EU AI Act Fines Are Now Live and Indian AI Companies Must Pay Attention

Europe's AI rulebook has moved from paper to enforcement. Obligations for general-purpose AI (GPAI) providers — the companies behind foundation models and systems built on them — have been in force since 2 August 2025, but the European Commission's power to actually enforce them, with fines attached, began on 2 August 2026, at the end of a one-year grace period. This matters in India because the Act applies across borders: an Indian team that builds on or fine-tunes an AI model and offers it to users in Europe can fall under the law without ever opening an EU office. If your company sells AI features to European customers, here is a plain-English briefing on your exposure and what to do about it.

The Short Answer

Since 2 August 2026, the European Commission can fine GPAI providers that breach the EU AI Act — up to 3% of total worldwide annual turnover (for the preceding financial year), or €15 million, whichever is higher, under Article 101. That is a separate, lighter tier from the headline 7% / €35 million figure, which belongs to Article 99 and applies to prohibited practices such as social scoring — not to GPAI obligations. Indian AI/SaaS companies with EU users must first confirm, in writing, what role they play in the AI supply chain (provider, deployer, or fine-tuner), then assemble the compliance documentation the Act requires, and either sign the GPAI Code of Practice or formally record why they are not signing. India has no domestic equivalent of the GPAI regime — the DPDP Act governs personal data, not model obligations — so exporters must comply with two unrelated regimes at once.

What Changed on 2 August 2026

The EU AI Act rolled out in stages. The GPAI obligations — technical documentation, transparency about training data, and related duties for providers of general-purpose AI models — took effect on 2 August 2025. What changed a year later was enforcement: the grace period ended, and the European Commission gained the power to penalise non-compliance. In practical terms, August 2026 is when the law grew teeth.

A separate development has added to the confusion: alongside the enforcement go-live, a "Digital Omnibus" process deferred some high-risk AI deadlines. The result is a regulatory landscape where one part of the Act is being enforced while other parts are shifting — which makes it more, not less, important for Indian companies to understand exactly which obligations apply to them, rather than assuming the whole Act has been delayed.

The Two Fine Tiers — Do Not Confuse Them

Media coverage often quotes a single scary number. The Act actually has two distinct tiers, and mixing them up misstates your risk:

• GPAI tier (Article 101): up to 3% of total worldwide annual turnover for the preceding financial year, or €15 million — whichever is higher. This is the tier for general-purpose AI model providers that breach their documentation, transparency and related obligations.
• Prohibited-practices tier (Article 99): up to 7% of total worldwide annual turnover, or €35 million — whichever is higher. This applies to banned practices such as social scoring — a much narrower and more serious category.

If your business builds AI features rather than deploying banned surveillance systems, the 3% / €15 million tier is the one that describes your exposure. That is still a very large number for a small company — 3% of global turnover is not a rounding error — but it is the correct number to plan around.

Why an Indian Company Counts as a "GPAI Provider"

The Act is extraterritorial: it follows the AI system to its users, not to the developer's office. Two rules are especially important for Indian teams:

• Offering to EU users is enough. An Indian team that fine-tunes a general-purpose model and makes the result available to EU users is treated as a GPAI provider — no EU office or subsidiary required.
• Material fine-tuning can transfer provider status. If you take an existing model and fine-tune it in a way that materially changes it, you can become the "provider" of the modified model, with the documentation and transparency obligations that follow. Many Indian SaaS startups building vertical AI features on open models sit exactly in this zone.

Note that India's own AI landscape does not prepare you for this: India has no domestic equivalent of the GPAI regime. The DPDP Act — India's data protection law — governs how you handle personal data; it says nothing about model documentation, training-data transparency or the other model-level obligations the EU Act demands. Complying with DPDP does not mean you comply with the EU AI Act. The two regimes are unrelated.

The GPAI Code of Practice: The Easier Route

The EU has published a final GPAI Code of Practice — a voluntary instrument that providers can sign. Signing is not mandatory, but it carries a concrete benefit: signatories get a presumption of conformity with the Act's GPAI obligations and a lighter-touch supervisory route. Non-signatories are not off the hook; they must demonstrate compliance the harder way, evidence by evidence.

For a small Indian company, the Code is worth taking seriously: it converts an open-ended compliance exercise into a defined checklist. If you choose not to sign, record the decision and your reasons in writing — regulators look more favourably on deliberate, documented positions than on gaps discovered later.

Practical Steps: A 4-Point Action Checklist for Indian AI/SaaS Companies

1. Confirm your role in writing. Are you a GPAI provider (building or materially fine-tuning a model), a deployer (using someone else's model in your product), or something in between? Write down the analysis with your reasoning. Roles determine which obligations apply.
2. Assemble your artefacts. GPAI providers must produce technical documentation on their models, including training-data transparency information. Start compiling these now — the documentation is also useful for enterprise customers doing their own due diligence.
3. Sign the GPAI Code of Practice — or formally record why not. Either way, make it a documented board-level decision, not an accident.
4. Pin down your upstream provider. If you build on someone else's model, get their compliance posture in writing — their documentation feeds yours, and their gaps can become your liability.

Finally, keep the two regimes straight in your planning: your DPDP work covers personal data handled by your website and products (our DPDP compliance checklist covers that side), while the EU AI Act covers the models themselves when you serve European users. Budget for both.

It is also worth watching how fast AI adoption is moving at home: OpenAI is training 1.7 crore government employees in AI — a sign that AI literacy is becoming mainstream in India, which makes getting your own compliance story straight even more valuable as a differentiator.

Frequently Asked Questions

Does the EU AI Act apply to my Indian company if I have no EU office?

Yes, potentially. The Act is extraterritorial: if you make an AI model or AI-powered product available to users in the EU — including by fine-tuning a general-purpose model — you can be treated as a GPAI provider regardless of where your company is based.

What is the fine for breaching GPAI obligations?

Under Article 101: up to 3% of your total worldwide annual turnover for the preceding financial year, or €15 million — whichever is higher. The 7% / €35 million figure is a separate tier (Article 99) for prohibited practices such as social scoring.

If I comply with India's DPDP Act, am I covered for the EU AI Act?

No. DPDP governs personal data handling; the EU AI Act's GPAI obligations concern model documentation, training-data transparency and related duties. They are unrelated regimes, and you must address each separately.

Is signing the GPAI Code of Practice mandatory?

No, it is voluntary — but signatories receive a presumption of conformity and lighter-touch supervision. Non-signatories must prove compliance the harder way. Either way, document the decision in writing.

Sources

• AI Tech Connect — "EU AI Act Enforcement Goes Live 2 August: Fines Begin" (editorial published 5 Jul 2026; primary references: European Commission guidance on Chapter V enforcement and Latham & Watkins on GPAI obligations) — https://aitechconnect.in/news/eu-ai-act-enforcement-2-august-2026-gpai-fines

Selling to Europe means meeting European standards — starting with your digital presence. Ready Multi Service helps Indian businesses build professional websites and digital services that stand up to international scrutiny, so your compliance story starts on solid ground.