Micro SaaS / API Wrapper / Bot
EU AI Act Compliance Tracker and Risk Register for Tech SMEs
A €29/month SaaS for EU and EU-market-facing tech SMEs that inventories their AI systems, classifies each against the AI Act's risk tiers (GPAI/Annex III/prohibited), tracks live obligations, logs post-market incidents, and generates the Annex IV technical documentation required for high-risk systems, replacing enterprise GRC tools that start at €30,000/year.
研究阶段进度
Demand side (strong): GPAI obligations are already in force since August 2025, creating immediate compliance pressure on any EU tech SME embedding a third-party LLM. 78% of organizations had not taken meaningful steps toward compliance as of April 2026 (Cloud Security Alliance). Enterprise procurement pressure is cascading AI Act attestation requirements to SME software suppliers, replicating the GDPR B2B demand dynamic. The ICT sector has 62.5% AI adoption (Eurostat 2025), making the target audience large and identifiable. Fine risk is meaningful (up to €150K for a €5M revenue SME), supporting willingness to pay.
Demand side (moderators): The December 2027 deferral of Annex III high-risk obligations under the Digital Omnibus removes near-term urgency for the highest-pain category. Some buyers will wait.
Competition side (opportunity): No self-serve product under €100/month delivers all five workflow components (inventory, obligation tracker, Annex IV generation, incident log, registration reminder). Legalithm is free but covers only documentation generation, not ongoing compliance workflow. Enterprise tools (Holistic AI, Credo AI, OneTrust) start at €30,000/year with sales-only access.
Competition side (risk): Legalithm's free positioning through April 2028 absorbs early adopters. Vanta has already added an EU AI Act compliance module with 14,000+ existing customers. EuroComply (€0-€149/month) covers the pricing tier but lacks AI Act workflow depth. The window for AI-Act-native positioning is estimated at 12-18 months before incumbents close the gap.
Score rationale: 7.1/10 reflects a confirmed pricing gap, reachable buyer audience, and meaningful fine-driven WTP, moderated by the deferral reducing urgency and the free competitor absorbing first-mover demand.
Technical feasibility (8.0/10): All five core features (AI system inventory, risk classification, obligation tracker, Annex IV document generation, incident log) are well within current LLM capability. Build cost is low; no proprietary training data required. Ongoing obligation database maintenance is the primary operational burden post-launch.
Financial feasibility (7.0/10): LTV/CAC of 5.3x on SEO-led acquisition; 13-month CAC payback; bootstrap break-even at 110 customers. Initial capital needed is EUR 60,000 (1 founder, bootstrapped) to EUR 270,000 (seed-funded). Unit economics are sound at EUR 53.50/month blended ARPU.
Competitive feasibility (5.0/10): This is the material drag. Legalithm is free through April 2028 and captures first-touch scoping and Annex IV generation. Vanta has 14,000+ existing customers with an EU AI Act compliance module already live. Together they absorb the highest-intent early adopters. The reachable market is the ongoing-workflow segment (incident register, obligation tracker) that neither covers, but it is smaller and harder to reach than the headline TAM suggests.
Compliance and legal feasibility (6.0/10): Manageable with proper disclaimers. Classification ambiguity at the Annex III boundary is real; the 'indicative only' disclaimer is non-negotiable. Obligation database currency is a permanent operational requirement. GDPR compliance for the product itself adds standard but non-trivial legal overhead.
Biggest killer: Legalithm free runway plus Vanta's installed base compress the effective first-mover window to roughly 12-18 months from mid-2026. A launch after Q4 2026 materially reduces the addressable early-adopter pool. FEASIBLE if launched promptly; window-dependent.
EU AI Act Compliance Tracker and Risk Register for Tech SMEs
One-liner
A €29/month SaaS for EU and EU-market-facing tech SMEs that inventories their AI systems, classifies each against the AI Act's risk tiers (GPAI/Annex III/prohibited), tracks live obligations, logs post-market incidents, and generates the Annex IV technical documentation required for high-risk systems. Priced for the gap that €30,000+/year enterprise GRC tools leave open.
Opportunity Source
Discovery methods used: Trend Sniffer (EU AI Act deadline search surge, August 2025 GPAI obligations in force) + Idea Generator (regulatory compliance SaaS pattern applied to AI Act gap).
Core signal: The EU AI Act entered phased application from August 2024. As of August 2, 2025, GPAI (General Purpose AI model) obligations are in force. The Annex III high-risk system obligations, originally due August 2, 2026, were deferred to December 2, 2027 under the Digital Omnibus (provisional political agreement May 7, 2026; EP approved June 16, 2026; Council publication pending). Despite the extension, the compliance burden is real and preparation must begin now: conformity assessments, EU AI database registration, quality management systems, and post-market monitoring all require months of groundwork.
As of April 2026, 78% of organizations have not taken meaningful steps toward compliance (Cloud Security Alliance research note). The search volume for "EU AI Act compliance" and "AI Act high-risk" is at an all-time high in 2026.
The specific gap: Enterprise GRC suites (OneTrust AI Governance, Holistic AI, Credo AI) cost €30,000-€100,000+/year and require a sales call. The free alternative, Legalithm, covers only applicability scoping and Annex IV documentation generation. It does not provide a live system inventory, ongoing obligation tracking, post-market monitoring log, or incident register. No self-serve SaaS priced under €100/month delivers the full compliance workflow for a tech SME operating one to ten AI systems.
Evidence: See assets/ for source links and extracted data.
