For EU and EEA businesses

Offshore Software Development for EU and EEA Companies

AI Dev Planner is a software and AI development team in Islamabad, Pakistan. We do not have an office in the EU. This guide is for European companies considering an offshore team outside the EEA: how the working day lines up, what the GDPR requires when a processor sits in a country without an adequacy decision, and how the EU AI Act affects AI features you commission.

General information, not legal advice. See the offshore software development overview for how the model works worldwide.

The short answer

Central Europe shares four to five working hours with Islamabad, which is enough for a daily stand-up and same-day decisions. The harder part is data protection: if the team can access personal data, you need an Article 28 processor contract and, because Pakistan has no EU adequacy decision, a transfer safeguard such as the Standard Contractual Clauses. The best way to make that manageable is to design the project so the team rarely needs real personal data at all.

Working hours: CET and its neighbours

Islamabad is UTC+5 all year. EU summer time runs from the last Sunday of March to the last Sunday of October (European Commission, accessed 17 October 2026), so the gap is an hour smaller in the European summer. In the table, the first value applies in European winter and the second in summer. The overlap assumes both sides keep a 09:00 to 17:00 local day; it is arithmetic for planning, not a statement of our working hours.

Time difference and working-day overlap between Islamabad and European time zones
Region	Offset (winter / summer)	Islamabad is ahead by	Overlap of a 09:00–17:00 day
Western Europe (Dublin, Lisbon)	UTC+0 / UTC+1	5 h / 4 h	3 h / 4 h
Central Europe (Berlin, Paris, Amsterdam, Madrid, Warsaw)	CET UTC+1 / CEST UTC+2	4 h / 3 h	4 h / 5 h
Eastern Europe (Helsinki, Athens, Bucharest)	EET UTC+2 / EEST UTC+3	3 h / 2 h	5 h / 6 h

In practice the shared hours fall in the European morning: 09:00 CET is 13:00 in Islamabad in winter, and 09:00 CEST is 12:00 in summer. That makes a morning stand-up or planning session easy, and leaves the European afternoon for review and feedback that the team picks up the next day.

GDPR Article 28: the processor contract

If a development team processes personal data on your behalf, for example by accessing a production database, handling support tickets that contain user details, or running data migrations, it acts as your processor. Article 28(1) of the GDPR says a controller must use only processors that provide sufficient guarantees of appropriate technical and organisational measures. Article 28(3) requires the processing to be governed by a contract or other legal act that sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and the controller’s obligations and rights (GDPR on EUR-Lex, accessed 17 October 2026).

The contract must require the processor to:

process personal data only on your documented instructions;
make sure the people authorised to process it are bound by confidentiality;
take the security measures required by Article 32;
respect the conditions for engaging another processor (a sub-processor);
help you respond to data subjects exercising their rights;
help you meet your obligations on security, breach notification and impact assessments (Articles 32 to 36);
delete or return all personal data at your choice when the services end, unless storage is legally required;
give you the information needed to demonstrate compliance, and allow for audits and inspections.

This applies to any processor, in the EU or outside it. Ask for these terms before the build starts, and check that the sub-processors named in the contract (cloud hosting, error monitoring, email delivery) match the tools the team actually uses.

Transfers to Pakistan: no adequacy decision, so SCCs

Chapter V of the GDPR allows transfers of personal data to a third country only if its conditions are met (Article 44). The simplest route is an adequacy decision, but Pakistan is not on the Commission’s list of countries with one (European Commission, adequacy decisions). Without adequacy, Article 46(1) allows a transfer only if the controller or processor has provided appropriate safeguards with enforceable rights and effective legal remedies for data subjects, and Article 46(2)(c) lists standard data protection clauses adopted by the Commission as one such safeguard.

The Commission adopted modernised Standard Contractual Clauses on 4 June 2021 (European Commission, SCCs). Implementing Decision (EU) 2021/914 sets them out in four modules: controller to controller, controller to processor, processor to processor, and processor to controller (EUR-Lex). When you hire a development team that processes personal data for you, Module Two, controller to processor, is the usual starting point.

