AMLEGALS — Strategic Lawyering
← Back to EU Hub

Regulation (EU) 2024/1689 Deep Dive

Title IArticles 1–4

Subject Matter & Scope

Article 2: Scope (The Brussels Effect)

The Act applies to providers placing AI systems on the EU market, regardless of establishment location. It also applies where the output produced by the system is used in the Union.

Article 3: Definitions

AI System: A machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that infers how to generate outputs such as predictions, content, recommendations, or decisions.

Title IIArticle 5

Prohibited AI Practices

Practices carrying Unacceptable Risk are banned outright:

✕

Subliminal Manipulation

Techniques to distort behavior and impair informed decision-making.

✕

Social Scoring

Evaluating persons leading to detrimental treatment in unrelated contexts.

✕

Real-time Remote Biometric ID

In public spaces for law enforcement (narrow exceptions).

✕

Emotion Recognition

Banned in workplace and education institutions.

✕

Predictive Policing

Assessing risk based solely on profiling or personality traits.

✕

Untargeted Scraping

Building facial recognition databases by scraping internet/CCTV.

Title IIIArticles 6–50

High-Risk AI Systems

Classification (Art 6)

  • 1. Safety Components: AI used in regulated products (Toys, Cars, Medical Devices).
  • 2. Annex III Systems: Biometrics, Critical Infrastructure, Education, Employment, Law Enforcement.

Core Obligations (Art 8-15)

Risk Management System
Data Governance
Technical Documentation
Record Keeping (Logging)
Transparency
Human Oversight
Accuracy & Robustness
Title VArticles 51–56

General Purpose AI Models (GPAI)

Regulates foundation models (GPT-4, Gemini, Claude). Distinguishes standard GPAI from those with Systemic Risk.

All GPAI Models

  • • Maintain technical documentation
  • • Comply with EU Copyright Law
  • • Publish training content summary

Systemic Risk Models

Threshold: 10²⁵ FLOPs
  • • Model evaluations (Red Teaming)
  • • Assess and mitigate systemic risks
  • • Report serious incidents to AI Office

Penalties

€35M
or 7% Turnover

Prohibited Practices (Art 5)

€15M
or 3% Turnover

High-Risk AI Obligations

€7.5M
or 1.5% Turnover

Incorrect Information

EU AI Act compliance for Indian businesses: questions and answers

What is the EU AI Act and when does it apply?

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases: prohibited AI practices from 2 February 2025 and general-purpose AI model obligations from 2 August 2025, with later phases for other obligations. Where an AI system processes personal data of individuals in India, DPDPA obligations apply in parallel.

How does DPDPA differ from the GDPR?

DPDPA applies only to digital personal data (and non-digital data later digitised), has no separate special-category regime, relies on consent and certain legitimate uses rather than six lawful bases, and uses a schedule-based penalty ceiling in rupees rather than a percentage of turnover. GDPR compliance does not by itself establish DPDPA compliance.

Does DPDPA apply to companies outside India?

The Act applies to processing of digital personal data outside India where the processing is connected with any activity relating to the offering of goods or services to Data Principals within the territory of India. The statutory test is the offering of goods or services within India — not the citizenship or residence of the individual.

Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to EU AI Act compliance for Indian businesses?

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).

Who advises businesses on EU AI Act compliance for Indian businesses under India's DPDPA?

AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on EU AI Act compliance for Indian businesses under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].

What should I send AMLEGALS to get a scoped proposal on EU AI Act compliance for Indian businesses?

Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for EU AI Act compliance for Indian businesses rather than a generic checklist.

How do I get a first view of my DPDPA exposure on EU AI Act compliance for Indian businesses?

Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.

Contact AMLEGALS about EU AI Act compliance for Indian businesses · DPDPA Exposure Assessment