Unlike the European Union, India has deliberately avoided enacting a single, horizontal AI statute. Instead, the Ministry of Electronics and Information Technology released the India AI Governance Guidelines in November 2025, formally unveiled around the India AI Summit in early 2026 — a voluntary, principles-based framework built on seven guiding “sutras”: trust, human-centricity, fairness and equity, accountability, transparency (“understandable by design”), safety and robustness, and inclusive, sustainable innovation. For a country positioning itself as both a major AI talent pool and a testbed for AI deployment across 1.4 billion people, the choice of a “techno-legal,” advisory-first approach over binding regulation is itself a significant policy statement.
Advisory Guidelines, Hardening Around the Edges
Calling India’s approach “unregulated” would be inaccurate. The Guidelines themselves are non-binding, but they sit atop — and are increasingly reinforced by — a patchwork of genuinely binding law. The Digital Personal Data Protection Act’s rules, notified in 2025, restrict the scraping or use of personal data to train large language models without explicit, unambiguous consent. The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, which came into force in February 2026, are India’s first binding rules explicitly defining “synthetically generated information” and imposing mandatory labelling, provenance metadata and takedown timelines — a strict three-hour window for synthetic content generally, tightened to two hours for non-consensual synthetic sexual content — with loss of safe-harbour immunity, and consequent civil and criminal exposure, for non-compliant intermediaries.
Sector Regulators Are Not Waiting
Where MeitY has moved cautiously at the horizontal level, sectoral regulators have moved faster within their own domains. SEBI’s Regulation 16C places the entire compliance and data-security burden for AI-driven tools on the regulated entity deploying them, regardless of whether the underlying model was built in-house or licensed from a vendor. The Reserve Bank of India’s FREE-AI framework offers advisory guidance to the financial sector on responsible AI adoption, stopping short of binding rules but signalling where enforcement priorities are likely to concentrate. The cumulative effect is a regulatory landscape that is technically “light-touch” at the centre but considerably firmer at the sectoral edges — closer to the American model of regulation-by-existing-statute than to the EU’s comprehensive AI Act.
The Deepfake Problem as the Guidelines’ First Real Test
If there is one issue driving India’s AI governance conversation from the op-ed page into enforceable rules, it is synthetic media — deepfakes used for non-consensual intimate imagery, electoral disinformation, and financial fraud impersonating public figures. The 2026 IT Amendment Rules’ provenance-labelling and rapid-takedown requirements are a direct legislative response to this pressure, and they represent the clearest instance so far of a “sutra” (transparency, safety) migrating from advisory guideline into binding intermediary obligation.
The Open Question: A Dedicated AI Statute
Proposals for a standalone AI (Ethics and Accountability) framework, and a broader Digital India Act to eventually replace the outdated IT Act, 2000, remain under discussion rather than enacted. Whether India ultimately follows the EU toward comprehensive, risk-tiered AI legislation, or continues extending its current patchwork of DPDP, IT Rules and sectoral regulation, is likely to be one of the defining Indian technology-law questions of the next three to five years — and a rich, still-unsettled area for student research and comment.
Leave a Comment