Why Indian Software Companies Must Care About the EU AI Act
The EU AI Act is the world's first comprehensive AI regulation. It entered into force in August 2024, with obligations phasing in through 2025, 2026, and 2027.
Many Indian software companies assume it does not apply to them. This is wrong. The EU AI Act applies based on where the AI system's output is used, not where the company is based. If an Indian company provides AI systems to EU customers, or its AI outputs affect people in the EU, the Act applies.
For Indian software exporters, this creates a new compliance requirement. For Indian companies planning to serve EU customers, it affects product design. And for companies in the AI space, it sets a global benchmark that other jurisdictions — including India — are watching closely.
The penalties are significant. Non-compliance can result in fines up to €35 million or 7% of global annual turnover, whichever is higher.
This guide explains EU AI Act compliance for software companies in 2026. It covers the risk tiers, obligations, timelines, costs, and what Indian businesses must do.
For organisations building compliant AI systems, Innovative AI Solutions provides AI consulting and AI development services.
What the EU AI Act Is
The Regulation
The EU AI Act is a comprehensive regulation governing the development, deployment, and use of AI systems in the European Union.
| Characteristic | Detail |
|---|---|
| Scope | AI systems affecting EU users |
| Approach | Risk-based |
| Enforcement | National authorities |
| Penalties | Up to €35M or 7% of turnover |
| Extraterritorial | Applies to non-EU companies |
Who It Applies To
| Role | Definition |
|---|---|
| Providers | Develop or place AI systems on the market |
| Deployers | Use AI systems in their operations |
| Importers | Bring AI systems into the EU |
| Distributors | Make AI systems available |
An Indian company providing AI software to EU customers is a "provider" under the Act.
Why It Applies to Indian Companies
| Scenario | Applies? |
|---|---|
| Indian SaaS serving EU customers | Yes |
| Indian AI product used by EU users | Yes |
| Indian company with EU subsidiary | Yes |
| Indian company with EU customers only | Yes |
| Indian company with no EU connection | No |
The Four Risk Tiers
Tier 1: Unacceptable Risk (Prohibited)
AI systems that pose unacceptable risks are banned outright.
| Prohibited Use | Example |
|---|---|
| Social scoring | Government scoring of citizens |
| Manipulation | Exploiting vulnerabilities |
| Real-time biometric surveillance | Public space facial recognition |
| Emotion recognition at work | Workplace emotion detection |
| Predictive policing | Individual crime prediction |
Obligation: Do not deploy. These systems cannot be placed on the EU market.
Tier 2: High Risk
AI systems that pose significant risks to health, safety, or fundamental rights.
| High-Risk Category | Examples |
|---|---|
| Critical infrastructure | Energy, transport, water |
| Education | Admissions, assessment |
| Employment | Recruitment, promotion |
| Essential services | Credit scoring, benefits |
| Law enforcement | Investigation support |
| Migration | Asylum, visa processing |
| Justice | Legal decision support |
Obligations: Extensive — risk management, data governance, documentation, transparency, human oversight, accuracy, cybersecurity, conformity assessment, registration.
Tier 3: Limited Risk
AI systems with transparency obligations.
| Limited Risk Category | Example |
|---|---|
| Chatbots | Users must know they are talking to AI |
| Deepfakes | Content must be labelled |
| Emotion recognition | Must inform users |
| Content generation | AI-generated content must be marked |
Obligations: Transparency — users must be informed they are interacting with AI.
Tier 4: Minimal Risk
Most AI systems fall here.
| Minimal Risk Category | Example |
|---|---|
| Spam filters | Email classification |
| Recommendation systems | Content suggestions |
| AI in games | Game AI |
| Inventory management | Stock prediction |
Obligations: None specific. Voluntary codes of conduct encouraged.
