How to Prepare Your AI SaaS for a Legal Compliance Review

Before you call a lawyer, do this

Legal compliance reviews are expensive. At €300–800 per hour, every minute counts. Here's how to prepare so you get maximum value from your legal consultation.

Step 1: Create your AI system inventory

List every AI feature in your product:

Feature	Model	Data inputs	Outputs	Decision level
CV ranking	GPT-4o	Resume PDFs	Score 1-10	AI recommends, human decides
Chat support	Claude 3.5	User messages	Text replies	Fully automated
Email summarizer	Custom LLM	Email threads	Summary	AI assists

Step 2: Document your data flow

Create a simple diagram or table showing:

1. What data enters the AI system
2. How it's processed
3. Where the output goes
4. Whether humans review it
5. Where it's stored
6. Retention period

Step 3: Run a preliminary risk assessment

Before spending on legal, run an AI Act readiness scan to identify:

• Potential high-risk classifications
• Missing documentation gaps
• Transparency obligations you haven't met

Step 4: Gather existing documentation

Collect:

• Privacy policy
• Terms of service
• Model documentation (provider, version, training data)
• Any existing AI disclosure notices
• Data processing agreements (DPAs) with model providers

Step 5: Prepare specific questions

Instead of "Am I compliant?", ask:

• "Based on my product description, do I qualify as a provider or deployer?"
• "Does my CV ranking system trigger Annex III.4 obligations?"
• "Is self-declaration sufficient, or do I need third-party assessment?"
• "What's the deadline for my specific obligations?"
• "Do I need to register in the EU database?"

What to expect from your legal review

A good legal review will:

1. Confirm your risk classification
2. Identify specific articles that apply to you
3. Review your documentation against requirements
4. Recommend specific actions with timelines
5. Provide draft language for disclosures

Timeline: 2 weeks to readiness

Day	Task
1	Run AI Act readiness scan
2–3	Document AI inventory and data flow
4–5	Add AI disclosure to website
6–8	Draft internal documentation
9–10	Legal consultation (prepared)
11–14	Implement legal recommendations

---

Start with a readiness scan before booking legal. You'll save hours of billable time.