EU AI Act for SaaS providers: when the product itself is the AI system
Updated: 2026-09
Building an AI feature into a SaaS product generally makes the vendor a provider under the EU AI Act — with broader duties than a mere user. At the same time, enterprise buyers increasingly ask for exactly that evidence in procurement.
Almost every SaaS product now has an AI feature: an assistant, a summary, a classification, a prediction. For the vendor that changes the role fundamentally. They do not merely use AI, they place it on the market — and become a provider under the AI Act.
The provider role is the more demanding side of the law. Depending on risk classification it covers technical documentation, risk management, transparency toward users, and requirements on oversight and logging.
Commercial pressure usually arrives before regulatory pressure. Enterprise procurement and public buyers ask about the classification of AI features during the buying process. A vendor who cannot answer loses the deal long before any supervisor gets in touch.
How it works
- 01
Delimit the AI features in the product
Name clearly which features are AI systems in the sense of the law — and which are plain rule logic, even where marketing calls them AI.
- 02
Record the purpose per feature
Classification follows purpose. A summary is not the same as an assessment of people or a decision recommendation.
- 03
Classify under Article 6
Assess per feature and record the reasoning, not just the result.
- 04
Implement transparency in the product
Establish where users must be informed about the AI, and anchor those notices in the interface rather than burying them in the terms.
- 05
Prepare evidence for procurement
Keep an exportable report that can be presented in a customer’s buying process.
- 06
Tie it to the release process
New AI features ship continuously. Classification belongs in the definition of done, not in a compliance project.
Why it fits here
Verifiable public compliance URLs address exactly the commercial case: a customer can check the status without anybody digging out a PDF.
Article 6 classification in minutes fits a SaaS release rhythm — an assessment that takes weeks gets skipped.
Team workspaces let product, legal and engineering work on the same evidence instead of maintaining three versions.
FAQ
Do we really become a provider?
Generally yes, if you place an AI system on the market under your own name — even where the underlying model comes from a third party. Classification settles the specific assessment.
Does a bought-in model inside our product count?
The model comes from a third party, but you offer the system. That constellation is the norm and generally does not change the provider role.
What do enterprise customers actually ask for?
Usually a traceable classification of the AI features and evidence that the duties are addressed. Commercial time pressure almost always precedes regulatory pressure.
Must we classify every small AI feature?
Every AI system in the sense of the law, yes, but the depth follows the risk. Many features fall into low categories with correspondingly little effort.
Does this replace legal advice?
No. You get structured classification and documentation; on sensitive borderline cases, legal advice remains sensible.
AI Risk Check
Verifiable public compliance URLs address exactly the commercial case: a customer can check the status without anybody digging out a PDF.
Article 6 classification in minutes fits a SaaS release rhythm — an assessment that takes weeks gets skipped.
Team workspaces let product, legal and engineering work on the same evidence instead of maintaining three versions.