The EU SaaS Compliance Handbook

A Practical Guide to GDPR, AI Act, Security, Accessibility, VAT, and Legal Requirements for Modern SaaS

Introduction: Why Compliance Is Your Product’s Foundation

1. The Cost of Getting It Wrong
2. The EU as a Regulatory Superpower
3. Who This Book Is For and How to Use It
4. The Compliance Mindset: From Checkbox to Culture

Chapter 1: The EU Regulatory Landscape — A Map for SaaS Builders

1. How EU Law Works: Regulations, Directives, and National Transposition
2. The Key Institutions: Commission, Parliament, EDPB, and Data Protection Authorities
3. The Brussels Effect: Why Global SaaS Companies Care About EU Law
4. Germany-Specific Considerations: BDSG, TTDSG, and the Enforcement Landscape
5. A Quick Reference Map of Every Relevant Regulation

Chapter 2: GDPR Fundamentals for SaaS — Data Protection by Design

1. Controller vs. Processor vs. Joint Controller (with SaaS Examples)
2. Lawful Bases for Processing: Which One Applies to Your Use Case?
3. Data Subject Rights in Practice: Access, Erasure, Portability, Objection
4. Data Protection Impact Assessments (DPIAs): When and How
5. Records of Processing Activities (RoPA): A Practical Template

Chapter 3: Building a GDPR-Compliant SaaS Architecture

1. Privacy by Design and Default: Technical Controls That Matter
2. Data Minimization and Storage Limitation in Practice
3. Encryption, Anonymization, and Pseudonymization
4. International Data Transfers: SCCs, IDTA, and the End of Safe Harbor
5. Choosing and Vetting Sub-processors

Chapter 4: ePrivacy, Cookies, and Tracking — The Consent Layer

1. The ePrivacy Regulation: Where Things Stand (and Why It Matters)
2. What Counts as Valid Consent Under GDPR + ePrivacy
3. Cookie Banners That Actually Work (And Those That Don’t)
4. Analytics, Advertising, and First-Party vs. Third-Party Tracking
5. The German Angle: TTDSG and the Stricter Enforcement Landscape

Chapter 5: The EU AI Act — Compliance for SaaS with AI/ML

1. The Four Risk Tiers: Unacceptable, High, Limited, and Minimal Risk
2. What Makes a SaaS “AI System” Under the AI Act?
3. High-Risk Obligations: Technical Documentation, CE Marking, Human Oversight
4. Transparency Requirements for Chatbots and Generated Content
5. Compliance Roadmap: Deadlines, Notified Bodies, and Conforms
6. AI Act vs. GDPR: Where They Overlap and Diverge

Chapter 6: Cybersecurity and Resilience — NIS2, ISO 27001, and Beyond

1. NIS2 Directive: Which SaaS Companies Are In Scope?
2. Essential and Important Entity Obligations Under NIS2
3. ISO 27001 and SOC 2: What They Mean, How to Get Them
4. The Cyber Resilience Act: Security by Design for Connected Products
5. Practical Security Measures: Access Control, Monitoring, Incident Response
6. Penetration Testing, Bug Bounties, and Vulnerability Disclosure

Chapter 7: Accessibility — WCAG, EAA, and What EU Users Expect

1. The European Accessibility Act (EAA): Scope and Deadlines
2. WCAG 2.1/2.2 AA: What It Means for Your Product
3. German Specifics: BITV and the Barrierefreiheitsstärkungsgesetz
4. Technical Implementation: ARIA, Keyboard Navigation, Screen Readers
5. Testing and Auditing: Automated Tools vs. Manual Review

Chapter 8: VAT, Tax, and Financial Compliance — Selling in the EU

1. VAT Basics for Digital Services: Where the Tax Is Due
2. B2B vs. B2C: Reverse Charge, OSS, and Thresholds
3. The German Fiscal Perspective: UStG, KassenSichV, and E-Invoicing
4. Invoicing Requirements and Documentation

Chapter 9: Contracts, Terms, and Enterprise Expectations

1. The Core Legal Documents: ToS, Privacy Policy, Acceptable Use
2. Data Processing Agreements (DPAs): Essential Clauses and Templates
3. Service Level Agreements (SLAs): What to Promise and How to Deliver
4. Enterprise Security Questionnaires: Preparing for SOC 2, ISO, and Custom RFIs
5. German Contract Law Considerations: AGB, BGB, and Digital Contracts

Chapter 10: Operational Compliance — Running a Compliant SaaS Business

1. Data Breach Response: The 72-Hour Rule and Beyond
2. Incident Response Playbooks for SaaS Teams
3. Vendor and Sub-processor Management at Scale
4. Employee Training and Compliance Culture
5. Audits, Certifications, and Continuous Improvement

Chapter 11: Scaling Compliance — From Startup to Enterprise

1. Stage-Gated Compliance: What Matters at Seed, Series A, and IPO
2. Building Your First Compliance Team (or Hiring a CCO)
3. Multi-Regulatory Expansion: EU, UK, US, APAC Simultaneously
4. Compliance as a Sales Enabler (Not a Roadblock)
5. Tools, Automation, and GRC Platforms

Chapter 12: The Future of EU SaaS Regulation — What’s Coming Next

1. Enforcement Trends: Fines, Investigations, and Market Surveillance
2. Upcoming Regulations: Digital Services Act, Data Act, Data Governance Act
3. AI Regulation Beyond the AI Act: Sector-Specific Rules
4. The Geopolitics of Data: US Cloud Act vs. EU Data Sovereignty
5. Building a Regulation-Aware Product Strategy

Conclusion: Compliance as Competitive Advantage

References