Risk Tier Summary
| Tier | Risk Level | Obligations |
|---|---|---|
| Unacceptable | Prohibited | Banned |
| High | Significant | Extensive compliance |
| Limited | Transparency | Disclosure |
| Minimal | Low | None specific |
Obligations by Risk Tier
High-Risk AI Obligations
| Obligation | What It Requires |
|---|---|
| Risk management | Systematic risk identification and mitigation |
| Data governance | Quality, relevance, bias testing |
| Technical documentation | Detailed system documentation |
| Record-keeping | Logging of operations |
| Transparency | Information for deployers |
| Human oversight | Human-in-the-loop controls |
| Accuracy | Performance metrics |
| Cybersecurity | Security safeguards |
| Conformity assessment | Third-party assessment |
| Registration | EU database registration |
| Post-market monitoring | Ongoing performance tracking |
| Incident reporting | Report serious incidents |
Limited Risk Obligations
| Obligation | What It Requires |
|---|---|
| Disclosure | Inform users they interact with AI |
| Labelling | Mark AI-generated content |
| Deepfake disclosure | Identify synthetic content |
GPAI (General-Purpose AI) Obligations
General-purpose AI models — like LLMs — have specific obligations.
| Obligation | What It Requires |
|---|---|
| Technical documentation | Model documentation |
| Training data summary | Describe training data |
| Copyright policy | Respect copyright |
| Transparency | Publish model information |
| Systemic risk assessment | For high-capability models |
| Incident reporting | Report serious incidents |
Compliance Timeline
Key Dates
| Date | What Applies |
|---|---|
| August 2024 | Act entered into force |
| February 2025 | Prohibited practices banned |
| August 2025 | GPAI obligations apply |
| August 2026 | High-risk obligations (Annex III) |
| August 2027 | High-risk obligations (Annex I) |
What This Means for 2026
By August 2026, high-risk AI systems in categories like education, employment, credit scoring, and law enforcement must comply with the full set of high-risk obligations.
Software companies with high-risk AI systems serving EU customers have limited time.
What Indian Software Companies Must Do
Step 1: Determine Applicability
| Question | If Yes |
|---|---|
| Do you serve EU customers? | Act may apply |
| Do your AI outputs affect EU users? | Act may apply |
| Do you have EU operations? | Act applies |
| Do you plan to enter EU market? | Plan for compliance |
Step 2: Classify Your AI Systems
| Question | Purpose |
|---|---|
| Is it prohibited? | Must be removed |
| Is it high-risk? | Full compliance required |
| Is it limited risk? | Transparency required |
| Is it minimal risk? | No specific obligations |
Step 3: Implement Required Obligations
| Risk Tier | What to Implement |
|---|---|
| Prohibited | Remove or redesign |
| High-risk | Full compliance framework |
| Limited risk | Disclosure mechanisms |
| Minimal risk | Voluntary best practices |
Step 4: Document Compliance
| Documentation | Purpose |
|---|---|
| Risk assessment | Evidence of assessment |
| Technical documentation | System details |
| Conformity assessment | Third-party verification |
| Post-market monitoring | Ongoing compliance |
Step 5: Monitor and Update
| Activity | Frequency |
|---|---|
| Performance monitoring | Continuous |
| Incident reporting | As required |
| Documentation updates | As systems change |
| Compliance review | Annually |
What EU AI Act Compliance Costs in India
Implementation Costs
| Compliance Scope | Cost Range (INR) | Cost Range (USD) | Timeline |
|---|---|---|---|
