This article is an informational overview and is not legal advice. If you need to determine your specific compliance obligations under the EU AI Act, consult a qualified legal adviser.
The EU AI Act entered into force in August 2024 with a phased implementation schedule. Regulation (EU) 2026/1744 - referred to informally as the Digital Omnibus on AI, dated 8 July 2026 and in force since 27 July 2026 - adjusted some application dates and clarified certain provisions. For most small SaaS founders, the practical question is: does my product trigger any obligation yet, and if so, which one?
The Original Timeline and What Moved
The Act was structured in layers. Prohibitions on unacceptable-risk AI systems applied from February 2025. General Purpose AI (GPAI) model obligations, including transparency requirements for providers of GPAI models, applied from August 2025. High-risk system obligations - the most demanding set of requirements, covering areas such as employment, credit scoring, education and law enforcement - were originally due from August 2026. Per the Official Journal text (published 24 July 2026), the high-risk obligations in Chapter III, Sections 1 to 3 now apply from 2 December 2027 for stand-alone systems under Article 6(2) and Annex III, and from 2 August 2028 for AI built into regulated products under Article 6(1) and Annex I. Transparency duties under Article 50 stay on the original general date of 2 August 2026, with one transition: providers of generative systems already on the market before that date have until 2 December 2026 to comply with the Article 50(2) marking duty.
Regulation 2026/1744 left the Article 50 transparency duties on their original date apart from that four-month transition; the headline change was the delay to high-risk obligations. Confirm how the dates apply to your product with counsel.
Which Category Does Your SaaS Fall Into?
The Act uses three relevant concepts: the AI system, the provider (the entity that develops or places the system on the market), and the deployer (the entity that uses it in a commercial context). A small SaaS that builds a feature using an OpenAI or Anthropic API is typically a deployer of an AI system, not a provider of a GPAI model. That distinction matters.
Most small SaaS products with AI features are not high-risk systems as defined by Annex III of the Act. High-risk systems include AI used in recruitment, credit decisions, biometric identification, critical infrastructure, and similar domains. A writing assistant, a summarisation feature, a chatbot for customer support, or an AI-powered search function is unlikely to be high-risk - though the exact determination depends on your use case.
The category most likely to apply to a typical small SaaS is the Article 50 transparency obligation. This requires that users be informed when they are interacting with an AI system - unless this is obvious to a reasonably well-informed person. A clearly labelled chatbot interface probably satisfies this. A feature that generates text presented as human-authored without disclosure may not.
Article 50: Transparency for AI-Generated Content
Article 50 covers two situations. First, systems that interact directly with natural persons - AI chatbots and voice assistants - must disclose that the user is communicating with an AI, in a clear and timely manner. Second, systems that generate synthetic audio, image, video or text content must mark that content as artificially generated or manipulated, in a machine-readable format.
The second requirement says the technical solutions must be effective, interoperable, robust and reliable as far as technically feasible - meaning the marking should work across platforms. The text points to machine-readable marking rather than a visible label on every output. How exactly to implement it is likely to be shaped by standards and guidance, so check for current guidance when you build.
For a small SaaS, a practical starting point is to audit every touchpoint where AI-generated content reaches an end user and document how each one discloses the AI involvement. This is not just a compliance task - it is also good product practice, because users increasingly expect to know when they are reading AI-generated content.
What Has Not Changed
Reg 2026/1744 left the existing prohibited practices in place (social scoring, real-time remote biometric identification in public spaces, subliminal manipulation techniques, and exploitation of vulnerable groups) and added two new Article 5 bans, on AI systems that generate non-consensual intimate or sexually explicit imagery of identifiable people and on AI-generated child sexual abuse material (these apply from 2 December 2026). If your product does none of these things - which most SaaS products do not - this section is not your immediate concern.
The GPAI model obligations, which applied from August 2025, also remained largely intact. If you are building on top of a GPAI model via an API - which is the case for most SaaS AI features - the compliance burden for maintaining the model itself sits with the model provider (OpenAI, Anthropic, Google, and so on), not with you. Your obligations are as a deployer, which are lighter.
Practical Steps for a Small SaaS Founder
- Map your AI features: list every place in your product where an AI model processes user data or generates content for users.
- Classify each feature: is it interacting directly with users? Is it generating content they will see? Is it involved in any decision that affects them?
- Check the high-risk Annex III list: if any feature touches recruitment, credit, education, law enforcement, or critical infrastructure, get legal advice now. High-risk duties for stand-alone Annex III systems apply from 2 December 2027, and from 2 August 2028 for AI built into regulated products, per the Official Journal text.
- Add disclosure where it is missing: a brief note such as 'Generated by AI' or a visible AI label on chat interfaces is a sensible starting point for Article 50 transparency (check the final text with counsel).
- Read your AI provider's terms and data processing agreements: most major providers have updated these for EU AI Act compliance and the obligations cascade to you as a deployer.
What to Do If You Are Unsure
The EU AI Act is complex legislation with technical standards still being finalised by the European AI Office. For most small SaaS companies, the immediate risk of non-compliance is low if they are not in a high-risk category and they are labelling AI-generated content appropriately. The high-risk category and the GPAI model rules are where the teeth of the Act are concentrated.
A useful parallel: the DPDP Act in India follows a similar pattern of layered obligations where most small founders are primarily affected by transparency and consent requirements rather than the most demanding technical standards. The DPDP Act checklist for apps covers the Indian side of this if your app has Indian users.
If you are building a product that processes personal data and uses AI features, a technical review can identify where your data flows touch regulated territories, even if the final legal determination belongs with your counsel. Reach out for a technical review if you want a structured look at your architecture before you invest in compliance work.
The Role of the European AI Office
Enforcement of the EU AI Act sits with the European AI Office, established within the European Commission, and with national market surveillance authorities in each member state. Which national authority is relevant to a non-EU company depends on where you are established and where your users are, so ask counsel. Article 2(1) applies the Act to providers and deployers established in a third country where the output of the AI system is used in the Union.
The practical implication for a small SaaS with EU users: even if you are based in India, the US, or elsewhere, Article 50 transparency obligations apply to your EU users. Whether you need an EU representative depends on your role (provider versus deployer) and your risk category, so ask counsel. In practice, for a feature built on a third-party model, the starting point is to disclose AI involvement to users and keep the model provider's compliance documentation to hand.
Common questions
Does the EU AI Act apply to my small SaaS with AI features?
Probably as a deployer, not a model provider, if you build on a third-party API. Most such features, like summarisation or support chatbots, are unlikely to be high-risk, though it depends on your use case. The Article 50 transparency duty is the one most likely to apply. This is not legal advice.
What do I need to disclose to users under Article 50?
Systems that interact directly with people, such as chatbots, must disclose that the user is communicating with an AI, unless this is obvious. Systems generating synthetic audio, image, video or text must mark that content as artificially generated in a machine-readable format.
When should I get a technical review for EU AI Act readiness?
If your product processes personal data and uses AI features, a technical review can show where your data flows touch regulated territory before you invest in compliance work. The final legal determination belongs with your counsel. Zovintra can provide the structured technical look.
Sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) - Official Journal of the European Union, 24 Jul 2026
- Regulation (EU) 2024/1689 (AI Act) - Official Journal of the European Union, 12 Jul 2024
- AI Act implementation timeline - Future of Life Institute AI Act resource, accessed 19 Oct 2026
- Article 50: Transparency obligations - Future of Life Institute AI Act resource, accessed 19 Oct 2026
