'Step-by-step EU AI Act compliance checklist for seed-stage SaaS founders shipping LLM features. Deadlines, risks, and free templates to avoid fines and lost deals.'
Keyword math:
You’re shipping a RAG pipeline that pulls insights from product catalogs. Or a fine-tuned LLM that eats ticket history and answers customers. You raised seed on AI velocity — not paperwork. The EU AI Act doesn’t care about that story.
From 2026–2027, those features stop being “experiments.” Depending on use case, data sources, and how you control outputs, they may land as high-risk or unacceptable.
This checklist is for early-stage SaaS founders who cannot absorb a €35M fine or an EU product recall. It’s stack-specific: AWS Bedrock, LangChain, PostgreSQL vector stores, Terraform templates, GCP Vertex AI. It separates what to do this quarter from what to defer. Free templates and decision flows included — hand them to the team tomorrow.
Answer: Any system that infers outputs with machine learning, logic, or statistical models — RAG, fine-tuning, tool-calling agents, automated decision systems — sits in scope if it’s placed on the EU market or used in the EU. Exceptions exist: open-source models under certain conditions, and AI baked into “non-high-risk” products like video games. Don’t guess. Run your case through an EU AI Act risk classifier or talk to counsel.
| AI use case | Risk class | Why | MVP deadline | Build priority |
|---|---|---|---|---|
| Product catalog search via RAG (PDFs + ERP data) | High-risk (AI in management of critical infrastructure-like systems) | Affects downstream inventory and ordering decisions | 2026-12-31 | P0 — must comply before production rollout |
| Customer support AI agent (fine-tuned on ticket history) | Limited-risk (transparency obligations only) | No systemic risk, but must disclose AI use to users | 2027-07-01 | P1 — deploy with opt-in and disclosure |
| Automated pricing engine (RL-based dynamic pricing) | High-risk (harm to economic interests) | Can manipulate pricing for consumers or SMEs | 2026-12-31 | P0 — requires risk management system |
| Internal data analysis dashboard (LLM summarization of BI data) | Minimal-risk (voluntary code of conduct) | No impact on users outside company | None | P2 — defer |
| AI-generated marketing copy (fine-tuned on brand voice) | Limited-risk | Transparency only | 2027-07-01 | P2 — add opt-in toggle |
[Internal link: Wolverine Solution AI & LLM systems]
| Milestone | Date | Action |
|---|---|---|
| AI Act applies (limited-risk transparency rules) | 2026-08-01 | Add AI disclosure to terms, onboarding, and UI |
| High-risk AI systems banned (e.g., social scoring, manipulative AI) | 2026-12-01 | Audit any banned use cases |
| Full enforcement starts | 2027-07-01 | All AI systems must comply; fines begin |
| Conformity assessment for high-risk systems | Rolling | Must be complete before going to market |
Build time is short. If your RAG pipeline touches NetSuite or Microsoft Dynamics 365 Business Central, treat it as high-risk. Bake compliance into your Terraform templates and AWS landing zone before you open the EU market.
Use the EU AI Act risk classifier (PDF on the EU Commission site) or the EU AI Office’s online tool. Gather:
[Internal link: Product strategy for AI-first SaaS]
Accountability doesn’t travel well. On a seed team, it’s usually the CEO or CTO. Put their name and contact in your SOP.
Keep a lightweight risk register in Notion or Jira. Columns:
| Risk | Likelihood | Impact | Mitigation | Owner | Deadline |
|---|---|---|---|---|---|
| Hallucination in RAG output → wrong product recommendations | Medium | High | Add eval harness with golden dataset; deploy LangSmith or RAGAS | CTO | 2026-10-15 |
| Data leakage via prompt injection | Low | High | Add input sanitization layer; block jailbreaks | Security lead | 2026-11-01 |
Stack tip: AWS Bedrock guardrails or GCP’s AI security toolkit for content filters.
High-risk systems need:
Template: Downloadable EU AI Act technical documentation template (Google Doc)
Example banner: “This feature uses AI to summarize your inventory data. You can turn it off in Settings.”
High-risk systems must allow human intervention. For a multi-location inventory dashboard:
[Internal link: UI/UX design for AI controls]
For high-risk AI, you need:
Most seed-stage teams start with internal assessment and upgrade later.
Template: EU AI Act conformity self-assessment checklist (Notion)
| Risk | Fine | Other consequences |
|---|---|---|
| High-risk non-compliance | Up to €35M or 7% of global turnover, whichever is higher | Product recall, ban from EU market, reputational damage |
| Limited-risk transparency failure | Up to €10M or 2% of turnover | Loss of enterprise deals, negative press |
| Banned AI use case | Immediate removal order | Feature shutdown, refunds, lawsuits |
For seed-stage SaaS, a €35M fine is existential. Compliance isn’t optional — it’s product-market fit insurance.
| Tool | Purpose | Link |
|---|---|---|
| EU AI Act risk classifier PDF | Classify your AI system | EC website |
| RAGAS evaluation harness | Measure hallucination, answer correctness | GitHub |
| LangSmith | LLM eval, prompt versioning, monitoring | LangChain |
| AWS Bedrock guardrails | Content filters, jailbreak blocking | AWS docs |
| EU AI Act conformity checklist (Notion) | Self-assessment template | Template link |
| Terraform AWS landing zone for AI | Secure AWS baseline for LLM apps | GitHub |
[Internal link: DevOps & Cloud for AI systems]
Expect €5k–€20k in Year 1 for a high-risk RAG or agent system. That covers eval harness setup (LangSmith, RAGAS), guardrails (AWS Bedrock or GCP), documentation templates, and legal review. Most seed teams can push third-party conformity assessment until they’re scaling. Use Terraform to automate secure landing zones and cut cloud security overhead.
No. The EU AI Act regulates AI systems, not model licenses. Deploy a fine-tuned Mistral-7B in an EU-facing SaaS that classifies customer data, and you’re in high-risk territory with full obligations. Classify the system, not the model.
Start with transparency and eval. Put AI disclosure in the UI and terms, then stand up a lightweight eval harness. Limited-risk obligations are doable in 2–4 weeks for most seed teams. High-risk systems: ship with a human fallback, then plan full compliance inside 6 months.
Yes. AWS, GCP, and Azure offer EU regions and EU AI Act-ready services like Bedrock, Vertex AI, and SageMaker. Point your Terraform templates at EU (Frankfurt, Ireland, Stockholm) regions and turn on data residency controls. Add guardrails and logging so technical documentation holds up.
Misclassification can mean fines or removal orders. Unsure? Engage an EU AI Act consultant or use the EU AI Office’s risk classifier. Seed-stage teams should lean cautious — classify as high-risk when there’s any ambiguity.
You have a week-by-week checklist, free templates, and a risk matrix. Fastest path to EU AI Act readiness:
[Book a scoping call] → [Internal link: Contact Wolverine Solution]