TL;DR: The EU AI Act sorts AI into four risk tiers: banned, high-risk, limited risk, and minimal risk. Most SaaS products land in limited risk. That tier has one duty: tell users when they talk to an AI or see AI-made content. The rules for SaaS teams apply from August 2, 2026 — three weeks from this post. A missed notice can cost up to €15M or 3% of turnover. The decision path below places your product in about ten minutes.
Your risk tier is visible from the outside
Founders treat AI Act tiers as a legal puzzle they can park for later. Here is the problem with that plan: anyone can read your tier from the outside. No code access needed.
Our scanner proves this on every audit. It pulls the JavaScript your site ships to each visitor and looks for the fingerprints of AI vendors.
- An
@anthropic-ai/sdkimport in your bundle names your AI vendor at0.70confidence (platformFingerprintScanner.js:124). - A
new OpenAI({call raises the flag at0.75(platformFingerprintScanner.js:175). - The runtime rule at
platformFingerprintScanner.js:173confirms it at0.82.
So a stranger with a browser can tell that your product uses AI. The next question a regulator would ask: do your users know? We test that too. Our compliance engine reads your public pages. It looks for an AI vendor name with no matching notice to users (compliance-scanner.js:287). The check is rated critical, and its fix note is blunt:
“If your product uses AI, you must disclose this to users per EU AI Act Article 50. Enforcement begins August 2, 2026.”
That line sits at compliance-scanner.js:76. The average Launch Readiness Score across 100 AI-built apps we scanned is 42/100. The same pattern drives both numbers: teams ship what the AI tool wrote and never check what it exposed. Your stack answers the tier question before you do. Better to answer it yourself first.
The four tiers in plain English
The Act does not grade your code. It grades what your product is used for. For the wider picture, our EU AI Act compliance guide covers the whole law. Here are the four tiers, from worst to best:
Banned (the Act calls this “unacceptable risk”). Social scoring of people. Scraping the web for face images. Reading the emotions of staff or students. These uses have been illegal in the EU since February 2, 2025. Fines here are the big ones you see in headlines: up to €35M or 7% of global turnover. Almost no SaaS product is in this tier. If yours is, stop reading and call a lawyer.
High-risk. This tier is a list of use cases, not a level of tech. The list lives in Annex III of the Act. It covers tools that screen job seekers or manage staff. Tools that score credit. Tools that grade students or decide who gets into a school. And tools that gate key services, such as insurance or benefits. Build for one of these and you carry the heavy duties: a risk system, logging, human oversight, and a technical file. Our Annex IV generator gives you the skeleton of that file.
Limited risk. This is the transparency tier. It is where most SaaS products with a chatbot or AI output live. One duty: tell people. Users must be told they are chatting with an AI, at the start of the chat — not in a footer. AI-made content that could mislead must be labelled. The rules sit in Article 50, and we wrote a full guide with copy-paste wording.
Minimal risk. Spam filters. Spell check. AI that helped you write code but never touches the user. No duties at all. Note that last case well: using Cursor or Claude Code to build your product does not, by itself, put the product in any AI tier. What counts is what the shipped product does.
The ten-minute decision path
Answer four questions in order. Stop at the first yes.
- Does the product do a banned thing? Score people socially, scrape faces, read emotions at work or school? Yes: it cannot be sold in the EU. No: next question.
- Is the product used to hire, grade, score credit, or gate key services? Check Annex III, not your gut — the list is exact. Yes: high-risk tier. Budget real work and legal review. No: next question.
- Do users chat with an AI, or see AI-made text, images, or audio? Yes: limited risk. Your duty is to tell users, under Article 50, and to label AI content. No: last question.
- None of the above? Minimal risk. No duties. Re-run this path when you ship a new AI feature. The answer changes the moment you add a chatbot.
One product can sit in two tiers at once. An HR screening tool (high-risk) with a support chatbot (limited risk) carries both sets of duties. Classify each feature, not the company.
A worked example
Say you built a legal-tech app with Bolt. Users paste a contract, and a chat panel answers questions about it. The answers come from the Claude API. Run the path. Banned? No. Annex III? No — contract review for private firms is not on the list. Do users chat with an AI? Yes. So the app is limited risk. The whole duty is a clear notice in the chat panel and a label on AI-drafted text. One evening of work.
Now add one feature: the same app screens CVs for a hiring team. That single feature is on the Annex III list. The CV tool is high-risk, with the full duty set — while the contract chat stays limited risk. Same codebase, two tiers. This is why you classify per feature.