| Applicability assessment | ₹75,000–₹2,50,000 | $900–$3,000 | 2–4 weeks |
| Risk classification | ₹1,00,000–₹3,00,000 | $1,200–$3,600 | 3–5 weeks |
| High-risk compliance (single system) | ₹8,00,000–₹25,00,000 | $9,600–$30,000 | 12–24 weeks |
| High-risk compliance (multiple systems) | ₹25,00,000–₹75,00,000 | $30,000–$90,000 | 24–40 weeks |
| GPAI compliance | ₹5,00,000–₹20,00,000 | $6,000–$24,000 | 8–16 weeks |
| Limited risk (transparency) | ₹1,50,000–₹5,00,000 | $1,800–$6,000 | 4–8 weeks |
Cost by Component
| Component | Cost Range (INR) | Cost Range (USD) |
|---|---|---|
| Risk management system | ₹1,50,000–₹5,00,000 | $1,800–$6,000 |
| Data governance | ₹1,00,000–₹4,00,000 | $1,200–$4,800 |
| Technical documentation | ₹1,50,000–₹4,00,000 | $1,800–$4,800 |
| Human oversight controls | ₹1,00,000–₹3,00,000 | $1,200–$3,600 |
| Conformity assessment | ₹2,00,000–₹6,00,000 | $2,400–$7,200 |
| Post-market monitoring | ₹1,00,000–₹3,00,000 | $1,200–$3,600 |
Ongoing Costs
| Cost Category | Monthly Range (INR) | Monthly Range (USD) |
|---|---|---|
| Compliance monitoring | ₹15,000–₹60,000 | $180–$720 |
| Documentation maintenance | ₹10,000–₹40,000 | $120–$480 |
| Incident reporting | ₹5,000–₹25,000 | $60–$300 |
| Audit and review | ₹15,000–₹75,000 | $180–$900 |
The Cost of Non-Compliance
| Penalty Level | Maximum Fine |
|---|---|
| Prohibited practices | €35M or 7% of turnover |
| High-risk violations | €15M or 3% of turnover |
| Incorrect information | €7.5M or 1% of turnover |
EU AI Act vs India's AI Framework
Comparison
| Aspect | EU AI Act | India (DPDPA + MeitY) |
|---|---|---|
| Approach | Binding regulation | Principles + existing law |
| Risk tiers | Four tiers | Risk-based guidance |
| Enforcement | Strong | Evolving |
| Penalties | Up to 7% turnover | DPDPA penalties |
| Extraterritorial | Yes | Limited |
What Indian Companies Should Do
| Action | Purpose |
|---|---|
| Assess EU applicability | Determine if Act applies |
| Build governance now | Prepare for both frameworks |
| Document everything | Compliance evidence |
| Monitor developments | India's framework evolving |
Companies that build strong governance for DPDPA and MeitY guidelines are well-positioned for EU AI Act compliance.
Decision Framework: EU AI Act Readiness
Readiness Scorecard
| Criteria | Weight | Score (1–5) | Weighted Score |
|---|---|---|---|
| EU applicability determined | 20% | ||
| AI systems classified | 20% | ||
| High-risk obligations identified | 20% | ||
| Documentation in place | 15% | ||
| Human oversight implemented | 15% | ||
| Monitoring established | 10% | ||
| Total | 100% | /5 |
Compliance Priority Matrix
| Action | Effort | Impact | Priority |
|---|---|---|---|
| Applicability assessment | Low | High | Immediate |
| Risk classification | Moderate | High | Immediate |
| Remove prohibited systems | Variable | Critical | Immediate |
| High-risk compliance | High | High | High |
| Transparency mechanisms | Low | Moderate | High |
| Post-market monitoring | Moderate | High | High |
Implementation Roadmap
| Phase | What to Do | Timeline | Cost (INR) |
|---|---|---|---|
| Phase 1 | Applicability, classification | 4–6 weeks | ₹1,75,000–₹5,50,000 |
| Phase 2 | High-risk compliance | 12–24 weeks | ₹8,00,000–₹25,00,000 |
| Phase 3 | Documentation, conformity | 4–8 weeks | ₹3,00,000–₹9,00,000 |
| Phase 4 | Monitoring, ongoing compliance | Ongoing | ₹30,000–₹1,50,000 monthly |
Frequently Asked Questions
1. Does the EU AI Act apply to Indian companies?
Yes, if your AI systems affect people in the EU. The Act applies based on where the output is used, not where the company is based.
