Compliance for SaaS companies.

If any EU user can access your product, you’re in scope. The AI Act regulates where AI has impact, not where it’s built.

Yes. You’re the deployer, which carries Article 26 obligations.

An AI Acceptable Use Policy, an AI Literacy Policy, and Article 50 transparency disclosures on any AI powered feature.

The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.

The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.

Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.

Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.

The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.

The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.