Is my SaaS high-risk under the EU AI Act?
Most SaaS products are not high-risk. A system is high-risk in two ways (Article 6):
- Article 6(1) – product safety: it is a safety component of, or is itself, a product under the EU laws listed in Annex I (medical devices, machinery, toys, lifts, radio equipment and so on) that needs third-party conformity assessment.
- Article 6(2) – Annex III use cases: it is intended for use in one of eight areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services (e.g. credit scoring, life/health insurance pricing, public benefits, emergency triage); law enforcement; migration, asylum and border control; administration of justice and democratic processes.
The Article 6(3) exemption
An Annex III system is not high-risk if it doesn't pose a significant risk of harm and doesn't materially influence the outcome of decisions, for example if it only performs a narrow procedural task, improves the result of a completed human activity, detects patterns without replacing human assessment, or performs a preparatory task. Any Annex III system that profiles natural persons is always high-risk. If you rely on the exemption you must document the assessment (Art. 6(4)) and register the system (Art. 49(2)).
Common SaaS examples
- CV screening / candidate ranking tool → high-risk (Annex III(4)).
- Credit-scoring or loan-eligibility AI → high-risk (Annex III(5)), except fraud detection.
- Automated exam grading → high-risk (Annex III(3)).
- Customer support chatbot → not high-risk, but Article 50 transparency applies.
- AI copywriting or image tool → not high-risk; Article 50(2) marking duties for the provider.
When it applies
Following the AI Omnibus, high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.
Not legal advice. Last reviewed 26 Oct 2026.