India AI Regulation & Governance

India has no standalone horizontal AI statute. The governing instrument is the India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation, published by the Ministry of Electronics and Information Technology (MeitY) on 5 November 2025, following a drafting committee convened in July 2025. The Guidelines are voluntary and non-binding; they apply existing law — the Digital Personal Data Protection Act and the Information Technology Act — to AI rather than creating new statutory categories, risk tiers, prohibitions or pre-approval requirements of the kind found in the EU AI Act, relying instead on India's existing sectoral regulators. Part 4 of the Guidelines asks AI developers and deployers in India, including foreign entities, to establish a grievance-redressal mechanism and to publish transparency reports. As of reporting on 17 December 2025, India had no standalone AI statute and was not understood to be planning one. The one legislative proposal on record is the Artificial Intelligence (Ethics and Accountability) Bill 2025, a Private Member's Bill introduced in the Lok Sabha on 17 December 2025 that would create a statutory AI Ethics Committee, mandatory bias audits for high-risk AI, developer documentation duties and penalties of up to Rs 5 crore; as a Private Member's Bill it carries no binding force, and the available reporting on it is uncertain as to its prospects.

India's AI Governance Guidelines impose no mandatory risk tiers, no prohibited-use categories and no pre-approval requirement for AI systems, in contrast to jurisdictions that enumerate banned practices. The operative instrument bearing on restricted deployment is MeitY's advisory on AI deployment by intermediaries, revised on 15 March 2024, which has extraterritorial reach. That revision removed the original advisory's requirement that intermediaries obtain explicit government permission before deploying 'under-testing' or 'unreliable' AI models, and removed the associated duty to file an action-taken-cum-status report with the government. No binding prohibited-practices regime has since replaced that permission requirement.

Binding high-risk obligations in India are sectoral rather than horizontal. In securities markets, Regulation 16C of the SEBI (Intermediaries) (Amendment) Regulations, 2025, in force since 10 February 2025, makes stock exchanges and market infrastructure institutions solely liable for the outputs of the AI/ML tools they deploy. Market infrastructure institutions, intermediaries, mutual funds and algorithmic trading members must also disclose their AI/ML applications to SEBI under the AI/ML reporting circular, binding since 1 February 2019 and harmonised across exchanges in 2025, reporting quarterly or half-yearly and filing mandatory NIL declarations where no AI/ML application is in use. In the financial sector more broadly, the Reserve Bank of India's FREE-AI report sets a non-binding supervisory expectation that RBI-regulated entities disclose to customers when they are interacting with AI and provide a channel to challenge AI-driven decisions; this is guidance rather than a binding rule. Outside these sectoral regimes, India's AI Governance Guidelines impose no mandatory risk tiers, no application prohibitions and no pre-approval requirement for AI systems generally.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 were notified on 10 February 2026 and took effect on 20 February 2026, introducing a binding statutory definition of synthetically generated information and binding due-diligence duties for significant social media intermediaries. Under Rule 3(3) and Rule 4(1A), such intermediaries must require users to declare synthetically generated content before it is put into service, verify that declaration technically, and label confirmed synthetically generated content with provenance metadata before publication. Rule 3(3) further requires intermediaries to deploy reasonable technical measures, including automated tools, to prevent the generation or circulation of specified categories of unlawful synthetic content, including child sexual abuse material, non-consensual intimate imagery, obscenity, false documents, explosives or weapons material, and deceptive deepfake impersonation. Under Rule 3(1)(d) and Rule 3(2)(a)-(b), intermediaries must act on takedown and grievance requests within compressed windows: three hours for court or government orders, two hours for non-consensual intimate imagery, thirty-six hours for other unlawful content, and seven days for appeals. Non-compliance with the synthetic-content labelling, verification or takedown due-diligence duties is deemed a failure of due diligence, exposing the intermediary to loss of safe-harbour protection under section 79 of the Information Technology Act. The amendment separately clarifies that an intermediary's good-faith use of automated detection or removal tools to act on synthetically generated information, or its removal or disabling of access to such information through reasonable technical measures in compliance with the Rules, does not by itself breach the safe-harbour conditions in section 79(2)(a) and (b). Routine digital editing and accessibility-related uses of AI are carved out of the due-diligence and labelling obligations, which are aimed at deceptive synthetic media rather than ordinary editing. Alongside this binding regime, MeitY's India AI Governance Guidelines, published 5 November 2025, set out voluntary measures for AI developers and deployers in India, including foreign entities, covering privacy, security, fairness, transparency, grievance redressal and transparency reporting, in the continued absence of a binding horizontal AI law; Part 4 of the Guidelines specifically asks developers and deployers to establish a grievance-redressal mechanism and to publish transparency reports.

