India to EU compliance: what Indian exporters actually have to do

Requirement nodes

23

Questions answered

38

Indian instruments mirrored

15

Read date

2026-08-26

Version

in-export-v1.0.0

• Requirements — one page per EU requirement, with the practical steps and the article references behind them.
• Questions — 38 questions answered in the first paragraph, each linking to the requirement that carries the citation.
• Indian law against EU law — 15 Indian instruments mirrored against the EU act governing the same subject, with the gap stated plainly.

Read in this order. The list follows the sequence in which an exporting company has to settle the questions, not a popularity guess, and every row links to the page that carries the article reference.

1. 01
   EU representative and responsible person

   Nothing may be placed on the EU market without an operator in the Union that can be held to account, and the data side needs a second appointment.

2. 02
   GDPR Chapter V transfers to India

   India has no adequacy decision, so every data flow runs on Standard Contractual Clauses plus a transfer impact assessment.

3. 03
   CE marking and the declaration of conformity

   No body issues a CE approval. The manufacturer declares, and the manufacturer carries the liability.

4. 04
   Conformity assessment routes: Module A, B, C

   The module decides whether a notified body is required, and the module is set by the act, not by preference.

5. 05
   Importer against manufacturer duties

   Roles are allocated by law. A private-label EU buyer inherits the manufacturer's duties, which changes the negotiation.

6. 06
   AI Act provider obligations

   The Act allocates duties by role, not by place of registration, so an Indian developer is the provider.

7. 07
   General Product Safety Regulation

   Since December 2024 the responsible person, traceability elements and accident reporting are mandatory for consumer goods.

8. 08
   Carbon Border Adjustment Mechanism

   Steel, aluminium, cement and fertiliser exporters without installation-level emissions data are priced at conservative default values.

9. 09
   Cyber Resilience Act for connected products

   Security updates for the whole support period, and a 24 hour report to ENISA for actively exploited vulnerabilities.

10. 10
    Indian SaaS and IT services selling into the EU

    Four regimes land at once: GDPR roles, Chapter V transfers, the Cyber Resilience Act and accessibility.

The whole layer is published as one document at /in/index.json: every address, the question it answers, the article references behind it, the Indian instruments mirrored against EU acts, and the read date of each register. One fetch and a reader knows what exists here without crawling the surface. The response carries an ETag, a canonical address and a content hash, so a citation made yesterday can be checked against today.

• Indian companies exporting to the EU — what requirements apply?

  Three layers apply at once, and they are assessed separately. First, an economic operator established in the EU must take responsibility for the product or the data processing. Second, the product or service must meet the substantive Union legislation for its category, which is normally several acts rather than one. Third, sector rules on carbon, deforestation, chemicals or due diligence apply on top, and they are contractual as well as regulatory because the EU buyer is under the same duty.

• India to EU export compliance — where do we start?

  Start by naming the role you occupy in the transaction, because every obligation follows from the role rather than from the place of registration. Manufacturer, provider, exporter or platform each carry a different set. Then list every act that touches the product or service, appoint the EU-side entity each act requires, and only after that build the documentation. Companies that start with documentation end up rebuilding it.

• Do Indian IT services firms need GDPR compliance without an EU office?

  Yes. The GDPR applies by reference to whose data is processed and where the individuals are, not to where the processor sits. An Indian IT services firm, BPO or global capability centre processing EU personal data is a processor with direct obligations under Article 28 and Article 32, and the data reaching India is a Chapter V transfer that needs its own legal basis.

• Data transfers from the EU to India — How does an Indian company lawfully receive personal data from the EU under GDPR Chapter V?
• EU representative and responsible person — Does an Indian company need a representative established in the EU?
• AI Act: provider obligations — Must an Indian AI company comply with the EU AI Act to sell in the EU?
• General-purpose and generative AI models — How does the EU AI Act apply to Indian generative AI and foundation models?
• CE marking for Indian manufacturers — What does CE marking require of an Indian electronics manufacturer exporting to the EU?
• General Product Safety Regulation — How does an Indian manufacturer meet the EU General Product Safety Regulation, and is a responsible person mandatory?
• Cyber Resilience Act — How does an Indian manufacturer meet the EU cybersecurity requirements for connected products?
• Carbon Border Adjustment Mechanism — What CBAM obligations fall on Indian steel, aluminium and cement exporters?
• Deforestation-free supply chains — How does the EU Deforestation Regulation affect Indian suppliers?
• Indian software and SaaS handling EU data — What EU requirements apply to Indian SaaS and software companies selling into the EU?
• EU conformity assessment routes: Module A, B, C and beyond — Which conformity assessment module applies to an Indian manufacturer, and when is a notified body required?
• Importer, distributor and manufacturer responsibilities — Who carries which duty when an Indian manufacturer sells through an EU importer?

No legal text is copied into this register. Each row carries the designation, the article number and a link to the article node in our own register, or to the official EUR-Lex text where the act is not article-indexed here. A read date is written only where the register holds one. The engine reproduces sources; applying them to a specific transaction is the reader's decision, or their counsel's.