EU AI Act for SaaS: what you actually have to do in 2026

I've spoken to a lot of SaaS founders in the last month, and the line I hear most is: 'it doesn't apply to us, we only use a chatbot'. About 80% of the time that's wrong. The AI Act classifies by use context, not by technology.

Four risk tiers — the short version

• Unacceptable: social scoring, manipulative behavioural systems. Banned.
• High risk: HR screening, credit decisions, critical infrastructure. Strict compliance.
• Limited: user-facing generative AI — transparency duty (e.g. 'AI-generated' labels).
• Minimal: internal productivity, spam filters. Effectively no obligation.

3 things most SaaS need to do now

1. Label AI-generated content: if the user sees AI output, it needs to say so.
2. Data-handling register: what you train on, from what source, and retention. Complements GDPR, doesn't replace it.
3. Incident plan: what your team does when a hallucinated or harmful output ships.

Three deadlines worth writing down

Q1 2026: unacceptable systems phased out. Q2: transparency for user-facing AI. Q4: full compliance for high-risk systems. If you're unsure which tier you're in, spend an hour with outside counsel or an engineer who's done the mapping — before you guess wrong.

Takeaway

Don't push this to 2027. Classification, labels, and the register need to happen now. We run a half-day AI Act session for SaaS teams — if you want a concrete output plan, reach out.