EU AI Act and Offshore Software Development: 2026 Guide

The EU AI Act covers offshore software development when the AI system is placed on the EU market or its output is used in the EU. Offshore vendors must support the provider with documentation, data records and testing under a written agreement, and need an EU representative if they sell their own high-risk AI.

Say you run a 40-person engineering team in Dhaka, Pune or Ho Chi Minh City. A German HR-tech client asks you to build a CV screening feature. Two years ago, that was a normal sprint. Under the EU AI Act, it is a high-risk system with a legal paper trail attached.

This guide covers what the Act asks of offshore teams and what changed in 2026. It also covers how European companies see it, and which records to keep. It is written from inside an offshore software company in Dhaka.

• The AI Act reaches non-EU companies whose AI systems or AI output are used in the EU (Article 2).
• In most outsourced builds the EU client is the provider, and the offshore vendor is a supplier bound by a written agreement under Article 25(4).
• The 2026 Digital Omnibus moved stand-alone high-risk duties to 2 December 2027; transparency duties still apply from 2 August 2026.
• Fines reach EUR 35 million or 7% of worldwide turnover for prohibited practices.
• About 20% of EU enterprises used AI in 2025, up from 13.5% in 2024, per Eurostat.
• Offshore vendors should keep an AI register, documentation packs, data records, logs, model supplier records and AI literacy training records.

Does the EU AI Act Apply to Offshore Software Companies?

Yes. The Act applies to any provider placing an AI system on the EU market. It also covers non-EU providers and deployers whose AI output is used in the EU. Article 2 sets that reach, and your office address does not change it.

The test is where the system is used. A chatbot built in Dhaka for a Dutch bank is in scope. So is a hiring tool built in Kyiv for a Swedish retailer. A forecasting script built in Manila for an Australian client with no EU users is out of scope.

EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law on artificial intelligence. It sorts AI systems by risk into prohibited, high-risk, limited-risk and minimal-risk tiers, and sets duties for providers, deployers, importers and distributors, including companies based outside the EU.

If this sounds like GDPR, that is deliberate. The EU used the same long-arm model. Offshore vendors met GDPR through data processing agreements and Standard Contractual Clauses. The AI Act is arriving the same way: through your client's contract and procurement checklist.

What Changed in 2026, and Which Deadlines Apply Now?

The Digital Omnibus on AI changed the timeline in 2026. It moved stand-alone high-risk obligations from 2 August 2026 to 2 December 2027. High-risk AI built into regulated products moved to 2 August 2028.

The European Commission first refused to pause anything. In July 2025 it said there would be no "stop the clock". By November 2025 it had proposed the Omnibus. Parliament and Council agreed a deal in spring 2026 and formally adopted it in June 2026.

Several dates stayed put. Bans on prohibited practices have applied since February 2025. Rules for general-purpose AI models have applied since August 2025. Transparency duties for chatbots and generated content apply from 2 August 2026.

7% of worldwide annual turnover, or EUR 35 million if higher, is the top fine for prohibited AI practices

Sources: European Parliament: AI Act simplification deal

Who Is the Provider When an Offshore Team Builds Your AI?

In most outsourced projects, the EU client is the provider. The provider is whoever places the system on the market under its own name or trademark. If your client ships the product under its brand, the main legal duties sit with the client.

The vendor still has work to do. Article 25(4) covers suppliers of tools, components and services used in high-risk AI. They must agree in writing on the information, access and help they give the provider.

The role can also move. Under Article 25(1), a company becomes the provider if it puts its name on a high-risk system. The same happens after a substantial change, or a new purpose that makes the system high-risk. Offshore firms that resell white-label builds should read that clause twice.

When Does an Offshore Vendor Need an EU Authorised Representative?

A vendor needs one when it sells its own high-risk AI system, or a general-purpose AI model, into the EU. Article 22 requires a written mandate with a representative based in the EU. Article 54 sets the same rule for general-purpose model providers.

The representative keeps your documentation available for regulators. It must also end the mandate and tell the authority if it believes you are breaking the rules. Pick one that will actually read your files.

Which Offshore AI Projects Fall Into Each Risk Tier?

Most offshore AI work lands in the limited-risk or minimal-risk tiers. Chatbots, voice agents, content tools and forecasting models make up the bulk of outsourced AI. High-risk work is a smaller share, but it carries most of the paperwork.

