Selling in the EU without being in the EU: the legal framework
The European market is attractive for any SaaS company: 450 million consumers, high digital penetration, and willingness to pay for quality software. But the question that holds many companies back is: can I legally sell in the EU without an office there?
The short answer is yes. The long answer is: yes, but you need to comply with a set of regulations you cannot ignore.
The three key regulations for SaaS in the EU
1. GDPR — If you process Europeans’ data, it applies to you
GDPR applies to any company processing personal data of EEA residents, regardless of where it is established. For a typical SaaS, this means:
- Appointing an EU representative (Article 27) if you have no EEA establishment
- Signing Data Processing Agreements (DPAs) with all European clients
- Implementing international data transfer mechanisms (SCCs + TIA)
- Maintaining a record of processing activities
- Responding to data subject rights requests within deadline (maximum 1 month)
- Notifying security breaches to the competent authority within 72 hours
2. AI Act — If your SaaS uses AI, you need an assessment
The AI Act has extraterritorial reach. If your SaaS incorporates AI features (recommendations, automatic classification, content generation, scoring) and is used in the EU:
- You must classify your system by risk level (minimal, limited, high, unacceptable)
- For limited risk: transparency obligations (inform the user they are interacting with AI)
- For high risk: technical documentation, risk management system, human oversight
- Appoint an authorised representative in the EU if you are a non-EU provider
3. Consumer law and digital taxation
- 14-day withdrawal right for B2C sales
- Legal guarantees on service functionality
- Digital VAT: OSS registration for B2C sales, or reverse charge for B2B
- Pre-contractual information obligations
The remote compliance stack
Implementing European compliance remotely requires an organised structure. This is the minimum viable stack:
Legal layer:
- Designated GDPR Article 27 representative in the EU
- Terms of service adapted to European law
- Standard DPA for European clients
- GDPR-compliant privacy policy with transfer clauses
Technical layer:
- Compliant consent mechanisms (cookie banner, opt-in)
- Data subject rights panel for European users
- Processing activity logging
- Breach notification procedure
Tax layer:
- OSS registration if selling B2C in the EU
- Invoicing system with European VAT
- Client location verification mechanism
Contractual layer:
- DPAs with subprocessors (AWS, Google Cloud, etc.)
- Client contracts reflecting GDPR obligations
- Compliant Service Level Agreements (SLAs)
Common remote compliance mistakes
Ignoring Article 27. Many SaaS companies outside the EEA do not appoint a GDPR representative because they are unaware of the obligation. It is one of the first points data protection authorities check.
Generic DPAs. Using a DPA downloaded from the internet without adapting it to your specific processing is a risk. Each DPA should reflect the actual data categories, purposes, and subprocessors.
Not assessing the AI Act. Assuming the AI Act “doesn’t affect you” because your company is outside the EU is a mistake. Extraterritorial reach is triggered when your AI’s outputs are used in European territory.
Forgetting taxation. Selling B2C digital services in the EU without charging local VAT or being registered for OSS can generate retroactive tax liabilities.
When the remote model is no longer sufficient
Remote compliance has limits. Signs you need to consider physical presence:
- EU invoicing exceeding €500,000/year
- Enterprise clients requiring invoicing from a European entity
- Need to hire employees in Europe
- Operations requiring European sectoral licences
- Frequent legal disputes requiring procedural representation
The remote model is ideal for market validation and initial growth. When you reach a certain scale, a European subsidiary complements (not replaces) the remote structure.
At A2 we help SaaS companies design and implement their European compliance stack entirely remotely. Book a consultation to assess your situation.