Industries
Sector rules first, technology second.
Each sector in India answers to its own regulator and runs its own systems: RBI and SEBI in finance, CERT-In for cyber incidents, the DPDP Act wherever personal data is held. We begin with your workflows, the officers who approve them and, where European customers are involved, the EU rules as well. Only then do we design the AI and software.
For Indian enterprises, PSUs and government bodies whose systems are shaped by RBI, SEBI, CERT-In and the DPDP Act, and by EU rules wherever European customers are involved.
Sectors (06)
Our practice was formed in public administration: 600+ government projects for public bodies across the European Union, where accessibility, security and a clear line of accountability are conditions of acceptance.
For banking and financial services, healthcare and life sciences, manufacturing, energy and utilities, and transport and infrastructure, each page sets out what we would build and which Indian and EU rules shape it, so that you can judge the fit before a first meeting.
01Where we started
Government & Public Sector
Services on Aadhaar-based authentication, DigiLocker and API Setu that stay accountable, meet GIGW 3.0 and can be audited.
600+Projects for European public administrations
Public bodies in EU Member States
ISO/IEC 27001 certified
Key rules
- March 2023GIGW 3.0 issued
- November 2025DPDP Rules notified
- May 2027Data Fiduciary duties apply
02
Banking & Financial Services
AI in lending, onboarding and claims that an RBI or SEBI inspection can follow, with the CERT-In six-hour clock built into operations.
Key rules
- 28 April 2022CERT-In six-hour reporting
- 20 August 2024SEBI CSCRF issued
- May 2027DPDP duties for lenders and insurers
03
Healthcare & Life Sciences
Patient records handled as the DPDP Act expects, and validation evidence ready for export markets in the EU.
Key rules
- 11 August 2023DPDP Act published
- May 2027Data Fiduciary duties apply
- 2 August 2028EU AI Act: AI in medical devices
04
Manufacturing & Industry
Plant data for the business, plus the product data EU buyers now ask of Indian exporters: CBAM, product passports, secure connected devices.
Key rules
- 1 April 202530-day limit on the IRP
- 1 January 2026CBAM definitive period for EU imports
- 11 December 2027EU Cyber Resilience Act applies in full
05
Energy & Utilities
Meter, outage and asset data that distribution companies and renewable developers can act on, with incident handling ready for CERT-In.
Key rules
- 28 April 2022Six-hour reporting to CERT-In
- May 2027DPDP duties for consumer data
- 2 December 2027EU AI Act and critical infrastructure
06
Transport & Infrastructure
Fleet, terminal and passenger data that logistics firms and metro rail companies can rely on, with control systems kept out of reach.
Key rules
- 28 April 2022Six-hour reporting to CERT-In
- May 2027DPDP duties for passenger data
- 2 December 2027EU AI Act and road traffic
Would you rather begin with the business problem?
- Solutions by business problem
Six solution patterns, from reading incoming documents and processing cases to retiring an ageing core system.
- Our delivery model
Four stages, each closed with a deliverable your team reviews and accepts.
- View our services
Seven services, one accountable delivery team.
India
Indian rules at home, EU rules through your customers
At home, the Digital Personal Data Protection Act, 2023 applies across sectors, and the DPDP Rules bring Data Fiduciary duties into force from May 2027. CERT-In’s Directions of 2022 require listed cyber incidents to be reported within six hours. Sector regulators such as RBI and SEBI add their own frameworks on top.
Indian organisations with European customers or subsidiaries meet EU rules as well: the EU AI Act where an AI system’s output is used in the Union, the EU General Data Protection Regulation (GDPR) when they offer services to people there, and DORA or NIS2 through the clauses of their European contracts.
We design one architecture that carries both sets of obligations, and document the Indian and the European specifics separately so that each auditor finds what they need.
- DPDP Act 2023Digital Personal Data Protection Act, 2023, also covering processing outside India connected with offering goods or services to Data Principals in India (opens external site)
- DPDP Rules 2025Digital Personal Data Protection Rules, 2025, brought into force in three steps over eighteen months (opens external site)
- CERT-In Directions 2022CERT-In Directions of 28 April 2022 under s. 70B(6) of the IT Act: reporting of listed cyber incidents within 6 hours, log retention, time synchronisation (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- Ministry of Electronics and Information Technology (MeitY)Ministry of Electronics and Information Technology (MeitY), policy for data protection, CERT-In and AI governance (opens external site)
- Data Protection Board of IndiaData Protection Board of India, adjudicatory body under the DPDP Act, working as a digital office (opens external site)
Frequently asked questions
Why does government come first on this page?
Because public administration formed our methods: 600+ government projects for public bodies across the European Union, completed and ongoing. Procurement rules, accessibility law, service in several languages and public scrutiny decided how we design, document and hand over a system, and Indian departments and PSUs expect the same rigour.
Do you work in sectors not listed here?
Yes. Our services and platforms are not tied to one sector, and private-sector work is a large share of what we do. These pages cover the sectors where regulation decides the architecture. For any other sector, start from the business problem on our solutions pages.
Do you have an office in India?
No. FromNine has no office in India; the people who would work with you are based in Antwerp, Ghent and Amsterdam. Our government projects are for public bodies across the European Union. We hold the first conversation in English and agree the working language of the project at the start.
Tell us which rules your systems answer to
Name the regulators involved, the systems in scope, who approves the outcome and whether European customers or subsidiaries are part of the picture.