Does the EU AI Act Apply to Your Indian SaaS Company?

If you run an Indian SaaS company with even a handful of European customers, you’ve probably heard the EU AI Act described as “the GDPR of AI”. The comparison is fair in one important way: like the GDPR, the EU AI Act reaches companies far outside Europe.

Many Indian founders assume a European law can’t touch a company in Bengaluru or Pune. For AI products used in the EU, that assumption is wrong. This guide explains when the EU AI Act applies to Indian companies, how the risk categories work, which deadlines changed after the EU’s 2026 “Digital Omnibus”, the penalties, and a practical plan for Indian SaaS businesses.

When the EU AI Act applies to an Indian company

The EU AI Act applies based on where an AI system is placed on the market or used, not where the company is incorporated. An Indian company can be caught in three main ways:

• As a provider placing an AI system on the EU market. If you sell or make available an AI system or a general-purpose AI model to customers in the EU, you are a “provider”, wherever you’re based.
• When the AI system’s output is used in the EU. Even if your system runs entirely on servers in India, the Act can apply where its output is used in the EU. For example, a candidate-screening score generated in India and used by a German employer.
• Through EU customers who deploy your system. Your EU customers are “deployers” with their own obligations, and they’ll push those obligations back to you through contracts and due diligence questionnaires.

Non-EU providers of high-risk AI systems, and of general-purpose AI models, must appoint an authorised representative established in the EU. For an Indian SaaS company, that’s often the first concrete sign that the EU AI Act is no longer someone else’s problem.

The risk categories: where does your product fit?

The EU AI Act sorts AI into tiers, and your obligations depend entirely on which tier your product falls into.

General-purpose AI models (foundation models) have their own obligations, which have applied since 2 August 2025. Most Indian SaaS companies that build on top of third-party models aren’t GPAI providers. But if you fine-tune and distribute your own model, check carefully.

A common mistake is to assume that because the underlying model comes from a big US provider, the EU AI Act is that provider’s problem. It isn’t. If your product uses AI for a high-risk purpose, such as ranking job applicants, you are the provider of that high-risk AI system, even if you didn’t train the model. Indian HR-tech, edtech and fintech startups are most exposed. Recruitment tools, exam proctoring and credit-decisioning products sold into Europe are classic high-risk use cases. Chatbots and synthetic media also carry labelling duties; our guide to deepfakes and personality rights in India covers how India treats synthetic content.

The 2026 Digital Omnibus: which deadlines changed

The EU AI Act entered into force on 1 August 2024 with a staggered timetable. In 2026, the EU changed that timetable. The “Digital Omnibus on AI” was formally adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026, and entered into force on 27 July 2026 (Usercentrics; European Commission). The current EU AI Act timeline for Indian companies is:

Sources: Secure Privacy; Jones Walker. In our view, the delay is a reprieve, not a reason to relax. The substance of the high-risk obligations hasn’t changed, and building risk management, documentation and human oversight into a product takes many months. European enterprise customers are already asking for this evidence in procurement.

Penalties and commercial consequences

The EU AI Act’s fines are designed to be felt. The maximum fines are:

• Prohibited practices: up to €35 million or 7% of worldwide annual turnover, whichever is higher.
• Most other obligations, including high-risk and transparency duties: up to €15 million or 3% of worldwide turnover (Certivo).
• Supplying incorrect or misleading information to authorities: up to €7.5 million or 1% of turnover.

For startups and SMEs, the Act applies the lower of the fixed amount and the percentage, which helps, but the numbers remain serious. For most Indian SaaS companies, though, the commercial consequences arrive first: lost European deals, failed vendor assessments, and contracts that shift AI Act liability onto the Indian supplier through warranties and indemnities.

A practical EU AI Act compliance plan for Indian SaaS companies

• Map your AI systems. List every feature that uses AI, which models power it, and which EU customers use it.
• Classify each system against the prohibited, high-risk, transparency and minimal-risk tiers, and record your reasoning.
• Meet the August 2026 transparency rules now. Disclose chatbot interactions and label AI-generated content where Article 50 applies.
• Build high-risk compliance into the roadmap for December 2027: risk management, data governance, technical documentation, logging, human oversight and post-market monitoring.
• Appoint an EU authorised representative if you are a non-EU provider of high-risk systems or GPAI models.
• Fix your contracts. Negotiate EU customer contracts so that AI Act responsibilities and indemnities are allocated fairly between you, as provider, and the customer, as deployer. See also who is liable when an AI agent makes a mistake.
• Align with Indian law too. The same governance work supports compliance with India’s AI Governance Guidelines, the DPDP Act and the IT Rules on synthetically generated content. See our DPDP Act compliance checklist and our guide to AI tools at work.

Remedies and disputes. EU market surveillance authorities enforce the Act, and their decisions can be challenged before national courts in the relevant member state. Commercial disputes with EU customers over AI Act responsibilities will usually be governed by your contract’s choice of law and dispute resolution clause, which is another reason to negotiate those clauses carefully. For how training data is treated in India, see our analysis of ANI v. OpenAI.

Quick answers

Does the EU AI Act apply to Indian companies?

Yes, if they place AI systems on the EU market or their AI system’s output is used in the EU, regardless of where they’re incorporated.

When do high-risk obligations apply now?

After the 2026 Digital Omnibus, from 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI in regulated products.

What applies from August 2026?

Article 50 transparency obligations, such as telling users they’re talking to AI and labelling AI-generated content.

Related reading: the DPIIT AI copyright working paper and labelling AI-generated content in India; also AI in hiring and employee monitoring; also India’s standalone AI law and what startups should prepare; also AI training data provenance audits after Bartz.

Final word

At Halverton & Co., we advise startups, SaaS companies and technology-driven businesses on EU AI Act readiness, cross-border SaaS contracts and AI governance. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for companies that need senior legal support without a full in-house team. Halverton & Co.: Where tech needs law!

Write to us at office@halvertonandco.com, or get in touch, to discuss your situation.

This article reflects the law and developments reported up to early October 2026. Technology regulation changes quickly; please take advice on your specific facts before acting.