AI compliance becomes a product as rules stay split and deadlines slip

Compliance is now sold by the module. Quick Heal launched Seqrite NOVA Data Privacy, an AI-powered offering for small offices, SMBs and mid-enterprises working through India's DPDP Act.

For buyers, the pitch moves the question. The useful test is no longer whether a tool is compliant. It is which specific state or national requirement it maps to, and who carries the cost when it misses. Neither company has said what the new modules cost.

NOVA ships in three tiers: Lite, Essentials and Professional. Its translation engine renders consent notices and cookie menus into 22 officially recognised Indian languages. Quick Heal says the platform finds and classifies personal data across endpoints, cloud applications, databases and unstructured files, including text inside scanned images. The company argues smaller buyers cannot staff that work themselves. "Navigating India's DPDP compliance shouldn't be a complex, resource-heavy ordeal for growing businesses," said Harish Kumar GS, chief executive of Quick Heal.

Fusemachines made a comparable bet four days earlier. On 29 October 2026 it rolled out an AI Usage Consent Module in HireFoundry.ai, pitched at employers hiring across all 50 U.S. states. Candidates who decline still get interviewed. The Interview Agent then does not join, listen, transcribe or analyse the call. "Enterprises should be able to focus on finding the right talent without having to build a separate AI consent process for every state where they hire," said Giovanni Lemus, vice president of product at Fusemachines.

The forecast rests on regulatory volume rather than any single law. ResearchAndMarkets credits AI and cloud adoption with cutting costs and enabling real-time monitoring across jurisdictions. It points to GDPR, CSRD and DORA as demand drivers.

India's DPDP deadline drives urgency

India's calendar is the tightest. India notified the DPDP Rules in November 2025. Key provisions take effect in stages through May 2027.

Readiness is thin. An EY survey published in January found more than 83% of organisations had not begun implementing the requirements across relevant processes and systems. That gap is the sales opening Quick Heal is aiming at. Whether a small firm can satisfy a regulator that way is untested. The staged commencement means obligations arrive piece by piece.

Europe extends sandbox timeline

Europe moved the other way, keeping its law and buying time. The AI Omnibus Regulation took effect across the EU on 27 July 2026.

Its most concrete change is a delay. Member states now have until 2 August 2027 to have at least one national AI regulatory sandbox running, a year later than the original deadline. The regulation also introduces an EU-level sandbox that the AI Office may set up with relevant authorities.

A sandbox is not a deregulation pass. Companies test systems under supervision and learn what regulators expect before launch.

U.S. rules stay split, and courts fill gaps

Washington has no federal AI statute. California enacted SB 53 in September 2025, and a federal FRONTIER bill was introduced in July 2026, according to a note.com analysis citing Newsweek Japan. The AI Act itself entered into force on 1 August 2024 and phases in its obligations.

Where legislatures lag, courts move. In October 2026 plaintiffs filed putative class actions in the Northern District of Illinois against xAI's Grok. The complaints allege the platform processed user-uploaded photographs without the required disclosures or written releases. BIPA, enacted in 2008, counts a scan of face geometry as a biometric identifier but expressly excludes photographs. The plaintiffs say the processing crossed that line. The allegations are unproven and the cases are at an early stage.

Oversight stays with employers

In each case the vendor sells the workflow and the buyer keeps the liability. Fusemachines says recruiters choose what to ask and remain responsible for candidate assessments and hiring decisions.

Deadlines remain open. The plaintiffs have not established the BIPA claims.