My SaaS integrates AI: am I a provider under the AI Act?
·
Updated on ·
By 
Aymeric Guyard · 7 min read
In brief
- Under Article 3.3 of the AI Act, as soon as an AI system is integrated into a product and marketed under the vendor's name or brand, the vendor becomes the provider — regardless of whether the model comes from OpenAI, Mistral or Anthropic. What matters is the marketed end use, not the origin of the model.
What Article 3.3 says
The provider is defined as the entity that develops an AI system — or has it developed — and places it on the market or puts it into service under its own name or trademark. The key point: 'has it developed'. You don't need to have trained the model yourself. Integrating it, configuring it and marketing it under your name is enough to qualify you as a provider vis-à-vis your end customer. See provider or deployer.
Three typical examples
- A project management SaaS that uses an LLM API to generate automatic meeting summaries.
- A marketing tool that integrates a lead scoring model via a third-party library.
- An HR platform that offers a training recommendation module based on a language model.
In all three cases, the vendor is the provider. The underlying model is supplied by a third party, but the AI function as perceived and used by the customer is that of the vendor.
Your obligations depend on the risk level
The first step is to determine whether the AI function you are marketing is high-risk. If it falls under Annex III (HR, credit, education, essential services…), you must produce technical documentation compliant with Annex IV. If the function falls under limited risk (chatbot, content generation), your obligations focus on transparency (Art. 50) and the instructions for use (Art. 13).
| Your AI function | Likely regime | Priority |
|---|---|---|
| Candidate or credit scoring | High-risk (provider) | Annex IV documentation, conformity assessment |
| Chatbot, summary, text generation | Limited risk | Transparency Art. 50, instructions Art. 13 |
| Basic recommendation, filtering | Minimal risk | Voluntary best practices |
The practical case of an HR SaaS
A vendor offers a premium automatic candidate scoring module, based on an LLM API. Candidate scoring falls under HR management (Annex III): the system is high-risk. The vendor must produce Annex IV documentation including a description of the scoring criteria and their weighting, the provenance of the data, and bias control measures. It must also provide its deployer customers with the instructions for use (Art. 13) enabling them to exercise their own human oversight.
What your customers will demand
Beyond regulatory obligation, pressure often comes from customers themselves. More and more European B2B buyers are demanding AI Act compliance documentation during the sales phase as part of their due diligence. A vendor able to provide clear documentation gains a competitive advantage. See responding to an AI Act due diligence. To structure the approach, start with the register of your AI systems and functions.
Take action
SaaS vendors: map your AI functions, assess their risk and build your AI Act compliance file with Data Comply One.
Discover the AI Act software →Test my compliance for free