EU-India FTA - commercial and tech contracting

Map product-level eligibility to RoO once published.

The importer to:

• conduct origin audits for export products
• obtain Long-Term Supplier's Declarations (LTSDs)
• include RoO indemnity clauses.

From an EU perspective, allocate the obligations above by role. In simple terms, EU exporters to India conduct origin audits and obtain LTSDs from suppliers, while EU importers from India secure RoO indemnities from Indian exporters.

Exporters will issue statements on origin and must maintain robust traceability to substantiate origin.

Importers should anticipate verification requests and potential denial of preference following administrative cooperation between authorities.

Ensure robust documentation from exporter to demonstrate compliance. Implement document retention schedules aligned to expected verification windows and require prompt notice of any customs queries. 

Watch out: Do not issue statements on origin absent product-specific evidence. Consider avoiding Delivered Duty Paid (DDP) terms where they obscure responsibility for origin, classification, and preference claims.

Renegotiate distribution pricing models to share new margins.

Watch out: Do not rely on force majeure for tariff matters. Use price-adjustment or re-opener clauses tied to actual entry into force and published staging, not anticipated outcomes.

Elimination of customs duties under the FTA does not relieve EU importers of obligations under CBAM for covered goods (currently including cement, iron and steel, aluminium, fertilisers, electricity and hydrogen). Under the definitive regime, authorised CBAM declarants will be required to report embedded emissions and surrender CBAM certificates.

Watch out: A zero tariff does not mean a zero border cost. Contracts should expressly allocate responsibility for CBAM compliance, embedded-emissions data provision, reporting obligations and the economic burden of CBAM certificates, and should include warranties regarding the accuracy and completeness of emissions data.

For in-scope commodities and derived products (including cattle, cocoa, coffee, oil palm, rubber, soya and wood), EU operators—and, in certain circumstances, traders—must exercise due diligence and submit a due diligence statement before placing relevant products on the EU market or exporting them from the EU, irrespective of any preferential tariff treatment under the FTA.

Watch out: Require geolocation information, traceability documentation and contractual warranties that products are deforestation-free and legally produced, together with audit rights, corrective-action mechanisms and termination rights for non-compliance.

Where applicable, the CSDDD and the Forced Labour Regulation impose separate due-diligence and risk-management obligations that operate independently of the FTA's Trade and Sustainable Development chapter. The Forced Labour Regulation establishes a prohibition on products made with forced labour being placed on, made available on, or exported from the EU market.

Watch out: Align supplier codes of conduct, contractual representations, information rights, audit rights, remediation procedures and termination provisions with applicable due-diligence and forced-labour requirements. Treaty-level Trade and Sustainable Development commitments are principally state-to-state obligations and do not discharge corporate compliance responsibilities under EU law.

Preferential tariff treatment affects landed costs and may influence which party assumes the role of importer of record and bears responsibility for origin compliance, customs declarations, tariff classification and regulatory obligations, including CBAM where applicable.

Watch out: Avoid using Delivered Duty Paid (DDP) terms without carefully allocating responsibility for origin substantiation, customs compliance and CBAM obligations. Incoterms should be aligned with the party best placed to manage customs procedures, origin verification and regulatory reporting requirements.

Reference the text of the FTA’s prohibition on mandatory disclosure by public bodies when resisting regulatory demands.

Do not rely on the FTA to refuse commercially negotiated source code escrow where appropriate for resilience or continuity, unless an obligation is regulator imposed.

Watch out: The protection bites only against mandatory disclosure by public authorities; it does not override EU AI Act obligations to provide technical documentation to regulators, nor does it affect commercially agreed escrow arrangements.

For personal data, continue to use GDPR-compliant transfer tools (e.g., Standard Contractual Clauses and transfer risk assessments) and align with India's Digital Personal Data Protection Act (DPDPA) requirements (as currently there is no EU adequacy decision for India). From an EU perspective, the FTA does not create a general free flow of personal data or displace EU law, so where the EU entity is the data exporter, GDPR continues to govern the transfer.

Watch out: Build data transfer contingencies into contracts rather than assuming new FTA rules will displace privacy law.

