Does the EU AI Act apply to SaaS companies outside the EU?

It may. Territorial scope can cover providers placing AI systems or GPAI models on the Union market regardless of establishment, EU-established deployers, and certain non-EU operators whose AI output is used in the Union. Having EU customers is not, by itself, a final determination.

Is every AI-powered SaaS product considered high-risk?

No. High-risk classification follows Article 6 routes (including Annex III intended-purpose analysis and possible derogations). A chatbot or writing assistant is not automatically high-risk because it uses AI.

What is the difference between an AI provider and deployer?

A provider develops an AI system (or has it developed) and places it on the market or puts it into service under its name. A deployer uses an AI system under its authority in a professional context. The same startup can be both for different systems.

Does using OpenAI or another third-party LLM make my startup a GPAI model provider?

Usually not by API use alone. GPAI model provider duties target those who place general-purpose AI models on the Union market. Fine-tuning, rebranding, or offering a model under your own name can change the analysis — review the facts.

Do startups need to disclose AI chatbots?

Article 50 can require informing people they interact with AI when that is not obvious, with conditions and exceptions. Whether your chatbot engages that duty depends on how it is designed and used. It is not a rule that every AI feature needs the same label.

Do small businesses have exemptions under the EU AI Act?

The Act is risk- and role-based rather than a simple SME free pass. Some measures and support contexts recognize SMEs, but you should not assume a blanket exemption from applicable obligations. Check the specific provision that may apply to your case.

When do EU AI Act obligations apply?

In stages. Literacy and most prohibitions have applied since 2 February 2025; GPAI model-provider rules since 2 August 2025; most remaining rules including Article 50 transparency since 2 August 2026; further transitions in December 2026; core Annex III high-risk obligations from 2 December 2027; Annex I product-embedded rules from 2 August 2028. Confirm against official timeline sources.

How can a startup prepare for EU AI Act compliance?

Inventory AI uses, map roles, screen applicability and risk, identify engaged obligations, assign owners, keep proportionate evidence, and reassess when the product or vendors change. Use the free Checker, Website Scanner, and Audit Assessment to structure the work — then get specialist review where stakes are high.

Does AuditBird certify EU AI Act compliance?

No. AuditBird does not certify compliance, issue official assessments, or replace legal counsel. Free tools are informational planning aids.

Can I use the free tools without creating an account?

Yes. The Checker, Website Scanner, and Audit Readiness Assessment do not require an account or email to see results.

For founders, CTOs, and lean SaaS teams

EU AI Act Compliance for Startups

EU AI Act compliance for startups, without the enterprise complexity.

Building or using AI in your SaaS product? Understand which EU AI Act obligations may apply, what your team should prioritize, and how to start preparing without building an oversized compliance program.

Practical guidance for SaaS teams
Official EU legal references
Free assessment tools

Check Your AI Act Obligations Explore the Startup Guide →

This page provides general informational guidance for startups and SaaS teams. It is not legal advice, an official EU assessment, certification, or a determination of compliance. Obligations are fact-specific.

Does the EU AI Act apply to your startup?

Applicability is not automatic from “we use AI.” It depends on several factors — and being small does not create a blanket exemption.

Your legal role

Whether you provide, deploy, import, distribute, or otherwise operate in a legally relevant role for a given AI system or model.

Intended purpose & system type

What the AI is meant to do, whether it is an AI system or a general-purpose AI model, and the applicable risk analysis.

Territorial scope

Whether systems or models are placed on the EU market, used in the EU, or produce output used in the Union — review Article 2 carefully.

Exemptions and exclusions

Some activities fall outside scope or benefit from specific conditions. Do not invent exemptions; check the provision that may apply.

Source: Article 2 · Source: Article 3

Not sure whether the Act applies? Use our free EU AI Act Checker

Provider versus deployer roles

Role classification depends on the actual business arrangement and legal definitions — not on whether you “feel like” a platform company.

