AI Law in India: Ultimate Guide till 2026

1.AI Law in India: Where Things Stand in 2026

For most of the last decade, the honest answer to "is there an AI law in India?" was simply "no". Artificial intelligence was governed indirectly — by a cybercrime statute written in 2000, by consumer and criminal law, and by policy papers that carried moral but not legal force. That answer is now too simple. Between November 2025 and February 2026, the Government operationalised the Digital Personal Data Protection Rules, released binding AI Governance Guidelines, and amended the IT Rules to create India's first enforceable, AI-specific due diligence regime for synthetically generated information. AI law in India, in September 2026, is a functioning system — fragmented, layered and still missing its centrepiece, but no longer empty.

The scale of what is being regulated justifies the attention. The Government's own reckoning is that artificial intelligence could add up to $1.7 trillion to India's economy by 2035, and India describes itself as the world's third-largest AI ecosystem. Public money has followed the ambition: the IndiaAI Mission, approved by the Cabinet on 7 March 2024 with an outlay of ₹10,371.92 crore over five years, is building sovereign compute capacity, funding indigenous foundation models and seeding an AI safety research infrastructure. Thousands of Indian startups, banks, hospitals, courts and government departments already deploy AI in production.

The legal response to that reality has been deliberate and, by design, incremental. India has repeatedly stated — in Parliament, in consultation papers and through its regulators — that it prefers to work through existing, technology-neutral laws, strengthening them as harms emerge, rather than enacting a single, economy-wide AI statute along European lines. That posture produced the March 2024 advisories to AI platforms, the DPDP Rules of November 2025, the AI Governance Guidelines of the same month, and the February 2026 IT Rules amendments. It has also begun to soften: in June and July 2026, both the Union Minister for Electronics and Information Technology and the MeitY Secretary publicly acknowledged that a dedicated AI law may now be needed. This guide maps all of it — the law that exists, the policy that shapes it, the institutions that enforce it, and the statute that may be coming.

2.The Legal Architecture: Four Layers, No Single Statute

Anyone advising on AI in India needs to read four distinct layers of the legal stack at once. None of them mentions "artificial intelligence" in its title (the DPDP Act comes closest, governing the data that AI runs on), yet together they cover most AI conduct that matters legally.

General law fills the gaps between the layers. The Consumer Protection Act, 2019 reaches AI-driven products and services through deficiency-in-service and product-liability provisions; the Bharatiya Nyaya Sanhita, 2023 supplies offences — cheating, impersonation, defamation, sexual-harassment provisions — that courts and police have applied to deepfakes and AI-enabled fraud; and the Constitution's equality and privacy jurisprudence constrains algorithmic decision-making by the State.

3.The IT Act, 2000 and the Deepfake Rules of 2026

The IT Act predates modern AI by two decades, but its intermediary framework has become the main vehicle through which India regulates AI-generated content. Section 79 of the Act grants intermediaries safe harbour from liability for third-party information, conditioned on observing due diligence under the rules — and the rules have now been rewritten with AI squarely in mind.

3.1 The 2024 advisories: India's first AI-specific compliance signals

In December 2023 and March 2024, following concerns over deepfakes and election-season synthetic content, MeitY issued a series of advisories to intermediaries and platforms. The advisory of 1 March 2024 told platforms that under-tested or unreliable AI models, LLMs, generative AI software or algorithms should be made available to users in India only with the explicit permission of the Government of India, and only with appropriate labelling of their inherent fallibility. After sharp industry pushback, a modified advisory of 15 March 2024 dropped the government-permission requirement but retained the substance that still defines Indian practice: AI models must not permit bias or discrimination or threaten the integrity of the electoral process; unreliable outputs must be labelled (including through consent popups); and any synthetic text, audio or visual content capable of misuse as misinformation or deepfake must carry a permanent unique metadata or identifier identifying the platform resource that created it.

Advisories are not legislation, and the 2024 instruments were cast as due-diligence reminders rather than new law. But they were the first formal articulation of obligations specific to generative AI in India, and nearly all of their substance has since been codified — first in the October 2025 draft, then in the binding 2026 amendments described next.