Update service terms and SLAs once final rules are published. Re-evaluate marketing communication consents, suppression, and opt-out mechanics. 

Watch out: Local e-commerce rules may still apply independently.

Watch out: Commitments are defined by sector-specific schedules and accordingly contracting assumptions about local presence waivers or board composition should be contingent on the final schedules.

Pricing should reflect that indirect tax treatment is unaffected by the FTA's services chapter.

Ensure robust protection in IP and confidentiality terms. From an EU perspective, EU rights holders should leverage the FTA’s enhanced enforcement standards, including for trade secrets.

Watch out: Identify kinds of intellectual property and recognise differential legal treatment for different types of IP (copyright, designs, trademarks, trade secrets, plant varieties) as reflected in the text of the FTA.

Anticipate a framework similar to the GATS Understanding by incorporating conditional "enablement" clauses for cross-border financial information flows in the final schedules of the FTA that take effect only where the domestic law permits. 

Watch out: Financial sector data rules and secrecy laws continue to apply notwithstanding the FTA. Ensure alignment with both GDPR, DPDPA and sector-specific regimes.

Risk-based obligations apply to providers and deployers placing AI systems or general-purpose AI models on the EU market, regardless of where development occurs and regardless of the FTA. 

Watch out: The FTA’s protection against mandatory source-code disclosure does not exempt high-risk AI from technical documentation, transparency and conformity-assessment duties, including regulator access to documentation. Preserve disclosure, audit and cooperation rights against Indian developers to enable EU compliance.

These regimes govern access to and sharing of (largely non-personal) data, including IoT-generated data and cloud-switching, with mandatory contractual terms and unfair-terms controls for data contracts. 

Watch out: Address data access, portability, interoperability and cloud-switching obligations in technology and cloud contracts; standard supplier terms drafted for other markets may be unenforceable in the EU.

There is currently no EU adequacy decision for India, so transfers from the EU require Article 46 safeguards (Standard Contractual Clauses plus a transfer impact assessment), while India’s Digital Personal Data Protection Act imposes its own obligations on processing connected to India. 

Watch out: Map data flows in both directions and do not assume the FTA enables or legitimises transfers; the digital chapter expressly preserves each party’s right to regulate privacy.

NIS2 imposes security and incident-reporting duties on essential and important entities, while DORA imposes ICT third-party risk management and prescriptive contractual requirements on financial entities and their providers. 

Watch out: Flow down NIS2 and DORA security, audit, sub-contracting and incident-notification clauses to Indian ICT and outsourcing providers, including register-of-information and exit requirements for in-scope financial services.

The FTA’s enhanced IP standards complement the EU’s enforcement framework, including the Trade Secrets Directive and the IP Enforcement Directive (IPRED). 

Watch out: Ensure governing-law, jurisdiction and confidentiality provisions enable EU-based injunctive and interim relief, and recognise the differential treatment across copyright, designs, trademarks, trade secrets and plant varieties.

Draft Statements of Work with role definitions that can be mapped to final mobility categories such as business visitors, intra-corporate transferees, contractual service suppliers, independent professionals and Indian short-term business visitors. 

Watch out: Avoid vague role descriptions that impede category alignment.

Insert sustainability warranties and audit rights to ensure key principles such as abolition of child labour, non-discrimination, safe and healthy working conditions, combatting illegal wildlife trade, etc. 

Watch out: Distinguish binding obligations from co-operation clauses; tailor supplier requirements to what is legally required and realistically auditable.

Insert mutual reciprocal obligations to leverage the RRM and submit joint concerns on vital requirements e.g., licence approvals through the state parties.

Watch out: Identify obligations to provide early warning for engagement with government authorities for unilateral RRM inquiries.

Continue to include binding international arbitration clauses (e.g., SIAC, LCIA, or ICC) in commercial contracts. 

Watch out: FTA committees are not replacements for arbitration so ensure obligations also apply under both routes. Use neutral arbitral venues.

Allocate regulatory-change risk expressly.

Do not assume treaty enforcement will resolve time-critical operational issues.