EU AI Act: What Software and SaaS Companies Need to Do

The EU Artificial Intelligence Act (AI Act) is the European Union’s law on artificial intelligence. It regulates AI according to risk, from outright bans to light transparency duties, and sets rules for general-purpose AI (GPAI) models such as large language models. It applies to companies anywhere whose AI systems are placed on the EU market or whose AI outputs are used in the EU.

In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), which postponed the high-risk deadlines and made other changes. This guide reflects the amended dates.

This guide is general information, not legal advice.

What is the EU AI Act?

The AI Act is a regulation (Regulation (EU) 2024/1689), so it applies directly across the EU. It works like EU product safety law: providers must make sure their AI systems meet requirements before placing them on the market, and deployers must use them properly.

Roles

A deployer or distributor can become a provider if it puts its name on a high-risk system, substantially modifies it, or changes its intended purpose so that it becomes high-risk.

Risk categories

History and timeline

The AI Act was introduced to protect health, safety and fundamental rights from AI risks, build trust in AI, and create one set of rules across the EU instead of 27. The 2026 Omnibus delayed high-risk rules because harmonised standards and guidance weren’t ready in time.

Who needs to comply?

The AI Act applies to:

• providers placing AI systems or GPAI models on the EU market, wherever they are established;
• deployers of AI systems located in the EU;
• providers and deployers outside the EU where the AI system’s output is used in the EU;
• importers, distributors and product manufacturers.

It does not apply to AI used exclusively for military or national security purposes, to scientific research and development before market placement, or to purely personal non-professional use.

Edtech note. Annex III lists AI used to determine access or admission, evaluate learning outcomes, assess the appropriate level of education, and monitor prohibited behaviour during tests. LMS and edtech companies should check AI features against this list carefully.

Is it mandatory?

Yes, for those in scope. Maximum fines:

For SMEs and start-ups, the lower of the amount or percentage applies. GPAI model providers can be fined by the Commission up to EUR 15 million or 3%.

Key requirements

For everyone

• No prohibited practices (since 2 February 2025).
• AI literacy (Article 4): after the Omnibus, providers and deployers must take measures to support AI literacy among staff and others operating AI on their behalf. No specific level is mandated.

Transparency (Article 50)

• Providers must design AI systems that interact with people so users are told they are interacting with AI, unless obvious.
• Providers of generative AI must mark outputs (audio, image, video, text) in a machine-readable format as AI-generated.
• Deployers of deepfakes must disclose that content is AI-generated or manipulated; deployers publishing AI-generated text on matters of public interest must disclose it unless it has human editorial review.
• Deployers of emotion recognition or biometric categorisation must inform the people exposed.

High-risk AI systems: provider obligations

High-risk AI systems: deployer obligations

• Use systems in line with instructions and assign competent human oversight.
• Ensure input data is relevant, where under the deployer’s control.
• Monitor operation, and report risks and serious incidents.
• Keep automatically generated logs for at least six months.
• Inform workers and their representatives before using high-risk AI in the workplace.
• Inform people when high-risk AI is used to make or assist decisions about them.
• Carry out a fundamental rights impact assessment if you are a public body, provide public services, or use AI for credit scoring or life and health insurance pricing.

General-purpose AI models

All GPAI model providers must keep technical documentation, provide information to downstream providers, have a copyright compliance policy, and publish a summary of training content. Models with systemic risk (presumed above 10^25 floating-point operations of training compute, or designated by the Commission) must also evaluate and mitigate systemic risks, report serious incidents and ensure cybersecurity. The Commission’s GPAI Code of Practice (July 2025) is a voluntary way to demonstrate compliance.

How to implement the EU AI Act

1. Inventory AI. List every AI system and model you build, buy, integrate or use, including AI features in your product.
2. Classify each one: prohibited, high-risk, transparency, minimal; and GPAI if you provide models.
3. Determine your role for each: provider, deployer, importer or distributor.
4. Stop any prohibited practices immediately.
5. Roll out AI literacy measures for staff who build or use AI.
6. Implement transparency: AI interaction notices, content marking for generative features, deepfake disclosures.
7. For high-risk systems, start now despite the later dates: risk management, data governance, technical documentation, logging, human oversight design, QMS and conformity assessment planning.
8. Update contracts with model providers and customers to share information and allocate responsibilities.
9. Align with GDPR: DPIAs, lawful basis for training and use of personal data.
10. Monitor guidance: Commission guidelines, harmonised standards and codes of practice.