3.2 The IT Rules Amendment, 2026: India's first binding AI-specific obligations

On 22 October 2025, MeitY published draft amendments to the IT Rules, 2021 on "synthetically generated information" for public consultation, with comments due by 6 November 2025. The final Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 were notified on 10 February 2026 (G.S.R. 120(E)) and came into force on 20 February 2026. With them, India acquired its first binding, AI-specific legal obligations. The key requirements are:

The enforcement logic is the same as it has always been under the IT Act: failure to observe due diligence costs the intermediary its safe harbour under Section 79, exposing it to prosecution under existing law. In a July 2026 written reply in the Lok Sabha, the Government confirmed that whether a generative AI system or chatbot qualifies as an "intermediary" under Section 2(1)(w) — and therefore whether it enjoys Section 79 protection — depends on the nature of the service it provides and the functions it performs. An AI system that merely provides access to third-party content stands differently from one that independently generates content. That functional test is now the pivotal question for every foundation-model provider operating in India.

4.The DPDP Act, 2023 and the DPDP Rules, 2025

The Digital Personal Data Protection Act, 2023 is India's foundational data law and, in practice, the closest thing AI companies have to a dedicated regulator-facing statute. It received Presidential assent on 11 August 2023, after an earlier Personal Data Protection Bill was withdrawn in 2022 in the face of a joint parliamentary committee report recommending dozens of amendments. The Act regulates "digital personal data" — data that is digitised, or likely to be digitised — and applies to processing done in India, and to processing abroad in connection with offering goods or services in India. Training and operating AI systems is processing, which pulls virtually the entire AI stack within its perimeter.

4.1 What the Act requires of AI companies

Cross-border transfers under the Act follow a negative list: the Government may restrict transfers to specific countries, an approach deliberately friendlier to cloud-based AI supply chains than a localisation mandate.

4.2 The DPDP Rules, 2025: from statute to system

For over two years the Act existed without rules, and therefore without operational force. That changed when the draft Digital Personal Data Protection Rules were published on 3 January 2025 for consultation, and the final DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)), following a consultation that drew nearly seven thousand public inputs. The Rules operationalise the Act on a deliberately gentle glide path:

For AI teams the planning implication is simple: enforcement risk under the DPDP regime is now real but staged. The Board exists and can act; the full compliance clock runs out in May 2027; and in the interim, every AI product that touches personal data should be building consent notices, breach playbooks and data-inventory discipline against the Rules' detailed specifications.

5.The IndiaAI Mission and the AI Safety Institute

India's most consequential intervention in AI is not a restriction but an investment. Approved by the Cabinet on 7 March 2024, the IndiaAI Mission carries an outlay of ₹10,371.92 crore over five years, organised into seven pillars — compute capacity, foundation models, datasets, application development, future skills, startup financing, and Safe & Trusted AI. Implemented by MeitY through an Independent Business Division under the Digital India Corporation, the Mission is simultaneously an industrial policy and, through its safety pillar, a governance experiment.

The compute pillar is the headline. From an initial target of 10,000 GPUs, the Mission had onboarded 38,231 GPUs by March 2026 through four rounds of empanelment of AI cloud service providers, offered to startups, MSMEs, researchers and government entities at a subsidised rate of roughly ₹65 per GPU-hour — about 40% below market, and under a dollar an hour. In February 2026, IndiaAI's CEO stated that installed capacity could roughly triple to about one lakh GPUs by the end of 2026, with fresh tenders opened and 20,000 additional GPUs already in the pipeline. India's stated aim is sovereign AI capability: compute, models and data anchored in Indian institutions rather than imported wholesale.

The safety pillar matters more to lawyers than its modest budget suggests. In January 2025, the Minister for Electronics and Information Technology announced the IndiaAI Safety Institute (AISI) under the Safe and Trusted pillar — a deliberately virtual, hub-and-spoke institution that works through partner cells in academia, industry and government rather than a brick-and-mortar secretariat. It has funded responsible-AI projects across watermarking and labelling, ethical AI frameworks, risk assessment, stress testing, deepfake detection, machine unlearning, privacy-enhancing tools, explainable AI and bias mitigation — thirteen projects had been approved by 2026 — and issued a call for partner institutions in May 2025. The AI Governance Guidelines released in November 2025 assign the AISI a central role: testing and evaluating AI systems, advising policymakers, and anchoring India's participation in the international network of AI safety institutes.

6.NITI Aayog and India's Responsible AI Approach

India's AI governance vocabulary was written by NITI Aayog years before any binding rule existed. The National Strategy for Artificial Intelligence (2018) — the country's first official AI policy document — positioned AI as a tool for social transformation under the banner of "#AIforAll", focusing on healthcare, agriculture, education, smart cities and transport. In 2021, NITI Aayog followed with the two-part Responsible AI for All approach document and its operationalising sequel, which set out India's foundational AI-ethics principles: safety and reliability; equality; inclusivity and non-discrimination; privacy and security; transparency; accountability; and the protection and reinforcement of positive human values.

