EU AI Act Compliance Checklist for SaaS Founders (2026)

Everything downstream depends on your risk tier, so start here. For each AI feature or system, answer: does it do anything in Article 5 (prohibited practices)? Does it operate in an Annex III area — hiring, credit, education, biometrics, essential services, law enforcement? Does it interact with people or generate content (Article 50)? If none apply, you land in minimal risk.

Classify per system, not per company. A SaaS product with an AI resume screener and a support chatbot has one high-risk system and one limited-risk system — different obligations, different deadlines for effort.

Artifact: a one-page risk classification memo per system, stating the tier and the reasoning with article references. This is the document enterprise procurement asks for first.

Prohibited practices and AI literacy duties have applied since 2 February 2025. GPAI model obligations since 2 August 2025. Article 50 transparency duties apply from 2 August 2026. Annex III high-risk systems point to 2 December 2027, and Annex I product-embedded systems to 2 August 2028.

Work backwards from your tier: a high-risk system needs its technical documentation, risk management system and conformity assessment ready before the applicable high-risk date - and documentation alone routinely takes weeks. Put an internal deadline at least a quarter before 2 December 2027.

In practice, compliance is evidenced by documents. The core set: a risk classification memo as a practical baseline across tiers, technical documentation per Annex IV for high-risk systems, a model card summarising capabilities and limitations, an internal AI usage policy that supports Article 4 AI-literacy measures, and a compliance roadmap with dated milestones.

These are practical baseline artifacts for defensibility and buyer review, even where the Act does not prescribe them as named documents. Write the classification memo and AI usage policy first because they are short and unblock sales conversations.

For high-risk systems, documents describe processes that must actually exist: risk management (Art. 9), data governance (Art. 10), logging (Art. 12), human oversight (Art. 14), accuracy and robustness testing (Art. 15), post-market monitoring (Art. 72). A document describing a process you do not run is worse than no document — it is evidence of misrepresentation.

Most of these map onto engineering practices you may partly have: incident tracking, evaluation suites, access controls, release review. The work is formalising and recording them, not inventing them from zero.

Enterprise security questionnaires increasingly include an AI section: what models do you use, what data trains them, are you in scope of the EU AI Act, what tier, where is your documentation. Teams with Steps 1–3 done answer in minutes; teams without lose deal momentum for weeks.

Keep a standing answer sheet next to your SOC 2 or ISO 27001 material. If you use a compliance platform, add the AI Act controls to the same workspace so evidence collection stays in one place.

Classification is not permanent. A new feature, a new customer segment, a new data source or a substantial model change can move a system across tiers — and a substantial modification can restart conformity obligations. Re-run classification at every major release, and log the result even when nothing changes.