AI provider

You may qualify when you develop an AI system — or have one developed — and place it on the market or put it into service under your name or trademark. Offering an AI feature in your SaaS product can engage this analysis even if the underlying model is third-party.

AI deployer

You may be a deployer when you use an AI system under your company’s authority — including third-party integrations and internal business tools. Personal, non-professional use is a different analysis.

GPAI model provider

Building an application on a third-party foundation model does not automatically make you a general-purpose AI model provider. Chapter V focuses on those who place GPAI models on the Union market. Fine-tuning or offering a model under your own name can change the facts.

One company may have different roles for different AI systems — for example providing a customer-facing assistant while deploying a third-party coding tool internally.

Role	Typical startup example	Key questions	Potential responsibilities	Source
AI system provider	You develop an AI-powered feature and offer it in your SaaS product under your brand.	Did you develop it (or have it developed)? Is it placed on the market or put into service under your name?	Role-dependent duties that can include design, documentation, and transparency — intensity depends on risk classification.	Article 3, Article 2
AI deployer	You use a third-party AI tool under company authority for support, hiring ops, or internal copilots.	Is use professional/under your authority? What instructions and oversight do you apply?	May include literacy, use according to instructions, oversight, and certain Article 50 deployer disclosures where engaged.	Article 3, Article 4, Article 50
GPAI model provider	You place a general-purpose model on the Union market — not merely call a vendor API from your app.	Are you providing the model itself, or building an application on someone else’s model?	Chapter V model-provider duties may apply. Using OpenAI/Anthropic/etc. as a customer is usually a different role analysis.	Article 53 / Chapter V (GPAI), Article 3
Multiple roles	You provide a customer-facing AI assistant and separately deploy a third-party coding assistant internally.	Which role applies to each system? Have owners been named per system?	Obligations are assessed per system and activity — one company can wear different hats for different AI uses.	Article 3, Article 2

Real-world SaaS startup scenarios

Orientation examples — not definitive legal classifications. Investigate the facts of your product before you treat any card as “your answer.”

SaaS product with an AI chatbot

You add a customer-support chatbot powered by a third-party LLM into your SaaS product.

Possible relevance. May raise provider/deployer role questions and Article 50 interaction transparency — high-risk classification is not automatic from chatbot use alone.

Investigate

• Who offers the chatbot under whose brand?
• Are users informed they interact with AI when it is not obvious?
• What does the model vendor contractually cover — and what remains yours?
• Is the intended purpose support automation, or something closer to regulated decision-making?

Next action. Scan public website signals, then run the Checker for role and transparency prompts.

Source: Article 3 · Source: Article 50

Scan Your Website →

AI-powered recruitment software

You develop AI features used for candidate screening or employment-related decisions.

Possible relevance. May engage Annex III employment themes and Article 6 classification analysis. Intended purpose and exceptions matter — high-risk status is not automatic for every hiring helper.

Investigate

• What decisions does the system materially influence?
• Are you the provider of the system or a deployer of a third-party tool?
• What human oversight exists before outcomes affect candidates?
• Do you need specialist legal and technical review before treating this as high-risk or not?

Next action. Use the Checker to surface role and high-risk investigation prompts — not a final classification.

Source: Annex III · Source: Article 6

Check Applicable Obligations →

AI writing assistant

You offer an AI content-generation product for marketing, docs, or support drafts.

Possible relevance. Provider/deployer distinctions and possible Article 50 synthetic-content or interaction duties may matter. Building on a foundation model does not automatically make you a GPAI model provider.

Investigate

• Do you place an AI system on the market under your name?
• Does the product interact with people in ways that trigger transparency duties?
• Who provides the underlying model, and what do you modify?
• Are deepfake-like or public-interest use cases in scope for your customers?

Next action. Run the Checker, then review vendor documentation for the model you use.

Source: Article 3 · Source: Article 50

Check Applicable Obligations →

Internal AI productivity tools

Your team uses AI for documentation, meeting summaries, and employee productivity.

