EU AI Act for Indian Companies: How Article 2 Reaches Indian AI Providers

A Bengaluru SaaS company whose AI screening tool is used by an employer in Frankfurt is bound by the EU AI Act — even with no European office, no European entity, and no plan to "comply with EU law." This is the part Indian companies most often miss. The EU AI Act is not Indian law and never becomes Indian law; there is no Indian application date and no Indian "AI Act authority" to register with. But Article 2 gives Regulation (EU) 2024/1689 deliberate extraterritorial reach, and it catches Indian providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union.

For an Indian IT-services exporter, an ML product company, or a GCC (global capability centre) building tools used across European group entities, Article 2 is not a bridge to some future Indian regime — it is the entire and permanent basis on which the Act can bind you.

---

India is a third country: the Act never becomes Indian law

India is not an EU Member State and not part of the European Economic Area (EEA). No mechanism — no transposition, no EEA incorporation — turns Regulation (EU) 2024/1689 into Indian central or state law. So the only question that matters for an Indian company is the extraterritorial one: does your activity bring you within Article 2?

India has no dedicated AI statute

As of mid-2026, India has no horizontal AI law equivalent to the EU AI Act, and it has signalled a deliberate, pro-innovation choice not to rush one. Governance instead rests on a patchwork:

• The Digital Personal Data Protection Act, 2023 (DPDP Act) — India's data-protection statute, with its implementing rules following — governs the personal-data dimension of AI but is not an AI-conformity regime.
• The Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, amended in early 2026 to address synthetically generated and AI-generated content, carry the online-content obligations.
• MeitY advisories and the IndiaAI Mission (a national capacity-building programme) plus the newly stood-up AI Safety Institute drive policy through guidance and standards rather than binding general legislation.

The much-discussed Digital India Act — intended to replace the IT Act, 2000 — has been in prospect since 2023 but, as of mid-2026, has not been introduced in Parliament and no official draft has been published; treat it as proposed and stalled, not enacted. None of these instruments satisfies the EU AI Act, and the EU AI Act satisfies none of them. An Indian company selling into the EU faces both pictures in parallel — treat the Indian side as fast-moving and a matter for separate Indian counsel.

No Indian application date to wait for

For an EU company the Act applies on fixed EU calendar dates. For an Indian company those dates are not a domestic switch-on; they are simply the dates on which Indian companies already in scope through Article 2 must comply. There is no separate "Indian date," and waiting for one is waiting for something that will never come.

---

Article 2: the two limbs that catch Indian companies

Article 2 sets the Regulation's scope, written to reach beyond EU borders precisely so non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. An Indian company that sells, licenses, or otherwise makes its AI product available to customers in Germany, France, or Ireland is caught — incorporation in Bengaluru and servers in Mumbai change nothing.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. The test is where the effect lands, not where the company or server sits. An Indian services firm whose model scores, ranks, or generates content about people in the EU is caught on this limb even without a direct EU contract — a pattern common in offshore IT and BPO work performed for European clients.

The authorised-representative obligation (Article 22)

An Indian provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22 — a designated in-Union point of contact and accountability, not a full office. Many Indian exporters already meet a parallel structural requirement under the GDPR's EU-representative rule (GDPR Article 27); this is a separate appointment under a separate statute.

---

Timeline: the EU dates apply to in-scope Indian companies

There is no separate Indian date. An Indian company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

The Digital Omnibus on AI is law: Regulation (EU) 2026/1744 was approved by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, published in the Official Journal on 24 July 2026, and has been in force since 27 July 2026. Stand-alone Annex III high-risk obligations apply from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028. The Commission's November 2025 "stop the clock" proposal would have tied the delay to standards availability, with backstop dates; the adopted text uses fixed calendar dates instead.

What did not move

Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51-55 since 2 August 2025. For Indian foundation-model or GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope Indian companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any Indian transposition, an in-scope Indian provider or deployer faces the same role-based duties as an EU company. There is no India-lite version. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. An Indian services firm that fine-tunes a base model into a new high-risk purpose, or white-labels a high-risk EU tool, can inherit the full provider stack without realising it — a live risk for the customisation-heavy work that defines Indian IT services.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9-15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or Indian revenue: up to EUR 35 million or 7% for Article 5 breaches (Article 99(3)); up to EUR 15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to EUR 7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. The third tier is 1%, never 1.5%. Separately, GPAI model providers are fined by the Commission under Article 101 (up to EUR 15 million or 3%), not under Article 99.

---

Worked example: a Bengaluru SaaS firm selling AI hiring software into the EU

TalentSetu Technologies Pvt Ltd is a roughly 160-employee Bengaluru SaaS company with around EUR 18 million in annual revenue. It sells an AI candidate-screening and ranking tool, and several customers are employers in Germany and the Netherlands.

Why TalentSetu is in scope now

As a provider placing the system on the EU market, TalentSetu is in scope under Article 2(1)(a) today — no EU office required, the absence of a European entity irrelevant. Its tool is high-risk under Annex III point 4 (employment, worker management — recruitment and selection of natural persons), which triggers the full provider stack under Articles 9-15. Even where TalentSetu has no direct EU contract, Article 2(1)(c) can catch it where the tool's output is used to assess candidates in the Union.

The prohibited-practice gate comes first

Before any high-risk work, TalentSetu must clear the hard gate at Article 5(1)(f): emotion recognition in the workplace is a prohibited practice. If the screening flow infers emotion from video interviews — reading "confidence" or "enthusiasm" from facial expression or tone — that feature must be removed for the EU market regardless of high-risk status. A prohibited practice cannot be cured by documentation; it is simply banned.

TalentSetu's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier. As an SME, TalentSetu benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of roughly EUR 18 million revenue is the operative ceiling, not the EUR 15 million figure.
• Keep Indian obligations — the DPDP Act, the IT Rules, any MeitY advisory — running in parallel; the EU file does not discharge them, and vice versa.

---

What Indian companies should do now

Map your EU exposure, not your Indian status

Do not start from "are we covered under Indian law?" Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2 — independent of anything India does or does not legislate.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union — including work done offshore for European clients.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you fine-tune, white-label, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your Indian obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: the Commission's draft high-risk classification guidelines (May 2026) and the harmonised standards still being finalised, which shape how EU high-risk duties are met, and India's own evolving landscape — the Digital India Act's progress, DPDP Act rules, and MeitY advisories — which may add Indian obligations but will not displace the EU AI Act's extraterritorial reach.

How Confir helps Indian companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical-documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to give an Indian exporter an EU-market compliance file that stands on its own, separate from whatever Indian obligations apply. The GPAI workflow (Articles 51-55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

Related guides

• EU AI Act for US companies: extraterritorial reach
• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act scope explained (Article 2)
• Provider vs deployer under the EU AI Act
• EU AI Act deadlines and application dates