Documentation and policies

• AI system inventory and risk classification
• AI policy and AI literacy programme records
• Transparency notices and content marking approach
• For high-risk systems: risk management file, data governance records, Annex IV technical documentation, logs, instructions for use, human oversight design, QMS, conformity assessment and EU declaration of conformity, registration, post-market monitoring plan, incident procedure
• For deployers of high-risk systems: oversight assignments, log retention, worker notices, fundamental rights impact assessments where required
• For GPAI providers: technical documentation, downstream information, copyright policy, training content summary

Audits, assessments and enforcement

• Conformity assessment for high-risk systems: internal control for most Annex III systems; notified body assessment for some biometric systems and for AI in products where sector law requires it.
• Market surveillance authorities in each member state enforce most rules.
• The AI Office in the Commission supervises GPAI models and, after the Omnibus, certain GPAI-based systems.
• ISO/IEC 42001 certification supports governance evidence but isn’t an AI Act conformity assessment.

Cost

Benefits

• Continued access to the EU market for AI products.
• Trust from customers, especially in regulated and public sectors.
• Better-engineered AI: documented, tested, monitored.
• Alignment with emerging AI laws elsewhere.

Risks of non-compliance

• Fines up to 7% of worldwide turnover for prohibited practices.
• Withdrawal or recall of AI systems from the EU market.
• Lost deals as EU buyers add AI Act clauses to procurement.
• Overlapping GDPR exposure.

Common mistakes

• Assuming you are only a deployer when you are the provider of the AI feature in your product.
• Ignoring Annex III use cases hidden in HR, education or finance features.
• Waiting for the 2027 deadline to start high-risk work that takes a year or more.
• No AI inventory, especially of AI features added by individual teams.
• Forgetting transparency duties that already apply.

Challenges for IT companies

• Relying on third-party foundation models while remaining responsible as provider of the system.
• Documenting data governance for models trained on mixed or historical data.
• Building meaningful human oversight into automated workflows.
• Keeping up with guidance and harmonised standards still being developed.

Best practices

• Use ISO/IEC 42001 as the management system for AI governance.
• Use the NIST AI RMF for practical risk management.
• Add AI Act classification to product design reviews.
• Keep model and dataset cards for every AI feature.
• Build logging and override features into AI workflows by default.

Tools that help

How the EU AI Act relates to other frameworks

Real-world examples

• GPAI Code of Practice. Many major model providers signed the Commission’s GPAI Code of Practice in 2025 as a route to demonstrating compliance.
• Digital Omnibus. The EU postponed high-risk deadlines in 2026 after industry and member states said standards and guidance were not ready.
• Illustrative scenario, not a real company: an LMS vendor uses an LLM to grade essays and recommend course levels for EU universities. It classifies the feature as high-risk under Annex III (evaluating learning outcomes), plans a risk management and documentation programme for December 2027, and adds AI disclosure notices for its tutoring chatbot now.

Frequently asked questions

Does the EU AI Act apply to companies outside the EU? Yes, if they place AI systems or models on the EU market, or if their AI system’s output is used in the EU.

When do the high-risk rules apply? After the 2026 Digital Omnibus: 2 December 2027 for stand-alone (Annex III) systems and 2 August 2028 for AI in regulated products (Annex I).

What applies already? Prohibitions and AI literacy (since February 2025), GPAI model obligations (since August 2025), and transparency obligations and penalties (since August 2026).

Is using ChatGPT or another LLM in my product regulated? You are likely the provider of your AI system. Transparency duties apply to chatbots and generative features; high-risk duties apply only for high-risk use cases.

What are the fines? Up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for most other breaches.

Does ISO 42001 certification mean AI Act compliance? No, but it provides a strong governance foundation and evidence.

Is AI used in education high-risk? Some uses are: AI for admissions, evaluating learning outcomes, placing students at levels, and monitoring behaviour during tests.

Next steps

• Build an inventory of every AI system and feature you provide or use.
• Classify each by risk and by your role.
• Implement AI interaction notices and content marking now.
• Start high-risk documentation and risk management well before December 2027.