Key takeaways
- The Act can apply even with no office in the EU
- Your role as provider or deployer decides your duties
- Start with an inventory and a classification
Does it apply to you?
The EU AI Act can apply to companies outside the EU when they place AI systems on the EU market, or when the output of their AI systems is used in the EU. An Indian SaaS company with a CV screening feature used by a German client is squarely in scope. A Pune services firm that builds a chatbot for a Dutch retailer may be too. If you have European clients, check.
Your role
- Provider: you develop an AI system and place it on the market under your own name.
- Deployer: you use an AI system in your own operations.
Providers carry most of the obligations, especially for high risk systems. Deployers still have duties, such as transparency towards users and proper human oversight. Many Indian companies are both: a provider for the product they sell and a deployer for the tools they use internally.
Risk levels
- Prohibited practices, such as certain manipulative systems and social scoring.
- High risk systems, such as some uses in hiring, credit, education and critical services, with strict requirements.
- Limited risk systems with transparency duties, such as chatbots and AI generated content.
- Minimal risk systems with no specific obligations.
Most business software falls in the last two groups. The work is in proving which group each system belongs to, and writing that reasoning down.
First steps
- List every AI system you build or use, including features inside larger products.
- Classify each one by risk level and by your role.
- For anything high risk, plan risk management, data governance, technical documentation, logging and human oversight.
- Use ISO 42001 or the NIST AI RMF to give the work a structure your clients' auditors will recognise.
Have a question about this guide? Write to us or ask Colony, our AI guide.