SaaS terms for selling to customers in the EU

A UK software business selling into the EU is subject to two data protection regimes, two sets of consumer rules that overlap without matching, and a body of EU platform, AI and digital content law that continues to apply to services offered to EU customers whatever the supplier's own law says. The terms have to work under both: English law as the governing law, the EU rules the customer's country applies regardless, and the practical questions of an EU representative, VAT and how a dispute would be enforced. I draft those terms for a fixed fee of £995, delivered in five working days.

Who this is for

SaaS businesses in England and Wales with business or consumer customers in EU member states, whether selling online to individuals across the single market or signing contracts with companies in one or two countries.

What matters in SaaS terms for EU customers

The EU GDPR, the UK GDPR and the representative

The UK GDPR applies to the supplier as a business established in the UK, and the EU GDPR applies to it as well where it offers services to individuals in the EU or monitors their behaviour there, which means an EU-based representative unless the processing is occasional and low risk, and processor terms with EU business customers that satisfy the EU version of Article 28. The terms and the privacy notice should refer to both regimes, the data processing schedule should be drafted to satisfy both, and the representative's details should be published.

Transfers from the EU to the UK and onward

An EU customer sending personal data to a UK supplier is transferring it outside the EU, which the European Commission's adequacy decision for the UK currently permits without further safeguards; the terms should rely on adequacy while it stands, provide for the EU standard contractual clauses to apply if it lapses, and address onward transfers from the UK to the supplier's subprocessors outside the UK under Article 46 of the UK GDPR. EU customers will ask where data is hosted, and the terms should say.

EU consumer rights and the home-country rule

A consumer in an EU member state keeps the mandatory protections of their own country under the EU version of Article 6 of Regulation (EC) No 593/2008 whatever law the terms choose, and those protections include a fourteen-day withdrawal right, digital content conformity rules, unfair terms control and pre-contract information requirements that largely mirror the UK's under the Consumer Rights Act 2015 and the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 but are not identical. The terms should be drafted to the stricter of the two where they differ, and should not purport to exclude local rights.

Platforms, business users and the digital services rules

Where the product is an online platform with EU business users, the EU platform-to-business rules on terms, ranking and complaints apply, and the retained version, Regulation (EU) 2019/1150, applies in the UK; where the product hosts user content for EU users, the EU Digital Services Act imposes notice-and-action, transparency and complaint duties that go beyond the Online Safety Act 2023. The terms should provide the complaints handling, the notice mechanisms and the plain-language obligations those rules require, scaled to the platform's size.

AI features and the EU AI Act

Where the product includes AI features used by EU customers, the EU AI Act applies to the supplier as a provider placing an AI system on the EU market, with transparency obligations for systems that interact with people or generate content and heavier obligations for high-risk uses such as employment, education and credit, on a phased timetable. The terms should describe the AI features, allocate responsibility for high-risk use to the customer where the customer deploys the product in such a use, and contain the transparency statements the Act requires, alongside the UK position under the UK GDPR.

VAT, governing law and enforcement

Sales to EU business customers are generally reverse-charged with the customer accounting for VAT in its own country, and sales of digital services to EU consumers are taxable where the consumer is, which the supplier can account for through the non-union one stop shop; the terms should state fees exclusive of VAT and require the customer's VAT status and country. English law and the courts of England and Wales can be chosen for business customers, with recognition of the judgment in the EU supported by the Hague conventions on choice of court and on judgments to which the UK is party; the terms should use an exclusive jurisdiction clause for that reason, and the Arbitration Act 1996 route where the customer's country makes arbitration the safer choice.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

Do we need an EU representative?

If you offer the service to individuals in the EU or monitor their behaviour there, yes, unless the processing is occasional and low risk. The terms and privacy notice publish the representative's details once appointed.

Can EU consumers cancel under their own law even though our terms say English law?

Yes in substance: the mandatory consumer protections of their own country apply regardless of the choice of law. The terms are drafted to the stricter rule where the UK and EU rules differ, so that one document works for both.

Our product has an AI assistant. Does the EU AI Act affect our terms?

It affects what the terms must say about the feature and who is responsible if a customer deploys it in a high-risk use. The terms contain the transparency statements and the allocation; the underlying compliance is a product question.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Contract review, £495
• Data protection agreements and privacy terms, £795
• SaaS terms for selling to customers outside the UK
• SaaS terms for selling to customers in the United States

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.