Compliance guide · European Union

The EU AI Act, for Indian companies.

Europe’s AI law reaches well beyond Europe. If your AI is sold in the EU, or its output is used there, parts of it can apply to you wherever your company is based. Here is how the risk tiers work, the dates after the 2026 changes, and the fines.

Check your EU AI Act exposure Find your risk tier
Dates updated for the 2026 Digital OmnibusRisk tier check for each AI systemArticle 15 security testing
In plain words

The EU AI Act (Regulation (EU) 2024/1689) sorts AI by risk. A few uses are banned; high-risk uses such as hiring, credit scoring and education must meet strict requirements; chatbots and AI-generated content carry transparency duties; and most other AI is lightly touched. It applies to companies outside the EU when they put AI on the EU market or when their AI’s output is used in the EU. Fines reach €35 million or 7% of worldwide turnover.

Checked against official sources on . General information, not legal advice.

Law
Regulation (EU) 2024/1689
In force since
1 August 2024
High-risk rules
From 2 December 2027
Highest fine
€35m or 7% of turnover
The risk tiers

Four tiers. Find yours first.

Everything in the AI Act follows from the tier your AI falls into. Most business AI lands in the bottom two; hiring, lending and education tools often land in high risk.

The four risk tiers of the EU AI Act. Banned since February 2025: social scoring, manipulation, emotion recognition at work or school, untargeted face scraping and crime prediction from profiling alone. High risk, strict rules from December 2027: hiring, credit scoring, education, essential services, critical infrastructure and policing, which need risk management, logs, human oversight and security. Transparency duties from August 2026: chatbots must say they are AI, and deepfakes and AI-generated content must be labelled. Minimal risk: no new duties. General-purpose AI models have their own duties since August 2025. BANNEDSTOP BANNED SINCE FEBRUARY 2025Social scoring, manipulation, emotion recognitionat work or school, untargeted face scraping,crime prediction from profiling alone.HIGH RISKSTRICT RULES STRICT RULES FROM DECEMBER 2027Hiring, credit scoring, education, essentialservices, critical infrastructure, policing.Risk management, logs, oversight, security.TRANSPARENCYTELL PEOPLE DUTIES FROM AUGUST 2026Chatbots must say they are AI. Deepfakes andAI-generated content must be labelled.MINIMAL RISKNO NEW DUTIES NO NEW DUTIESSpam filters, games, most internal tools.Voluntary codes of conduct.ALONGSIDE THE TIERS: GENERAL-PURPOSE AI MODELS HAVE THEIR OWN DUTIES, SINCE AUGUST 2025
A simplified view of the AI Act’s risk tiers. Which tier you are in depends on what the AI is used for, not on the technology behind it.
Key dates

The dates, after the 2026 changes.

AUG 2024AI Act in forceFEB 2025Banned practices applyAUG 2025General-purpose AI rulesAUG 2026Transparency duties applyDEC 2026New ban: fake intimate imagesDEC 2027High-risk rules (Annex III)AUG 2028High-risk AI in products TODAY · NOV 2026
  1. AUG 2024AI Act in force
  2. FEB 2025Banned practices apply
  3. AUG 2025General-purpose AI rules
  4. AUG 2026Transparency duties apply
  5. DEC 2026New ban: fake intimate images
  6. DEC 2027High-risk rules (Annex III)
  7. AUG 2028High-risk AI in products

Dates as amended by the Digital Omnibus on AI, in force since 27 July 2026, which pushed back the high-risk rules. Generative AI providers also got a grace period, to 2 December 2026, for marking AI-generated content.

Does it apply to you?

You are probably in scope if any of these are true.

  • You sell an AI product or AI feature to customers in the EU
  • An EU client uses your AI’s output, such as a hiring score or a chatbot answer
  • You build AI that an EU company sells under its own name
  • You offer a general-purpose AI model that is available in the EU

Based outside the EU? Providers of high-risk AI systems and general-purpose AI models must appoint an authorised representative in the EU.

If none of these apply, the Act probably does not reach you today, but your EU customers may still ask for proof that your AI is safe.

If your AI is high-risk

Nine things you will need.

High-risk providers carry most of the duties. Article 15 is where security testing, and our AI red teaming, comes in.

  • Art. 9 · Risk management

    A process to find, assess and reduce risks, across the whole life of the system.

  • Art. 10 · Data governance

    Training and test data that are relevant, representative and checked for bias.

  • Art. 11 · Technical file

    Documentation that shows how the system was built and how it meets the rules.

  • Art. 12 · Logs

    Automatic records of events, so problems can be traced.

  • Art. 13 · Instructions

    Clear information for the companies that deploy your system.

  • Art. 14 · Human oversight

    People who can understand, override or stop the system.

  • Art. 15 · Accuracy and security

    Resistance to data poisoning, model poisoning, adversarial inputs and confidentiality attacks. This is where red teaming fits.

  • Art. 17 · Quality management

    A documented quality system for design, testing and changes.

  • Art. 72–73 · After launch

    Monitoring after release, and reporting serious incidents to the authorities.

How we help

From “does it apply?” to evidence.

  1. Week 1

    EU exposure check

    Which of your AI systems reach the EU, and whether you are a provider, deployer or both.

  2. Weeks 1–2

    Risk tier per system

    Each system placed in a tier, with the reasoning written down.

  3. Weeks 2–4

    Gap check

    Your duties for that tier, scored met, partly met or missing.

  4. Weeks 3–6

    Article 15 testing

    Red teaming for prompt injection, data leaks, poisoning and misuse, mapped to the Act.

  5. Weeks 5–8

    Evidence pack

    Records, test results and transparency notices, ready for customers and authorities.

Questions

EU AI Act questions from Indian teams.

Q01Does the EU AI Act apply to an Indian company?
It can. It applies to providers that put AI systems or general-purpose AI models on the EU market or into service there, wherever they are based. It also applies to providers and deployers outside the EU when the output of their AI system is used in the EU, for example a hiring score your software produces for an EU client.
Q02Our chatbot serves EU customers. What must we do?
From 2 August 2026, people must be told they are talking to an AI, unless it is obvious. If your system generates text, images, audio or video, its output must be marked as AI-generated in a machine-readable way, and deepfakes must be disclosed. Also check that none of the chatbot’s uses fall into the high-risk list.
Q03How do we know if our AI is high-risk?
Check two lists. Annex III covers uses such as biometrics, critical infrastructure, education, hiring and managing workers, access to essential services (including credit scoring and life and health insurance pricing), law enforcement, migration, and justice. Annex I covers AI that is a safety part of products such as medical devices or machinery. There are narrow exceptions, but AI that profiles people in Annex III areas is always high-risk.
Q04What are the fines?
Up to €35 million or 7% of worldwide annual turnover for banned practices; up to €15 million or 3% for most other breaches; and up to €7.5 million or 1% for giving authorities incorrect or misleading information. For start-ups and small businesses, the lower of the two amounts applies.
Q05What changed with the Digital Omnibus?
The 2026 amendments, in force since 27 July 2026, moved the high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products. They gave generative AI providers until 2 December 2026 to mark AI-generated content, and added a new ban, from the same date, on AI used to create intimate images of real people without consent.
Q06Does ISO 42001 help with the AI Act?
Yes. Its risk process, impact assessments, life cycle controls and records line up well with what the Act asks of providers. It is not a substitute for the Act’s specific duties, but it makes them much easier to meet and prove. See our ISO 42001 guide.
Q07Does GDPR still apply?
Yes. If your AI processes personal data of people in the EU, GDPR applies alongside the AI Act. The AI Act adds to GDPR; it does not replace it.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings