Indian AI companies close the trust gap abroad by mapping the rules that reach them through customers, such as GDPR transfers, Article 27 representation and the EU AI Act. They then send one counsel-reviewed pack: entity details, data flow map, DPA with standard contractual clauses, AI use statement, assurance and local-time support terms.
The pilot won the room. Then the buyer's privacy counsel asked how EU data would lawfully reach India, and nobody had the answer in writing.
Anyone who has applied to a foreign university knows the moment. The marks are excellent, then the admissions office asks for transcripts in its own format, and the timeline slips by months. Indian AI global expansion meets the same wall: the product wins the pilot, then legal, privacy and security teams ask questions written for their jurisdiction. This guide shows which rules reach you through your customers, what each review team will ask, and how to answer before the questionnaire arrives.
Why Indian AI companies stall in overseas procurement
The stall rarely happens at the demo. It comes after the champion says yes, when people whose role is to find risk take over. They are not asking whether the model is good. They are asking where their data goes, which law governs it and who responds at 3 a.m. their time.
Three causes recur. Distance means a buyer in New York or Frankfurt has less context, so it asks for more written proof. Jurisdiction means European rules reach a non-EU provider through its customers, so being an Indian company is no answer to a GDPR question. Inconsistency means answers given from memory rarely match across calls and contracts, and reviewers compare them line by line. The usual result is a review that drifts past the buyer's quarter end.
Which rules reach you through your customers
Most friction comes from rules your customer must satisfy and passes to you by contract. The table is a planning map, so ask your counsel to confirm each position.
| Rule | How it reaches you | What buyers ask for |
|---|---|---|
| GDPR (EU 2016/679) | Directly under Article 3(2), or as a customer's processor | A DPA, sub-processor list, security measures, possibly an EU representative |
| EU transfer rules | India has no EU adequacy decision | Standard contractual clauses and input for transfer assessments |
| EU AI Act | Applies to providers anywhere whose output is used in the EU | Your role, Article 50 transparency and a high-risk view |
| India's DPDP Act and Rules | Foreign-contract processing largely exempt; security duties still apply | Handling of Indian personal data, where relevant |
| US enterprise requirements | Mostly contractual, driven by sector regulators and policy | SOC 2 Type II report, questionnaire, insurance and incident terms |
Transfers and representation
Sending EU personal data to a country without an adequacy decision requires another safeguard. The European Commission's adequacy list does not include India. An EU customer will therefore usually rely on the standard contractual clauses, model contract terms the Commission modernised on 4 June 2021, attached to your data processing agreement (DPA).
The second question is whether you need an EU representative. Article 27 requires one where Article 3(2) applies, subject to a narrow exemption. The analysis may differ for pure processors, so settle the point once with counsel and record it.
The EU AI Act and India's DPDP regime
The EU AI Act applies to providers placing AI systems on the EU market, wherever they are established. Its Article 50 transparency obligations, such as telling people they are interacting with AI, have applied since 2 August 2026. High-risk obligations under Annex III have been postponed to 2 December 2027.
India's DPDP Rules were notified on 14 November 2025 and phase in over 12 to 18 months. For an overseas buyer, the practical point is simple: your DPDP position does not replace their GDPR position, so lead with theirs.
Build the cross-border evidence pack
The remedy is one pack, written once, reviewed by counsel and sent before the questionnaire. Keep it in a versioned folder with a named owner who updates it whenever anything changes.
- Entity sheet: the signing entity, its registration, acceptable governing law positions and insurance cover.
- Data flow map: where prompts, outputs, logs and backups are stored and processed, by region, including model inference.
- Transfer kit: a GDPR-aligned DPA with standard contractual clauses and a sub-processor list naming every model provider.
- AI use statement: whether customer data trains any model, retention periods and how model changes are notified.
- Independent assurance: a SOC 2 report or ISO/IEC 27001 certificate with scope and dates. If ISO/IEC 42001 is in progress, say so plainly.
