For businesses in the EU
Remote AI and Full-Stack Developer for Businesses in the EU
I am Shahid Malla, a remote developer in India who builds AI agents and chatbots, SaaS products and web apps, CRMs and WHMCS systems for companies in the European Union. Your morning is my afternoon, my invoices go out under the reverse charge, the GDPR clauses for access from India are signed before I see any personal data, and a chatbot I build for you tells people it is AI from the first message. You pay a fixed price or $55-$65 per hour.
Free scoping call of about 30 minutes · written quote within one business day · two weeks of support after delivery
By Shahid Malla, AI agent and AI chat developer, full-stack developer · Updated
What can you hire me to build?
AI agents and chatbots first, then the software around them: SaaS products, web apps, CRMs, automations and websites. For EU hosting companies, I also build on WHMCS. Each line of work has its own page with the scope and the limits.
| Work | Typical project | Details |
|---|---|---|
| AI agents | An agent that reads support tickets, looks up the account and drafts the reply, with a person approving anything risky | AI agent development |
| AI chatbots | A chatbot on your site, in WhatsApp or in your app that answers from your own documents, says it is AI and hands off to your team | AI chatbot development |
| SaaS and web apps | A subscription product or customer portal on Laravel or Next.js, with Stripe billing | SaaS development |
| Mobile apps | Android and iOS apps from one codebase, with the API and admin panel behind them | Mobile app development |
| CRM and automation | A CRM shaped around your sales process, or workflows that move data between the tools you already pay for | CRM development |
| WHMCS | E-invoicing integrations, VIES checks, SEPA billing and EU domain fields for a hosting company | Hire a WHMCS developer |
| Servers and DevOps | Deployment, monitoring and hardening for the servers your product runs on, in an EU region | Hosting infrastructure |
I do not sell small one-off fixes as a separate service. Work starts from a written scope, even when the scope is short.
How do our working hours overlap?
Your morning is afternoon in India, so calls fall inside both our working days. India stays on UTC+5:30 all year. EU clocks went back on 25 October 2026 and go forward on 28 March 2027, and the Commission has published the dates through 2031. In EU summer, India is one hour closer to you. The table shows your 9:00-13:00 in India time (UTC+5:30), written that way rather than as "IST", which in Ireland means Irish Standard Time.
| Where you are | In India, 25 Oct 2026 to 27 Mar 2027 | In India, 28 Mar to 30 Oct 2027 |
|---|---|---|
| Ireland, Portugal, Canary Islands | 14:30-18:30 | 13:30-17:30 |
| Central European Time: Germany, France, the Netherlands, Belgium, Spain, Italy, Poland, Sweden and others | 13:30-17:30 | 12:30-16:30 |
| Eastern European Time: Finland, the Baltic states, Greece, Romania, Bulgaria, Cyprus | 12:30-16:30 | 11:30-15:30 |
For most of the EU, your whole morning falls in my working afternoon. We agree a call slot in the quote, and a written update each working day covers the rest.
How do VAT and invoices work when you pay me?
For a VAT-registered business, there is no VAT on my invoice and you account for it yourself. These are the rules the VAT Directive and national tax authorities publish, not advice about your return. Your accountant applies them.
- Place of supply. Article 44 of the VAT Directive taxes business-to-business services "where that person has established his business", meaning you.
- Reverse charge. Under Article 196, VAT is payable by the customer when the supplier is not established in that country. I do not add EU VAT.
- What the invoice shows. Article 226 requires your VAT identification number and the words "Reverse charge". I check the number in the Commission's VIES tool before the first invoice.
- E-invoicing. The mandates in Germany, Belgium, Poland and France bind businesses established there, not a supplier in India. In France, from 1 September 2027, the buyer reports a reverse-charged purchase from a foreign supplier itself, so a clean invoice number, date, totals and currency help you.
- Withholding tax. Whether your country withholds tax on a payment to a non-resident depends on its own law and its tax treaty with India. Germany's income tax law, for example, lists payments for the use of rights and know-how among those taxed at source. The quote is for a service, with the custom code becoming yours, so check any licensing clause with your accountant.