2. What are the four risk tiers of the EU AI Act?
Unacceptable risk (prohibited), high risk (extensive obligations), limited risk (transparency), and minimal risk (no specific obligations).
3. What AI systems are prohibited under the EU AI Act?
Social scoring, manipulation, real-time biometric surveillance in public spaces, emotion recognition at work, and predictive policing.
4. What obligations apply to high-risk AI systems?
Risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, cybersecurity, conformity assessment, registration, post-market monitoring, and incident reporting.
5. What is GPAI and what obligations apply?
General-Purpose AI models like LLMs. Obligations include technical documentation, training data summary, copyright policy, transparency, systemic risk assessment, and incident reporting.
6. When do EU AI Act obligations apply?
Prohibited practices from February 2025. GPAI obligations from August 2025. High-risk obligations from August 2026 (Annex III) and August 2027 (Annex I).
7. What are the penalties for non-compliance?
Up to €35 million or 7% of global annual turnover for prohibited practices. €15 million or 3% for high-risk violations.
8. How much does EU AI Act compliance cost in India?
Applicability assessment costs ₹75,000–₹2,50,000. High-risk compliance for a single system costs ₹8,00,000–₹25,00,000 ($9,600–$30,000).
9. How does the EU AI Act compare to India's framework?
The EU AI Act is binding regulation with strong enforcement. India's framework is principles-based (MeitY guidelines) plus DPDPA. Companies building for both should build strong governance.
10. Do I need third-party conformity assessment?
Yes, for high-risk AI systems. Conformity assessment verifies compliance before the system is placed on the EU market.
11. What documentation is required?
Risk assessment, technical documentation, data governance records, human oversight procedures, accuracy metrics, cybersecurity measures, and post-market monitoring plans.
12. How can Innovative AI Solutions help?
Innovative AI Solutions is a Delhi-based AI development company that helps businesses build compliant AI systems. We implement risk management, documentation, human oversight, and monitoring — designed for EU AI Act and DPDPA compliance. Explore our AI consulting and AI development services.
Contact Innovative AI Solutions
Ready to achieve EU AI Act compliance?
We help Indian software companies assess applicability, classify AI systems, and implement compliance frameworks.
Contact Information
Innovative AI Solutions
📍 Netaji Subhash Place, Pitampura, Delhi – 110034
🌐 Website: https://innovativeais.com 📧 Email: info@innovativeais.com
📞 Phone: +91 7464 099 059 / +91 96899 67356
Business Services
• AI Automation • AI Development • AI Consulting • Machine Learning Solutions • Deep Learning Solutions • Generative AI Services • NLP Solutions • AI Agents • AI Chatbots • Voice AI • CRM Development • Custom Software Development • Website Development • Mobile App Development
About the Author
Abhishek Kumar
Founder & CEO, Innovative AI Solutions
5+ years building production AI systems for Indian businesses. Based in Delhi, serving clients across India.
Ready to build AI solutions for your business?
Innovative AI Solutions — Delhi's leading AI development company. Free consultation available.
Get Free Consultation →
A practical 2026 guide to EU AI Act compliance for software companies — risk tiers, obligations, timelines, and costs for Indian exporters.
#EUAIAct #Compliance #SoftwareCompanies #2026 #RiskTiers #HighRiskAI #GPAI #GeneralPurposeAI #ConformityAssessment #Documentation #Transparency #Penalties #IndianExporters #AIRegulation #Governance #Costs #India #DelhiNCRTech #EnterpriseApps #StartupApps #AICompliance #GlobalRegulation #TechIndia #DigitalProducts #SoftwareDevelopment #BusinessSoftware #InnovativeAISolutions
Copyright © 2015–2026 Innovative AI Solutions. All Rights Reserved. | Privacy Policy | Terms & Conditions
