EU AI Act Compliance Consulting for SaaS, AI Vendors and US Companies Selling Into the EU

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in tranches. Prohibited AI practices (Article 5) became applicable 2 February 2025. Obligations for general-purpose AI models (Chapter V) apply from 2 August 2025, including transparency, technical documentation, and copyright policy. Most obligations for high-risk AI systems (Chapter III) apply from 2 August 2026. Obligations for high-risk AI systems embedded in regulated products under Annex I (medical devices, machinery, toys, in-vitro diagnostics, etc.) apply from 2 August 2027. If you sell into the EU, EEA, or your output is used in the EU, you are in scope even if your company is incorporated in the US — Article 2 has extraterritorial reach.

We classify against Annex III (eight high-risk areas: biometrics, critical infrastructure, education, employment, essential services including credit scoring and life/health insurance pricing, law enforcement, migration/asylum/border control, administration of justice and democratic processes) and Annex I (AI as a safety component in regulated products). Limited-risk systems under Article 50 (chatbots, emotion recognition, biometric categorisation, deepfakes) only have transparency duties. Minimal-risk systems have voluntary codes. We deliver a written classification memo with article citations and a risk register the board can read. About 60 percent of SaaS products we classify end up limited-risk and only need transparency notices and watermarking — that decision alone saves six-figure compliance cost.

No, you remain a downstream provider or deployer, not a GPAI provider. GPAI provider obligations (Article 53) apply to the model creator — OpenAI, Anthropic, Google DeepMind, Mistral. But you inherit downstream duties: maintain instructions for use, monitor for systemic risks, and if you fine-tune a GPAI model on your data, you can become the provider of a derived GPAI model under Article 25(1)(c). We map the upstream/downstream boundary, document it in your contract with the model provider, and write the fine-tuning policy that keeps you out of provider-class obligations unless you genuinely want to be a provider.

Annex IV defines it for high-risk systems: a general description of the system and intended purpose; a detailed description of components and development process; monitoring, functioning and control; risk management system per Article 9; training, validation and test data per Article 10; technical means for human oversight per Article 14; accuracy, robustness and cybersecurity metrics per Article 15; the quality management system per Article 17; logs and the post-market monitoring plan per Article 72. For GPAI models, Annex XI applies — model card, training data summary, energy consumption, and copyright compliance policy. We deliver the full pack as versioned Markdown in your repo, plus a public-facing model card and a deployer-facing instruction sheet.

Heavily, and the trick is one integrated controls map. The Article 9 risk management system can reuse your ISO 27001 risk register. The Article 10 data governance requirements align tightly with GDPR Articles 5, 25 and 32 — same DPIA framework with extra fairness and bias documentation. ISO/IEC 42001:2023 AI management system covers about 70 percent of Article 17 quality management requirements; if you are pursuing ISO 42001 certification we sequence it to discharge AI Act duties at the same time. The Data Act, NIS2, and the Cyber Resilience Act add adjacent obligations that share evidence — we deliver a unified evidence library, not five duplicate ones.

Three packages, each scoped and budgeted before any work starts, with no enterprise markup. Readiness Assessment is a fixed-scope two-week engagement: classification memo, gap analysis against the relevant articles, remediation roadmap, and an executive briefing. Documentation Pack is a fixed-scope six-to-eight-week engagement: full Annex IV or Annex XI documentation, risk management system, data governance policy, post-market monitoring plan, instructions for use, and the public model card. Ongoing Compliance Operations is a monthly retainer with transparent scope: quarterly evidence refresh, regulatory monitoring (EU AI Office, national competent authorities, harmonised standards from CEN-CENELEC JTC 21), incident reporting support per Article 73, and one annual third-party-ready audit dry run. Larger phases can run as fixed-scope-per-phase or transparent time-and-materials. Conformity assessment with a notified body is quoted separately when required.

Fines are tiered under Article 99. Prohibited AI practices (Article 5) carry the top penalty: up to €35 million or 7 percent of total worldwide annual turnover, whichever is higher. Most high-risk and GPAI obligation breaches are up to €15 million or 3 percent of turnover. Supplying incorrect, incomplete, or misleading information to authorities is up to €7.5 million or 1 percent. Enforcement is split: the EU AI Office supervises general-purpose AI models directly, while national market surveillance authorities in each Member State enforce high-risk and prohibited-practice rules for products sold in their territory. SMEs and startups face proportionally capped fines, but the reputational and procurement fallout usually outweighs the fine itself — enterprise buyers now ask for AI Act evidence in RFPs.

It depends on the system. For most stand-alone high-risk AI systems under Annex III, conformity assessment is based on internal control (Annex VI) — you self-assess, sign the EU declaration of conformity, and affix the CE marking, provided you have the full Annex IV documentation and quality management system in place. A notified body (third-party assessment via Annex VII) is required mainly for certain biometric systems and for AI that is a safety component of a product already subject to third-party assessment under Annex I sectoral law (e.g. many medical devices). We tell you up front which route applies, prepare the technical documentation to the standard the assessor expects, and liaise with the notified body only when it is genuinely required — so you neither skip a mandatory assessment nor pay for one you do not need.

If you are a provider of a high-risk AI system or a GPAI model and you place it on the EU market without an establishment in the Union, Article 22 requires you to appoint, by written mandate, an authorised representative established in the EU before making the system available. That representative holds the technical documentation, cooperates with authorities, and is the local point of contact. Limited-risk and minimal-risk systems do not trigger this obligation. We help you determine whether you cross the threshold, and if so we structure the mandate and the documentation handover so the representative can actually discharge the role rather than being a nameplate.

The obligations follow the role, defined in Article 3. A provider develops an AI system or GPAI model and places it on the market under its own name — it carries the heaviest duties (classification, documentation, QMS, conformity assessment). A deployer uses an AI system under its own authority in a professional context — it owes transparency to affected people, human oversight, and, for public bodies and some others, an Article 27 FRIA. An importer places a third-country provider’s system on the EU market and must verify the provider did its part. A distributor makes it available down the chain and checks the CE marking and documentation are present. A single company is often several roles at once. We map exactly which role each of your products puts you in, because misidentifying it is the most common and most expensive mistake we see.

For a single high-risk system with cooperative engineering access, plan on six to eight weeks for the full documentation pack once classification is confirmed — that covers the Annex IV documentation, the Article 9 risk management system, Article 10 data governance, Article 14 human-oversight design, and the Article 72 post-market monitoring plan. Classification and gap analysis take the first two weeks. If a notified body assessment is required, add lead time for their queue, which is why we start that conversation early. Multiple systems or a fine-tuned GPAI model extend the timeline. The practical takeaway: to be comfortably ready for 2 August 2026 you want to start classification no later than the first quarter of 2026, because remediation — not paperwork — is usually the long pole.