Does the EU AI Act apply to a US SaaS company?

Yes, the EU AI Act can apply to a US SaaS company, and parts of it already do. Regulation (EU) 2024/1689 reaches non-EU providers that place AI systems on the EU market, and non-EU providers and deployers whose AI output is used in the EU. The bans, AI literacy, general-purpose AI rules and most transparency duties are in force. Amendments in force since July 2026 delayed the high-risk obligations, which buys time but does not remove the work.

This update reflects the law as of October 22, 2026. It is not legal advice. Classification under the Act involves legal interpretation, so coordinate with your counsel.

How does the Act reach a US company?

Two scope rules in Article 2(1) matter most.

• Article 2(1)(a): providers that place AI systems or general-purpose AI models on the EU market are covered "irrespective of whether those providers are established or located within the Union or in a third country." Selling an AI feature to EU customers is enough.
• Article 2(1)(c): providers and deployers established outside the EU are covered "where the output produced by the AI system is used in the Union." A US company with no EU sales can still be in scope if an AI system's output is used there.

Your role decides most of your obligations. Under Article 3(3), a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Under Article 3(4), a deployer uses an AI system under its authority in a professional context. A SaaS vendor that ships an AI feature is usually a provider, and a deployer of the AI tools it uses internally.

What are the risk tiers, in SaaS terms?

• Prohibited (Article 5). Banned outright. The list includes social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images to build recognition databases, and inferring emotions of people in the workplace or in education, except for medical or safety reasons. HR and edtech products should check the emotion recognition ban carefully.
• High-risk (Article 6 and Annexes I and III). Annex III lists the stand-alone use cases. For SaaS, the most relevant are education (admission, evaluating learning outcomes, proctoring), employment (recruitment, filtering applications, evaluating candidates, decisions on promotion, termination, task allocation and performance monitoring) and credit (evaluating creditworthiness or establishing a credit score, except fraud detection). Under Article 6(3), an Annex III system can fall outside high-risk if it does not pose a significant risk of harm, but a system that profiles natural persons is always high-risk.
• Transparency (Article 50). Chatbots, synthetic content, deepfakes and emotion recognition carry disclosure duties.
• Minimal risk. No specific new obligations beyond general duties such as AI literacy.

General-purpose AI models sit on a separate track in Chapter V. If you build on a third-party model, Article 53 requires the model provider to give you documentation on its capabilities and limitations.

The same check in text:

1. Scope. You are in scope if you place an AI system or general-purpose AI model on the EU market (Article 2(1)(a)), or if your AI system's output is used in the EU (Article 2(1)(c)).
2. Prohibited practices. A feature that falls under Article 5 is banned, and has been since February 2, 2025.
3. High-risk. Obligations for Annex III use cases apply from December 2, 2027, and for AI in Annex I products from August 2, 2028. Document any Article 6(3) reasoning.
4. Transparency. Systems that interact with people or generate synthetic content carry Article 50 duties, which have applied since August 2, 2026.
5. General-purpose AI models. Model providers have had Article 53 duties since August 2, 2025.
6. Everyone in scope. Providers and deployers must take AI literacy measures under Article 4.

Which obligations already apply?

Prohibited practices and AI literacy, since February 2, 2025. As amended in 2026, Article 4 requires providers and deployers to take measures to support AI literacy among staff and others who operate AI on their behalf, replacing the original "ensure, to their best extent, a sufficient level". The Commission and Member States must now support those efforts.

General-purpose AI model obligations, since August 2, 2025. Article 53 requires technical documentation, information for downstream providers, a copyright policy and a public summary of training content. Models placed on the market before August 2, 2025 have until August 2, 2027.

Transparency, since August 2, 2026. Under Article 50(1), people must be told they are interacting with an AI system unless that is obvious. Under Article 50(2), providers of systems that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as AI-generated. The amendments give systems placed on the market before August 2, 2026 until December 2, 2026 to meet Article 50(2). Deployers of deepfakes must disclose them under Article 50(4).

What did the 2026 amendments change?

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on July 8, 2026 and published in the Official Journal on July 24, 2026. It entered into force on July 27, 2026. The changes most relevant to a SaaS company are:

• High-risk dates. Obligations for Annex III systems apply from December 2, 2027. Obligations for high-risk AI in products covered by Annex I apply from August 2, 2028.
• New prohibitions. The two Article 5 additions described above, from December 2, 2026.
• Watermarking transition. The December 2, 2026 deadline for existing synthetic content generators under Article 50(2).
• Small mid-cap enterprises. A new category, the SMC, joins SMEs in some relief. SMEs and SMCs may file Annex IV technical documentation on a simplified Commission form, quality management can be proportionate to size, and fines for SMCs are capped at the lower of the percentage or the fixed amount.
• Bias detection. A new Article 4a permits processing special categories of personal data for bias correction, under strict conditions that sit alongside the GDPR. Involve your data privacy lead.

Do you need an authorised representative?

Under Article 22, a provider established outside the EU must appoint an authorised representative in the EU by written mandate before making a high-risk AI system available on the EU market. Article 54 imposes the same requirement on non-EU providers of general-purpose AI models. The representative verifies your documentation, so start early.

What are the penalties?

Article 99 sets three tiers of administrative fines, whichever is higher of a fixed amount or a share of worldwide annual turnover:

Infringement	Maximum fine
Prohibited practices (Article 5)	EUR 35 million or 7% of turnover
Most operator obligations, including providers, authorised representatives, deployers and Article 50 transparency	EUR 15 million or 3% of turnover
Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1% of turnover

For SMEs, including start-ups, each cap is the lower of the two figures. The Commission fines general-purpose AI model providers separately under Article 101, up to 3% of turnover or EUR 15 million.

Timeline

Date	What applies
August 1, 2024	The Act enters into force
February 2, 2025	Prohibited practices and AI literacy
August 2, 2025	General-purpose AI model obligations
July 27, 2026	Digital Omnibus on AI enters into force
August 2, 2026	Most remaining provisions, including Article 50 transparency
December 2, 2026	New Article 5 prohibitions; Article 50(2) deadline for existing generators
August 2, 2027	Deadline for general-purpose AI models placed on the market before August 2, 2025
December 2, 2027	High-risk obligations for Annex III systems
August 2, 2028	High-risk obligations for AI in Annex I products

What should you do now?

1. Inventory your AI. List every AI feature you ship and AI tool you use internally, with the underlying model and where output goes.
2. Classify your role. Record whether you act as provider, deployer or both, and whether output is used in the EU.
3. Screen against Article 5 and Annex III. Check the prohibitions first, then test each feature against the employment, credit and education categories. Document any Article 6(3) reasoning.
4. Ship transparency notices. Confirm chatbots disclose that users are talking to AI and that synthetic output is marked, ahead of the December 2, 2026 deadline for existing generators.
5. Update vendor and model contracts. Require your general-purpose AI model providers to deliver the Article 53 documentation, and add AI Act terms to EU customer agreements.
6. Build the documentation. Start the risk management, data governance and technical documentation that high-risk systems will need. The NIST AI Risk Management Framework is a practical structure for that work.
7. Test the systems. High-risk systems must meet accuracy and cybersecurity requirements. AI security testing for prompt injection and data leakage produces evidence you can use.
8. Train your people. Put an AI literacy program in place for staff who build, sell or operate AI.

Our EU AI Act readiness work covers inventory, role classification, risk-tier mapping and a roadmap tied to these dates, coordinated with your counsel. If you want to talk through where your product sits, contact us.