The EU AI Act is the European Union's law on artificial intelligence. It sorts AI systems by risk and puts duties on providers and deployers, including those outside the EU if their system's output is used in the EU. An Indian company that sells software or services into Europe may be in scope even with no office there.
Last reviewed: 17 October 2026. Facts checked. We opened the Act's implementation timeline (last updated 31 August 2026), the high-level summary, and the Article 4 page, all at artificialintelligenceact.eu. We searched for the Digital Omnibus: results report Regulation (EU) 2026/1744, published 24 July 2026 and in force 27 July 2026, but we did not open the regulation or EUR-Lex, and one source conflicts with another on how transparency rules were treated. We did not verify fine amounts, so none are given. This is not legal advice.
The core idea: four risk tiers
Per the Act's high-level summary:
| Tier | What it means | Example |
|---|---|---|
| Unacceptable | Banned | Social scoring, manipulative AI |
| High | Heavy obligations, mostly on providers | AI in listed sensitive areas |
| Limited | Transparency duties | Chatbots, deepfakes: people must know it is AI |
| Minimal | Largely unregulated | Most everyday tools |
Most finance and audit tools sit in the lower tiers. Which tier a particular system falls into is a legal question, so check the Act's classification rules with counsel.
Who in India is in scope?
The summary says the Act covers:
- Providers that place high-risk systems on the EU market, wherever they are based.
- Providers and deployers outside the EU whose system's output is used in the EU.
- Deployers (organisations using AI professionally) that are located in the EU.
So an Indian IT or BPO firm that builds or runs AI for European clients should map its position. An Indian company that only uses ChatGPT-style tools internally, with no EU output, is much less likely to be affected.
Dates as of 17 October 2026
The timeline page lists these:
| Date | What applies |
|---|---|
| 1 August 2024 | Act enters into force |
| 2 February 2025 | Prohibitions and AI literacy duties begin |
| 2 August 2025 | General-purpose AI model rules, governance, some penalties |
| 2 August 2026 | Remainder of the Act applies, unless stated otherwise |
| 2 December 2027 | High-risk systems under Article 6(2) and Annex III |
| 2 August 2028 | High-risk systems under Article 6(1) and Annex I |
The page also gives a later date, 2 December 2026, for some systems already on the market and for a few new prohibitions. The high-risk dates above are later than the original schedule. The search results we read attribute that move to the Digital Omnibus on AI. Dates have shifted once, so check the live timeline before planning.
AI literacy: a duty that is already live
Article 4 has applied since 2 February 2025. Providers and deployers must take measures to support AI literacy among staff and others who operate AI on their behalf. The page notes that this does not require guaranteeing any specific level for any individual. It also shows the article as amended, so read the current text. For an Indian firm in scope, a short training record is a sensible first step.
What finance and audit teams should do now
- Inventory. List AI systems you build, sell or run, and where outputs go. Our AI governance framework starts here.
- Find EU links. Which customers, users or subsidiaries are in the EU?
- Classify. With legal help, decide the tier for each system.
- Train staff. Keep records of AI literacy training.
- Read contracts. EU clients may add AI clauses to supplier agreements.
- Tell the auditor. Regulatory exposure may matter for provisions and disclosures. Use our AI risk assessment tool to structure the discussion.
What auditors should ask
- Does the entity place AI systems on the EU market or have outputs used there?
- Has management assessed which obligations apply, and when?
- Is there a compliance plan, owner and budget?
- Could non-compliance create contingent liabilities or affect going concern assumptions? We have not found guidance that settles this, so apply professional judgement.
How it relates to India's own rules
India does not have an equivalent single AI law that we found. Data protection is covered by the DPDP Act and Rules, notified in November 2025 with an eighteen-month phase-in. See our DPDP readiness checklist. Frameworks such as the NIST AI RMF can help organise evidence for both.
Frequently Asked Questions
Does the EU AI Act apply to Indian companies?
It can. The Act covers non-EU providers and deployers whose AI system's output is used in the EU. Companies with no EU link are less likely to be in scope.
What are the risk categories?
Unacceptable (banned), high, limited and minimal risk. Obligations rise with the tier.
When do the high-risk rules apply?
The timeline page lists 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Check the live page, as dates have changed before.
Is AI literacy required now?
Article 4 has applied since 2 February 2025 for providers and deployers in scope. Read the current amended wording.
What are the fines?
We did not verify penalty amounts for this post. Check the Act's penalty provisions on EUR-Lex.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error