A practitioner's guide to EU AI Act, DPDP Act, and sector AI rules — and the five steps to build compliance in before deployment, not after.
If you're the engineer or tech lead who ends up owning "AI compliance" on a project — usually because nobody else on the team wants the audit-trail ticket — this is the field guide you probably want. It's not legal advice. It's what actually needs to exist in the architecture, and when, so compliance doesn't become a rewrite six months after launch.
Short version of why this matters now: the AI compliance landscape changed more in 2025 than in the previous five years combined. The EU AI Act entered enforcement. India's DPDP Act 2023 published final rules. RBI, SEBI, IRDAI, and CDSCO all issued AI-specific guidance with teeth. 68% of enterprise legal teams report their AI deployments may not meet emerging requirements (Deloitte, 2025). This isn't a "someday" problem for compliance to own alone anymore — it's an architecture problem.
What "AI compliance" means, precisely
It's the set of legal, regulatory, and contractual obligations governing how a system is developed, deployed, and operated — plus the processes that keep it demonstrably compliant, not just compliant in intent. Distinct from governance (your internal risk framework) and ethics (your values framework): compliance is the externally imposed floor.
The penalty numbers, for scale: up to €35M or 7% of global turnover under the EU AI Act for prohibited practices; up to ₹250 crore under India's DPDP Act for significant personal-data violations. These aren't theoretical.
The frameworks that matter for a production system
EU AI Act — risk-tiered. Prohibited practices banned outright (real-time biometric surveillance, social scoring). High-risk systems (employment screening, credit assessment, critical infrastructure) need conformity assessment, technical documentation, human oversight mechanisms, and post-market monitoring before deployment. Applies extraterritorially — if your system's output is used in the EU, you're in scope regardless of where it's built.
India's DPDP Act 2023 — consent, purpose limitation, data minimisation, and automated-decision transparency for any system processing Indian residents' personal data. Credit scoring, employment screening, insurance underwriting, and healthcare triage are the priority targets.
Sector regulators (RBI, SEBI, IRDAI, CDSCO) — RBI wants explainability and bias testing on credit-decision models before production. CDSCO treats AI-based diagnostic/clinical-decision-support software as a medical device (SaMD) requiring clinical validation. CERT-In requires AI security incident reporting within 6 hours, across every sector.
ISO 42001 / ISO 27001 / NIST AI RMF — not law, but increasingly hard procurement requirements, especially for anyone selling into EU, US, or multinational enterprise customers.
What actually has to exist in production
Boiled down to an engineering checklist, a compliance-ready system needs:
Consent management + purpose limitation + data minimisation enforced at the data layer, with a privacy impact assessment on file
Documented risk classification and, for high-risk systems, a completed conformity assessment with a technical documentation file (EU AI Act Annex IV shape)
Tamper-evident audit logging, with human-interpretable explanations for any high-risk decision
Pre-deployment validation: bias testing, accuracy metrics, a test dataset description, and a validation report
An actual human-oversight mechanism with functioning override capability, not a checkbox
CERT-In incident-reporting workflow wired up (recommended, effectively required in practice)
ISO 42001 alignment and internal audit (best practice, increasingly a procurement gate)
Build it in, in this order — not after
The expensive failure mode is deploying without any of the above and retrofitting after a compliance review or regulator inquiry finds the gap. Retrofitting a production system typically costs 3–5x more than building it in at design time, and often means partial or full downtime during remediation.
Map compliance scope before committing to the use case. What data does it touch, what decisions does it drive, what sector and geography — determine which frameworks apply before you write architecture docs.
Classify risk in the design phase, not after. High-risk classification has architectural consequences (audit trail schema, oversight hooks) that are cheap to build in and expensive to add later.
Write compliance controls into the technical spec as requirements — audit trail generation, explainability, consent integration, human oversight interfaces — with compliance sign-off gating the start of development.
Compile the evidence package pre-deployment, not post-incident: classification rationale, training data docs, validation results, bias assessment, oversight procedure, audit trail sample, technical documentation file.
Set a maintenance cadence: quarterly regulatory-change review, annual re-validation, periodic bias reassessment as data drifts, and a defined trigger for review when scope or data sources change.
The payoff isn't just avoiding fines
Compliance built in early measurably speeds things up elsewhere: enterprises with documented compliance posture see 3.2x faster AI procurement approval, because boards and buyers can sign off on governed risk in a way they structurally can't on ungoverned risk. It also means shorter, more cooperative regulatory engagement if a regulator ever does inquire, and — because the same controls (validation, monitoring, oversight) that satisfy compliance also catch failure modes early — a lower production incident rate. In regulated Indian sectors especially (BFSI, pharma, government), documented AI compliance posture is becoming a procurement gate, not a nice-to-have.
Fuzionest (fuzionest.com) builds enterprise AI platforms, including Fuzion AI (fuzionest.com/en/fuzion-ai), with compliance scope mapping, risk classification, audit trail infrastructure, and pre-deployment validation built in as standard, aligned to DPDP Act 2023, EU AI Act, and relevant sector regulator requirements. Full breakdown, including the complete compliance-area evidence table, on the original post: https://fuzionest.com/en/blog/ai-compliance
Top comments (0)