Can a developer in India work on your customer data under the GDPR?
Yes, with a written contract. The EDPB's guidelines say remote access from a non-EU country, "even if it takes place only by means of displaying personal data on a screen", is a transfer. India is not on the Commission's adequacy list, so the transfer needs a safeguard:
- A processor contract under Article 28, saying what I may do with the data and on whose instructions.
- The standard contractual clauses from Commission Decision 2021/914: Module Two (controller to processor), or Module Three (processor to processor) if your company is itself a processor for its customers. They also cover the Article 28 terms. At the end of the work, at your choice, I delete the data and certify that I have, or return it, as Clause 8.5 says.
- A transfer impact assessment, which Clause 14 asks both parties to document, following the EDPB's six steps. I give you the information it needs.
The EDPB says a processor outside the EU becomes "indirectly subject to some obligations imposed by controllers subject to the GDPR by virtue of contractual arrangements under Article 28". The 72-hour deadline for reporting a breach to the authority applies to you, and I tell you of any breach without undue delay. To keep transfers small, your data stays on servers in an EU region, I get access only to what each task needs, and test or pseudonymized data comes first where the job allows it.
Cookies follow EU rules too. Under Article 5(3) of the ePrivacy Directive, cookies and similar identifiers need prior consent unless they are strictly necessary for the service the visitor asked for, so on a site I build for you, non-essential scripts load only after opt-in. Some national regulators accept narrow exemptions for audience measurement, so your adviser has the final say. An exemption for audience measurement has been proposed in the Digital Omnibus, and the Council agreed its position on 21 October 2026, but Parliament has not voted. Until it is law, the current rules apply. The Omnibus also proposes changes to the GDPR itself, such as a longer breach deadline, and those are not law either.
What does the AI Act mean for a chatbot or agent I build?
Most of the duties that matter for a business chatbot are already in force. The Digital Omnibus on AI (Regulation (EU) 2026/1744) has applied since 27 July 2026 and moved some dates, but not the chatbot rule.
- Telling people it is AI. Article 50(1) has applied since 2 August 2026. People must be informed they are interacting with an AI system "at the latest at the time of the first interaction", in a clear way that meets accessibility requirements. The Commission's guidance names "chatbots, AI agents, and avatars", and there is no grace period. A chatbot or agent I build for you that talks to people says so in its first message.
- Who is responsible. Under Article 3(3), a business that "has an AI system … developed" and puts it into service under its own name is its provider, so that is usually you, not the developer you hire. The Commission adds that a business "remains a deployer even if third parties (e.g. contractors, freelancers) are involved in the operation of the system". I build the system so you can meet Article 50.
- Marking generated content. Under Article 50(2), the provider of a system that generates synthetic images, audio, video or text must mark the output in a machine-readable way. Systems already on the market before 2 August 2026 have until 2 December 2026. This can reach a chatbot's own text replies, so in scoping I check how your model provider marks its output and what the Commission's guidelines exempt.
- High-risk uses moved. The rules for high-risk systems, such as AI used in hiring or credit decisions, now apply from 2 December 2027, or 2 August 2028 for AI built into regulated products. Tell me in the first call if the AI decides anything about people.
- Fines and training. Breaching Article 50 can cost up to €15 million or 3% of worldwide turnover, whichever is higher; for SMEs, whichever is lower. Article 4 asks providers and deployers to support AI literacy among their staff, and the handover call for your team is part of the project.
Where do the AI model calls run?
Your app and database can run in an EU region of AWS, Azure or Google Cloud, such as Frankfurt or Paris. AI model calls depend on the provider. OpenAI's European endpoint, covering the EEA and Switzerland, stores and processes data there, but only for accounts OpenAI approves, with extra retention terms signed. Anthropic's own API offers US or global processing only, so EU-only Claude means Amazon Bedrock's EU inference profile called from an EU region, or Google Cloud's EU endpoint. AWS advises checking every destination region, and Google says its endpoints alone do not guarantee data residency. Azure OpenAI offers an EU Data Zone, which can also include Norway and Switzerland. I set this up in your accounts, and none of it removes the need for the GDPR contract above.