• Prohibited: untargeted scraping of faces to build recognition databases. Clearview AI built exactly that. The Dutch data protection authority fined it EUR 30.5 million in 2024 under GDPR. Under the AI Act it is banned outright.
• High-risk: CV screening and candidate ranking. Reuters reported in 2018 that Amazon scrapped a recruiting model after it learned to downgrade CVs mentioning the word "women's". A high-risk file exists to catch that bias before launch.
• High-risk: credit scoring, life and health insurance pricing, exam proctoring and student assessment.
• Limited risk: customer service chatbots, AI voice agents, and tools that generate text or images. Users must be told they are dealing with AI.
• Minimal risk: demand forecasting, spam filters, search ranking and code completion.

Classification is harder than the list suggests. In 2023, appliedAI checked 106 enterprise AI systems against draft versions of the Act. For 40% of them, the risk tier was unclear.

The unclear cases clustered in hiring, critical infrastructure and product safety, per the same study. For an offshore team, the risk call belongs at the start of the project. Put it in writing and get the client to sign it.

What Should an Offshore Software Company Maintain for AI Act Work?

An offshore company should maintain eight sets of records. Each one answers a question an EU client or regulator will ask. Start with the first two this quarter, then add the rest per project.

1. An AI Register

List every AI feature you build or run. Record the client, purpose, risk tier, model used, and who signed off the tier. Update the entry when the purpose changes. A shared spreadsheet is enough on day one.

2. Contracts That Name the Roles

Each statement of work should say who the provider is, who the deployer is, and what the vendor hands over. Most outsourcing master agreements predate the Act and say nothing on this. An AI annex fixes it without reopening the whole contract.

3. A Documentation Pack per System

Annex IV lists what a high-risk technical file contains: purpose, design, data, testing and known limits. Build that pack during the project. Providers must keep it for 10 years under Article 18, so it has to outlive your project team.

4. Data Governance Records

Article 10 asks for training, validation and test data that is relevant, representative and checked for bias. Record data sources, cleaning steps, labelling rules and known gaps. Keep each client's data separate.

5. Logging Built Into the Product

High-risk systems must record events automatically. Providers and deployers keep those logs for at least six months. Design the log schema in the first sprint, while it is still cheap to change.

6. Human Oversight in the Interface

Give operators a way to review, override and stop the system. Show confidence levels where they help a person decide. Write down why each control exists, because the provider's file will need it.

7. A Model Supplier Register

Most offshore AI work wraps a model from OpenAI, Anthropic, Google or Mistral. Record the model, the version, and the provider's published documentation. General-purpose model providers have owed that documentation downstream since August 2025.

8. AI Literacy and Incident Training

AI literacy has been part of the Act since February 2025. The 2026 Omnibus talks softened how that duty is framed, but EU procurement teams still ask for proof. Keep training records per engineer.

Train project leads on incident escalation too. Providers must report serious incidents within 15 days, and in the worst cases within 2. Your client cannot meet that deadline if you tell them late.

20% of EU enterprises with 10 or more staff used AI in 2025, up from 13.5% in 2024. Among large enterprises the figure was 55%. Eurostat, December 2025

That growth is why these records matter to vendors. Every new EU AI project brings the Act's questions with it, and many of those projects are outsourced.

How Does the AI Act Sit Next to GDPR?

Both apply at once. GDPR covers the personal data, and the AI Act covers the system that uses it. Italy's data protection authority fined OpenAI EUR 15 million in December 2024 under GDPR alone.

Keep your data processing agreement and Standard Contractual Clauses current. Expect clients to ask for help with data protection impact assessments as well as AI documentation.

How Do European Companies See the EU AI Act?

European companies are split. Most large firms accept the goal, but many object to the timing and the cost. The loudest objections came from Europe's own industrial leaders.

• In July 2025, more than 40 European CEOs signed an open letter asking for a two-year "stop the clock" pause. Signatories included Airbus, ASML, Lufthansa, Mistral and Philips.
• The same month, Siemens CEO Roland Busch and SAP CEO Christian Klein called for the Act to be revised. Their argument: the rules slow down European AI work.
• Swedish Prime Minister Ulf Kristersson publicly backed a pause in mid-2025.
• Meta refused to sign the voluntary Code of Practice for general-purpose AI in July 2025, saying it went beyond the Act. Google, Microsoft, OpenAI, Anthropic and Mistral signed it.

The pressure worked in part. The Omnibus delayed the heaviest rules by 16 months. It kept the bans and transparency duties, and it added a new ban on AI that creates non-consensual intimate images.

How Are European Companies Putting the AI Act Into Practice?

Large European companies are implementing the Act through AI inventories, supplier checks and contract changes. The order mirrors GDPR in 2018: a register first, then policies, then supplier terms.

