Detect when a SaaS AI feature is high‑risk under the EU AI Act using an Annex III decision tree

Executive Summary

SaaS companies embedding ML/LLM features face a practical and urgent problem: under the EU AI Act many product features may be classified as high‑risk under Annex III, but product, legal and procurement teams lack a consistent, explainable way to decide when that threshold is crossed. This affects an estimated 120,000 global software vendors and creates a market opportunity worth roughly $12.0B at a $100K ACV target, because classification failures lead to procurement rejection, costly redesigns, or regulatory exposure. You could build an Annex III decision‑tree engine that ingests product metadata (data subjects, intended use, autonomy level, biometric or safety implications), applies deterministic mappings derived from the Annex text and delegated acts, and emits an auditable classification report with clause‑level citations and remediation guidance. Packaged as API/CI integrations and a governance dashboard, the product would produce explainable artifacts for procurement, legal review and external auditors and could be sold at enterprise ACVs in the $50K–$200K range depending on depth of integration. The market is unusually receptive now because the EU has codified criteria in Annex III, AI features are proliferating across SaaS product lines, and buyers increasingly demand explainability and auditability rather than opaque risk scores. Where you can realistically differentiate is by offering a legally traceable, rule‑based mapping (not a black‑box model), tight SDLC integrations that prevent late‑stage surprises, and partnerships with law firms or standards bodies to validate interpretations. Challenges include keeping pace with delegated acts and national guidance, the need for liability‑aware language and legal review, and long enterprise procurement cycles, but the deterministic nature of Annex III mitigates core technical risk and makes the value proposition defensible.