EU AI Act for Indian Companies: Are You in Scope?

Many Indian technology companies build AI features for customers in Europe, or sell software that European businesses use. That raises a natural question: does the EU AI Act apply to us, even though we are based in India?

The answer depends on what you do and where your AI is used. The Act was written to reach beyond Europe’s borders in some situations. This guide explains the key ideas in general terms and the questions to check. It is not legal advice, and the details depend on your own situation, so check the current text and take advice where needed.

1. How the Act can reach companies outside Europe

The EU AI Act regulates AI systems placed on the EU market or used in the EU. Like the GDPR, it is designed so that a company cannot avoid it simply by being located elsewhere. Broadly, it can apply to providers that place AI systems on the EU market wherever they are based, and in some cases to providers and deployers outside the EU when the output of their AI system is used in the EU.

For an Indian company, the practical triggers are usually commercial. Do you sell an AI product to customers in the EU? Do you provide an AI feature inside software that EU businesses use? Is the output of your AI system used by people in the EU? If the answer to any of these is yes, the Act may be relevant.

Where your company sits matters less than where your AI is sold and used.

2. Provider or deployer?

The Act gives different roles different duties. Two roles matter most for most companies.

• Provider. The organisation that develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. Providers carry most of the obligations for higher-risk systems.
• Deployer. The organisation that uses an AI system under its own authority in a professional setting. Deployers have their own, generally lighter, duties.
• Other roles. The Act also describes importers, distributors and authorised representatives. A provider outside the EU may need an authorised representative in the EU in some cases.

Many Indian SaaS companies are providers for their own AI features. A company that builds a hiring tool used by a European employer is likely a provider, while the employer is a deployer. A company that uses an AI tool internally in India, with no output reaching the EU, may be outside scope for that use.

The Act also sorts AI systems by risk. Some practices are prohibited, some systems are treated as high risk with detailed obligations, some carry transparency duties and many carry few obligations. Where your system sits makes a large difference to the work involved.

3. What to check now, and the timetable

The EU AI Act applies in stages, and the timetable has been revisited. As part of the EU’s Digital Omnibus process, changes have been made to postpone the obligations for high-risk systems. Because dates can move, do not rely on an old summary. Check the current timetable in the official EU sources before you plan.

While the details settle, a few steps are useful whatever the final dates.

Start with an inventory of your AI systems and features, noting which are offered to EU customers or produce output used in the EU. For each, record what it does, who uses it and what decisions it supports. This tells you where to focus.

Next, make a first assessment of role and risk for each system. Are you the provider or the deployer? Could the system fall into a high-risk area, such as employment, education, credit or access to essential services? Mark the uncertain cases for closer review.

Then look at your customers’ requests. European customers may already ask about AI governance in their due diligence, whatever the legal timetable. A clear description of how you manage AI, ideally backed by a recognised framework, helps those conversations.

A management system such as ISO/IEC 42001 does not equal compliance with the Act, but it builds the inventories, risk assessments and documentation the Act expects. Our practical AI governance framework explains the basics. If you would like help mapping your AI systems against the Act, our ISO 42001 consulting team is happy to talk.