EU AI Act + SOC 2 + ISO 42001. One substrate for every SaaS.

It depends on use case, not on being SaaS. Limited-risk obligations (transparency, deepfake/chatbot disclosure under Article 50) apply to most generative features. High-risk applies if your AI is used in employment, credit scoring, education or other Annex III areas. General-purpose / foundation models carry their own Chapter V obligations. MEOK classifies each feature and ships the matching evidence pack.

The Trust Service Criteria (CC1-CC9) still apply, but an AI overlay adds controls auditors now expect: training-data governance and provenance, model cards, model-change management, and monitoring for drift and bias. MEOK maps these AI-specific controls onto your existing SOC 2 control set so a single evidence chain covers both.

ISO/IEC 42001 is a full AI Management System (AIMS). Clauses 6-10 require leadership accountability, AI risk and impact assessment, defined objectives, operational controls and continual improvement, all kept under a documented management-system loop. It is the certifiable AI-governance backbone that SOC 2 and the EU AI Act both lean on, and MEOK runs it as the substrate under both.

Only if you are an essential or important entity, typically SaaS serving EU critical infrastructure such as energy, transport, health or digital infrastructure, or qualifying as a digital service provider. If in scope, NIS2 adds cyber risk-management measures, supply-chain security and 24-hour incident notification. MEOK's nis2-compliance-mcp determines scope and ships the corresponding stack.