1. Inventory first: firms list every AI system in use, including tools bought from vendors, and tag each with a risk tier.
2. Early pledges: more than 100 companies signed the Commission's voluntary AI Pact in 2024, committing to start compliance work before the deadlines.
3. Supplier screening: AI questions now sit in vendor due diligence beside GDPR and security questions.
4. Contract annexes: new outsourcing deals add clauses on roles, documentation hand-over and incident notice.

Member states are building the enforcement side. Spain set up AESIA in A Coruña as the EU's first dedicated AI supervisory agency. Italy passed its own national AI law, Law 132/2025, in autumn 2025. In the Netherlands, the data protection authority coordinates algorithm supervision.

The Dutch have a hard lesson behind that role. Their tax authority used a risk model that wrongly flagged thousands of families for childcare benefit fraud. The scandal brought down the government in January 2021.

Cases like that sit behind Article 27. Public bodies must assess the impact on people's rights before deploying high-risk AI. So must firms that use AI for credit scoring or life and health insurance pricing.

What Will EU Clients Ask Their Offshore Vendor?

EU clients will ask you to prove the system was built to comply. Expect questions like these in RFPs and security reviews:

• Which risk tier did you assign this system, and who signed it off?
• Which foundation model and version does it use, and where is the provider's documentation?
• Where did the training and test data come from, and how did you check it for bias?
• How does a user know they are dealing with AI?
• What does the system log, and for how long?
• Which engineers on this project have AI literacy training on record?
• How fast will you tell us about a serious incident?

A vendor that answers from an existing file closes faster. A vendor that answers from memory adds weeks of legal review to every deal.

How Does Augmex Handle EU AI Act Work From Dhaka?

We screen every AI feature for its risk tier during discovery, before any code is written. The tier goes into the project file with the client's sign-off. If the intended use changes later, we screen it again.

AI Chatbot Builder Platform (confidential client)

A 4-person Augmex team took a multi-tenant AI chatbot builder from Scale MVP to a live SaaS product in 8 weeks. The build included source attribution on RAG answers and strict tenant data isolation, two areas EU buyers now probe under the Act's transparency and data rules.

Read the full case study

Offshore vendors used to sell speed and cost. For EU AI work, the documentation file is part of the product. If we cannot hand it over, our client cannot ship.

With staff augmentation, our engineers work inside your process and the provider role stays with you. When we build end to end, the documentation pack ships with the code.

What Do Teams Ask About the EU AI Act and Offshore Development?

Does the EU AI Act apply to companies outside the EU?

Yes. The EU AI Act applies to non-EU providers that place AI systems on the EU market, and to non-EU providers and deployers whose AI output is used in the EU. A software company in India, Bangladesh or Vietnam is in scope whenever its AI work serves EU users.

Who is responsible for AI Act compliance in outsourced software development?

The provider is responsible, and in most outsourced builds that is the EU client who ships the system under its own name. The offshore vendor still has supplier duties: Article 25(4) requires a written agreement on the documentation and help it provides. If the vendor sells its own AI product, the vendor is the provider.

When do the EU AI Act high-risk rules apply?

Stand-alone high-risk rules apply from 2 December 2027, after the 2026 Digital Omnibus moved them from August 2026. High-risk AI inside regulated products, such as medical devices, follows from 2 August 2028. Bans and general-purpose model rules already apply.

Do offshore vendors need an EU authorised representative?

Only when they are the provider of a high-risk AI system or a general-purpose AI model. In that case Articles 22 and 54 require a written mandate with a representative established in the EU. A vendor building a client-branded system does not need one, because the client is the provider.

What are the fines under the EU AI Act?

Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, whichever is higher. Most other breaches carry up to EUR 15 million or 3%. Supplying incorrect information to regulators can cost up to EUR 7.5 million or 1%. For SMEs, the lower of the two figures applies.

Is a customer service chatbot high-risk under the AI Act?

No, a standard customer service chatbot is limited risk. From 2 August 2026 it must tell users they are dealing with AI. It becomes high-risk only when used for a listed purpose, such as deciding access to credit or public benefits.

Does the AI Act replace GDPR?

No. Both laws apply at the same time. GDPR governs personal data, and the AI Act governs the AI system itself. Offshore vendors need a data processing agreement and transfer safeguards under GDPR, plus AI Act documentation on top.

Start with the register. List every AI feature you build for EU clients this quarter. Tag its risk tier and note who the provider is. Most of the remaining work follows from that one list.