Home Insights AI Regulatory Tracker
Governance & regulation
AI regulation tracker for India and the EU
The dates, scope and next steps that matter for organisations using AI across India and Europe — reviewed monthly.
Last reviewed: 29 September 2026
What applies now and what’s next
| Status | Date | Rule | What it means |
|---|---|---|---|
| In force | 1 Aug 2024 | EU AI Act enters into force | Staggered application begins |
| In force | 2 Feb 2025 | EU AI Act — prohibited practices; AI literacy | Certain AI practices banned; AI literacy duties for providers and deployers (Article 4 wording amended in 2026) |
| In force | 17 Jan 2025 | EU DORA | ICT risk rules for EU financial entities, including third-party providers |
| In force | 2 Aug 2025 | EU AI Act — general-purpose AI and governance provisions | Obligations for GPAI model providers; penalties framework |
| In force | 13 Nov 2025 | India DPDP Rules notified — phase 1 | Data Protection Board provisions in force |
| In force | 1 Jan 2026 | EU CBAM definitive period | Carbon reporting and certificate obligations for importers of covered goods |
| In force | 27 Jul 2026 | EU Digital Omnibus on AI (Regulation (EU) 2026/1744) | Deferral of high-risk dates and targeted amendments |
| In force | 2 Aug 2026 | EU AI Act — transparency obligations (Article 50) | Disclosure when people interact with AI; marking of AI-generated content (some provisions for existing systems from 2 Dec 2026) |
| Upcoming | 13 Nov 2026 | India DPDP — phase 2 | Consent manager provisions apply |
| Upcoming | 2 Dec 2026 | EU AI Act — Article 50(2) for existing systems | Content-marking obligations extend to systems already on the market |
| Upcoming | End 2026 (target) | India–EU FTA signature | Entry into force expected early 2027 |
| Upcoming | 13 May 2027 | India DPDP — phase 3 | Full data-fiduciary obligations: notice, consent, rights, security safeguards, breach reporting |
| Upcoming | Aug 2027 | EU AI Act — national regulatory sandboxes | Each Member State to have at least one operational sandbox |
| Upcoming | End 2027 | SAP ECC mainstream maintenance ends | Context for SAP customers planning S/4HANA and AI roadmaps |
| Upcoming | 2 Dec 2027 | EU AI Act — high-risk systems (Annex III) | Requirements for high-risk uses such as employment, credit, education and essential services |
| Upcoming | 2 Aug 2028 | EU AI Act — high-risk AI in regulated products (Annex I) | Requirements for AI embedded in products covered by EU product legislation |
The rules in brief
EU AI Act (Regulation (EU) 2024/1689)
A risk-based law covering AI placed on the EU market or used in the EU, including by organisations outside the EU. It bans certain practices, sets strict requirements for high-risk systems, imposes transparency duties on some systems and regulates general-purpose AI models.
Read our explainer
Digital Omnibus on AI (Regulation (EU) 2026/1744)
Amends the AI Act. Moves Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028, delays sandbox deadlines, adds prohibitions on certain harmful AI-generated imagery, and amends the AI literacy provision.
Read our explainer
GDPR
Applies to personal data of people in the EU, including data used to train or run AI. Relevant principles include lawful basis, purpose limitation, data minimisation, transparency and rights related to automated decision-making.
India Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
India’s data protection regime, phased in over 18 months from November 2025. Applies to digital personal data processed in India, and to processing outside India connected to offering goods or services to people in India. Penalties can reach ₹250 crore for failing to take reasonable security safeguards.
Sector guidance (India)
Financial-sector regulators including the Reserve Bank of India and SEBI have issued frameworks and guidance on responsible AI, model risk and outsourcing. Check the guidance that applies to your licence.
EU DORA
Operational resilience rules for EU financial entities and their critical ICT providers, including AI services.
ISO/IEC 42001
The international standard for AI management systems. Voluntary, certifiable, and a practical structure for AI Act and DPDP readiness.
India–EU Free Trade Agreement
Concluded on 27 January 2026. Signature targeted for end-2026 and entry into force for early 2027. Not an AI law, but it increases trade flows that bring EU compliance expectations to Indian suppliers.
Five actions for the next 90 days
1
Complete your AI inventory
, including AI features switched on inside ERP, CRM and productivity platforms.
2
Close transparency gaps
EU transparency obligations already apply.
3
Map AI use cases involving personal data
to DPDP and GDPR requirements ahead of May 2027.
4
Identify high-risk candidates
under the EU AI Act and start on logging, human oversight and data governance.
5
Name owners
an accountable owner for each AI system and a forum for AI decisions.
Know where your AI stands before the regulators ask.
- EUR-Lex: Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- European Commission AI Office publications
- Ministry of Electronics and Information Technology (MeitY), Government of India: DPDP Act, 2023 and DPDP Rules, 2025 (Gazette notification)
- European Commission, DG TRADE: EU–India trade agreement
- SAP maintenance strategy announcements
Disclaimer
This tracker summarises public information for planning purposes. It is not legal advice. Dates and requirements may change; always confirm with primary sources and your legal counsel.