EU AI Act compliance India is the work an exporter does when a European buyer treats the model as in scope. The Act has been in force since 1 August 2024. Most Annex III high-risk duties have applied since 2 August 2026. ISO 42001 gives you a management system and evidence. It does not create a presumption of conformity.

A buyer in Munich sends a questionnaire, not a lecture. EU AI Act compliance India, for a product firm in Gurugram or Bengaluru, usually starts as that PDF. The policy helps only when it names a live system, an owner and a test record.

Prohibited practices have applied since 2 February 2025. GPAI obligations have applied since 2 August 2025. Most Annex III obligations have applied since 2 August 2026, so they apply on 31 October 2026. Some product-legislation duties run later, into 2027. If the model has no owner, EU AI Act compliance India does not start. A blank owner column is the first gap.

What EU AI Act compliance India requires before a European buyer samples the file

On a practical file, EU AI Act compliance India means three things you can show without a speech. Which systems are in scope. Who owns each one. Which record shows how it was tested. An AI system that is already in production needs an owner, a purpose, and a record of how it was tested.

Treat EU AI Act compliance India as a scope decision before it is a writing project. List what you build, what you buy and what staff paste into a browser. A vendor copilot on customer text stays in the inventory. A sandbox that never left one laptop can be marked out of production, with a date and a name.

Your counsel still classifies provider and deployer. They are not the same seat. EU AI Act compliance India inside the company is the inventory, the AI risk assessment and the AI impact assessment a buyer can read. The legal memo can sit beside that file. It should not replace it.

Most duties for high-risk AI systems in Annex III have applied since 2 August 2026. High-risk AI systems are not every model you run. A hiring model sold into a European HR stack can fall into high-risk AI systems. An internal meeting summary usually does not. Some product-legislation duties for high-risk AI systems run later, into 2027.

The AI Act for exporters is usually a procurement question before it is a fine. Read the AI Act for exporters against the contract annex. An AI Act for exporters pack that a Gurugram product firm can actually send is short: system list, owner, purpose, data, test record, incident path.

Roles, stop lists and the GPAI date

Prohibited practices have applied since 2 February 2025. The AI Act for exporters starts with that stop list. If a feature sits on the banned side, stop it and name who stopped it.

GPAI obligations have applied since 2 August 2025. If you place a general-purpose model on the EU market, the AI Act for exporters includes those duties, separate from Annex III. If you only wrap someone else’s model, write that role in the inventory row.

The AI Act for exporters does not care that an ISO 27001 certificate is framed in the lobby. ISO 27001 governs information security. It is not an AI management system. A buyer who asks how the model was tested will not accept the security certificate as the answer.

Your inventory should mark which entries are high-risk AI systems, which are not, and which are waiting on counsel. If you only deploy high-risk AI systems bought from someone else, say so in the row. The provider’s technical file is not your oversight record.

Testing records matter most for high-risk AI systems. An accuracy slide is not a validation record. High-risk AI systems with no person who can stop them fail a buyer review and a Stage 2 sample.

How EU AI Act compliance India uses an AI management system

ISO/IEC 42001:2023 is the AI management system, the AIMS. Clauses 4 to 10 set the cycle. Annex A has 38 controls, from A.2 through A.10. A certification body issues the certificate after Stage 1 and Stage 2. Seven Step Consulting does not issue ISO certificates.

EU AI Act compliance India does not get shorter because the manual is thick. The Statement of Applicability records which Annex A controls apply and why. A one-line “not applicable”, with no reason, is a weak answer for a buyer.

People search EU AI Act ISO 42001 because they want one file for the auditor and the buyer. EU AI Act ISO 42001 is a pairing, not a legal shortcut. The standard gives you a management system, an inventory and evidence. The Act keeps its own duties and, for some products, its own conformity path.

Use EU AI Act ISO 42001 when you need an AI risk assessment and an AI impact assessment that a European security review can sample. ISO/IEC 23894:2023 guides the risk work. ISO/IEC 42005 guides the impact work. Do not tell a buyer that EU AI Act ISO 42001 equals conformity. ISO 42001 does not by itself create a presumption of conformity.

A Statement of Applicability belongs in a serious EU AI Act ISO 42001 file. EU AI Act ISO 42001 evidence has to be the same records Stage 2 will sample. For a product firm, EU AI Act ISO 42001 work is often the AIMS plus a short mapping note for the questions the buyer asked.

When procurement asks for the EU certificate, be precise. EU AI Act compliance India is not delivered by the ISO mark alone. Check the body’s current scope on the NABCB or IAF directory before you book. This article names no bodies. An accredited ISO 27001 mark does not answer EU AI Act compliance India.

What the management system does not replace

A conformity assessment, where the Act requires one, is not a management-system audit. A notified body, where the product law requires one, is not your certification body. The AIMS shows you run the work. It does not stand in for a product assessment the Act demands.

