If your enterprise has customers, employees or data flows touching the European Union, your India delivery operation is in scope for a set of regulatory instruments that have either activated or materially changed within the past year. Most GCC operators discover this the way most compliance gaps get discovered — when a client's general counsel raises it, mid-engagement, after the entity is already built.
The EU AI Act, amended
The most recent amendment postponed high-risk AI system obligations under Annex III by sixteen months — the obligation still exists, only the timeline moved. What did not move: documentation requirements that are active now. If your GCC modifies or repurposes AI systems for EU-facing clients, exhaustive technical documentation must be available to downstream developers on request. The penalty for non-compliance runs to three percent of worldwide annual turnover or fifteen million euros, whichever is higher.
The Cloud and AI Development Act, proposed
CADA is a proposal, not yet law, but it is the instrument most likely to matter for GCC operators with EU public-sector clients. Its core mechanism: providers of cloud and AI services to critical EU sectors must meet localization and audit standards before deployment. India does not currently hold GDPR adequacy status, which limits how India-based providers can qualify for the higher assurance tiers CADA proposes — a gap that a UAE common-law corridor structure can address for enterprises with material EU exposure.
DORA, already active
The Digital Operational Resilience Act has been in force since January 2025. It applies to financial entities and their critical technology providers, and it requires documented resilience testing at least once a year, network latency service-level documentation and formal third-party risk management. If your enterprise serves EU financial services clients, your India operation is a critical ICT third-party provider under DORA whether or not anyone has labeled it that way yet.
What this means for your assessment
The practical implication is that regulatory scoping belongs in the same conversation as location strategy and entity structure — not a separate legal review bolted on afterwards. We map EU exposure during the assessment phase, before any entity decision is made, precisely because retrofitting compliance architecture onto an already-built center is far more expensive than designing for it from the start.