The EU AI Act for Indian companies: a checklist before you sell AI into Europe
The EU AI Act applies to companies outside Europe when their AI systems are placed on the EU market or their outputs are used in the EU. If you're an Indian SaaS company with European customers, or an exporter whose AI-enabled product ends up in Europe, it can apply to you.
This article is general information, not legal advice. Obligations are being phased in over several years, so confirm current timelines with a qualified adviser.
Step 1: Work out your role
The Act assigns different duties depending on whether you are a provider (you develop the AI system or put it on the market under your name), a deployer (you use it in your operations), an importer or a distributor. Most Indian SaaS companies selling AI features are providers.
Step 2: Identify the risk tier
| Tier | Examples | What it means |
|---|---|---|
| Unacceptable risk | Social scoring, certain manipulative systems | Prohibited |
| High risk | AI used in hiring, credit scoring, education access, critical infrastructure, certain safety components | Strict requirements: risk management, data governance, documentation, human oversight, accuracy and robustness |
| Limited risk | Chatbots, AI-generated content | Transparency duties, such as telling people they are talking to AI |
| Minimal risk | Spam filters, most internal tools | No specific obligations beyond general law |
General-purpose AI models carry separate duties, mainly for the model providers themselves.
Step 3: If you're high risk, plan for these
- A documented risk management system across the AI lifecycle.
- Data governance: training and test data that are relevant and checked for bias.
- Technical documentation and record-keeping (logs).
- Human oversight built into the design (Article 14).
- Accuracy, robustness and cybersecurity testing.
- Conformity assessment before placing the system on the EU market.
Step 4: Even if you're limited risk
- Tell users clearly when they're interacting with an AI system.
- Label AI-generated content where required.
- Keep basic evaluation records. Buyers will ask for them anyway.
Step 5: Use standards to get organised
ISO/IEC 42001 gives you a management framework that maps well to many of the Act's expectations. Combined with a solid evaluation process for quality and safety, it lets you answer European buyers with evidence instead of assurances.
The practical takeaway
Make a list of every AI feature you ship, who uses it, and in which countries. That single document is the starting point for every compliance conversation, and most companies don't have it yet.