The EU AI Act and India's rules for security teams
What the EU AI Act and India's data and cyber rules mean for teams that secure AI, in general terms. Always confirm current rules with legal counsel.
In 60 seconds
The EU AI Act and India's rules for security teams
What the EU AI Act and India's data and cyber rules mean for teams that secure AI, in general terms. Always confirm current rules with legal counsel.
The EU AI Act: a risk-based approach
| Category | Meaning, in general terms | Examples of the kind of use |
|---|---|---|
| Prohibited | Practices considered unacceptable, banned | Certain manipulative techniques, and social scoring of the kind the Act describes |
| High-risk | Allowed, with strict requirements | Certain uses in areas such as employment, education, credit and essential services, and some safety components |
| Limited risk (transparency) | People must be told | Chatbots telling users they are AI; labelling certain AI-generated content |
| Minimal risk | No specific new obligations | Spam filters, AI in games |
What matters most to security teams
- High-risk systems must meet requirements for accuracy, robustness and cybersecurity, including resilience against attacks such as data poisoning, adversarial examples and model flaws.
- Risk management, data governance, logging, technical documentation and human oversight are also required for high-risk systems. Your AI-BOM, pipeline controls and logs become evidence.
- Serious incidents involving high-risk systems must be reported to authorities.
- Providers of general-purpose AI models with systemic risk have additional duties, including cybersecurity protection.
Why Indian companies should care
India: data, cyber and sector rules
| Rule or body | What it means for AI security, in general terms |
|---|---|
| Digital Personal Data Protection Act, 2023 | Applies when AI systems process digital personal data: notice, consent, purpose, security safeguards, breach handling and people's rights. Detailed rules and timelines are set by the government. |
| Information Technology Act, 2000 | India's main law on electronic records, cyber offences and intermediaries, with rules made under it. |
| CERT-In | India's national agency for cyber security incident response. Its 2022 directions require certain cyber incidents to be reported to CERT-In within 6 hours of being noticed, and set requirements such as keeping logs. |
| Sector regulators | Regulators such as RBI, SEBI and IRDAI issue cyber security and technology rules for their sectors, and increasingly discuss AI. Check what applies to you. |
A practical approach
- 1
Inventory
Know which AI systems you build, buy and sell, and where their users are. - 2
Classify
With legal counsel, decide which rules and categories apply to each. - 3
Map controls
Link each obligation to controls you already have, such as ISO 27001, ISO/IEC 42001 and NIST AI RMF activities. - 4
Fill gaps
Add missing controls: robustness testing, logging, documentation, incident reporting. - 5
Keep watching
Assign someone to track changes to laws, rules and dates.
Watch and read more
Lab
An obligations map for two AI systems, with owners and questions for legal counsel.
The problem
Pick two AI systems: one used inside your company and one sold to or used by customers (real or realistic, such as a resume screener and a customer support bot).
- For each, note: who uses it, where users are, whether it handles personal data, and what decisions it affects.
- Write your first guess of which rules might apply: EU AI Act category, DPDP Act, CERT-In reporting, sector regulators.
- For each, list the security controls that would provide evidence (logs, robustness tests, AI-BOM, incident process).
- Write at least three specific questions for legal counsel.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Why might a resume screening tool be treated very differently from a spam filter under the EU AI Act?Reveal
The Act focuses on the impact on people's rights and safety. Decisions about hiring can seriously affect people's lives, and employment is an area named for high-risk uses. A spam filter has much lower impact, so it is usually minimal risk. The same technology can fall into different categories depending on its use.
Q2An attacker poisons your fine-tuning data and your chatbot starts leaking customer data. Which obligations might this trigger?Reveal
Possibly several at once: a personal data breach under the DPDP Act, a reportable cyber incident under CERT-In's directions, sector regulator notifications, contract duties to customers, and, if an EU high-risk system is involved, serious incident reporting under the AI Act. This is why AI incidents must go through the existing incident process, with legal counsel involved early.
Questions people ask
We are an Indian company with no EU office. Can the EU AI Act still apply?
Possibly. It can apply based on where AI systems are placed on the market or where their output is used, not only where the company is based. Ask legal counsel to assess your products and customers.
Is there one AI law in India?
At the time of writing, India relies on existing laws, such as the DPDP Act and the IT Act, plus government advisories, guidelines and sector regulators' rules, rather than one AI-specific law. This can change, so keep watching.
Does the 6-hour CERT-In reporting apply to every security event?
No. The directions list the kinds of incidents that must be reported. Your incident response team and legal counsel should know the current list and process, and AI incidents should flow into the same process.
Where can I read the official texts?
Read official sources: the European Commission's pages on the AI Act, CERT-In's website for its directions, and official Government of India sources for the DPDP Act and its rules. Avoid relying on summaries alone.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.