A structured AI Act risk classification and impact assessment for SaaS companies selling into Europe. Written up in plain English, mapped to the articles, with a prioritised action list. Fixed price. Delivered in 2–5 business days.
For SaaS teams of 20–200 people. Not legal advice. A structured readiness assessment your team and counsel can work from.
The AI Act is in force, but its obligations arrive in phases, and the dates have moved.
Enterprise buyers in the EU have started adding AI Act questions to security and procurement questionnaires.
The 2026 "Digital Omnibus" amendment (Regulation (EU) 2026/1744) moved the main high-risk requirements to 2 December 2027 for Annex III systems and 2 August 2028 for product-embedded systems.
Anything touching hiring, HR, credit, insurance, education or biometrics deserves a closer look. You need to know which features, and write down why.
A law firm will usually charge far more than this for a first classification memo. A blank template leaves your team guessing.
The useful first step is a clear, documented answer to three questions: What AI do we have? What risk tier is each piece in? What do we have to do, and by when?
Every finding states its reasoning, the article it rests on, and the date that applies.
Every AI feature and internal AI tool you told us about, with your role for each one: provider, deployer, or both.
Each system checked against prohibited practices (Art. 5), high-risk categories (Art. 6 and Annex III, including the Art. 6(3) exception), transparency (Art. 50) and general-purpose AI considerations.
Which articles apply to you (Arts. 9–15 for high-risk providers, Art. 26 for deployers, Art. 27 where an impact assessment is required, Art. 50), and when each one applies.
Who could be affected, how, and which safeguards you already have in place, with a fundamental-rights lens.
Prioritised actions, each with an owner role and a target date tied to the real application dates.
A one-paragraph AI Act position statement your sales team can paste into questionnaires. Included in Standard and Full.
A 6-page sample assessment for a fictional HR-tech SaaS company.
Book a short call, we confirm the right tier and scope, and you get an invoice and the intake form.
For companies with one or two AI features that just need a clear answer.
For SaaS products with AI built into the core.
For teams with a likely high-risk feature or an active enterprise deal.
Prices in USD, excluding any applicable taxes. Delivery times count from a complete intake. Late delivery means a full refund.
A documented methodology, AI-assisted drafting, and human review of every report.
15 minutes to confirm scope and the right tier, or whether you need this at all.
A structured questionnaire, about 30–45 minutes, usually filled in by your product lead or CTO.
Your answers go through a methodology mapped to the AI Act. AI tools help draft; Eric Phan reviews every report.
PDF plus an editable version, within your tier's timeframe from a complete intake.
Use the action plan internally, share the summary with customers, and take open legal questions to your counsel.
No. ActPrism provides structured regulatory-readiness assessments based on the information you supply. We are not a law firm, and the report does not create a lawyer–client relationship. Where a question needs a legal opinion, the report flags it so you can take it to qualified counsel.
Very possibly. The Act covers providers that place AI systems on the EU market, and in some cases providers and deployers outside the EU whose AI output is used in the EU (Art. 2). The assessment confirms your position for each system.
No, and you should be wary of anyone who says it is. Obligations apply in phases: prohibitions and AI literacy from 2 Feb 2025; general-purpose AI model rules from 2 Aug 2025; most other provisions, including Art. 50 transparency, from 2 Aug 2026; core high-risk requirements from 2 Dec 2027 (Annex III) or 2 Aug 2028 (Annex I), following Regulation (EU) 2026/1744. The report ties every action to the date that actually applies.
Usually not. The general-purpose AI model obligations fall mainly on the companies that develop the models. If you build a product on top of one, you are typically the provider or deployer of an AI system, and the obligations that matter for you depend on what the system does. We map this for each feature.
Most private SaaS companies don't. Art. 27 applies to public bodies, private entities providing public services, and deployers of certain credit-scoring and life/health-insurance pricing systems. Many companies still want a structured impact analysis, because customers ask for one and it supports risk management. Our report says clearly whether Art. 27 applies to you.
Templates, a fixed methodology, and AI-assisted drafting, followed by human review. You get consistency and speed. We don't skip the thinking.
Your intake answers and documents are used only to produce your report. Drafting uses a commercial LLM API under terms where the provider does not train its models on your data. We delete your intake answers, uploaded documents and working drafts 30 days after delivery; we keep only the invoice record and, unless you ask us not to, a copy of the final report. Want everything deleted sooner? Email eric@actprism.com. Happy to sign your NDA (or send ours) before you submit anything. Details in our privacy policy.
Your report reflects your product on the assessment date. When you add AI features or materially change existing ones, a re-assessment within 12 months of your original report costs 50% of your original tier ($250 / $600 / $1,000).
If we don't deliver your report within the stated timeframe for your tier (counted from a complete intake), you get a full refund, and you keep the report when it arrives. If you change your mind before submitting the intake, we refund in full as well.
15 minutes on a call is enough to tell you which tier fits, or whether you need this at all.