Keeping the data in the EU does not automatically avoid the question. The EDPB’s Guidelines 05/2021 say that remote access from a third country, even when it only involves displaying personal data on a screen for support or administration, can be a transfer when the criteria are met, and that a processor in a third country remotely accessing EU-stored data results in a transfer (EDPB Guidelines 05/2021, version 2.0). The EDPB’s Recommendations 01/2020 then cover the measures that may be needed to supplement a transfer tool such as the SCCs (EDPB Recommendations 01/2020). All accessed 17 October 2026.

A practical sequence

Map what the team will actually touch
List which systems hold personal data and whether developers need any access to them. Often the honest answer is: only test data, plus production access for a named person during incidents.
Minimise first
Keep production data in an EU region of a cloud account you own. Build and test on synthetic or anonymised data. Use least-privilege access, logging and time-limited credentials for anything else.
Sign the Article 28 terms
Put a processor contract in place that covers the minimum terms of Article 28(3), with the sub-processors and security measures named.
Put the transfer safeguard in place
Because Pakistan has no adequacy decision, use an Article 46 safeguard, typically the Commission's Standard Contractual Clauses with the module that matches your roles.
Assess and record
Assess the transfer in its context and record your conclusions and any supplementary measures, following the EDPB's Recommendations 01/2020. Your DPO or adviser should lead this step.

This is a checklist, not legal advice and not a compliance certification. Your data protection officer or adviser should decide the roles, the module and the assessment. We do not claim certifications on this page; security practices are described on our trust page.

The EU AI Act and AI features you commission

If the product includes AI, such as an assistant, document extraction, recommendations or generated content, the AI Act is part of the specification, not an afterthought. The European Commission summarises the framework as four levels of risk (European Commission, AI Act, accessed 17 October 2026):

Unacceptable risk: banned practices, such as social scoring.
High risk: uses such as AI in employment, education or critical infrastructure, which carry strict requirements including risk management, data quality, documentation, logging and human oversight.
Transparency risk: people should be told when they are interacting with a machine such as a chatbot, and providers of generative AI must make AI-generated content identifiable.
Minimal or no risk: most AI in use today, such as spam filters, with no specific rules.

On timing, the Commission’s page states that the Act entered into force on 1 August 2024; prohibited practices and AI literacy obligations applied from 2 February 2025; general-purpose AI obligations from 2 August 2025; and the Act became applicable on 2 August 2026, with some exceptions. Following the AI Omnibus, which the page says entered into force on 27 July 2026, high-risk obligations for the use cases in Annex III start on 2 December 2027, and those for AI embedded in regulated products under Annex I on 2 August 2028. These dates have already changed once, so check the Commission’s page when you plan.

What this means for a development project:

Classify the AI feature during discovery, before the architecture is fixed.
Build disclosure into the interface where it is needed, for example telling users they are talking to an AI assistant.
Keep records of the models and data sources used, the evaluations run and the human review steps, because higher-risk uses depend on them.
If the use case looks high-risk, take specialist advice early. It changes scope, timeline and cost.

For how we approach AI work, see AI development and secure AI development.

IP ownership and other EU build considerations

Software copyright: the employee rule does not cover contractors

The Software Directive says the author of a computer program is the natural person or group of persons who created it, or a legal person where national law allows. Where a program is created by an employee in the execution of their duties or on the employer’s instructions, the employer alone may exercise the economic rights, unless the contract provides otherwise (Directive 2009/24/EC, Article 2, EUR-Lex, accessed 17 October 2026). An outside development company’s engineers are not your employees, so that rule does not give you the rights. Your contract needs an express assignment or licence, drafted under the national law you choose to govern it.

Our terms of service say that bespoke source code, database designs and associated assets are assigned to the client once the contractual milestones under the statement of work are met, and that the signed master services agreement and statement of work govern the details. Ask for the exact wording before you sign.

Accessibility

The European Accessibility Act covers products and services including e-commerce and banking services, and Member States apply its requirements from 28 June 2025 (Directive (EU) 2019/882, Article 31, EUR-Lex, accessed 17 October 2026). If your product is in scope, accessibility belongs in the acceptance criteria for every sprint, not in a final audit.

Languages and formats

European products often launch in more than one language. If yours will, plan translation files, locale-aware date, number and currency formats, and longer text in layouts from the first sprint. Retrofitting them later costs more than building them in.