The trap in vibe-coded apps: “we just call an API”
Founders who built with Lovable, Bolt, or Cursor often assume the AI Act is OpenAI’s problem. It is not. The law splits roles. The model maker carries the model duties — those started for the big labs on August 2, 2025. But the chatbot in your product is your AI system. You chose to put it in front of users, under your brand. The duty to tell them is yours, not your vendor’s.
This is where vibe-coded SaaS products, websites and apps walk into trouble. The AI tool wires up a chat widget in an afternoon. It does not add the “you are chatting with an AI” notice, because no one asked it to. Our scans find the vendor SDK in the open bundle again and again. That is what the fingerprint rules above are for. The matching notice is missing far more often than not.
August 2, 2026 is when this stops being theory. From that date, the duties in Article 50 can be enforced. The fine runs up to €15M or 3% of global turnover. Not the €35M headline number — that one is reserved for the banned tier. We broke down the full fine ladder in our fines guide. Three weeks is enough time to add a missing notice. It is not enough time to fix it after an enterprise buyer or a regulator asks first.
What to do this week, by tier
If you landed in limited risk (most readers):
- Add the chat notice. At the start of the chat, in the chat window itself. Our Article 50 guide has wording you can paste today.
- Label AI-made content where a user could mistake it for human work.
- Write the one-page AI policy that says what your product uses AI for and where a human checks it. Our AI policy guide walks through the whole document.
- Check GDPR at the same time. The AI Act does not replace it, and AI features almost always process personal data. Run the GDPR checks too.
- Expect the question from buyers. Enterprise security questionnaires now ask about AI Act tiers by name. Here is how to answer them when your app was AI-built.
If you landed in high-risk:
Do not try to wing this with blog posts, ours included. You need a risk system, logging, human oversight, and a technical file — and you need legal review. Start the technical file now with the Annex IV generator, and use our compliance checklist to see the full surface. To be clear about our limits: we prep you for this work. We do not certify you, and nothing here is legal advice.
Check your exposure in three minutes
You now know your tier. The faster question is what your product already shows the world. The free scan reads your live URL from the outside — DNS, page source, public endpoints — and returns a Launch Readiness Score out of 100 in about 30 seconds.
Run the free scan — $0If you want the full picture, the Compliance Score runs automated checks across GDPR, the EU AI Act, and SOC 2 foundations, and ships a report with fixes ranked by risk. The tier system rewards teams who classify early. Three weeks is plenty — if you start this week.
FAQ
What are the four EU AI Act risk categories?
The EU AI Act sorts AI systems into four tiers. Banned uses, such as social scoring, are illegal in the EU. High-risk uses, listed in Annex III, carry heavy duties such as logging and human oversight. Limited-risk systems, such as customer chatbots, must tell users they are dealing with AI under Article 50. Minimal-risk systems, such as spam filters, have no duties.
Is my SaaS high-risk under the EU AI Act?
Only if it is used for a case on the Annex III list. That list covers hiring and worker management, credit scoring, education access and grading, and access to key services such as insurance or benefits. A normal SaaS chatbot or writing tool is not high-risk. It usually sits in the limited-risk tier, where the duty is a clear notice to users.
Does the EU AI Act apply to my app from August 2026?
Yes, if you have users in the EU. The transparency duties in Article 50 apply from August 2, 2026, along with the high-risk duties for Annex III uses. Banned practices have applied since February 2, 2025, and duties for the big model makers started on August 2, 2025. Where your company is based does not matter. What matters is where your users are.
What is the fine for a missing AI disclosure?
Up to EUR 15M or 3% of global annual turnover, whichever is higher. The EUR 35M or 7% tier that appears in most headlines applies only to banned AI practices, not to missed disclosures. For a small SaaS, the bigger cost is often the enterprise deal that stalls when a buyer asks for your AI Act tier and you have no answer.
Does using the OpenAI or Claude API make me responsible under the AI Act?
Yes. The model maker carries the duties for the model itself. But the chatbot you ship in your product is your AI system, under your brand. The duty to tell users they are chatting with an AI sits with you, not with your API vendor. Calling an API does not move your product out of the limited-risk tier.
Which tier is an app built with Cursor, Lovable, or Bolt in?
The build tool does not set the tier. Using AI to write your code puts no duty on the shipped product. The tier depends on what the product does for users. If it has a chatbot or shows AI-made content, it is limited risk. If it is used for hiring, credit, grading, or key services, it is high-risk. If neither, it is minimal risk.