What Do High-Risk AI System Requirements Mean in Practice?

High-risk AI systems must meet eight specific requirements before deployment in the EU. Risk management system: a documented process for identifying, analysing, and mitigating risks throughout the AI system lifecycle. Data governance: training data quality requirements including representativeness, bias assessment, and data management practices. Technical documentation: a technical file describing the system's purpose, design, capabilities, limitations, and validation results. Record-keeping: logging of system inputs and outputs sufficient for post-deployment review. Transparency: information provided to deployers enabling informed use. Human oversight: design features enabling human monitoring, intervention, and override. Accuracy, robustness, and cybersecurity: tested performance claims and security protections. Conformity assessment: either self-declaration (for most high-risk categories) or third-party assessment (for biometric and critical infrastructure AI) (EU AI Act, 2025).

[ORIGINAL DATA] In our EU AI Act readiness assessments for Indian IT exporters, the most commonly missing requirement is technical documentation. Indian IT companies typically have adequate code documentation but lack the system-level documentation the EU AI Act requires: a complete description of the AI system's purpose, design decisions and their rationale, training data provenance, model performance across demographic subgroups, and known limitations. Creating this documentation retroactively for deployed systems is time-consuming and reveals compliance gaps that require remediation.

How Does the EU AI Act Interact with DPDPA for Indian Companies?

Indian companies with EU clients face dual compliance obligations. DPDPA 2023 governs processing of Indian citizens' personal data. GDPR governs processing of EU citizens' personal data. The EU AI Act governs the AI system itself, regardless of data origin. These frameworks have significant overlap: both DPDPA and GDPR require data protection impact assessments, transparency to affected individuals, and security safeguards. The EU AI Act's risk management, transparency, and human oversight requirements complement GDPR's AI-specific provisions (particularly GDPR Article 22 on automated decision-making). A combined compliance framework addressing all three simultaneously is the most efficient approach for Indian IT companies with dual India-EU exposure (NASSCOM, 2025).

<a href="/in/ai-governance-consulting/" title="AI Governance">AI governance</a> India DPDPA

Citation Capsule: EU AI Act and India

The EU AI Act (enforced August 2025) applies to Indian IT companies whose AI systems are used by EU clients. NASSCOM estimates 1,200+ Indian IT companies have EU clients potentially within scope. High-risk AI requires conformity assessment, technical documentation, and human oversight. Penalties for prohibited AI reach EUR 35 million or 7% of global annual turnover. Indian IT companies face dual compliance: DPDPA for Indian citizen data and EU AI Act for systems used in Europe (EU AI Act, 2025).

Frequently Asked Questions

Do all Indian IT companies exporting to Europe need to comply with the EU AI Act?

Only those whose services include AI systems or AI-powered products used by EU clients need to comply. Pure IT services (application support, infrastructure management without AI components) are not within scope. Indian IT companies should audit their EU client contracts to identify any AI components: AI-powered reporting tools, automated decision systems, AI chatbots, or ML-based analytics delivered as part of the service. Each identified AI system must then be risk-classified under the EU AI Act (NASSCOM, 2025).

What should an Indian IT company do first to prepare for EU AI Act compliance?

Three immediate steps: first, conduct an AI system inventory across all EU client engagements, identifying every AI component delivered as part of the service. Second, risk-classify each identified AI system against the EU AI Act's four tiers. Third, for any system classified as High risk, begin technical documentation development immediately, as this is the most time-consuming compliance requirement. NASSCOM has published an EU AI Act readiness toolkit specifically for Indian IT companies that provides templates for the system inventory and risk classification process.

Can Indian IT companies claim they are not the "provider" of AI used by EU clients?

The EU AI Act's definition of "provider" is broad: any legal person who develops an AI system with the intention of placing it on the market or putting it into service under their own name. If an Indian IT company builds and brands an AI system that is then deployed for an EU client, it is the provider. If it operates a white-labelled AI system built by a third party (such as a LLM API) for an EU client's use, it may be the "deployer." Both providers and deployers have obligations under the EU AI Act, though providers bear the primary compliance burden for high-risk systems.

Conclusion

The EU AI Act is not a European regulatory curiosity. It is a direct compliance requirement for a substantial portion of India's IT export industry. Indian IT companies that serve European clients and have AI components in their service delivery must complete risk classification, establish compliance programmes for high-risk systems, and build the technical documentation and governance capabilities the Act requires.

The good news is that much of the EU AI Act's compliance infrastructure, risk management, transparency, human oversight, and documentation, overlaps with responsible AI best practices that Indian enterprises should be implementing anyway. Starting compliance preparation now, before enforcement actions begin, is significantly cheaper than remediation after a regulatory finding.

For EU AI Act compliance support combined with DPDPA, explore our AI Consulting Services or read our full guide on AI Governance for India: DPDPA and EU AI Act.