How European companies work with us

Discovery, then fixed sprints. Workflows, data model and integrations are mapped before the build is priced, then the build runs as fixed 2-week sprints against the agreed scope.
Or join your team inside your Git workflow, code review standards and sprint cycle.
Visible progress. A dedicated Slack channel and a video walkthrough of working software every two weeks.
EU hosting in your account. Hosting can be set up in an EU region, in cloud accounts your business controls, with the repository in your own GitHub or GitLab organisation.
After launch. A 60–90 day warranty covers defects in what we delivered.

We are probably not the right partner if:

your policy or customers require that personal data is never accessible from outside the EEA;
you need a supplier with an EU establishment or on-site presence;
you need a fixed quote before anyone has looked at the scope.

Our published planning ranges are in GBP. For an indicative range for your product, use the MVP cost calculator.

Related guides

Offshore software development FAQs for EU companies

Does Pakistan have an EU adequacy decision?

No. When we checked on 17 October 2026, Pakistan was not on the European Commission's list of countries with an adequacy decision. A transfer of personal data to a processor in Pakistan therefore needs appropriate safeguards under Article 46 of the GDPR, most commonly the Commission's Standard Contractual Clauses.

Is it a transfer if the team only accesses data held in the EU?

It can be. The EDPB's guidelines on the interplay between Article 3 and Chapter V say that remote access from a third country, even just viewing personal data on a screen for support, can be a transfer when the criteria are met, and that a processor in a third country remotely accessing EU-stored data results in a transfer. Hosting in the EU reduces exposure but does not remove the question if the team can reach the data.

Which SCC module applies when we hire an offshore development team?

If your company is the controller and the development team processes personal data on your behalf, the relevant set is usually Module Two, controller to processor. If your company is itself a processor for your customers, Module Three, processor to processor, may apply. Confirm the roles with your data protection officer or adviser.

Do we still need an Article 28 contract if we use SCCs?

The two do different jobs. Article 28 requires a contract governing any processor's processing on your behalf, wherever the processor is. The SCCs provide a safeguard for the transfer to a third country. Your adviser will tell you how to combine them; the important point is that neither replaces the other.

Does the EU AI Act apply to an AI feature built by an offshore team?

The AI Act sets obligations according to what an AI system does and the risk it carries, so where the developers sit is not the main question. What matters is what the feature does: most AI features carry no specific obligations, chatbots and generated content carry transparency duties, and uses listed as high-risk carry strict requirements. Check your use case against the Commission's guidance early, because it affects the design.

How much of the working day overlaps with Central Europe?

Islamabad is four hours ahead of Central European Time in winter and three hours ahead in summer. If both sides kept a 09:00 to 17:00 day, about four hours would overlap in winter and five in summer, typically the European morning.

Do you have an office or representative in the EU?

No. Our team is based in Islamabad, Pakistan, and we work with European clients remotely. We do not claim an EU office, EU entity or EU representative.

Sources

All sources accessed 17 October 2026. This guide is general information, not legal advice.

European Commission: Summertime — EU summer time runs from the last Sunday of March to the last Sunday of October.
EUR-Lex: Regulation (EU) 2016/679 (GDPR) — Article 28 processor contracts; Articles 44 and 46 on transfers and appropriate safeguards.
European Commission: Adequacy decisions — The countries with an EU adequacy decision. Pakistan is not among them.
European Commission: Standard contractual clauses — The modernised SCCs adopted on 4 June 2021 as a basis for transfers to third countries.
EUR-Lex: Commission Implementing Decision (EU) 2021/914 — The four SCC modules, including Module Two, controller to processor.
EDPB: Guidelines 05/2021 on the interplay between Article 3 and Chapter V (version 2.0) — Remote access from a third country by a processor can be a transfer.
EDPB: Recommendations 01/2020 on supplementary measures — Measures that supplement transfer tools to ensure the EU level of protection.
European Commission: AI Act regulatory framework — AI Act risk categories, transparency obligations and application dates.
EUR-Lex: Directive 2009/24/EC on the legal protection of computer programs — Authorship of computer programs and the employer rule for programs created by employees.
EUR-Lex: Directive (EU) 2019/882 (European Accessibility Act) — Member States apply the accessibility requirements from 28 June 2025.

Start with the data questions

Tell us what you are building and what personal data it involves. We will set out how the work can be done with as little access to that data as possible, and tell you if we are not the right fit.

Discuss your project Estimate your MVP cost