Does the European Accessibility Act apply to your site?
If you sell to consumers online, probably yes. Since 28 June 2025, the Act covers e-commerce services, consumer banking, e-books and some transport and communications services. It defines a service provider as anyone who "makes offers to provide such a service to consumers in the Union", with no requirement to be based in the EU. Its requirements name the identification, security and payment functions of an online service, on top of the site as a whole, which on a shop includes login and checkout.
- Who is exempt. Service businesses with fewer than 10 staff and an annual turnover or balance sheet of €2 million or less. Check with your adviser whether you qualify.
- What I build to. WCAG 2.2 Level AA, which version 4.1.1 of the EN 301 549 standard treats as equivalent to its web clauses. As of 29 October 2026, no harmonized standard is cited in the Official Journal under the Act, so I do not certify compliance or claim a presumption of conformity.
- What you publish. The Act asks service providers to explain how the service meets the requirements, in the terms and conditions or an equivalent document. I can draft that page from the build.
- Enforcement. Germany's version of the law sets fines of up to €100,000 for offering a non-compliant service, and the authority can order the service to stop.
What can I set up for EU hosting companies on WHMCS?
EU hosting companies face deadlines that WHMCS does not cover on its own.
- E-invoicing. Belgian businesses have exchanged structured e-invoices over Peppol since 1 January 2026. In Germany, every business can already receive e-invoices, and issuing them becomes mandatory from 1 January 2027, or from 1 January 2028 for businesses with prior-year turnover of €800,000 or less, in formats such as XRechnung or ZUGFeRD. Poland's KSeF has been mandatory for issuing invoices since 1 February 2026 for the largest businesses and since 1 April 2026 for the rest, apart from the smallest. In France, large and mid-size companies have issued e-invoices since 1 September 2026, and smaller ones follow from 1 September 2027. WHMCS's own E-Invoicing addon, released on 17 September 2026, sends invoices to an e-invoicing service in Peppol format, but it is a limited release for invited users and supports Belgium only. For Germany, France or Poland you need a third-party module or a custom integration, which I scope as a module project.
- VAT numbers. WHMCS can check EU VAT numbers against VIES and mark validated business customers as tax exempt, while Home Country Exclusion keeps charging VAT at home. I set the rules and test them with real numbers.
- Switching under the Data Act. If you sell cloud, VPS or SaaS services in the Data Act's sense, its switching rules have applied since 12 September 2025, wherever the provider is based. From 12 January 2027, providers may not charge for switching, data egress included. Contracts need the switching terms and your website needs the jurisdiction notice. I can build the export and switching request flow and take migration-out fees out of WHMCS.
- Domains. Under NIS2, national laws require registrars and resellers to keep accurate, complete registration data, regardless of their size. Check your country's version, because in July 2026 the Commission took four member states to court for not transposing NIS2. Registries want the real customer as holder. SIDN can cancel a .nl name held by a reseller, .eu needs an EU or EEA citizen, resident or business as holder, and .fr a holder resident or located in the EU, the EEA or Switzerland. In the WHMCS 9.0 release I checked, the default .eu fields leave Iceland, Liechtenstein and Norway out of the citizenship list, although EURid has accepted their citizens since 2021, so the fields file needs an update.
- SEPA and local payments. WHMCS now recommends its Stripe Dynamic Payments module over the older Stripe SEPA module. Stored payment methods can move across, but a SEPA debit can take up to 14 business days to confirm, so the old module stays active until pending payments clear. GoCardless has an official module that supports EUR. For Dutch customers, the scheme owner says iDEAL merchants move to Wero by the end of 2027 at the latest.
Scope, safety and proof for WHMCS work are on my hire a WHMCS developer page.
How can you check my work?
Clients in EU countries are not named on this site. The nearest named example is Krunus, a UK hosting company whose website shows plan prices with VAT. My AI chatbot product, MagizAI, is in the portfolio too, and the rest of my work is in my portfolio. My Upwork and Fiverr profiles carry the public reviews: Top Rated on both, with 580+ five-star reviews on Fiverr. For UK businesses, my UK page covers HMRC, the UK GDPR and Nominet.
