EU AI Act high-risk obligations: preparing data governance, bias evaluation and red-teaming evidence (for India-based teams)

If your AI system is placed on the EU market or its output is used in the EU, the high-risk rules can apply to you even from India. This guide covers the reported dates and the evidence worth building now.

This is a general guide, not legal advice. Confirm your risk classification, dates and obligations with counsel and the official sources linked below.

Dates, as reported

• 2 August 2026: the date originally set in the EU AI Act (Regulation (EU) 2024/1689) for most high-risk obligations to apply.
• December 2027: the European Commission's Digital Omnibus proposal, as reported, would push the application of high-risk obligations for stand-alone (Annex III) systems back to December 2027. Adoption of the Omnibus is unconfirmed at the time of writing. Until it is formally adopted and published, treat the original dates in the Regulation as the legal position.

Sources: Regulation (EU) 2024/1689 on EUR-Lex and the European Commission (commission.europa.eu) for the Digital Omnibus proposal and its status.

The evidence a team needs

Whatever the final dates, the high-risk rules expect data governance for training, validation and testing data, plus testing for bias and robustness. Regulators and EU customers will ask for records, not assurances.

1. Documented training, validation and test data: Where each dataset came from, how it was collected and labelled, what was cleaned or filtered, and the assumptions made about what the data is meant to represent.
2. Representativeness: Evidence that the data fits the intended purpose and the people and settings the system will meet, including Indian languages, dialects and demographics where the system is used on them.
3. Bias evaluation: Examination of the data and model outputs for biases that could harm people, with the groups tested, the method, the results and the mitigations applied, kept as dated records.
4. Adversarial testing: Red-teaming records: the attack and misuse scenarios tried, who tried them, what failed, what was fixed and what was retested.

How data curation and expert evaluation produce that evidence

Data curation. Curated, documented datasets give you the provenance and representativeness records above. Annotation guidelines, reviewer notes and quality checks become part of the audit trail.

Expert-in-the-loop evaluation. Domain experts review model outputs against written criteria, so bias findings and failure cases are recorded with reasoning, not just scores.

Red-teaming. Structured adversarial testing by trained reviewers yields the dated attack, result and fix records. See our note on red-teaming frontier models, and for the Indian side of data handling, DPDP Act training data records.

Where Indika fits

Indika works with a network of 60K+ vetted annotators and experts, is ISO 27001 and SOC 2 Type II audited, and is GDPR compliant. We are independently owned, do not compete with customers' models and do not use customer data to train our own. A no-cost pilot is offered, so you can test an evaluation or red-teaming workflow before committing.