For SaaS companies · Written by Yobel Tzegai · Last checked 9 October 2026

Which EU AI Act tool should a SaaS company that sells to banks and other larger customers use?

The EU AI Act tool for a SaaS company with larger customers: what banks, insurers and public bodies ask, what Complipath does and the price.

Check your AI systems, free Book a 30-minute walkthrough

Who asks you: Banks Insurers Public sector Healthcare Large enterprises Retail chains

AI you build or put your name onYou are its provider

You place it on the market or put it into service under your own name or trademark, having developed it or had it developed (Article 3, point (3)). Your customer will ask you for the instructions for use, the logging and the oversight design.

AI you buy and useYou are its deployer

You use it under your own authority, outside a personal non-professional activity (Article 3, point (4)). Your duties are the deployer's, and the vendor's answers are part of your evidence.

The answer, in detail

What will a larger customer ask?

Usually a supplier questionnaire with an AI section beside the security and privacy ones, whether the customer is a bank, an insurer, a public body, a healthcare provider, a large enterprise or a retail chain.
A customer that deploys a high-risk system must take measures to use it in accordance with its instructions for use and keep the logs under its control (Article 26(1) and (6)), so it asks the provider for the instructions, the logging and the oversight design.

If the customer is a financial institution, Article 26(5) counts the monitoring duty as met by complying with the internal arrangements its financial services law requires, and Article 26(6) has it keep the logs with the documentation that law requires.
Each question, with the article behind it: how to answer AI questions in a supplier questionnaire.

Is our AI feature high-risk because our customer is a bank, an insurer or a public body?

No.
Classification follows the intended purpose, not the customer.
A feature intended to evaluate the creditworthiness of natural persons or establish their credit score is high-risk under point 5(b) of Annex III, except where it is used to detect financial fraud.
Risk assessment and pricing for natural persons in life and health insurance is point 5(c).
A support chatbot or a document summariser in a customer's hands is neither, and carries the Article 50 transparency duty if it interacts with people.
A provider who considers an Annex III system not high-risk under Article 6(3) documents that assessment first (Article 6(4)).

Who is the provider and who is the deployer?

You are the provider of an AI feature you develop and place on the market under your own name; the customer that uses it under its authority is the deployer (Article 3, points (3) and (4)).
The role is set per system, so a company can be provider of one and deployer of another: provider or deployer.

Your customer asks. You answer with proof.

1List every AI system
Illustration · not your dataSystem Customer support chatbotClass Limited risk · Article 50(1)
Add the AI you use. Each system gets a role, a risk class and the article it rests on.
Live
2Attach the proof
Illustration · not your dataDuty Article 26(6), keep the logsProof logging-policy.pdf · page 3
Link each duty to a file and the page it stands on: a policy, a log setting, a training record.
Live
3Answer their questionnaire
Illustration · not your dataQuestion Do you log AI decisions?Answer drafted from your own proof
Answering a customer's questionnaire inside the app, from the proof you already linked.
Coming soon

What Complipath does

Risk classification Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms.
Article mapping Each reason behind a verdict names the provision it rests on, so a reader can check it herself
Obligations per system Confirming a classification creates the obligations that follow from it, each with an owner, a status and a place for evidence
Annex IV documentation A workspace for the technical documentation, section by section, saying which Annex IV points each one answers
Evidence management A file linked to the requirements it proves, with the passage and its page
Export (PDF, JSON, spreadsheet) The whole register as a spreadsheet, as JSON or as a PDF, with the exact law texts it was assessed against
Audit log Who did what, and when. No one can edit or delete a line, an owner included; only deleting the whole workspace removes it
Two-factor sign-in A code from your phone after the email link, which the owner can require for everyone
Vendor management An AI tool you buy is registered and classified like one you build, with the obligations of a deployer and the AI literacy record. There is no vendor questionnaire and no contract review.

Rules decide. AI only drafts. A person confirms.

What it does not do yet

Customer questionnaires (audit room) Coming soon Coming soon: answering a customer's AI questionnaire from your own register.
Audit pack Coming soon One file for an auditor: every system, its classification, evidence, the audit log and a fingerprint. Not available yet.
Conformity assessment (Article 43) Not supported We found no support for this in what we have built. The same search found the number in one file — a comment using it as an example of the Official Journal's citation form — and the words in six, every one of them quoting Article 6(1), point (b)'s third-party condition, an Article 5 sentence or a section name. No template, no column, no limb.
Post-market monitoring (Article 72) Not supported We found no support for this in what we have built. MVP searched 245 shipped source files, 44 migrations, 14 obligation templates, 15 export columns and 12 Annex IV limbs, on the article number and on the provision's own words: nothing on any of the five.
ISO/IEC 42001 mapping Not supported The assistant answers questions about ISO/IEC 42001 next to the AI Act. There is no mapping of its controls to the Act, and Complipath certifies nothing.

What is live today

Checked against the app on 8 October 2026

AI inventoryLive
Risk classificationLive
Article mappingLive
Obligations per systemLive
DeadlinesLive
Annex IV documentationLive
Documentation draftingLive
Regulatory change monitoringLive
Named ownersLive
Export (PDF, JSON, spreadsheet)Live
Evidence managementLive
DashboardLive
AI literacy (Article 4)Live
Two-factor sign-inLive
Audit logLive
Audit packComing soon
Customer questionnaires (audit room)Coming soon
Domain-specific guidanceNot supported
Full risk-management lifecycleNot supported
Conformity assessment (Article 43)Not supported
Post-market monitoring (Article 72)Not supported
Serious incident reporting (Article 73)Not supported
Fundamental rights impact assessment (Article 27)Not supported
Declaration of conformity (Article 47)Not supported
EU database registration (Article 49)Not supported
ISO/IEC 42001 mappingNot supported
Vendor managementLive

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Every duty, deadline and article
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Do we need ISO/IEC 42001 to sell AI features to larger customers?

The AI Act does not require it. A bank, an insurer or a public body may ask for it in its own procurement, and that is a contract question, not an AI Act one. Complipath does not map ISO/IEC 42001 controls to the Act and certifies nothing; it records what the Act asks of each system, with the article behind each answer.

Who answers a customer's AI questions, us or our model provider?

You do, for the features you place on the market under your own name. If you build on a general-purpose AI model, its provider owes you information on the model's capabilities and limitations under Article 53(1), point (b), unless Article 53(2) exempts it: a model released under a free and open-source licence that allows access, usage, modification and distribution, with its weights and the information on its architecture and usage made public, is exempt; a model with systemic risk never is. That information is evidence for your answers, not a substitute for them.

When do the high-risk duties apply to a credit-scoring feature?

From 2 December 2027 for systems high-risk under Article 6(2) and Annex III, where creditworthiness sits (point 5(b)): Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744. Article 4 applies already, and Article 50 too, except that paragraph 2 waits until 2 December 2026 for systems placed on the market before 2 August 2026 (Article 111(4)).

What does Complipath cost for a SaaS company?

Starter is €499 a month. Prices exclude VAT. Your first system is free with no end date, so the first AI feature you classify costs nothing and shows you the article behind each answer before you pay. Growth and Scale are not available yet. The full terms are on the pricing page, and nothing here is a discount.