The EU AI Act is now in force, with phased application dates introducing early governance obligations and later requirements for high-risk systems. For scaling AI-enabled SaaS businesses, model selection, training data provenance, human oversight, and incident reporting must be treated as contractual deliverables. Procurement terms, warranties, audit rights, and customer flow-down obligations should reflect whether systems qualify as general-purpose AI, high-risk systems, or downstream deployments.