EU AI Act Investigations: What Indian Businesses Serving Europe Should Know

This week the EU AI Office reportedly opened its first investigations under the AI Act, into OpenAI and Anthropic. In the UK, a parliamentary hearing also heard OpenAI and Anthropic support legally binding AI safety requirements, including mandatory reporting of serious incidents, while Google DeepMind and Meta preferred relying on existing regulation and technical standards. Regulation is clearly moving from paper to practice.

Even if you are an Indian company with no office in Europe, this can reach you.

Not legal advice: the AI Act is complex and timelines can change. Speak to a qualified lawyer about your own situation.

Why this matters outside Europe

The EU AI Act is built around risk. In general terms, it can apply to organisations outside the EU when their AI systems are placed on the EU market or their outputs are used in the EU. You may be affected if you:

• Sell software, apps or services to EU customers
• Build products for European clients as a development partner
• Use AI features, such as chatbots, scoring or recommendations, that EU residents interact with
• Supply AI-based components to companies that sell in Europe

Even when the law does not apply directly to you, your European clients may ask you to meet its requirements in their contracts.

The risk-based idea in plain words

• Banned uses: certain practices are prohibited outright.
• High-risk uses: AI in areas such as hiring, credit decisions, education or essential services faces stricter rules.
• Transparency duties: people should be told when they are talking to an AI system, and some AI-generated content should be identifiable.
• General-purpose AI models: model providers have their own obligations.
• Minimal-risk uses: most everyday tools face few requirements.

Dates for different parts have been phased in and have been the subject of proposed changes, so check the current timeline instead of relying on old articles.

A practical preparation plan

1. List every place you use AI, in your products, your internal tools and your marketing.
2. Classify each use by risk. Is it advising on hiring, lending or health? That needs closer attention.
3. Tell users when they are dealing with AI, such as a clear "AI assistant" label on a chatbot.
4. Know your vendors. Keep records of which model and provider you use, and ask them for their compliance documentation.
5. Keep records: what the system does, what data it uses, how it was tested, and who is responsible.
6. Add human oversight for any decision that significantly affects a person.
7. Respect data rules, including GDPR if you handle EU personal data and India's DPDP Act for Indian users.
8. Write down incident handling: how you detect, log and report serious problems.

Regulation shapes products too

Regional rules already change which AI features reach which markets. Apple, for instance, said its new HomeView smart-home hub will not launch in the EU at first, because its Siri AI is not available there. If you build for several regions, plan features so that they can be switched on or off by location.

Where KalzTech fits

We build web apps, mobile apps and AI integrations for clients in India and abroad, and we can help you document AI use, add clear AI disclosures and design features that can be adjusted by region. Contact us to talk it through.