EU AI Act Compliance for SaaS Companies: What Your Terms of Service Must Address in 2026
The EU AI Act entered into force on August 1, 2024, with its phased implementation timeline now well underway. By 2026, SaaS companies deploying AI systems to users in the European Union are required to meet specific obligations that go directly to how those systems are described, governed, and disclosed in legal agreements. If your platform uses AI features, your terms of service, end-user agreements, and B2B contracts need to reflect these requirements.
Many US-based SaaS companies assume the EU AI Act does not apply to them because they are incorporated in the United States. That assumption is incorrect. The Act applies to any provider whose AI system produces outputs that are used within the EU, regardless of where the provider is located. If any of your users are in EU member states, your compliance obligations are live.
Here is what your legal documents need to address.
1. Understand Where Your AI System Sits in the EU AI Act’s Risk Categories
The EU AI Act classifies AI systems into four risk tiers: unacceptable risk (banned outright), high risk, limited risk, and minimal risk. The obligations your SaaS platform faces depend on which tier your AI features fall into.
High-risk AI systems include those used in employment decisions, credit scoring, biometric identification, educational assessment, and several other categories listed in Annex III of the Act. If your SaaS platform includes features that fit these categories, your obligations are substantial, covering conformity assessments, technical documentation, logging, human oversight mechanisms, and registration in the EU’s AI database.
Limited-risk AI systems, which include most AI-powered chatbots, content generators, and recommendation engines used in general SaaS applications, are subject to transparency obligations. Users must be informed when they are interacting with an AI system. This obligation directly affects what your terms of service, onboarding screens, and user interface must disclose.
2. Transparency Disclosures Required in Your Terms of Service
Under Article 52 of the EU AI Act, providers of AI systems that interact with natural persons must ensure those users are informed they are interacting with an AI, unless it is obvious from context. This requirement applies to AI chatbots, AI-generated customer service responses, AI-generated content tools, and AI decision-support features that surface recommendations to end users.
Your terms of service should include an explicit section disclosing:
- That the platform uses AI systems and in what capacity
- What types of AI-generated content or decisions the platform produces
- The nature of any automated processing that affects the user
- How users can seek human review of AI-generated outputs that affect them materially
These disclosures are not just about legal compliance. They also set user expectations and reduce the likelihood of disputes over AI-generated outputs that users did not understand were automated. See how US-focused compliance obligations intersect with these requirements in the analysis of CCPA and CPRA privacy policy requirements for 2026, which increasingly overlap with EU AI Act data-handling obligations.
3. What B2B Contracts Must Cover When AI Is Involved
If you provide AI-enabled SaaS to business customers, your B2B contracts need to allocate responsibility for EU AI Act compliance clearly. The Act distinguishes between providers (who build AI systems) and deployers (who put those systems to use in their own products or workflows). Many SaaS companies are providers. Their customers are often deployers.
Your SaaS agreement should address:
- Which party bears responsibility for ensuring the AI system is used within the scope of its intended purpose under the Act
- What instructions you provide to customers about appropriate and compliant use
- Whether the customer’s intended use case falls into a high-risk category that you have not tested or certified the system for
- Data governance obligations that apply to AI training data or model outputs retained by the customer
- Your right to modify or discontinue AI features to maintain compliance with regulatory changes
Failing to allocate these responsibilities in your contracts means you may bear more regulatory exposure than you intended when a customer deploys your AI features in a high-risk context you did not anticipate.
4. Human Oversight and User Rights Provisions
High-risk AI systems under the EU AI Act must incorporate human oversight mechanisms. Even for limited-risk systems, good practice and emerging regulatory guidance favor giving users meaningful ability to understand, challenge, and override AI outputs that affect them.
Your terms of service and product documentation should describe what oversight mechanisms exist, how users can flag incorrect AI outputs, and what your process is for reviewing disputes about AI-generated decisions. For SaaS platforms serving business customers, your contract should state what tools you provide to allow the customer’s own users to exercise oversight rights.
5. Data and Model Documentation Requirements
High-risk AI systems require technical documentation that includes information about training data, model design, testing methodology, and accuracy limitations. While this documentation obligation runs to the AI system itself rather than to your end-user terms, the existence of this documentation should be referenced in your B2B agreements as part of your compliance representation.
