The EU AI Act reached its general date of application on 2 August 2026, and GDPR still governs every transfer of personal data outside the EEA. Neither rule prevents outsourcing AI development to India; both require you to do it deliberately. This guide sets out the rules that matter, the contract and architecture choices that satisfy them, and a checklist for French and Italian buyers.
What changed for European buyers
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. Prohibited practices and the AI literacy duty have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. Under the text as adopted, most remaining provisions, including the Annex III high-risk requirements and the transparency rules, apply from 2 August 2026, while high-risk AI built into products covered by EU product legislation follows on 2 August 2027. In November 2025 the European Commission proposed a "digital omnibus" package that would push back some high-risk deadlines, so check the current consolidated text on EUR-Lex before fixing a plan around a date.
For companies in Paris, Lyon, Milan and Rome, the practical effect is that compliance has moved from legal's inbox into the engineering roadmap. Offshore contracts increasingly ask vendors to evidence risk management, data governance, logging and documentation, and buyers audit for it.
The two rulebooks, briefly
- GDPR governs personal data. India does not have an EU adequacy decision, so transferring personal data to an India-based team needs another mechanism, typically the Commission's Standard Contractual Clauses, backed by a transfer impact assessment and technical safeguards such as encryption, access control and minimisation. Fines can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
- The EU AI Act governs the AI system by risk tier. A small set of practices is prohibited. High-risk uses, for example in employment, creditworthiness assessment of individuals, education and access to essential services, carry the heavy requirements. Chatbots and AI-generated content carry transparency duties. Most other business applications carry few or no specific obligations. Knowing your tier is step one.
Who is the "provider"?
The AI Act places most obligations on the provider: the organisation that develops a system, or has it developed, and places it on the market or puts it into service under its own name. When a French or Italian company commissions a system from an Indian development partner and deploys it under its own name, the European company is usually the provider, and often the deployer too. The vendor's job is to build in a way that lets the provider meet its duties, with documentation, logs, test evidence and a clear record of data sources. Write that into the statement of work rather than assuming it.
How to outsource to India and stay compliant
- Classify the system under the AI Act before you build. The tier drives architecture, documentation and testing.
- Sign a data processing agreement with SCCs (Module 2 covers controller-to-processor transfers). India's Digital Personal Data Protection Act, 2023 gives Indian vendors a domestic privacy framework to map to, but it does not replace your GDPR obligations.
- Run a transfer impact assessment. Document what data goes where, who can access it, and which safeguards apply.
- Minimise and pseudonymise data that leaves the EEA. Keep raw personal data in-region where possible and send only what the model or engineer needs. Masked or synthetic data is often enough for development.
- Keep the audit trail. Logging, evaluation records, dataset documentation and the human-oversight design are not optional for high-risk systems.
- Plan for incidents. Agree breach notification timelines with the vendor that let you meet GDPR's 72-hour notification duty to the supervisory authority.
The compliant architecture pattern
A common pattern is EU-region infrastructure for data at rest, with the India team building and operating the system through controlled, logged access: named accounts, role-based permissions, just-in-time access to production, and no bulk exports to laptops. The build talent is offshore; the regulated data stays where the regulator expects it. Development and testing run on masked data, and production support happens through audited sessions. This pairs with disciplined MLOps and backend & infrastructure practice. See our guardrails for regulated industries for the controls layer.
Contract checklist for French and Italian buyers
- A DPA with SCCs, a sub-processor list and an approval process for changes.
- Data location commitments for storage and model inference, including any third-party model APIs.
- Access control and logging requirements, with a right to audit.
- AI Act deliverables: technical documentation, risk management records, evaluation results and logging design.
- Breach and incident notification timelines.
- Return or deletion of data at the end of the engagement.
Common mistakes
- Sending a copy of the production database to the vendor "just for testing".
- Forgetting that a third-party model API processing data outside the EEA is itself a transfer.
- Classifying the system after it is built, then discovering it is high-risk.
- Treating the vendor's certifications as a substitute for your own GDPR assessment.
FAQ
Can personal data be accessed from India at all?
Yes, with a valid transfer mechanism such as SCCs, a transfer impact assessment and appropriate safeguards. Remote access from India counts as a transfer, so treat it the same way as copying the data.
Does the AI Act apply if the developer is outside the EU?
Yes, when the system is placed on the EU market or its output is used in the EU. The obligations mainly sit with the provider and deployer, which is usually the European company.
How Velura Labs helps EU clients
Velura Labs builds AI for French and Italian companies with GDPR-aware data handling and AI Act classification built into the AI Strategy & Roadmap. Whether it is document processing or LLM applications, the design accounts for the regulator from day one. Talk to us about a compliance-first build.