When am I the wrong choice for you?
- You need meetings, contracts or support in German, French, Dutch or another language. I work in English.
- Your contract or tender requires a supplier established in the EU, or an EU VAT number.
- You need someone on site, or a large team at once. I am one developer.
- The cheapest hourly rate decides. My rate is $55-$65, which buys one senior developer who scopes, builds and supports the work.
Disclosure: I am an independent developer, not affiliated with OpenAI or Anthropic. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI. Tax, data protection, AI Act, accessibility and payment points on this page summarize EU law, the European Commission, the Council, the EDPB, the tax authorities of Germany, Belgium, Poland and France, Germany's accessibility law, ETSI, EURid, SIDN, Afnic, Currence, WHMCS and the payment, cloud and AI providers as read on 29 October 2026. They are not legal or tax advice.
Who this is for
- EU startups and SaaS companies that want an AI agent, a chatbot or a product feature built by one accountable senior developer
- EU hosting companies on WHMCS that need e-invoicing, VIES checks, SEPA billing or EU domain fields set up
- Online shops and consumer services that need a site built toward the European Accessibility Act
- Teams with in-house developers who need senior help on a defined project
What is included
- A free scoping call of about 30 minutes in your morning, then a written scope and fixed quote within one business day
- A call slot agreed inside the overlap hours, plus a written update each working day
- Invoices without VAT, marked Reverse charge and showing your VAT number, checked in VIES
- A processor contract and the EU standard contractual clauses (Module Two, or Module Three if you are a processor yourself) before I get access to personal data
- An AI disclosure on every chatbot and agent that talks to people
- Websites and web apps built toward WCAG 2.2 AA (I do not certify compliance)
- Hosting in an EU region, with model accounts, API keys and domains opened in your company's name
- Code in your repository, deployment notes and two weeks of support after delivery
How the work runs
-
1
Scoping call
About 30 minutes in your morning on the problem, the systems involved and who will use the result. A written scope and fixed quote follow within one business day.
-
2
Quote and paperwork
The quote lists what is built, what is left out, the price, the payment stages and who owns the code. If the work touches personal data, the processor contract and standard contractual clauses are signed before I get access.
-
3
Build on staging
I build on a staging copy, review every change myself and send a written update each working day. We talk live in the agreed slot.
-
4
Review and acceptance
You test on staging against the scope, and fixes go in before launch.
-
5
Launch and handover
Production deployment, the repository, notes and a walkthrough call for your team, then two weeks of support.
Guides on this topic
All guides →-
AI Chatbot for Your Website: Ready-Made Tool or Custom Build?
Most site owners choose between a hosted AI chatbot tool on a monthly plan and a custom bot trained on their own content. I compare four real tools' plans and limits, the costs of each route, and how to judge answers.
-
How Much Does It Cost to Build an AI Agent or AI Chatbot?
Build hours by cost driver, monthly token bills worked out with Anthropic and OpenAI prices read on 15 October 2026, the costs people forget, a quote checklist and when not to build.
-
WHMCS GDPR Compliance Setup: Retention, Consent, Export and Deletion
Which WHMCS settings help with GDPR, from the current WHMCS docs: automatic deletion of inactive clients, marketing opt-in, terms acceptance, JSON export, client deletion, and the gaps you cover yourself.
-
WHMCS Tax Setup: UK and EU VAT, Australian GST and US Sales Tax
How to set up tax in WHMCS 9.1 for UK VAT, EU VAT, Australian GST and US state sales tax: tax rules, inclusive or exclusive prices, VAT number checks, paid invoice numbering and launch checks.
Frequently asked questions
What hours do you overlap with Europe?
Your morning is afternoon in India. From 25 October 2026 to 27 March 2027, 9:00 to 13:00 in Berlin, Paris or Amsterdam is 13:30 to 17:30 in India. In Dublin or Lisbon it is 14:30 to 18:30, and in Helsinki or Athens 12:30 to 16:30. From 28 March 2027 each window moves one hour earlier, because India does not change its clocks. We agree a call slot in the quote.