The DPDP Act, 2023, and the DPDP Rules, 2025, are a separate clock. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force. Personal data in training sets, prompts and outputs still needs an owner and a purpose. EU AI Act compliance India still needs that purpose and that record when the same data is in the model.

Keep one mapping. EU AI Act ISO 42001 notes that live only in slide folders will not match the record an auditor samples.

A spreadsheet named Final_v7, with scores and no owner column, is not an inventory. If that sheet ranks candidates or claims, it is a system. Leaving it off makes EU AI Act compliance India look tidy and fail the first buyer question. A model with no owner fails a Stage 2 sample the same way.

What the work costs in 2026 market ranges

Every rupee figure below is a 2026 India market range for one legal entity. It is not a Seven Step rate card. Staff time is the cost people forget.

For a startup or a single-product exporter, consulting that carries EU AI Act compliance India often sits between ₹4 lakh and ₹8 lakh. The certification body invoices Stage 1 and Stage 2 separately, about ₹2 lakh to ₹8 lakh, driven by headcount and sites. That audit range is a market range, not a Seven Step fee.

A mid-market exporter with several models should read EU AI Act compliance India against a consulting market range of ₹8 lakh to ₹15 lakh. A bank, an insurer, a GCC or a multi-site firm often sees EU AI Act compliance India work in a consulting market range of ₹15 lakh to ₹30 lakh, and sometimes more. A gap review often falls between ₹1.5 lakh and ₹4 lakh as a 2026 market range, not a Seven Step fee.

EU AI Act compliance India mapped against an ISO 42001 inventory for exporters
Profile Consulting market range Audit invoice market range What else the Act still needs
Single-product exporter, one site ₹4 lakh to ₹8 lakh about ₹2 lakh to ₹8 lakh Role note, buyer mapping, one system
Several models, mid-market ₹8 lakh to ₹15 lakh about ₹2 lakh to ₹8 lakh More impact notes and named owners
Bank, insurer, GCC, multi-site ₹15 lakh to ₹30 lakh, sometimes more about ₹2 lakh to ₹8 lakh Legal review, sites, model risk

A quote PDF that promises EU coverage in one line is not an AI Act for exporters plan. Ask which systems, which role and which dates sit inside the fee. The AI Act for exporters still expects the file to stay current when the model changes.

After the certificate, budget a surveillance audit. Annual surveillance is often around 40 percent of the initial audit fee, for two years, then recertification around year three. That is a market pattern, not a Seven Step fee. A surveillance year that drops the model the buyer still uses is a hole in EU AI Act compliance India. Implementation often takes 3 to 6 months, depending on size, AI maturity and how many systems are in scope. A focused firm with a small inventory can be audit-ready for Stage 1 in about 90 days if leadership shows up. That is readiness, not a certificate.

Staff weeks sit outside the table. EU AI Act compliance India includes the time your engineers spend on logs, test notes and the owner column.

Book the review before the annex goes red

EU AI Act readiness review is the right first step when a buyer has already sent the form. We will look at the systems in the annex, the tools staff actually use, and the dates that already apply. Write through the contact page: https://www.sevenstepconsulting.com/contact-us/

Questions people ask before they buy

Does an ISO 42001 certificate prove compliance with the Act?

No. The certificate shows a certification body sampled your AIMS. It does not prove EU AI Act compliance India. EU AI Act ISO 42001 does not replace a conformity assessment the Act requires for certain products. The standard does not create a presumption of conformity.

Which systems should an Indian exporter list first?

Start with the systems a European customer can touch. That is the practical edge of EU AI Act compliance India. Then add tools that see personal data or decide something about a person. Guessing that you have no high-risk AI systems is how exporters get surprised in a security review.

Have all high-risk duties already started?

Most Annex III obligations have applied since 2 August 2026. Prohibited practices have applied since 2 February 2025. GPAI obligations have applied since 2 August 2025. Some product-legislation duties run into 2027. Ask which annex or product law your system sits under before you tell the board the work is finished.

What should a fixed-fee quote list?

Name the legal entity, the sites and the AI systems, or cap the count. State whether the fee includes the inventory, the Statement of Applicability, the AI risk assessment and the AI impact assessment. Put certification body fees and legal opinions outside the fee. Every rupee band here is a 2026 market range, not a Seven Step fee.

If you already hold ISO 27001, is that enough for a European AI review?

ISO 27001 does not cover the model. You still need an inventory, an AI risk assessment, an AI impact assessment and a Statement of Applicability for Annex A. The AI Act for exporters reaches Indian firms through the customer, the contract and, where you place a system on the EU market, through the Act itself.

Send the file, not a slogan

If the questionnaire is already in your inbox, do not answer it from a slide. Book an EU AI Act readiness review. We will separate legal classification from the management-system evidence so EU AI Act compliance India is a file you can defend.