EU AI Act: what UK SaaS founders need to do before August 2026

TL;DR

• The EU AI Act becomes fully applicable on 2 August 2026
• Several obligations are already in force now
• UK SaaS companies selling into Europe fall within scope regardless of Brexit
• EU buyers are already asking for governance records and risk documentation
• Acting early reduces friction in procurement and lowers contract risk

The deadline is fixed. The European Commission has confirmed it will not be moved. And for UK SaaS founders with customers or commercial ambitions in Europe, August 2026 is closer than the calendar makes it feel.

Several obligations are already in force. EU buyers are already asking questions during procurement. The businesses that started preparing early are moving through those conversations faster, with fewer delays and less friction, than those treating this as a 2026 problem.

Does it apply to UK companies?

Yes, in many cases, and Brexit does not change that.

If customers use your product in the EU, or if you sit within the supply chain for an EU client, the Act applies to how you build and deploy AI. For most UK SaaS companies with any European presence, or with European growth on the roadmap, that means the clock is already running.

What is already live

The Act entered into force on 1 August 2024 and is being rolled out in stages rather than through a single switch-on date.

From February 2025, practices classified as unacceptable under EU law became prohibited. From August 2025, governance and transparency obligations for general-purpose AI systems came into effect. Full application, including the complete set of obligations for high-risk systems, arrives on 2 August 2026.

EU buyers are not waiting until that date to ask questions. Compliance checks are increasingly built into supplier onboarding and contract reviews today, well before the final deadline.

Which tier does your product sit in?

The Act works on a four-tier risk model. Knowing where your product sits is the starting point for everything else.

Unacceptable risk covers practices prohibited outright, including social scoring and real-time biometric surveillance. Unlikely to apply to standard SaaS products.

High-risk carries the most significant obligations. This tier covers AI used in hiring decisions, credit assessments, health and education. If your product influences decisions in any of these areas, there is a substantial amount of preparation ahead.

Limited risk introduces transparency requirements. Chatbots, AI-generated content and recommendation engines fall here. Users must know they are interacting with an AI. This applies to a large number of SaaS products already on the market, including ones where the AI element feels relatively minor.

Minimal risk carries no specific obligations. Most productivity tools, spam filters and basic automation sit here.

What most UK SaaS products need to address

Transparency in the product. If AI generates content, makes recommendations or interacts with users directly, that needs to be clearly disclosed. Not buried in terms and conditions, but visible in the product itself, in onboarding flows and in supporting documentation.

Data governance and oversight. High-risk systems require documented human oversight as a formal requirement. But even outside that category, clear data governance is increasingly expected during enterprise procurement. Build audit trails, document how decisions are made and be able to show where model inputs come from.

Third-party AI components. Using an external API does not transfer responsibility. If it is embedded in your product, you remain accountable for how it behaves. Document what you are using and why, and what controls are in place.

The commercial case for moving early

EU AI Act readiness has become a procurement requirement as much as a regulatory one. Buyers want to see written governance processes, risk records and incident procedures before contracts are signed, not after.

UK companies that can provide clear document tend to move through conversations faster. Those that cannot often face delays or more restrictive contract terms, regardless of how good the product actually is.

Getting ahead of August 2026 is not only about managing regulatory risk. It is about making sales conversations with European clients easier.

Five things to do now

If you are not sure where to begin, these five steps will cover most of the ground:

1. Audit every AI component in your product and classify it by risk tier
2. Update user-facing disclosure language wherever AI is active
3. Document your data governance approach, including inputs, outputs, decision logic and human oversight
4. Review your agreements with third-party AI providers
5. If you are approaching the high-risk category, get specialist legal input before your next major release

How Aecor helps

We work with UK SaaS companies to turn EU AI Act requirements into practical governance documentation, risk records and product changes that hold up during procurement review. 

If you want to understand exactly where your product stands, a free consultation is a good place to start.

Book a free consultation