Do you charge VAT?
Not for business customers. Under Article 44 of the VAT Directive, business-to-business services are taxed where the customer is established, and under Article 196 the customer pays the VAT when the supplier is not established in that country. My invoice shows your VAT number and the words Reverse charge, as Article 226 requires, and I check the number in VIES first. If your business has no VAT number, ask your accountant, because the reverse charge can still apply to you.
Do your invoices have to be e-invoices?
The national e-invoicing mandates bind businesses established in the country. Germany's applies when both supplier and customer are established in Germany, and Belgium and Poland exclude suppliers with no establishment there. In France, from 1 September 2027, the French customer reports a reverse-charged purchase from a foreign supplier itself. So my invoices are PDFs that carry what your systems need: a number, the date, the totals, the currency and Reverse charge. If your own company must issue e-invoices from WHMCS, see the WHMCS section.
Can a developer in India work on our customer data under the GDPR?
Yes, with the right contract. The EDPB treats remote access from outside the EEA, even only viewing data on a screen, as a transfer, and India has no adequacy decision. So we sign a processor contract and the standard contractual clauses (Module Two, controller to processor, or Module Three if you are a processor yourself; they also cover the Article 28 terms), and we document a transfer impact assessment. Your data can stay on servers in an EU region, such as Frankfurt, Ireland or Paris.
What does the AI Act require from a chatbot?
Since 2 August 2026, Article 50 requires that people are told they are interacting with an AI system, at the latest at the first interaction, unless that is obvious. The Commission's guidance names chatbots and AI agents, and there is no grace period for this rule. A business that has an AI system developed and puts it into service under its own name is its provider, so that is usually you, and a chatbot I build for you shows the disclosure from the first message.
Is our online shop covered by the European Accessibility Act?
Probably, if it sells to consumers. Since 28 June 2025 the Act covers e-commerce services, and its definition of a service provider covers anyone offering a service to consumers in the EU, with no condition that the provider is based in the EU. Service businesses with fewer than 10 staff and an annual turnover or balance sheet of €2 million or less are exempt. I build toward WCAG 2.2 AA, which version 4.1.1 of the EN 301 549 standard maps to, but I do not certify compliance.
Can our AI model calls stay in Europe?
Yes, with the right provider. OpenAI offers a European endpoint, covering the EEA and Switzerland, with storage and processing there for customers it approves. Anthropic's own API offers US or global processing only, so EU-only Claude means Amazon Bedrock's EU profile or Google Cloud's EU endpoint, with the routing checked. Azure OpenAI has an EU Data Zone, which can also include Norway and Switzerland. Access from India is still a transfer, so the contract stays in place.
Do you work in German, French or Dutch?
No. I work in English. A site can carry content in several languages that your team or translator supplies, but our meetings, contracts and support are in English.
Related services
-
Hire AI Developer: AI Agents, Chatbots, RAG and AI Features
Hire AI developer Shahid Malla, a freelance AI developer for agents, chatbots, RAG, MCP servers and AI feature...
-
AI Agent Development: Hire an AI Agent Developer
Agentic AI development for hosting and SaaS teams: AI agents that answer tickets from your knowledge base, upd...
-
AI Chatbot Developer: Chatbots for Websites, WhatsApp and Support
AI chatbot developer behind MagizAI. I build chatbots for websites, WhatsApp and WHMCS that answer from your d...
-
SaaS Developer: Build a SaaS Website or Product
Freelance SaaS developer for SaaS websites, MVPs and customer portals on Laravel and Filament, with Stripe, Pa...
-
Hire WHMCS Developer: Scope, Safety and Proof
Hire a WHMCS developer with 13+ years and 900+ projects. See which jobs need one, how changes stay upgrade-saf...
-
How I Work: Process, Rates and Payment
How a project with me runs: free 30-minute scoping call, written quote within one business day, $55-$65 per ho...
Ready to talk about your project?
You deal with me personally from the first message to the handover. Choose the way that suits you; I reply within one business day.