Those papers proposed a risk-based approach — stricter oversight for higher-stakes deployments in healthcare, policing or the judiciary, lighter rules for low-risk uses — and recommended mechanisms such as red-teaming, adversarial testing and incident reporting that prefigure what later frameworks made concrete. Although NITI Aayog's documents never became law, they became the shared reference point for every regulator that followed: the RBI's committee cited the same principles, MeitY's subcommittee built on the same taxonomy, and sectoral guidance in health and finance echoes its language.

6.1 From NITI Aayog to MeitY: the AI Governance Guidelines of 2025

The baton passed formally to MeitY. A subcommittee on AI governance and guidelines development, working under a multi-stakeholder Advisory Group chaired by the Principal Scientific Advisor, produced a report published for public consultation on 6 January 2025 (consultation concluded 27 February 2025, drawing over a hundred suggestions). A dedicated drafting committee constituted in July 2025 then produced the final AI Governance Guidelines, released on 5 November 2025 — the clearest statement yet of India's governing philosophy for AI.

The Guidelines adopt seven guiding principles or "sutras", adapted from the RBI FREE-AI committee's framework for the financial sector: Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; and Safety, Resilience and Sustainability. Under these principles, the Guidelines make recommendations across six pillars — infrastructure, policy and regulation, capacity, institutions, and the mitigation of risks to individuals and society — and propose a whole-of-government institutional architecture:

• An AI Governance Group (AIGG) — described in a February 2026 parliamentary reply as the AI Governance and Economic Group — as a permanent, high-level inter-ministerial body to steer national AI policy;
• a Technology and Policy Expert Committee (TPEC) to supply technical and policy advice to the Group;
• the AI Safety Institute as the technical anchor for testing, evaluation and safety research; and
• continued sectoral enforcement by existing regulators within their domains, with MeitY as the nodal ministry coordinating the whole.

The Guidelines also commit to an action plan: India-specific risk assessment and classification frameworks with sectoral inputs, regulatory gap analysis, voluntary compliance frameworks, a master circular consolidating applicable rules, the groundwork for an AI incidents database and grievance redressal, and liability regimes mapped across the AI value chain. Notably, the committee chair emphasised on release that the document is not styled an "AI Regulation of India" — the intent being to enable AI development, not throttle it. That framing is itself the policy: guidelines first, legislation only when necessary.

7.Sectoral AI Regulation: RBI, SEBI, IRDAI and CERT-In

While Parliament legislated horizontally, India's sector regulators quietly built the most operationally specific AI governance in the country. Their premise is consistent: the technology is welcome, the accountability stays with the regulated entity.

7.1 RBI and the FREE-AI framework

In December 2024, the Reserve Bank constituted a committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the financial sector; its report was released on 13 August 2025. The FREE-AI framework rests on seven sutras and six strategic pillars (infrastructure, policy and capacity on the innovation side; governance, protection and assurance on the risk side), and makes twenty-six actionable recommendations — among them board-approved AI policies for every regulated entity, AI inventories and repositories, model-lifecycle governance, AI incident reporting with a non-punitive sector-wide database, red-teaming, AI disclosures in annual reports, an AI innovation sandbox, indigenous sector-specific models as public goods, and a graded liability framework. Its influence is visible well beyond banking: MeitY's national AI Governance Guidelines adapted their seven principles from this report, making the RBI the doctrinal first mover of Indian AI governance.

7.2 SEBI: from inventory to accountability

SEBI has required reporting of AI and ML applications by stockbrokers, market infrastructure institutions and mutual funds since 2019. In December 2024, its Board approved amendments to the Intermediaries, SECC and Depositories Regulations assigning responsibility for AI-tool use squarely to regulated persons: an intermediary using AI tools — whether built in-house or procured from a vendor — is solely responsible for the privacy, security and integrity of investor data, for the output of those tools, and for legal compliance. A June 2025 consultation paper on responsible AI/ML usage in Indian securities markets proposed a tiered, "regulatory-lite" approach: full disclosure, testing and documentation duties where AI directly affects customers (algo selection, portfolio and advisory services), and lighter obligations for internal uses such as surveillance and compliance, with investor-facing disclosure, segregated pre-deployment testing, continuous monitoring, and five-year documentation of model logic, inputs and outputs. Separately, SEBI's February 2025 framework for retail algorithmic trading — unique exchange tagging of API-sourced algo orders, empanelment of algo providers, exchange kill-switches — became fully applicable to all stock brokers from 1 April 2026.

