EU AI Act Compliance for SaaS: What Ships in 2026

The EU AI Act is the first horizontal AI regulation in force worldwide. If your SaaS serves EU customers, ships an LLM feature, or embeds a third-party model, you are in scope — regardless of where your company is headquartered.

The four risk tiers, in plain English

• Unacceptable — social scoring, manipulative AI. Banned.
• High-risk — AI in hiring, credit scoring, medical devices, critical infrastructure. Heavy documentation and conformity assessment.
• Limited risk — chatbots, generative AI. Transparency obligations (users must know they are interacting with AI).
• Minimal risk — everything else. No specific obligations.

Most SaaS LLM features land in limited risk, but a copilot that recommends candidates or scores loan applications moves straight into high-risk.

GPAI: the model provider obligations that leak into you

General-Purpose AI (GPAI) providers — OpenAI, Anthropic, Google — must maintain technical documentation, publish training data summaries and implement copyright policies. For you as a downstream deployer, this means:

• Pin model versions and log them per request
• Retain provider documentation with your DPIA
• Notify users when GPAI output is used in decisions affecting them

Transparency: the article 50 requirements

Users interacting with an AI system must be informed. Content generated by AI (text, image, audio) must be marked as such in a machine-readable way. In practice this means adding disclosure UI to any user-facing generation surface and metadata to exported artifacts.

The audit trail is the compliance product

Enforcement will not ask for your policy document — it will ask for evidence. Every prompt, every model version, every policy decision, every human override must be logged in a way you can export to an auditor. This is the same requirement GDPR imposes for personal data, and the same one SOC 2 imposes for change management.

A 90-day roadmap

• Days 1–30: Inventory every LLM feature. Classify each into a risk tier.
• Days 31–60: Deploy a governance proxy for PII detection, tokenization and per-request audit logs.
• Days 61–90: Write the DPIA, publish the transparency notice, pin model versions.

Privaro is designed to be that governance layer. Read the platform overview or explore the enterprise AI security guide for the technical controls.