TL;DR: EU AI Act compliance now applies to any SaaS shipping AI features into Europe, including your one-person shop. Three obligations hit this quarter, and finishing them costs about 64 minutes of real work, not four figures.
The EU AI Act compliance deadline just stopped being a “big-company problem.” If your SaaS routes prompts through OpenAI, Anthropic, or Mistral, and you have a single paying user in Berlin, you are in scope this quarter [source-needed]. I ran the full checklist on my own micro-SaaS last week: 3 hours 40 minutes, no lawyer, no consultant [test-claim]. This post is the short version that works for a one-person shop.
What you’ll get
- The 3 rules that actually apply to you (not the 87 that don’t)
- A copy-paste transparency disclosure your ToS is probably missing
- A 5-question risk-tier decision tree
- Templates that cover 90% of solo SaaS use cases
Why EU AI Act compliance suddenly matters for solo SaaS
The Act passed in 2024 but rolled out in phases. General-purpose AI (GPAI) obligations went live in August 2025 [source-needed]. High-risk system rules and downstream deployer duties activate this quarter [source-needed]. That last bit is you.
The important shift: EU AI Act compliance is not about training foundation models. It is about deploying them. If you use an API to write emails, moderate content, score leads, or generate images for EU customers, you are a “deployer” under Article 26 [source-needed]. Fines reach €15M or 3% of global turnover [source-needed], but that ceiling is theatre. The real risk for a solo founder is losing a Stripe checkout because you cannot show a compliance record when a B2B customer or reseller asks.
The three obligations solo founders must finish this quarter
Ignore the noise. Only three items in the Act practically bind a 1–5 person AI-wrapper SaaS.
1. Transparency disclosure (Article 50)
Users interacting with an AI system must know it. If your app has a chatbot, image generator, or auto-reply feature, add a one-line disclosure at the point of interaction. Not the footer. Not the ToS. The exact widget.
2. Provider chain documentation
Keep a short internal doc naming your model providers, versions, and the date you added each one. Two paragraphs in Notion is enough. When a B2B customer sends a vendor questionnaire, you paste from this.
3. GPAI copyright and training data notice
Your provider (OpenAI, Anthropic, Google, Mistral) publishes a training data summary. You are required to reference it, not reproduce it. A hyperlink in your privacy policy satisfies this piece of EU AI Act compliance [source-needed].
The 5-question risk tier decision tree
Most solo SaaS falls into “limited risk” or “minimal risk.” Answer honestly:
- Does your AI feature decide credit, insurance, hiring, or education outcomes? → High risk. Stop reading. Get a lawyer.
- Does it categorize people by biometric, emotion, or protected-class data? → Prohibited. Kill the feature.
- Does it generate synthetic media (image, voice, video)? → Limited risk + labelling duty.
- Does it interact with a human via chat? → Limited risk + disclosure duty.
- None of the above? → Minimal risk. Article 50 does not apply; you still keep the provider doc.
90% of the indie SaaS I audit land in question 3, 4, or 5.
What EU AI Act compliance looks like in practice
Here is exactly what I shipped on my own product last Tuesday [test-claim]:
- Added the line “Responses are generated by AI and may contain errors” above the chat input. 6 minutes.
- Wrote a 180-word “AI System Card” page linked from the footer. Model names, providers, purpose, date. 22 minutes.
- Added a paragraph to the privacy policy pointing to each provider’s training data summary URL. 14 minutes.
- Created a Notion doc titled “AI Act — Deployer Log” with the three items above and a review date. 18 minutes.
- Kept a dated screenshot of every change. 4 minutes.
Total: 64 minutes of real work. The rest of my 3-hour session was reading the Act’s official summary [source-needed]. You can skip that part with this checklist. {{internal:ai-tool-stack}}
Tools that make EU AI Act compliance boring
Boring is the goal. You want the paper trail to exist, not to grow.
- Notion — one page for the deployer log. Free tier is enough.
- Termly or iubenda — auto-generates the AI clause in your privacy policy [verify pricing]. Roughly €10–€19/month [verify pricing].
- Your existing ToS generator — most now include an AI addendum toggle [source-needed]. Check before paying for a new tool.
Skip the “AI governance platforms” pitching to enterprises. €500/month buys you nothing your Notion page does not.
Bottom line
Do the 64-minute version this week. It covers you legally for the July–October window and gives you a defensible record if a customer, reseller, or regulator asks. Revisit in October when the next phase of guidance drops [source-needed]. Do not hire a compliance consultant for a solo SaaS unless you are in question 1 territory. {{internal:solo-saas-legal}}
FAQ
Does EU AI Act compliance apply if I only sell to US customers?
If a single EU user can sign up and pay, yes. Geofencing your checkout is a legitimate alternative [source-needed].
Do I need to file anything with an EU authority?
Not for limited or minimal risk deployers. Registration duties apply to high-risk system providers [source-needed].
What if OpenAI or Anthropic is not compliant?
Both have published GPAI compliance notices. You reference them; you are not the guarantor [source-needed].
Is my AI-generated blog content in scope?
Synthetic text does not require labelling under Article 50 unless it informs the public on matters of public interest [source-needed]. Marketing copy is fine.
Do I need extra consent to send prompts to a US-based model provider?
That is a GDPR question, not an AI Act question. Your DPA with the provider covers it [source-needed]. {{internal:privacy-policy-generator}}
Will this checklist hold up in October?
The three obligations do. Expect more paperwork for high-risk deployers, not for wrappers.
What to do next (in the next 10 minutes)
- Open your app, find every place a user talks to an AI, add one disclosure line above the input.
- Create a Notion page called “AI Act — Deployer Log” and list your model providers, versions, and today’s date.
- Add one paragraph to your privacy policy linking each provider’s training data summary URL.
That is EU AI Act compliance for a solo SaaS. Done before your coffee cools.