The EU AI Act for Indian companies: what actually applies in 2026

In May 2026, the EU agreed to move the AI Act's most demanding deadlines. If your compliance calendar still says "high-risk obligations: August 2026," it is out of date — and if it says "nothing applies yet," it is more out of date still. Here is the position for an Indian company selling software or services into Europe, as of June 2026.

First: why an Indian company is covered at all

The AI Act applies extraterritorially. It catches non-EU providers placing AI systems or general-purpose AI models on the EU market, and it catches providers and deployers outside the EU where the output of their system is used in the EU. An Indian SaaS product with EU customers and an AI feature is in scope; so is an Indian analytics vendor whose model outputs are consumed by an EU client. Providers of high-risk systems and of GPAI models must also appoint an EU authorised representative before placing them on the market.

Already in force by mid-2026

• Prohibited practices (since 2 February 2025): social scoring, exploitative manipulation, untargeted facial-image scraping and the other Article 5 practices. Penalties for these reach €35 million or 7% of worldwide turnover, whichever is higher.
• AI literacy (since 2 February 2025): organisations must take measures so staff operating AI systems understand them — softened in wording by the 2026 omnibus, but not removed.
• GPAI model obligations (since 2 August 2025): documentation, copyright policy and training-data summaries for general-purpose model providers.

What lands on 2 August 2026

• Article 50 transparency duties. Users must be told when they are interacting with an AI system; AI-generated and manipulated content (deepfakes) must be disclosed. A carve-out gives existing systems until 2 December 2026 for machine-readable marking of synthetic content.
• GPAI enforcement. The Commission's power to fine GPAI providers — up to €15 million or 3% of worldwide turnover — becomes exercisable. The first year of GPAI obligations was treated as cooperative engagement; that posture ends.

What just moved: the Digital Omnibus deferral

On 7 May 2026, EU negotiators reached provisional agreement to defer the high-risk regime: obligations for stand-alone Annex III high-risk systems (recruitment, credit scoring, education, essential services) move from 2 August 2026 to 2 December 2027, and AI embedded in Annex I regulated products (medical devices, machinery, vehicles) moves to 2 August 2028. The stated reason is to let European standards bodies finish the harmonised standards businesses would certify against.

Two cautions. First, as of 11 June 2026 this is a provisional agreement — formal adoption is expected mid-2026, with publication in the Official Journal anticipated before the original August deadline. Plan on the new dates, but track adoption. Second, the omnibus also adds obligations: two new prohibitions (AI generating non-consensual intimate imagery and child sexual abuse material) take effect 2 December 2026.

What this means in practice for an Indian exporter

1. Classify your AI features now. Prohibited, high-risk (Annex III or embedded in an Annex I product), limited-risk (transparency), or minimal. The classification drives everything else, and customers' procurement teams will ask for it in 2026 regardless of deferred deadlines.
2. Ship Article 50 compliance for August 2026. Chatbot disclosure lines, deepfake labelling and synthetic-content marking are engineering tickets, not legal memos — schedule them like any other release.
3. If you provide a GPAI model, treat 2 August 2026 as the end of the grace period: documentation, copyright policy and training-data summaries must stand up to supervision.
4. Use the deferral, don't waste it. If any feature is plausibly Annex III high-risk, the 16 extra months are for building the risk-management system, data governance, logging and human-oversight design the regime will demand — and for appointing the EU authorised representative.
5. Mind the parallel stack. GDPR still applies to the personal data in your AI pipeline (with fines to €20M/4%), India's IT Amendment Rules, 2026 impose their own labelling regime for synthetic content, and the EU's Data Act and NIS2 may add contractual and registration duties for digital-service providers.