7.3 IRDAI and the insurance sector

IRDAI moved later but concretely. Following revised information and cyber security guidelines issued for insurers in April 2026, the regulator constituted a seven-member working group on AI — chaired by Prof. Sandeep K. Shukla of IIIT Hyderabad — announced in June 2026, to assess AI adoption and governance across the insurance ecosystem. Its terms of reference include a structural inventory of AI systems used by regulated entities, an AI governance framework for ethical, transparent and explainable adoption (including in claims and fraud prevention), a pre- and post-deployment AI audit framework, sector-wide stress tests, and security controls against AI-driven automated attacks, alongside review of global supervisory approaches and policyholder data protection.

7.4 CERT-In and the security layer

CERT-In, India's cybersecurity incident-response agency, has issued a series of AI-relevant advisories: guidance on adversarial threats arising from AI-based applications (May 2023), best practices for the effective and responsible use of generative AI solutions (March 2025), and technical guidelines on the AI Bill of Materials (July 2025) — requiring structured documentation of model architecture, training-data sources, known vulnerabilities and security requirements for AI systems in the supply chain. Its Certified Security Professional in AI programme, launched with industry in September 2024, builds the audit capacity this documentation regime implies.

8.India vs the European Union: Two Regulatory Philosophies

The EU AI Act — the world's first comprehensive, horizontal AI statute — is the inevitable benchmark, and the contrast with India is instructive. The EU chose ex-ante, risk-tiered legislation: practices deemed an unacceptable risk (certain social scoring, manipulative systems, untargeted facial-image scraping) are banned; high-risk systems in areas like employment, credit, education and law enforcement face conformity assessments, risk management, technical documentation, human oversight and post-market monitoring; general-purpose model providers carry transparency and (for the most powerful models) systemic-risk obligations; and penalties reach up to €35 million or 7% of global turnover. India chose the opposite path: existing technology-neutral law, sectoral rules, and guideline-led policy — with no risk tiers, no conformity assessment, and penalties attached only to data-protection failures.

The EU's own timeline shows the cost of the prescriptive route. The AI Act entered into force on 1 August 2024, with prohibitions applying from 2 February 2025, general-purpose AI obligations from 2 August 2025, and the bulk of the Act — including Article 50 transparency duties for chatbots and synthetic-content marking — from 2 August 2026. But with harmonised standards and guidance running late, the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026), pushing the high-risk obligations for Annex III systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products from 2 August 2027 to 2 August 2028, while adding new prohibitions on non-consensual sexual deepfakes from 2 December 2026. The deferral is candidly a simplification measure — and Indian policymakers have cited exactly this experience when explaining why they will not copy the model wholesale.

Which approach is "right" is a live debate. The Indian position is that premature, blanket regulation risks strangling an ecosystem where compute, capital and talent are still being assembled, and that targeted rules against demonstrated harms (deepfakes, data misuse, sectoral failures) deliver protection without the compliance drag. Critics respond that guideline-led governance leaves citizens without enforceable rights against algorithmic harm, entrenches a surveillance capacity without statutory guardrails, and leaves smaller jurisdictions to follow whoever moves first. Both positions have merit; the honest summary is that India is running a live experiment in governing frontier technology with existing law, and the world is watching the results.

9.The "AI Act India" Debate

Whether India should enact a dedicated AI Act has moved from an academic question to a live policy debate inside the Government itself — and the Government's answer has changed within a single year.

The long-standing position was a firm no. In 2023, the IT Ministry told Parliament in a written reply that the Government was not considering bringing a law or regulating the growth of artificial intelligence in India, framing AI as a kinetic enabler of the digital economy. A separate strand of thinking proposed folding AI regulation into a new Digital India Act — a project that has since stalled. Through 2024 and 2025 the operative answer became: use the existing toolkit. That produced the advisories, the IT Rules amendments on synthetic content, the DPDP Rules, and the November 2025 Governance Guidelines, whose drafting chair pointedly noted the document was not titled an "AI Regulation of India" because the intent was not to throttle AI development. As late as December 2025, MeitY's Secretary publicly reiterated his inclination to avoid new law unless absolutely necessary, since India already has many.

The first half of 2026 shifted the tone. In June 2026, the Union Minister for Electronics and Information Technology said in an interview that, beyond what has been done under the IT Act framework, "there is a requirement for a new law because the world of AI is very different from the world when the IT Act was enacted in 2000", adding that the Government was discussing a framework with industry to balance innovation and citizen safety. In July 2026, the MeitY Secretary went further: "We will look at AI regulation when the time is right. It appears the time is getting right and we will start" — acknowledging that the ministry could prepare draft legislation, though he could not indicate when a bill might be introduced. A parallel track of parliamentary scrutiny has built the evidentiary base: the Standing Committee on Communications and Information Technology tabled a detailed report on the impact of the emergence of AI, examining governance, readiness and institutional questions.

