Case: EU AI Act Readiness at a B2B SaaS Deployer

A US HR-tech vendor spends a year discovering that it is the provider of a high-risk system, that 2 December 2027 is closer than the roadmap assumed, and that its documentation is a product now.

A composite teaching case: realistic fiction assembled from well-documented public patterns — not a real engagement.

The setup. Call the company Meridian Talent Systems — a composite of several real readiness projects, not a client. Meridian is a US-headquartered HR-tech SaaS: about 480 employees, roughly $60M ARR, and a product that parses CVs, ranks candidates against job requisitions, and schedules interviews. Around 30% of revenue comes from some 200 EU customers, sold through a Dublin subsidiary. The stakes arrived by email: a Dutch retail bank — their largest EU account, mid-renewal — sent a security questionnaire with a new section titled EU AI Act, and question three read: 'Please provide your conformity assessment documentation and instructions for use per Article 13.'

Nobody at Meridian knew what an instructions-for-use document was. The general counsel’s working theory, shared by most of the leadership team, was that the AI Act was 'a customer compliance problem' — the customers run the hiring, so the customers carry the obligations. The roadmap had a line item reading 'EU AI stuff — 2028?' owned by no one.

Over the following fourteen months, three assumptions died in order: that Meridian was a mere technology supplier, that the deadline was comfortably far away, and that documentation could stay a marketing function.

What the review found. The readiness review ran six weeks — document requests, a dozen interviews, one long session with the ML team’s architecture diagrams. Six findings, in the order they hurt:

1. Role misclassification. Meridian develops the system and places it on the EU market under its own name. Under Article 3, that makes Meridian the provider. Its customers are deployers. The 'it’s our customers’ problem' theory inverted reality: the heaviest obligations in the Act — Articles 8 through 15, conformity assessment, CE marking, registration — sit on the provider.
2. The product is named in the annex. Annex III point 4(a) lists AI systems for 'recruitment or selection of natural persons, in particular… to analyse and filter job applications, and to evaluate candidates.' Meridian’s candidate-ranking engine is not adjacent to that text; it is that text.
3. The date was wrong on the roadmap. Someone had read a headline about the Digital Omnibus 'delaying the AI Act to 2028' and written 2028 down. The Omnibus moved Annex I embedded-product systems to August 2028 — but Annex III systems like Meridian’s bite on 2 December 2027. The roadmap was carrying a phantom eight months.
4. The Article 6(3) hope was dead on arrival. Engineering wanted to argue the ranking engine was a 'preparatory task' under the filter. But candidate ranking scores natural persons on performance-relevant traits — that is profiling, and profiling of natural persons always stays high-risk. Twenty minutes with the statute closed a debate the team had budgeted a quarter for.
5. No quality management system, no technical documentation. Nothing resembling an Article 17 QMS; model documentation lived in a data scientist’s notebook repo; the only customer-facing description of accuracy was a sales one-pager claiming '95% matching precision' with no methodology.
6. Article 13 changes what documentation is. Instructions for use must give deployers characteristics, capabilities, limitations, accuracy metrics, human-oversight measures, and how to interpret logs. Meridian had never written a limitations section in its life — marketing had spent a decade deleting exactly those sentences.

The classification workshop fight. Finding 1 did not land quietly. The workshop that was scheduled for ninety minutes ran three hours. The VP of Sales opened with the position everyone wanted to be true: 'Our customers configure the ranking weights. They run the hiring. They’re the operator — we just sell software.' Counsel walked the room through Article 3(3): a provider is whoever develops an AI system and places it on the market under its own name or trademark. Configuration options don’t transfer the role; Meridian’s logo is on the login page.

The second round was subtler. The head of product asked whether the white-label deal with a European staffing platform changed anything — the platform resells Meridian’s engine under its own brand. Answer: yes, and not in a comforting way. Under Article 25, a distributor or other third party that puts its name on a high-risk system becomes the provider — and Meridian, as original provider, owes them the documentation and access needed to comply. One contract, two providers’ worth of obligations to sort out, and a flow-down clause nobody had drafted.

Round three was the Article 6(3) filter, and it is worth recording how it died. Engineering argued the ranker only 'prepares' a shortlist a human reviews — condition (d), preparatory task. Counsel read out the profiling override: the derogation never applies where the system performs profiling of natural persons. Scoring candidates on inferred traits to predict job performance is profiling under the GDPR definition the Act imports. The whiteboard photo from that session — 'HIGH-RISK. PROVIDER. DEC 2027.' in red marker — became the first page of the classification memo, and the memo became the artifact every later decision cited.

The FRIA question from the bank. Midway through the programme, the Dutch bank’s procurement team sent a one-line demand: 'Provide the fundamental rights impact assessment for the system.' This produced a week of confusion, because both sides were partly wrong.

Article 27 puts the FRIA on deployers — and only certain ones: public-law bodies, private entities providing public services, and deployers of the Annex III 5(b) creditworthiness and 5(c) life/health insurance systems. Whether a retail bank using a recruitment tool is caught at all was contested inside the bank’s own legal team; their credit-scoring models clearly were, their HR tooling arguably wasn’t. But the bank’s internal AI policy required a FRIA-equivalent for every high-risk system regardless — so contractually, the demand stood.

What Meridian could not do is write the bank’s FRIA: the assessment covers the deployer’s processes, affected categories of persons, oversight arrangements, and complaint channels — facts only the bank has. What Meridian could do, and eventually productised, was a FRIA support pack: system description and intended purpose, known risk categories and their evidence, the accuracy and bias-testing results, the human-oversight measures the system supports, and the data categories processed — inputs mapped one-to-one against Article 27’s required content, so every deployer stops asking for bespoke documents. The pack took one senior person about six weeks to build. It has since shortened three enterprise sales cycles, which is the only reason finance stopped complaining about the six weeks.

Make or buy: the technical-documentation decision. The biggest single line item was Annex IV technical documentation plus the Article 13 instructions for use — a permanent, versioned documentation capability, not a one-time deliverable. Three options went to the steering committee:

What broke anyway. Three things, despite a competent programme.

First, the Article 13 productisation slipped two quarters. Turning marketing collateral into limitations-bearing instructions for use required accuracy numbers the team could defend — which meant building the evaluation harness first, which nobody had scheduled. The '95% matching precision' claim did not survive contact with a defined methodology; the defensible figure was lower and required three pages of context. Sales renegotiated one contract where the old number had been written in.

Second, the authorised representative was discovered late. A US provider needs an EU authorised representative appointed by written mandate before its high-risk system is on the EU market (Article 22). Legal had assumed the Dublin sales subsidiary 'counted.' Whether a group company can hold the mandate took outside counsel six weeks and a fee note to resolve — the mandate, verification duties, and termination obligations had to be papered properly regardless of whose name went on it.

Third, the upstream model dependency. The CV parser rides on a large language model from a GPAI provider. When that vendor shipped a major version, Meridian’s carefully documented accuracy figures aged overnight — and the team learned to demand the Article 53 / Annex XII downstream documentation in the contract, gate vendor model updates through their own re-evaluation, and version the instructions for use against the model version. The re-evaluation gate caught a real regression six months later, which converted the last internal skeptics.