The EU AI Act: What Indian Software Companies Serving Europe Need to Know

If an Indian software studio builds a product for a client in Germany, France or Ireland, the European Union's AI law can become relevant even though the studio has no office there. The rules also changed this year. This post sets out what has actually been enacted as of November 2026, and what a small vendor should and should not worry about. It is general information, not legal advice.

The short version

The EU AI Act (Regulation 2024/1689) sorts AI systems by risk. A few uses are banned, some are called high-risk and carry heavy duties, some need simple transparency, and the rest, which is most business software, face no new obligations. A change law known as the Digital Omnibus on AI was published in the EU's Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk deadlines later. That part is now law, not a proposal.

The dates you can rely on

• Banned practices and AI literacy have applied since early 2025, and rules for general-purpose AI models started in August 2025.
• High-risk systems listed in Annex III (stand-alone uses such as recruitment, credit scoring and education tools) now apply from 2 December 2027. The original date was 2 August 2026.
• High-risk AI built into regulated products (such as medical devices and machinery, listed in Annex I) now apply from 2 August 2028.
• Transparency duties under Article 50 still apply from 2 August 2026. This includes telling people they are talking to an AI system and marking synthetic audio, image, video or text in a machine-readable way.
• Marking of synthetic output has a grace period until 2 December 2026 for systems that were already on the market before 2 August 2026.

Because Article 50 is already live, a chatbot or content tool sold into Europe is the area where a small vendor is most likely to have a real task today, not the high-risk list.

Does it apply to a vendor in Madurai?

The Act reaches providers outside the EU when their AI system is placed on the EU market or when the system's output is used in the EU. So a studio that builds an AI feature for a European client, or sells a product to European users, should assume the Act is relevant and check. A studio that only builds a normal website or billing system for a Chennai shop is outside its reach.

What counts as high-risk

High-risk is a defined list, not a feeling. Annex III covers areas such as hiring and worker management, credit decisions, access to education and certain public services. If your software ranks job applicants, scores loan applicants or decides who gets a place on a course, treat it as a likely high-risk case and get advice early.

Ordinary systems such as stock control, inventory management, appointment booking, accounting, a CRM or a school fee module are not on that list. Adding a feature that summarises notes or drafts an email does not turn them into high-risk systems. Honest advice for most small business software: the Act asks little of you beyond transparency where AI talks to people or generates content.

What else changed in July 2026

• A new ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a transition until 2 December 2026.
• A softer AI literacy duty: providers and deployers must support staff training, without a fixed competence level for each person.
• Support measures for small businesses, now extended to small mid-cap companies, including priority access to regulatory sandboxes. Member states have until 2 August 2027 to set up at least one sandbox.

A document checklist for an Indian vendor with EU clients

If you do fall under the Act, good records help with every client conversation, even before any official deadline.

1. List each AI feature in the product and say what it does in two plain sentences.
2. Record which model or service powers it, who provides it, and where data is processed.
3. Note whether the feature falls under a banned use, the high-risk lists, or Article 50 transparency.
4. Show users clearly that they are dealing with an AI, and mark generated content where required.
5. Keep a change log, test results and a named person responsible for each AI feature.
6. Agree in the contract which party, you or the client, is the provider and which is the deployer.

How we handle it at VS Tech Builders

We serve clients in India, Malaysia and Singapore and beyond, so we ask in discovery where the end users live and whether any feature makes decisions about people. That decides whether we simply document the feature or advise the client to take legal advice first. Our process already includes written scope and handover documentation, and our SaaS development work follows the same habit. Read how India's own AI governance approach compares, or contact us with your case. For binding advice on your product, speak to a lawyer who knows EU technology law.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• The Digital Omnibus on AI enters into force today — Lewis Silkin
• EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes — Gibson Dunn

Frequently asked questions

When do the EU AI Act high-risk rules apply now?

After the Digital Omnibus on AI entered into force on 27 July 2026, stand-alone high-risk systems under Annex III apply from 2 December 2027, and AI built into regulated products under Annex I from 2 August 2028. The earlier date of 2 August 2026 no longer applies to them. Transparency duties under Article 50 still start on 2 August 2026.

Does the EU AI Act apply to an Indian software company?

It can. The Act covers providers outside the EU if their AI system is placed on the EU market or its output is used in the EU. A studio building an AI feature for a European client should check its position. A company serving only Indian customers with no EU users is generally outside its scope.

Is a normal business app a high-risk AI system?

Usually not. High-risk is a defined list covering areas like recruitment, credit scoring and education access. Billing, inventory, booking and standard CRM software are not on it. If you add an AI chatbot or content generator, transparency duties may apply, but that is much lighter than the high-risk regime.

Is this legal advice?

No. This post summarises published sources as of November 2026 for general understanding. Whether your product falls under the Act depends on facts such as who uses it, what decisions it supports and the contract with your client. Consult a lawyer experienced in EU technology law before making compliance decisions.