Possible relevance. Often a deployer-leaning analysis with AI literacy, data governance, privacy, and vendor review — not every internal use case is high-risk.

Investigate

• Which tools are used under company authority, including contractors?
• What data may be pasted into third-party models?
• Have you given proportionate AI literacy guidance to people who use these tools?
• Is any internal use drifting into employment evaluation or other sensitive purposes?

Next action. Assess readiness for literacy, ownership, and vendor hygiene with the Audit Assessment.

Source: Article 4 · Source: Article 3

Run Audit Readiness Assessment →

AI-powered customer scoring

You use AI to score leads, accounts, or commercial opportunities.

Possible relevance. Classification depends on actual purpose and context. Ordinary commercial lead scoring is not automatically the same as regulated creditworthiness or other Annex III essential-services uses.

Investigate

• What outcome does the score drive — marketing prioritization or access to essential services?
• Does the intended purpose match an Annex III theme after Article 6 analysis?
• Who relies on the score, and with what human review?
• Are personal data processed in ways that also engage GDPR?

Next action. Map intended purpose carefully in the Checker before assuming high-risk status.

Source: Annex III · Source: Article 6

Check Applicable Obligations →

Startup developing its own AI model

You develop and place a model on the market, alone or as part of a product.

Possible relevance. Distinguish an AI system from a general-purpose AI model. GPAI Chapter V duties attach to model providers under specific conditions — a separate applicability assessment is required.

Investigate

• Are you placing a GPAI model on the Union market, or an AI system that uses one?
• Do documentation, transparency, and copyright-related GPAI duties potentially apply?
• Have you substantially modified or rebranded a third-party model?
• What evidence would a specialist need to review role and model vs system lines?

Next action. Use the Checker for role prompts, then plan documentation ownership in the Audit Assessment.

Source: Article 53 / Chapter V (GPAI) · Source: Article 3

Run Audit Readiness Assessment →

EU AI Act risk categories for startups

The familiar “minimal risk” label is often descriptive marketing language — not a universal statutory classification process. Focus on intended purpose and context.

Prohibited practices

Certain AI practices are banned when the legal conditions are met. This is not a list of every biometric or “sensitive” feature — the prohibition is specific and often includes exceptions.

Most Chapter II prohibitions have applied since 2 February 2025. Certain additional Article 5 points apply from 2 December 2026.

Source: Article 5 · Source: Article 113

High-risk AI systems

A system may be high-risk because it is a safety component of a regulated product (Annex I route) or because its intended purpose falls into an Annex III use area — subject to Article 6 and possible derogations.

Core Annex III high-risk obligations: 2 December 2027. Annex I product-embedded rules: 2 August 2028. Classification review can start now.

Source: Article 6 · Source: Annex III

Transparency obligations (Article 50)

Separate duties for certain human–AI interaction, synthetic-content marking, deepfakes, public-interest text, and emotion recognition / biometric categorisation. Not every generated sentence must be labelled.

Article 50 has applied since 2 August 2026, with a limited Article 50(2) transition to 2 December 2026 for some systems already on the market.

Source: Article 50 · Source: Article 50 FAQ

Other AI systems

Many everyday uses are not high-risk. Providers and deployers may still have AI literacy duties, and Article 50 can still apply if the system interacts with people or generates certain content.

Literacy has applied since 2 February 2025; transparency since 2 August 2026 where Article 50 is engaged.

Source: Article 4 · Source: Article 50

For a structured pass on your own facts, use the free EU AI Act Checker. Broader definitions live on the EU AI Act pillar.

EU AI Act timeline

Major applicability milestones as of October 2026. Distinguishes rules already applicable from transitions and future obligations. Proposed changes that are not yet law are not treated as enacted.

