EU AI Act and India's AI Rules: What Businesses Must Do in 2026-27

AI regulation in late 2026 looks very different depending on where your users are. The EU AI Act is law and partly in force, but its heaviest obligations for high-risk systems were pushed back to December 2027 and August 2028 by the Digital Omnibus adopted in mid-2026. India decided not to write a separate AI law and instead governs AI through guidelines, amended IT Rules for synthetic content, the DPDP Act, and sector regulators.

For a business in India or the UAE that builds or uses AI, this means two practical questions. Do any of my AI systems touch people in the EU? And what do Indian rules already require of me today?

This guide sets out the current EU timeline, what applies right now, what the high-risk rules will demand, India's approach, and a checklist you can work through. It is a practical summary, not legal advice; take counsel for your specific situation.

Why the EU AI Act matters outside Europe

The AI Act applies based on where an AI system is placed on the market or where its output is used, not where the company sits. An Indian software company that sells an AI-enabled product to EU customers is a "provider" under the Act. A UAE hospital group with a clinic in Europe that uses an AI triage tool there is a "deployer". Even a chatbot on a website serving EU visitors can bring transparency duties.

If none of your AI systems reach the EU, the Act will still shape the products you buy, since global vendors design to it.

The EU AI Act timeline after the Digital Omnibus

The Digital Omnibus on AI was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. Besides moving deadlines, it adds new prohibited practices covering AI-generated non-consensual intimate imagery and child sexual abuse material, and strengthens the AI Office's supervisory powers. The high-risk deferral was the headline: Annex III systems moved from August 2026 to December 2027, and Annex I systems from August 2027 to August 2028.

Roles and risk tiers in plain terms

• Provider: develops an AI system or model and places it on the market under its name. Carries most obligations.
• Deployer: uses an AI system in a professional capacity. Has lighter but real duties, especially for high-risk systems.
• GPAI model provider: trains and releases general-purpose models. Most businesses are not this; they build on these models.

Risk tiers decide what applies:

• Prohibited: practices such as manipulative techniques causing harm, social scoring and certain biometric uses. Fines reach up to €35 million or 7% of global turnover.
• High-risk: Annex III areas such as employment and hiring, access to education, credit scoring, access to essential services, and certain law enforcement and migration uses; plus AI that is a safety component of products already regulated, such as medical devices (Annex I).
• Transparency-only: chatbots, emotion recognition, deepfakes and AI-generated content.
• Minimal risk: everything else, such as spam filters or internal summarisation tools.

What applies right now

Transparency (Article 50). Since 2 August 2026, people must be told when they are interacting with an AI system unless it is obvious, and deployers of deepfakes and certain AI-generated text must disclose it. Providers of generative systems must mark outputs in a machine-readable way; systems already on the market before August 2026 have until 2 December 2026 for that marking, according to Gibson Dunn's analysis of the Omnibus. For most businesses this is the most immediate duty: label your chatbot and voice agent as AI, and label synthetic media.

GPAI obligations. If you only build on models from major providers, these duties fall mainly on those providers. The Commission published a General-Purpose AI Code of Practice in July 2025 with chapters on transparency, copyright, and safety and security, and the AI Office has been able to enforce GPAI rules since August 2026. Ask your model vendors whether they have signed the Code; the Commission's signatory taskforce page explains how signatories are supported.

AI literacy. The Omnibus softened this from ensuring a sufficient level of staff literacy to supporting its development. A documented training programme for staff who use AI remains a sensible minimum.

Prohibitions. Already in force since February 2025. Review any emotion recognition in workplaces or schools, and any profiling that could amount to social scoring.

Preparing for high-risk obligations

If you provide a system in an Annex III area, December 2027 is closer than it looks. Providers will need:

• A risk management system across the lifecycle.
• Data governance showing training, validation and test data are relevant, representative and examined for bias.
• Technical documentation and automatic logging.
• Transparency information and instructions for deployers.
• Designed-in human oversight.
• Accuracy, robustness and cybersecurity measures.
• A quality management system and conformity assessment before market entry.

For healthcare software, the main route into high-risk status is Annex I: AI that is, or is part of, a medical device under the EU Medical Device Regulation. Those obligations apply from August 2028, on top of existing medical device requirements. Hospital operations software, such as scheduling, bed management or billing assistants, is usually not high-risk under the Act, though transparency rules may apply.

India's approach: guidelines, not a new law

India has chosen a lighter, sector-led path.

India AI Governance Guidelines (November 2025). Released by MeitY on 5 November 2025, the guidelines set out seven principles ("sutras"), including trust, people first, innovation over restraint, fairness, accountability, understandability and safety, adapted from the Reserve Bank of India's FREE-AI framework for finance. They describe six pillars, including infrastructure, capacity building, policy and regulation, risk mitigation, accountability and institutions. Officials have said there is no plan for an umbrella AI law; existing laws apply, with targeted amendments where needed.

IT Rules on synthetically generated information. Amendments to the IT Rules, first published in draft in October 2025, came into force on 20 February 2026. They define "synthetically generated information" and require platforms to label it prominently, including through metadata or identifiers. If your product creates or hosts AI-generated images, audio or video, labelling is now an Indian obligation as well as an EU one.

DPDP Act and Rules. The Digital Personal Data Protection Rules were notified in November 2025 with a phased rollout of about 18 months, running to around May 2027. AI systems that process personal data need a lawful basis, clear notices, purpose limits, security safeguards and breach handling. Our DPDP Act checklist for hospitals applies to AI features too.

Sector regulators. The RBI's FREE-AI framework shapes expectations in banking and finance, and health, telecom and securities regulators issue their own guidance. For healthcare AI, clinical safety, consent and data protection are the practical constraints today.

A side-by-side view

A practical compliance checklist

• Build an inventory of every AI system you build or use: purpose, users, data, model vendor, and countries where output is used.
• Classify each one: prohibited, high-risk, transparency-only or minimal under the EU Act, and note Indian obligations.
• Add AI disclosure to chatbots, voice agents and AI-written messages.
• Label AI-generated images, audio and video, with machine-readable marking where you generate them.
• Collect model vendor documentation and Code of Practice status.
• Run a short AI literacy programme for staff who use AI tools.
• For any potential high-risk system, start documentation, logging and human oversight design now.
• Map personal data flows in AI features against DPDP obligations.

How to start

1. Spend a week building the inventory; most companies discover AI features they had forgotten.
2. Fix transparency gaps first. They are cheap and already required.
3. Prioritise any system that could fall into Annex III or Annex I and plan its documentation and testing.
4. Build logging and evaluation into AI products by default; they serve both regulators and quality. Our guide to LLM evaluation and observability shows how.
5. Review prompt injection and data leakage risks, which overlap with cybersecurity duties. See our prompt injection defence guide.

Algon builds AI systems with this documentation in mind from the start through our AI development services and healthcare software development work, which makes later compliance far cheaper than retrofitting.

Conclusion

The EU gave businesses more time for high-risk AI, but not for transparency, general-purpose AI rules or prohibitions, all of which apply now. India chose guidelines and targeted rules over a new law, but synthetic media labelling and the DPDP Act already bite.

For most companies the action list is short: know your AI systems, disclose AI to users, label synthetic content, handle personal data properly, and start documenting anything that could be high-risk. Doing that now costs far less than doing it under a deadline.