Europe’s AI rulebook now threatens to become India’s next export industry. The EU AI Act, effective since August 2026, quietly rewires how Indian technology providers must operate, and few have grasped the full stakes.
New Delhi has signaled plans for standalone artificial intelligence legislation. Meanwhile, the EU framework already applies pressure across the global AI supply chain. Its risk-based structure bans certain systems outright, imposes strict duties on high-risk applications, and keeps lighter scrutiny for limited-use cases.
Most Indian firms understand the Act reaches them when their systems deliver outputs inside Europe. But a deeper mismatch carries bigger consequences.
The law imagines software as a finished product, built once, approved, and sold unchanged. India’s technology sector runs on continuous customization. The real trap sits in what happens after approval.
Any high-risk AI system used for sensitive decisions, hiring, education, credit, must first pass a conformity assessment under Article 43. Providers self-certify against testing, documentation, and human oversight standards. Then the system may operate freely. But if a “substantial modification” occurs, one not anticipated in the original assessment, the entire process restarts.
In June 2026, Brussels extended deadlines for standalone high-risk systems to December 2027 and embedded AI in regulated products to August 2028. Grandfathering provisions protect systems already on the market unless substantially modified. Planned updates examined during initial assessment trigger no new review. Unplanned changes likely do.
This distinction favors predictable product roadmaps. Standardized AI vendors can pre-assess scheduled upgrades. Bespoke service providers, those promising rapid adaptation to each client’s needs, may struggle to prove future changes fall within the original scope.
India’s industry, from IT services giants to global capability centers in Bengaluru and Hyderabad, depends on responsive adaptation. As a result, any firm substantially modifying someone else’s high-risk system inherits the original builder’s full legal obligations. An unplanned improvement that shifts intended purpose could force a fresh regulatory exercise.
Yet opportunity hides inside the compliance burden. Self-assessment demands governance frameworks, technical documentation, and testing at scale. Harmonized technical standards remain under development. Indian legal and technical professionals already support clients across data protection, financial regulation, and assurance work. They can deliver AI Act compliance capability too.
A longer-term prize exists beyond services. The Act allows third-country conformity assessment bodies to gain recognition where treaty arrangements exist. India’s free trade agreement with the EU, concluded in January, includes regulatory cooperation machinery. If leveraged, qualified Indian bodies could participate directly in Europe’s assessment ecosystem.
Europe wrote itself a mountain of rules. India holds the capacity to perform the work. Whether those rules become a threat or a revenue stream will be decided soon.