1 August 2024
Applied
Regulation enters into force
Regulation (EU) 2024/1689 entered into force. Application of most obligations followed in stages.
Source: Article 113 · Source: Regulation (EU) 2024/1689 (consolidated 27 July 2026)
2 February 2025
Applied
Prohibited practices and AI literacy
Chapter I general provisions (including AI literacy) and Chapter II prohibitions became applicable.
Source: Article 113 · Source: Article 4
2 August 2025
Applied
GPAI model rules and governance
Obligations for providers of general-purpose AI models, related governance arrangements, and certain penalty rules became applicable.
Source: Article 113 · Source: Article 53 / Chapter V (GPAI)
2 August 2026
Current
General application, including transparency
The majority of the AI Act became applicable, including Article 50 transparency obligations. National and EU-level enforcement of applicable rules started for those provisions already in force.
Source: Article 113 · Source: Article 50
2 December 2026
Upcoming
Additional prohibitions and synthetic-content transition
Certain additional Article 5 prohibitions become applicable. Providers of systems already on the market before 2 August 2026 that generate synthetic content have a transitional deadline for Article 50(2) machine-readable marking.
Source: Article 113 · Source: Implementation timeline
2 December 2027
Upcoming
Annex III high-risk obligations
Core high-risk obligations for AI systems classified under Article 6(2) and Annex III (including many employment, education, credit and biometric use cases) apply from this date, following the Digital Omnibus on AI timeline update.
Source: Article 113 · Source: Annex III
2 August 2028
Upcoming
Annex I product-embedded high-risk rules
High-risk rules for AI systems that are safety components of products covered by Annex I Union harmonisation legislation apply from this date.
Source: Article 113 · Source: European Commission AI Act overview

Last verified against project sources: October 2026 · AI Act Service Desk timeline · Regulation (EU) 2024/1689

A practical EU AI Act roadmap for lean SaaS teams

Seven steps that scale with a small team. Not every step is a legally mandated standalone process for every startup — apply them where your role and risk analysis justify the work.

01
Inventory your AI use cases
List product features, internal tools, third-party services, intended purposes, and responsible owners.
02
Determine your role
For each system, assess provider, deployer, importer, distributor, or GPAI model provider — more than one can apply.
Use the Checker →
03
Review applicability and risk
Check territorial scope, intended purpose, prohibited-practice concerns, high-risk classification questions, and transparency triggers.
Use the Checker →
04
Identify applicable obligations
Separate duties that may be legally engaged from voluntary good practices you choose for customers and risk management.
Use the Checker →
05
Assign ownership
Name product, engineering, security, legal, and operations owners proportionate to how your team actually works.
Use the Audit Assessment → · Website Scanner for public signals
06
Build evidence and operational processes
Where relevant, keep decisions, disclosures, vendor records, oversight procedures, and monitoring notes — not theater binders.
Use the Audit Assessment → · Website Scanner for public signals
07
Review and update
Reassess when features, vendors, intended purposes, applicable rules, or markets change.
Use the Audit Assessment → · Website Scanner for public signals

Startup preparation checklist

Startup preparation checklist — not a certification or compliance determination. Items are planning prompts, not a claim that each is a universal legal obligation.

□ Identify AI systems and use cases
□ Document intended purposes
□ Identify relevant organizational roles
□ Review EU territorial applicability
□ Investigate potential prohibited or high-risk uses
□ Identify relevant transparency requirements
□ Review AI literacy measures
□ Identify relevant third-party AI vendors
□ Document key decisions and assumptions
□ Assign owners for relevant actions
□ Review privacy and security dependencies
□ Establish periodic reassessment

Run the Free Audit Readiness Assessment

Find the right EU AI Act tool for your startup

Three free tools with distinct jobs. None of them certify compliance or replace specialist review.

EU AI Act Checker

Question answered. Which obligations might apply to my business?

Structured informational assessment from your answers — not an official determination.

Start the Checker

AI Website Scanner

Question answered. What public AI transparency signals can be observed on my website?

Limited public-website signal review — not a legal compliance scan or score.

Scan a website

Audit Readiness Assessment

Question answered. Which governance practices have we implemented, and what should we work on next?

Self-reported readiness planning — not an official audit or conformity assessment.

Assess readiness

EU AI Act compliance costs for startups

There is no honest universal startup budget. Cost drivers vary with role, risk, complexity, and which obligations are actually engaged.

Classification & advice

Inventory work, role analysis, and legal advice where stakes or Annex III themes warrant it — not every feature needs a notified-body process.

Documentation & governance

Technical documentation, transparency measures, literacy, vendor review, and operational ownership scale with what you build and deploy.

Engineering & testing

Internal effort for safeguards, logging, oversight design, and risk management often exceeds software subscription lines.

External assessment (when relevant)

Conformity-related costs apply only where the law actually requires them for your system type. AuditBird does not eliminate legal or assessment costs.

Common startup mistakes

Practical pitfalls — not scare tactics.

Assuming the EU AI Act applies only to large enterprises

Size alone is not a blanket exemption. Applicability turns on role, activity, territorial scope, and system type.

Assuming every AI-powered SaaS product is high-risk

High-risk status depends on Article 6 routes and intended purpose. Many SaaS AI features are not Annex III systems.

Confusing an AI application provider with a GPAI model provider

Building on a third-party foundation model is usually a different analysis from placing a GPAI model on the market yourself.

Assuming a third-party AI vendor handles every obligation

Vendors may cover model or platform duties; your product, disclosures, and how you deploy tools can still create responsibilities.

Ignoring the actual intended purpose of an AI feature

Classification and transparency often turn on what the system is meant to do in practice, not the marketing label “AI.”

Treating website disclosures as the entire compliance program

Public signals matter for some Article 50 questions, but governance, literacy, and role analysis usually go further.

Treating a self-assessment score as proof of compliance

Free tools help prioritize work. They do not certify compliance or replace legal review where stakes are high.

Copying enterprise compliance processes without considering applicability

Start with inventory and role/risk questions. Build only the controls and documentation that your situation actually engages.

Build a compliance program that grows with your startup.

AuditBird is being built for lean teams managing SOC 2, ISO 27001, and emerging AI governance requirements — without the complexity of oversized enterprise compliance platforms. Planned product features and early-access pricing are separate from the free educational tools on this page.

Explore AuditBird Pricing →

AuditBird does not guarantee EU AI Act compliance, issue certifications, perform official conformity assessments, or replace legal counsel.

Legal sources

Primary references used on this page. Prefer article-level reading over homepage-only citations.

Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lex · last reviewed 2026-10-06
Article 2 — ScopeAI Act Service Desk · last reviewed 2026-10-06
Article 3 — DefinitionsAI Act Service Desk · last reviewed 2026-10-06
Article 4 — AI literacyAI Act Service Desk · last reviewed 2026-10-06
Article 5 — Prohibited AI practicesAI Act Service Desk · last reviewed 2026-10-06
Article 6 — Classification rules for high-risk AI systemsAI Act Service Desk · last reviewed 2026-10-06
Annex III — High-risk AI systems referred to in Article 6(2)AI Act Service Desk · last reviewed 2026-10-06
Article 50 — Transparency obligations for certain AI systemsAI Act Service Desk · last reviewed 2026-10-06
Article 53 — Obligations for providers of general-purpose AI modelsAI Act Service Desk · last reviewed 2026-10-06
Timeline for the implementation of the EU AI ActAI Act Service Desk · last reviewed 2026-10-06
AI Act — Shaping Europe’s digital futureEuropean Commission · last reviewed 2026-10-06

Also see the EU AI Act hub, AuditBird for startups, and AI compliance.

Questions

It can. Applicability depends on role, AI systems or models involved, territorial scope, and risk classification — not on company size alone. Being a startup is not an automatic exemption or an automatic obligation.

Start with the free tools. Join early access when you want a program home.

Use the Checker, Scanner, and Audit Assessment today. Early access is for teams that want AuditBird as compliance grows with the company.

Explore pricing →

SOC 2 · ISO 27001 · EU AI Act · More coming