EU requirements for Indian exporters: the obligation list

IT services, SaaS, BPO, GCC

How does an Indian company lawfully receive personal data from the EU under GDPR Chapter V?

The European Commission has not issued an adequacy decision for India, so personal data cannot be sent from the EU to India on that basis. The route available is the appropriate safeguards in Chapter V, which in practice means the Commission's Standard Contractual Clauses backed by a transfer impact assessment. This applies to Indian IT services firms, BPOs, GCCs and SaaS vendors alike, whether or not they have an EU office.

All exporters, marketplaces sellers

Does an Indian company need a representative established in the EU?

Yes, in most cases, and often twice over. On the product side, no product may be placed on the EU market unless an economic operator established in the Union can be contacted and held to account. On the data side, an Indian company without an EU establishment that offers goods or services to people in the EU, or monitors their behaviour, must appoint a written GDPR representative. These are two separate obligations discharged by two separate appointments, and the AI Act adds a third for model providers.

AI, machine learning, deep tech

Must an Indian AI company comply with the EU AI Act to sell in the EU?

Yes. The AI Act allocates duties by role, not by place of registration. A company that places an AI system on the EU market or puts it into service there is the provider, even where every stage of research, training and deployment happens in India. What you owe depends on the risk class, and a general-purpose model carries a separate set of duties on top.

Foundation models, LLM developers

How does the EU AI Act apply to Indian generative AI and foundation models?

A general-purpose AI model placed on the EU market carries obligations of its own, separate from the risk classification of any system built on it. The provider must keep technical documentation, give downstream providers what they need to comply, adopt a copyright policy and publish a sufficiently detailed summary of the training content. Models presenting systemic risk carry evaluation, adversarial testing, incident reporting and cybersecurity duties in addition.

Electronics, appliances, hardware

What does CE marking require of an Indian electronics manufacturer exporting to the EU?

CE marking is not a certificate and no body issues a general CE approval. It is a declaration by the manufacturer that the product meets every piece of applicable Union harmonisation legislation. The manufacturer signs it and the manufacturer carries the liability, even where the goods are made in India and sold by an EU importer.

Consumer goods, toys, textiles, furniture

How does an Indian manufacturer meet the EU General Product Safety Regulation, and is a responsible person mandatory?

Yes, the responsible person is mandatory. Since December 2024 no consumer product may be placed on the EU market unless an economic operator established in the Union takes responsibility for it, and the product carries that operator's name and address. The regulation also requires an internal risk analysis, traceability information on the product itself and an accident reporting route through the Safety Business Gateway.

IoT, networking, embedded software

How does an Indian manufacturer meet the EU cybersecurity requirements for connected products?

Any product with digital elements, from a camera or router to an industrial gateway or a piece of software sold separately, must be designed to the essential cybersecurity requirements and supplied with security updates throughout its support period. Actively exploited vulnerabilities and severe incidents must be reported to ENISA and the national authority within twenty-four hours of becoming aware of them.

Steel, aluminium, cement, fertilisers

What CBAM obligations fall on Indian steel, aluminium and cement exporters?

Steel, aluminium, cement, fertilisers, hydrogen and electricity entering the EU carry a reporting duty on embedded emissions, and from the definitive regime a financial charge. The declarant sits on the EU side, but the data can only come from the Indian installation, so the exporter that cannot supply installation-level figures is priced at default values, which are deliberately conservative and therefore more expensive.

Rubber, leather, coffee, timber, furniture

How does the EU Deforestation Regulation affect Indian suppliers?

Commodities covering cattle, cocoa, coffee, oil palm, rubber, soya and wood, and the products derived from them, may only be placed on the EU market with a due diligence statement, and that statement requires the geolocation of the plots of land where the commodity was produced. For Indian rubber, leather, coffee, timber and furniture exporters this means traceability to the plot, not to the trader.

SaaS, software products, IT services

What EU requirements apply to Indian SaaS and software companies selling into the EU?

Selling software into the EU pulls in four separate regimes at once: the GDPR as a processor or controller, the Chapter V transfer rules for the data that lands in India, the Cyber Resilience Act where software is placed on the market as a product, and the accessibility requirements for consumer-facing services. Add the AI Act on top where the product embeds a model.

Electronics, machinery, medical devices, radio equipment

Which conformity assessment module applies to an Indian manufacturer, and when is a notified body required?

CE marking is the outcome; the module is the road you take to it. Union harmonisation legislation sets out the assessment procedures as lettered modules, and each product act names the modules a manufacturer may choose from. Module A is internal production control with no notified body. Module B is EU type-examination by a notified body, always paired with Module C, C1, C2, D, E or F for the production stage. Modules G and H cover unit verification and full quality assurance. The practical question is never whether you like a module, it is which modules your act permits for your product class.

All goods exporters, private label, marketplace sellers

Who carries which duty when an Indian manufacturer sells through an EU importer?

The duties are allocated by role, and the roles are defined in the legislation rather than in your contract. The manufacturer designs, assesses, documents and signs the declaration. The importer verifies that the manufacturer did it, puts its own name and address on the product, and keeps the declaration available for ten years. The distributor checks the markings and the paperwork are present. The trap is role escalation: an importer that sells under its own brand, or modifies the product, becomes the manufacturer in law and inherits the whole set, including the liability.