Ship AI features.
Pass the security review.
AI features for B2B software companies: assistants, search across your customers’ data and workflow automation, with tenant isolation and the documentation enterprise buyers ask for.
The rules you work under.
The regulations that shape an AI system in saas. A summary for orientation, not legal advice.
| Regulation | What it means for an AI system |
|---|---|
| GDPR Article 28Regulation (EU) 2016/679 | As a processor for your customers, you work under their data processing agreements. Adding a sub-processor, such as an LLM provider, needs their authorisation, and under a general authorisation you must tell them first so they can object. |
| GDPR Chapter VInternational transfers | Sending customer data to a model provider outside the EU is a transfer. It needs an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or appropriate safeguards such as Standard Contractual Clauses. |
| NIS2Directive (EU) 2022/2555 | Cloud computing and managed ICT service providers above the size thresholds must manage cybersecurity risk, including in their supply chain, and report significant incidents. |
| EU AI Act, Article 50Regulation (EU) 2024/1689 | Since 2 August 2026, users must be told when they are interacting with an AI system, and providers of systems that generate content must mark it in a machine-readable way. |
| EU AI Act, Annex III 4Employment and workers management | If your product screens CVs, ranks candidates, allocates tasks or monitors staff performance, it is high-risk from 2 December 2027. |
Agents we’d build for you.
ExamplesIllustrative starting points. Each one keeps a person in charge of the decisions that matter.
In-product assistant
Answers how-to questions from your documentation and the customer’s own data, inside each tenant’s boundary, and says plainly that it is an AI.
Search across customer data
Retrieval over each customer’s documents and records, with permission checks so people only see what they are allowed to see.
Support triage
Classifies tickets, drafts replies from your knowledge base and escalates to your team with the context already gathered.
Workflow automation
Agents that carry out multi-step tasks in your product, such as data entry or reconciliation, with an approval step before anything irreversible.
Onboarding and data import
Maps a new customer’s spreadsheets and exports to your data model and shows the mapping for a person to confirm.
Chat features already need disclosure.
Article 50 has applied since 2 August 2026: users must know when they are talking to an AI. If your product screens candidates or monitors staff, it is high-risk under Annex III from 2 December 2027.
Check where your system fallsCommon questions.
How do you keep one customer’s data out of another customer’s AI answers?
Tenant isolation at every layer: separate indexes or row-level security in the vector store, a tenant check on every retrieval, and automated tests that try to cross the boundary.
Can we use a US model provider?
Yes, with the right safeguards: a data processing agreement with the provider, the EU–US Data Privacy Framework or Standard Contractual Clauses, zero-retention settings where offered, and the provider on your sub-processor list. EU-hosted models are an option when customers require them.
Tell us about the feature you want to ship.
One feature is enough to start. We reply within 24 hours on working days.