As of September 2026, no AI bill has been introduced in Parliament. The observable direction of travel is a phased one: binding rules where harms are concrete (content, data, finance), institutional machinery for coordination and safety, and a dedicated statute if and when the gap analysis says one is needed. For practitioners, the practical consequence is that "is there an AI law in India?" is now a question with a timeline attached to its answer.

The Government's approach, restated across advisories, rules and parliamentary replies, has been constant in one respect: the accountability for AI outcomes rests with the entity that deploys the system — and no interim framework has yet displaced the IT Act as the backbone of that accountability. Synthesis of MeitY's stated position, 2024–2026

10.Liability, IP and Open Questions in AI Law in India

Beneath the headline frameworks, a set of harder questions remains genuinely open. Clients should be advised that these are areas of evolving, not settled, law.

10.1 Liability for AI harms

India has no AI-specific liability regime. Harmful AI outcomes are presently addressed through general law: negligence (developers and deployers owe a duty of care for foreseeable harms, from medical misdiagnosis to autonomous-vehicle accidents), the Consumer Protection Act, 2019 (deficiency in service, unfair trade practices, and product-liability provisions covering design and manufacturing defects and failure to warn), contract law, and criminal law. The Bharatiya Nyaya Sanhita, 2023 — which replaced the IPC — supplies offences for cheating, impersonation, identity fraud and sexual-harassment conduct that courts and police have applied to deepfakes and AI-enabled fraud. Where the State deploys AI, constitutional review remains the outer boundary: Articles 14, 15 and 21 have been invoked against biased algorithmic systems in public functions, and surveillance-heavy deployments raise unresolved privacy questions after the Supreme Court's right-to-privacy jurisprudence.

10.2 Intellectual property and AI-generated works

The Copyright Act, 1957 defines an author as a human person — but Section 2(d)(vi) deems the author of a computer-generated work to be "the person who causes the work to be created", a provision drafted long before generative AI that now carries the weight of India's entire position on AI authorship. Purely machine-generated works with no human creative input are unlikely to qualify for protection; AI-assisted works with demonstrable human creativity probably do, on a spectrum that Indian courts have not yet mapped. There is no text-and-data-mining exception, so training models on copyrighted works remains legally contested ground — and litigation elsewhere will shape it here too. Under the Patents Act, 1970, an inventor must be a natural person, so AI cannot be a named inventor, consistent with the international position after the DABUS litigation. A Department for Promotion of Industry and Internal Trade committee reviewing the copyright framework published the first part of a working paper in December 2025 and chose not to recommend statutory amendments, leaving the existing framework in place for now.

10.3 Deepfakes beyond the platform rules

The 2026 IT Rules discipline platforms; they do not, by themselves, create a private right of action for the person depicted. Victims of non-consensual synthetic imagery currently work through a combination of criminal complaints (BNS offences), takedown demands on platforms under the IT Rules' accelerated grievance timelines, and the DPDP Act where their personal data was processed without consent. India has no standalone deepfake statute — the electoral-commission and media advisories of the 2024 general-election cycle filled the gap reactively, and the February 2026 rules are the structural answer so far.

10.4 The unanswered questions

• Facial recognition and surveillance AI: large-scale deployments by police and immigration authorities operate with no dedicated statutory oversight or biometric-protection law; courts have yet to rule definitively on constitutional limits.
• AI in the judiciary: tools such as SUPACE and SUVAS assist with case management and research in the higher judiciary, but no rules govern AI-assisted judicial decision-making or its due-process implications.
• Algorithmic credit: AI-driven scoring by banks, NBFCs and fintechs carries no general transparency mandate; a consumer denied credit by a model has no statutory right to an explanation — a fairness gap the RBI's FREE-AI recommendations acknowledge but do not yet close.
• Labour and gig work: the 2020 Labour Codes do not address algorithmic management, automated hiring discrimination or automation-driven displacement, leaving gig workers governed by opaque platform systems with minimal recourse.
• Cross-border compliance: Indian AI exporters increasingly face simultaneous obligations under the DPDP regime and foreign law such as the EU AI Act — multi-jurisdiction compliance planning is becoming standard work for technology counsel.

11.Compliance Checklist for AI Deployers

For a team building or deploying AI in India today, this is the working compliance map — sequenced by the deadlines that bite first.

12.Myths vs Facts About AI Regulation in India

13.Timeline: How India's AI Governance Evolved

14.Frequently Asked Questions