoe-pravo-komu-prinadlezhat-prava-na-sgenerirovannye-teksty-i-izobrazheniya\/\">AI-Generated Content and Copyright: Who Owns the Rights to Generated Texts and Images?<\/a>; <a href=\"\/en\/software-contractor-ip-contract\/\">Hiring a Software Contractor: Who Owns the Code<\/a>. Services: <a href=\"\/en\/it-saas-legal-services\/\">legal services for IT and SaaS<\/a>.<\/p><div class=\"lbm-src\"><b>Sources<\/b><ul><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" rel=\"nofollow noopener\" target=\"_blank\">EUR-Lex: Regulation (EU) 2024\/1689 (AI Act)<\/a><\/li><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2026\/1744\/oj\" rel=\"nofollow noopener\" target=\"_blank\">EUR-Lex: Regulation (EU) 2026\/1744 (Digital Omnibus on AI)<\/a><\/li><\/ul><\/div><\/section><\/div>\n\n\n\n<div class=\"lb-ac\"><h2>This is what we do<\/h2><p>How we help projects with this topic:<\/p><ul><li><a href=\"\/en\/ai-ml-legal-services\/\">Legal support for AI and ML projects<\/a><\/li><li><a href=\"\/en\/legal-documents\/\">Contracts and documents<\/a><\/li><\/ul><\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"BlogPosting\",\"headline\":\"EU AI Act checklist for IT companies and SaaS developers\",\"description\":\"EU AI Act for IT and SaaS companies: provider vs deployer roles, 2 Aug 2026 and 2 Dec 2027 deadlines, fines up to \u20ac35M and an 8-step checklist.\",\"url\":\"https:\/\/legalbit.top\/en\/ai-act-checklist-saas\/\",\"mainEntityOfPage\":\"https:\/\/legalbit.top\/en\/ai-act-checklist-saas\/\",\"image\":\"https:\/\/legalbit.top\/wp-content\/uploads\/2026\/10\/eu-ai-act-saas-checklist.webp\",\"datePublished\":\"2026-10-19T00:00:00Z\",\"dateModified\":\"2026-10-18T22:58:35Z\",\"inLanguage\":\"en\",\"author\":{\"@type\":\"Organization\",\"name\":\"LegalBit\",\"url\":\"https:\/\/legalbit.top\/\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"LegalBit\",\"url\":\"https:\/\/legalbit.top\/\"}}<\/script>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Does the AI Act apply if the company is outside the EU?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, if your AI systems are used in the EU or affect people in the EU.\"}},{\"@type\":\"Question\",\"name\":\"I use the OpenAI API: am I a provider or a deployer?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If you ship the feature under your own brand, you are generally the provider of that AI system.\"}},{\"@type\":\"Question\",\"name\":\"When do the high-risk requirements start?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"For Annex III systems: 2 December 2027. For those embedded in regulated products (Annex I): 2 August 2028.\"}},{\"@type\":\"Question\",\"name\":\"Is ISO 42001 enough for AI Act compliance?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No, but it covers a significant part of the requirements and speeds up preparation. AI Act-specific requirements, such as Annex IV documentation and conformity assessment, remain.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>How the AI Act affects IT and SaaS companies: provider and deployer roles, deadlines after the Digital Omnibus, fines and an 8-step checklist.<\/p>\n","protected":false},"author":1,"featured_media":6899,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[129,115,112,130,73],"post_folder":[],"class_list":["post-6895","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it","tag-ai-act","tag-compliance","tag-eu","tag-saas","tag-ai"],"_links":{"self":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/6895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/comments?post=6895"}],"version-history":[{"count":27,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/6895\/revisions"}],"predecessor-version":[{"id":8152,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/6895\/revisions\/8152"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media\/6899"}],"wp:attachment":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media?parent=6895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/categories?post=6895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/tags?post=6895"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/post_folder?post=6895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}