SaaS companies often sit in the middle of the AI value chain: a third-party model underneath, your product and brand in the middle, and customer use cases downstream. The commercial risk is assuming that someone else’s model documentation answers your own system-level obligations.
The Regulation applies to providers placing AI systems or GPAI models on the Union market even when they are established outside the EU. Article 3 defines provider, deployer, importer, distributor, placing on the market, and making available on the market.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
A SaaS company can become the provider of an AI system it develops or has developed and places on the market under its own name or trademark. Using a third-party model does not automatically eliminate provider responsibilities at the system level.
The Act can apply when AI systems or models are placed on the Union market. Availability can occur through software, APIs, cloud services, integrations, or other commercial delivery paths.
A general SaaS feature can move into a more demanding governance route when customers use it for employment, credit, essential services, biometric, safety, transparency-sensitive, or other regulated purposes.
Preserve instructions, intended purpose, limitations, version history, change notices, technical information, transparency measures, human-oversight expectations, and other evidence customers need to use the system within a supportable boundary.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Separate the underlying model, your SaaS application, embedded AI features, customer-configured workflows, and downstream use cases. Different layers can carry different roles and obligations.
Establish whether you are acting as provider, deployer, importer, distributor, product manufacturer, GPAI provider, or another operator for each relevant layer. Preserve the facts supporting that role.
Connect transparency, technical documentation, instructions, logs, risk controls, system versions, human oversight, support boundaries, and change notices to the claims your SaaS business makes to customers.
Model swaps, new autonomous features, expanded decision authority, new customer sectors, EU market entry, or changes in intended purpose can change both role and obligation state.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
It can. Article 2 applies to providers placing AI systems or general-purpose AI models on the Union market regardless of whether the provider is established in the EU, and it can also apply where outputs from a third-country provider or deployer are used in the Union.
No. Role depends on the actual system and how it is developed, branded, placed on the market, and used. A SaaS company can still be the provider of its own AI system even when that system incorporates a third-party model.
The Commission’s current GPAI guidance expressly notes that first availability on the Union market can occur through APIs, downloads, cloud services, integrations into applications, or other means. System-level analysis should still be done separately from model-level analysis.
Low-risk does not mean “no obligations.” Depending on the system, provider/deployer role, transparency features, AI literacy duties, customer use, and other legal layers may still matter. The first step is classification, not assumption.
At minimum: system identity, version, intended purpose, operator role, model/provider dependencies, customer instructions, transparency measures, change history, limitations, testing, incident records, and the evidence supporting any classification or exclusion claim.
No. TA-14 can preserve role analysis, system identity, evidence, gaps, changes and revalidation history. It does not itself provide legal advice, conformity assessment, certification or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views