- Operating commitments: incident notice in hours and support hours stated in the buyer's time zone.
One contradiction between documents can reopen the whole review, such as sales promising EU data residency that engineering has not built.
A worked example: the support promise that fails on arithmetic
Hypothetical example. A Bengaluru AI company offers a US insurer a four-hour first response for severity-one incidents. Its support desk works 09:00 to 18:00 IST. India is 9 hours 30 minutes ahead of New York during US daylight saving time.
In summer, that desk is open from 23:30 to 08:30 New York time, closing before the insurer's day begins. An incident raised at 10:00 in New York is 19:30 in Bengaluru. Without an on-call rota, the first response arrives at 09:00 IST, more than 13 hours later.
The lesson is not that Indian teams cannot support US customers; many do so well. It is that every commitment should be written in the buyer's time zone and tested against the actual rota. A modest promise kept is worth more than an ambitious one broken.
A readiness scorecard for your next overseas deal
Score each area 0 if missing, 1 if partial or verbal, and 2 if written, counsel-reviewed and current. Run it before any first call with a US or European prospect.
| Area | Scores 2 when | Scores 0 when |
|---|---|---|
| Entity and contract | Signing entity, law positions and insurance confirmed in one sheet | Decided per deal by whoever is on the call |
| Data flow | Storage, inference, log and support access regions documented | The answer is that the cloud is global |
| Transfers | DPA with standard contractual clauses ready | You wait for the buyer's template |
| AI use | Training use, retention and change notice stated in writing | Sales answers verbally |
| Assurance | Current, in-scope report or certificate with dates | Only policy documents exist |
| Operations | Support hours stated in the buyer's time zone | Times appear in IST only |
Most gaps in the first four rows need counsel and engineering, not more sales effort.
The bottom line
Conclusion
The student with excellent marks still needs transcripts in the university's format. Likewise, an AI company with an excellent pilot still needs answers in the buyer's legal language. For Indian AI companies the gap is rarely capability; it is cross-border questions answered late and from memory.
Answer them once, in writing and with counsel, and every overseas review starts from a filed answer. This week, draw your data flow map by region and provider, then check it against your sub-processor list. Most contradictions surface there.
Frequently asked questions
Does GDPR apply to an Indian AI company?
It can apply directly where the company offers services to, or monitors, people in the EU. It also applies through contract when the company processes personal data for an EU customer. Counsel should confirm each case.
Is India covered by an EU adequacy decision?
No. India is not on the European Commission's adequacy list, so EU customers usually rely on standard contractual clauses to transfer personal data to an Indian provider.
Does the EU AI Act apply if I have no office in Europe?
It can. The Act covers providers placing AI systems on the EU market wherever they are established, and providers outside the EU whose system output is used in the Union.
Does the DPDP Act apply when I process foreign customers' data?
Processing non-residents' data under a contract with a person outside India is largely exempt, but some duties, such as reasonable security safeguards, still apply. Counsel should confirm the details.
What documents do US enterprise buyers expect from an AI startup?
Commonly an in-scope SOC 2 report or ISO/IEC 27001 certificate, a completed questionnaire, a sub-processor list, a written statement on training use, incident terms and support hours in the buyer's time zone.
References
- EUR-Lex, General Data Protection Regulation (EU) 2016/679
- European Commission, Adequacy decisions
- European Commission, Standard contractual clauses (SCC) for international transfers (adopted 4 June 2021)
- EUR-Lex, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Annex III (2024)
- European Commission, Transparency obligations under Article 50 of the AI Act
- Gibson Dunn, EU AI Act Omnibus: postponed high-risk deadlines
- The Week (PTI), Govt notifies DPDP Rules, phased over 12 to 18 months
- Morgan Lewis, India enacts new privacy law: the Digital Personal Data Protection Act (August 2023)
- Secureframe, SOC 2 Trust Services Criteria explained
- ISO, ISO/IEC 27001 Information security management
- IEC Webstore, ISO/IEC 42001:2023 Artificial intelligence management system
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.