Insights
What building AI, enterprise software and cloud for regulated organisations teaches us: where an authorised person decides, how answers become verifiable, and what EU rules ask of Indian companies alongside the DPDP Act.
For decision makers and engineers in Indian enterprises and GCCs, with sources you can verify.
FeaturedPublic sector / AI engineering
After the 2026 amendments, European public bodies that deploy high-risk AI face their main deadline on 2 December 2027, while prohibitions, AI literacy and transparency already apply. The duties of those deployers, how the Act reaches a provider based in India, India’s own approach for comparison, and a plan for the months ahead.
FromNine editorial team10 min read
Platforms / Architecture
In India, B2B invoices of GST-registered businesses above the turnover threshold go to the Invoice Registration Portal, which returns an Invoice Reference Number. In the EU, structured e-invoicing is spreading country by country, with Belgium’s B2B obligation since January 2026 and an EU-wide rule for cross-border trade from 2030. What each system requires, how Peppol works, and how to run both from one ERP.
FromNine editorial team9 min read
Architecture
Since 28 June 2025, online shops, consumer banking, passenger ticketing, e-books and other services offered to consumers in the EU have had to be accessible, including when an Indian company provides or builds them. Which services the Act covers, what it means for a site or an app, where EU national laws differ, how India’s own standards line up, and how to make accessibility part of delivery.
FromNine editorial team11 min read
Architecture / Cloud
NIS2 puts supply-chain security among the duties of every EU organisation in scope and holds management to account for it. What the directive demands, why most Indian software and managed service providers meet it through their customers’ contracts, when a provider must appoint a representative in the EU, and the evidence both sides need.
FromNine editorial team10 min read
Cloud / Architecture
When an Indian company runs applications, infrastructure or data services for a European bank or insurer, DORA governs that relationship. The regulation turns operational resilience into duties for the financial entity, and most of them reach the supplier through the contract. What DORA requires, what the designation of critical providers changed, how it compares with the rules Indian teams already know, and what to prepare.
FromNine editorial team11 min read
AI agents / Public sector
Indian banks, NBFCs and finance functions already separate the person who prepares a transaction from the person who authorises it. AI agents need the same split. A method for deciding which agent actions run on their own, which wait for an authorised officer, and how that line moves as evidence builds up.
FromNine editorial team10 min read
AI engineering / Data
A compliance officer checking which RBI direction applies, or a plant engineer looking up an SOP, needs an answer that can be verified, not a fluent guess. Trust in search over your own documents rests on five properties that can be designed and tested: permissions, provenance, freshness, honest gaps and measured quality.
FromNine editorial team7 min read