EU AI Act: What Indian AI Vendors Serving EU Clients Must Do

Yes, the EU AI Act can apply to an Indian company even if it has no office in Europe. If you place an AI system on the EU market, or the output of your system is used in the EU, you are in scope. Your duties depend on your role and on the risk level of the system, not on where your team sits.

As of 26 October 2026: prohibitions, AI literacy, general-purpose AI (GPAI) rules and Article 50 transparency rules already apply. The Digital Omnibus on AI, Regulation (EU) 2026/1744, is adopted and in force. It moved most high-risk deadlines to 2 December 2027 and 2 August 2028.

This article is general information, not legal advice. Check your own situation with a qualified EU lawyer.

Does it apply to you?

Article 2 of Regulation (EU) 2024/1689 sets the scope. Three parts matter most for Indian vendors:

• Providers that place AI systems or GPAI models on the EU market are covered "irrespective of" where they are established.
• Providers and deployers in a third country are covered where the output of the AI system is used in the EU.
• Authorised representatives of non-EU providers are covered too.

In practice, an Indian vendor usually lands in one of two positions.

1. You are the provider. You build an AI product or system and sell or license it to EU customers under your name. The law treats you as the party responsible for the system.
2. You are a supplier to an EU provider or deployer. You build to a client's specification, the client puts it into service under its own name, and you deliver code, models or services. Here the client is often the provider, and your duties come mainly through the contract.

The line is not always clean. Under Article 25, a party becomes the provider of a high-risk system if it puts its name on it, makes a substantial modification, or changes its purpose so it becomes high-risk. Agree in writing who the provider is for each system.

Authorised representative. Under Article 22, a provider outside the EU must appoint an EU authorised representative, by written mandate, before making a high-risk AI system available in the EU. Article 54 sets a similar rule for non-EU GPAI model providers. If you are the provider of a high-risk system, plan this early.

Your role decides your duties

Timeline and what changed

The original Act set fixed dates. The Digital Omnibus on AI changed some of them. It was proposed by the Commission on 19 November 2025, agreed by Parliament and Council on 7 May 2026, adopted by the Council on 29 June 2026, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. These changes are law, not proposals.

The Omnibus made other changes worth knowing:

• AI literacy (Article 4) was softened. Providers and deployers must now "take measures to support the development of AI literacy". The duty does not require them to guarantee any specific level. The Commission and Member States must support these efforts.
• Simplified technical documentation now extends from SMEs to small mid-cap companies.
• Registration stays. Providers that self-assess a system as not high-risk under Article 6(3) still register, through a simplified procedure.

Practical steps for the next 90 days

The high-risk delay gives you time. It does not remove the duties that already apply. Use the next 90 days to get the basics in place.

1. Map your contracts. List every EU client and every AI system you build or run for them. For each, record who is the provider and who is the deployer. Add AI Act clauses that cover documentation, cooperation, incident reporting and who carries which duty.
2. Build an AI inventory. Note each system's purpose, users, models used, data sources and where its output goes. Without this list, nothing else works.
3. Classify risk. Check each system against the Article 5 prohibitions, the Annex III high-risk list and Article 50. Hiring tools, credit scoring and education tools for EU clients are common high-risk cases for service firms.
4. Start technical documentation. For likely high-risk systems, document design, training data, testing, known limits and performance, as listed in Annex IV. Write it while you build.
5. Turn on logging. High-risk systems must record events automatically so results can be traced. Deployers must keep logs for at least six months. Design log storage and retention now.
6. Design human oversight. Decide who can review, override or stop the system. Build the screens and controls for that, and write instructions for the client's staff.
7. Add transparency labels. Article 50 already applies. Tell people when they are talking to a chatbot. Mark AI-generated audio, image, video and text in a machine-readable way. Label deepfakes. If your generative system was on the EU market before 2 August 2026, the marking deadline is 2 December 2026.
8. Check your GPAI model providers. If you build on third-party models, the model providers carry the GPAI duties. Ask for their model documentation, check whether they signed the GPAI Code of Practice, and keep this on file. If you fine-tune or modify a model heavily, take advice on whether you become a provider yourself.
9. Run AI literacy training. The duty is lighter after the Omnibus, but you still need to take measures. Give staff who build, sell and support AI systems short training on the Act, risks and their role. Keep attendance records.

Penalties

Article 99 sets maximum fines. For each tier, the higher of the two amounts applies.

For SMEs and start-ups, the lower of the two amounts applies. After the Omnibus, small mid-caps get the lower amount for the second and third tiers. GPAI model providers face separate fines under Article 101 of up to EUR 15 million or 3%.

FAQ

We have no EU office. Can the EU really enforce this on us?

The law applies to you if you place AI on the EU market or your system's output is used in the EU. Your EU clients, importers and authorised representative also carry duties, so in practice they will push compliance requirements onto you through contracts.

Is the whole AI Act delayed to 2027?

No. Only the high-risk obligations moved. Prohibitions, AI literacy, GPAI rules and Article 50 transparency already apply.

We only use ChatGPT or Claude through an API. Are we a GPAI provider?

Usually not. The company that develops the model and places it on the market is the GPAI provider. You are typically the provider or deployer of the AI system built on top. That system still has its own duties, such as Article 50 transparency and, if relevant, high-risk rules.

Does ISO/IEC 27001 certification cover the AI Act?

No. ISO/IEC 27001 is an information security standard. It helps with security controls and documentation habits, but it does not cover AI risk classification, human oversight or conformity assessment under the Act.

When do we need an EU authorised representative?

If you are the provider of a high-risk AI system, before you make it available on the EU market. For Annex III systems, high-risk rules apply from 2 December 2027. Non-EU GPAI model providers already need one.

Sources

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal, EUR-Lex, Publications Office of the European Union
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, EUR-Lex, Publications Office of the European Union
3. AI Act: regulatory framework for AI, European Commission, Shaping Europe's digital future
4. The General-Purpose AI Code of Practice, European Commission
5. Digital Omnibus on AI, Legislative Train Schedule, European Parliament
6. Artificial Intelligence: Council gives final green light to simplify and streamline rules (29 June 2026), Council of the European Union
7. AI Act Explorer: Articles 2, 4, 22, 25 and 99, and Digital Omnibus page, Future of Life Institute
8. Digital AI Omnibus Delays Key Deadlines, Introduces New Rules, Cooley LLP