Your SaaS agreement with enterprise customers in the EU may need to include representations about your AI system’s documentation status, particularly if your customer is subject to their own regulatory obligations that depend on what their software providers can attest to.
6. Prohibited AI Practices to Confirm Your Platform Does Not Use
The EU AI Act bans certain AI practices entirely, including real-time remote biometric identification in public spaces (with limited law-enforcement exceptions), AI systems that exploit psychological vulnerabilities to manipulate behavior, and social scoring systems. Your agreements with EU customers may need to represent that your platform does not deploy any of these prohibited practices, particularly if you offer customizable AI features that could theoretically be misconfigured by a customer to approach these categories.
What a Technology Lawyer Can Do That Your AI Vendor Cannot
Your AI infrastructure provider will give you documentation about their system’s compliance posture. That documentation does not substitute for a legal review of how you describe, govern, and allocate responsibility for AI use in your own customer-facing agreements. The EU AI Act compliance gap for most SaaS companies is not in their technology; it is in their contracts.
A SaaS agreement lawyer with experience in technology law can audit your existing terms of service and B2B contracts for EU AI Act exposure, draft the necessary disclosures and compliance provisions, and ensure the allocation of deployer versus provider responsibility in your customer contracts reflects your actual legal position. For companies at meaningful scale in the EU market, that review is now overdue.
Frequently Asked Questions
Does the EU AI Act apply to US SaaS companies?
Yes. The EU AI Act applies to any provider of an AI system whose output is used within the European Union, regardless of where the provider is established. If you have EU-based users or customers, the Act applies to your platform. The same extraterritorial principle operates similarly to how GDPR applies to US businesses with EU users.
What is the difference between a provider and a deployer under the EU AI Act?
A provider is the entity that develops or places an AI system on the market. A deployer is an entity that uses an AI system in a professional context, often a business that buys a SaaS product and deploys it to their own users or in their own workflows. Many SaaS companies are both providers (to their customers) and deployers (of third-party AI tools they incorporate into their product). Both roles carry distinct compliance obligations.
What happens if my SaaS platform does not comply with the EU AI Act by the required deadlines?
Penalties under the EU AI Act are structured by violation type. Violations involving prohibited AI practices can result in fines up to 35 million euros or 7% of global annual turnover, whichever is higher. Violations of transparency obligations for limited-risk systems can result in fines up to 15 million euros or 3% of global annual turnover. These are maximum figures, but they signal the regulatory seriousness of non-compliance.
Do I need to register my AI system in the EU’s AI database?
High-risk AI systems must be registered in the EU’s AI database before being placed on the EU market. Limited-risk systems do not have this requirement. Whether your system qualifies as high-risk depends on the specific use case and the categories listed in Annex III of the EU AI Act. A legal review of your platform’s features is the right way to determine which category applies.
Can I use a GDPR-compliant privacy policy to satisfy EU AI Act disclosure requirements?
No. The EU AI Act’s transparency obligations are distinct from GDPR data subject rights, though they overlap in some areas. Your privacy policy may cover the data processing aspects of AI use, but it does not fulfill the EU AI Act’s specific requirement that users be informed when they are interacting with an AI system. Both sets of obligations need to be addressed in your legal documents.
When did the EU AI Act’s main obligations take effect?
The prohibition on unacceptable-risk AI practices took effect in February 2025. Obligations for general-purpose AI models took effect in August 2025. High-risk AI system obligations become fully applicable in August 2026, with limited extensions for certain regulated sectors. Limited-risk transparency obligations have been in effect since August 2025. As of November 2026, all major compliance phases are in effect or have passed.
Conclusion
The EU AI Act does not create a grace period for companies that choose to wait and see. Its compliance deadlines are structured, its penalties are significant, and its reach extends to US SaaS companies with EU users. The clearest gap for most platforms is not in their technology; it is in their legal documents.
If your SaaS agreements, terms of service, and privacy policies have not been reviewed for EU AI Act compliance, that review needs to happen now. Contact Hansen Tong at TOSLawyer.com to work with a technology lawyer who understands how the EU AI Act’s requirements translate into concrete changes to your contracts and user-facing legal terms.