Demand Detail
Who needs this:
- EU-based tech startups and scaleups that have deployed AI in any Annex III category (HR screening/recruitment, credit scoring, education/training assessment, biometric categorisation)
- Non-EU companies with products sold into the EU market that touch GPAI or high-risk categories
- Digital agencies and software houses that build AI features for clients and need to advise on AI Act compliance
The workflow they need (and no tool under €100/month delivers):
- AI system inventory: catalogue each AI system with intended purpose, training data type, deployment context, affected population
- Risk classification: map each system to prohibited, high-risk (Annex I/III), GPAI, or minimal-risk, with reasoning and a citation to the relevant article/annex
- Obligation tracker: per-system checklist of applicable obligations (quality management, data governance, transparency, human oversight, technical documentation, post-market monitoring) with deadlines
- Annex IV documentation generator: produce the required technical documentation for high-risk systems from structured questionnaire answers
- Post-market monitoring log: incident register, serious incident reporting to national authority (Art. 73; within 15 days for serious incidents)
- EU AI database registration reminder: alert when a high-risk system approaches placement on EU market
Why the urgency is real despite the delay:
- GPAI obligations (Art. 51-56) are already in force as of August 2025, with no deferral. Any SME using a GPAI model (GPT-4, Claude, Gemini) in their product must comply now with transparency and usage policy obligations.
- The Omnibus deferral has not yet been formally published in the Official Journal. If publication slips past August 2, 2026, the original high-risk deadline briefly applies.
- Larger enterprise customers are increasingly requiring AI Act compliance attestations from their software vendors as a procurement condition, creating downstream pressure on SMEs before the hard deadline arrives.
7-Dimension Triage Scores
| Dimension | Score | Rationale |
|---|---|---|
| Demand Pull | 4 | 78% non-compliance rate documented; GPAI obligations already in force; high and growing search volume; enterprise procurement pressure cascading to SMEs; score 4 not 5 because Annex III deferral to December 2027 reduces immediate urgency for some buyers |
| Acquisition Feasibility | 4 | Strong SEO opportunity on "EU AI Act compliance software SME" with limited self-serve competitors; developer and tech founder community (Hacker News, ProductHunt, EU startup communities) is reachable; EU Commission's AI Act Service Desk and regulatory sandboxes are indirect awareness channels |
| Agent Advantage | 5 | Risk classification from system description, Annex IV document generation from structured answers, obligation checklist generation from classification, incident report auto-formatting: all core LLM tasks; high structural advantage over manual legal research |
| Low-Volume Economics | 5 | Pure SaaS; token costs for document generation are marginal; €29/month x 200 users = €5,800 MRR before breakeven; Annex IV document generation upsell (€149 one-time per system) adds revenue without marginal cost |
| Operator Hand Lightness | 5 | Classification and documentation generation are automated; operator does not touch individual company systems; "indicative classification only, confirm with legal counsel" disclaimer handles liability; no per-customer manual work |
| Market Trend | 5 | EU AI Act application schedule is a rising tide through 2027-2028; GPAI obligations in force now; each new application deadline wave creates a fresh demand spike; regulatory compliance SaaS is the fastest-growing sub-category of B2B SaaS in 2025-2026 |
| Policy Redline | 4 | Must carry "indicative only, not legal advice" disclaimer clearly; cannot claim to certify compliance or guarantee notified body approval; score 4 not 5 because some risk classifications are genuinely ambiguous (EU Commission AI Office has not resolved all Annex III interpretive questions) |
Triage Total: 32 / 35
Hypotheses and Lines for Research
Key hypotheses to test:
- Legalithm (the main free competitor) truly does not have a live system inventory and obligation tracker. Confirm from their product page and changelog.
- Holistic AI, Credo AI, and Modulos are all enterprise-only (€30,000+/year). Verify no self-serve tier exists below €200/month.
- The GPAI transparency obligations (Art. 53) require specific disclosures that most SMEs using off-the-shelf LLMs have not implemented. Confirm this is the fastest monetisable pain point.
- Enterprise software vendors are including AI Act compliance as a procurement questionnaire item for their SaaS suppliers. Verify this creates measurable bottom-up pressure on SME adopters.
Competitor lines:
- Legalithm (legalithm.com): free through ~April 2028, AI-Act-native, covers scoping + Annex IV documentation, no live tracker or incident log, no ongoing obligation monitoring
- Modulos (modulos.ai): compliance and risk management, unclear SME pricing (appears enterprise)
- Holistic AI: enterprise only, €30,000+/year
- Credo AI: enterprise only, €30,000+/year
- OneTrust AI Governance: enterprise GRC, €50,000+/year
- EU Commission's free AI Act Compliance Checker: web tool only, not a persistent tracker
Red line notes:
- Cannot guarantee or certify AI Act compliance; must state classification is indicative and requires legal review
- Cannot store customer AI system training data or model weights. Only system descriptions and questionnaire answers are stored.
- GPAI model providers (Anthropic, OpenAI, Google) have their own obligations. This tool serves the deployer (the SME using the GPAI model), not the model provider itself.
- EU AI database registration is performed by the operator on the official portal. The tool provides reminders and prep, not actual registration.
Assets Evidence Checklist
-
assets/01-eu-ai-act-timeline-and-obligations.md: AI Act application schedule, GPAI in-force date, Annex III deferral, source links -
assets/02-compliance-gap-and-market-data.md: 78% non-compliance rate, enterprise tool pricing, Legalithm free tool limitations -
assets/03-search-volume-and-demand-signal.md: Search volume surge data, regulation text sources