The EU AI Act, Regulation (EU) 2024/1689, is often discussed as if it were a single future deadline. It is not. It applies in stages, and two of those stages have already arrived. For a European SaaS company, the parts that matter today are Article 4 on AI literacy and Article 50 on transparency.
Both are practical rather than technical. Both need someone to own them, and both are easy to miss simply because nobody has noticed how much AI is already in use across the company.
A note before the detail: this article explains what the rules say and how companies typically respond to them. It is not legal advice. For decisions specific to your company, speak to a lawyer.
What do Articles 4 and 50 of the EU AI Act ask of a SaaS company?
Article 4, applying since 2 February 2025, asks companies to take measures so the people who use AI have sufficient AI literacy; an internal record of training is enough. Article 50, applying since August 2026, asks that AI which interacts with people says it is AI unless that is obvious, and that deep fakes are disclosed.
Neither calls for a certificate or a new department. In practice, what they call for is awareness, a record and honest labeling.
Article 4: AI literacy, in practice
Article 4 has applied since 2 February 2025, and national authorities have supervised the AI Act since August 2026. It asks companies to take measures so that the people working with AI on their behalf understand it well enough to use it properly: what it is good at, where it fails, and what data should never go into it.
Two points are often misunderstood. First, no certificate is required. There is no official course to buy and no exam to pass. Second, an internal record is enough: what training and guidance were given, to whom, and when.
For a SaaS company, the hard part is not the training. It is knowing where AI is actually used. The Microsoft and LinkedIn Work Trend Index 2024 found that 75% of knowledge workers use generative AI at work, and that 78% of AI users bring their own tools. In a typical SaaS company that means support agents drafting replies, sales reps writing outreach, engineers using coding assistants and finance pasting figures into a chat window, often with no approved tool and no guidance.
A workable approach has three steps:
- Inventory. List the AI tools in use, approved or not, who uses them, and what company or customer data goes into them.
- Guidance by role. Short, specific guidance for each team: what the tools may be used for, what data must stay out, and how to check the output. A support team and a finance team need different rules.
- A record. A dated record of who received which guidance or training, updated when tools or roles change.
This is also good operations, law or no law. A company that knows where its data goes is a company that can answer a customer’s security questionnaire honestly.
Article 50: telling people they are talking to AI
Article 50 has applied since August 2026. Its core is simple: an AI system that interacts with people must make clear that it is AI, unless that is obvious from the context. Deep fakes, meaning AI-generated images, audio or video that could pass for real, must be disclosed.
For a SaaS company, the places to check are usually:
- The assistant inside the product. An in-app helper that answers users should say that it is AI.
- Website, sales and support chat. A chat that answers customers or prospects needs a clear statement that the replies come from AI.
- Voice and video. An AI voice on a call, or an AI-generated presenter in a product video or an advert, needs disclosure.
Disclosure is a design task more than a legal one: a line in the chat window, a label in the interface, a sentence at the start of a call. It is cheapest when it is part of the design from the start. The same thinking applies to internal agents: the NordOps AI Agent is built for European rules, with every question and action logged.
What does not apply yet
Much of the attention around the Act goes to high-risk AI, and for most SaaS companies that part is still ahead:
- 2 December 2027: the rules for the high-risk areas listed in Annex III, such as AI used in hiring, apply.
- 2 August 2028: the rules for AI built into regulated products apply.
These dates follow the 2026 amendment to the Act, which entered into force on 27 July 2026. A SaaS company whose product is used in recruitment, or in another Annex III area, should use the time to prepare rather than wait. For everyone else, the priority is the two articles that already apply.
A practical checklist for this quarter
- Name one owner for AI in the company, with the time to do the job.
- Complete an inventory of AI in use, including the tools people brought in themselves.
- Write short guidance for each team, and record who received it.
- Check every place where AI talks to customers, prospects or the public, and add a clear disclosure where one is missing.
- Check marketing content for AI-generated people or voices, and label it.
- If your product is used in hiring or another Annex III area, start planning for December 2027.
None of this makes a Chief AI Officer a legal requirement; it is a role, not an obligation. But the work needs an owner, and in most growing companies it has none yet. That is part of what a fractional Chief AI Officer takes on, and our AI Snapshot starts with exactly this inventory and the literacy and transparency check.
Source: Regulation (EU) 2024/1689, Articles 4, 50 and 113, as amended in 2026. This article informs; it is not legal advice.