AI Compliance for Technology
SaaS, AI platforms, and infrastructure: provider obligations under the EU AI Act
Technology companies face two distinct compliance profiles: as AI system providers (building the AI), and as deployers (using AI in their own products). The EU AI Act has different obligations for each. SaaS companies using AI in their products may trigger high-risk classification. AI platform providers face general-purpose AI model requirements.
Applicable regulations
EU AI Act — General Purpose AI Models (GPAI)
Critical RiskScope: Companies training or fine-tuning foundation models in EU
Technical documentation, copyright compliance policy, transparency about training data, systemic risk providers (>10²⁵ FLOPS): adversarial testing, incident reporting, serious risk mitigation
Deadline: August 2025 (in force)
EU AI Act — Provider vs Deployer Obligations
High RiskScope: All companies placing AI on the EU market
Providers: conformity assessment, CE marking, technical documentation. Deployers: monitor use, implement human oversight, maintain logs, provide transparency to users
Deadline: August 2, 2026 (Art. 50 transparency); December 2027 (high-risk, deferred under the 2025 Digital Omnibus)
GDPR — AI Data Processing
High RiskScope: Any AI processing personal data of EU residents
Legal basis for processing, DPIA for high-risk processing, data processor agreements with AI vendors, data subject rights mechanism
Deadline: Ongoing
US State AI Laws (Colorado, California, Texas)
Medium RiskScope: SaaS companies with users in regulated US states
Colorado AI Act: developer transparency to deployers for high-risk AI. California SB 942: AI content labeling. Texas AI law: bias testing requirements.
Deadline: 1 Jan 2027 (Colorado, SB 26-189)
EU Product Liability Directive (revised) — covers AI software
Medium RiskScope: AI providers and operators placing AI-embedded products in EU
Strict liability for defective AI software causing harm, easier claimant access to evidence, presumption of defectiveness/causality in specified circumstances
Deadline: December 2026 (in force; the separate AI Liability Directive proposal was withdrawn in 2025)
What to do first
Classify your AI products: are they high-risk? Check EU AI Act Annex III against every product
GPAI model providers: publish transparency documentation now, regardless of scale
If you build high-risk AI: complete technical documentation and prepare conformity assessment
If you use high-risk AI (deployer): get documentation from your AI vendor, they must provide it
Data processor agreements with all AI vendors that process personal data
Colorado AI Act (SB 26-189, effective 1 Jan 2027): if you sell AI to deployers, you need developer transparency documentation
Estimated compliance cost
$15,000–$80,000 initial (varies widely by product type) + $5,000–$20,000/year ongoing
Proactive compliance typically costs 3–5× less than post-enforcement remediation.
Generate your technology AI compliance plan
Aegis Firma maps your specific AI systems against all applicable regulations for technology — and generates prioritized documentation across 169 jurisdictions.