Indian copyright law contains no dedicated text-and-data-mining or AI-training exception. The Department for Promotion of Industry and Internal Trade's December 2025 Working Paper confirms that only the ordinary fair-dealing provision in section 52(1)(a) of the Copyright Act, 1957 applies to uses of copyrighted works for AI purposes; there is no specific exception comparable to the EU's text-and-data-mining exceptions. Against that statutory backdrop, the Delhi High Court, in ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, held at the interim-injunction stage on 24 July 2026 that OpenAI's storage of ANI's copyrighted news articles to train ChatGPT falls within the fair-dealing exception in section 52(1)(a)(i) of the Copyright Act, 1957, and that the court has jurisdiction over the dispute. This is an interim finding at the interlocutory stage rather than a final determination of the litigation.

India's binding sectoral framework rests on several statutes operating independently of any horizontal AI law. The Digital Personal Data Protection Act, 2023, in force since 11 August 2023, contains no right against solely automated decision-making comparable to Article 22 of the GDPR and no profiling-specific provision; its only algorithm-adjacent duty is the general data-accuracy requirement. In Karnataka, the Platform Based Gig Workers (Social Security and Welfare) Act, 2025, in force since 11 September 2025, requires under section 13 that aggregators and platforms inform gig workers, in a listed Indian language known to the worker, of the parameters of automated monitoring and decision-making affecting their work conditions, and prevents discrimination arising from such systems; breach of these algorithmic-transparency and anti-discrimination duties attracts a fine starting at Rs. 5,000, though the Act does not clearly specify a ceiling or an enforcing authority. A comparable but less certain obligation is reported in Rajasthan, where the Platform Based Gig Workers Act, 2023 is said to require aggregators to inform gig workers about rating systems, worker classification and personal-data use, though this remains an uncertain reading of the Act. In the medical-device space, the Medical Device Rules, 2017 have governed AI-enabled software performing a medical function since 2017; the Central Drugs Standard Control Organisation's draft guidance of 21 October 2025 clarifies that such software is risk-classified Class A to D under the Rules and introduces an Algorithm Change Protocol permitting iterative AI/ML model updates without requiring re-licensing each time. In securities markets, SEBI's AI/ML reporting circular, binding since 1 February 2019 and harmonised across exchanges in 2025, requires market infrastructure institutions, intermediaries, mutual funds and algorithmic trading members to disclose their AI/ML applications quarterly or half-yearly, including mandatory NIL declarations. In banking and finance, the Reserve Bank of India's Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI), published 13 August 2025, sets out seven non-binding guiding sutras for AI development and risk mitigation and the supervisory expectation that RBI-regulated entities disclose AI interaction to customers and provide a channel to challenge AI-driven decisions. These sector-specific rules sit under SEBI, RBI and IRDAI authority respectively, each operating under its own parent statute rather than a common AI statute. Overarching all of this, MeitY's India AI Governance Guidelines, published 5 November 2025, set out voluntary measures for AI developers and deployers in India, including foreign entities, covering privacy, security, fairness, transparency, grievance redressal and transparency reporting, in the absence of a binding horizontal AI law.

India has no standalone AI safety-incident reporting statute. The closest binding analogue is SEBI's AI/ML reporting circular, harmonised across exchanges in 2025, which requires market infrastructure institutions and intermediaries to disclose their AI/ML applications to SEBI on a quarterly or half-yearly basis, including mandatory NIL declarations where no AI/ML application is deployed. This obligation is specific to securities markets and does not extend to a general AI-incident reporting duty across other sectors.

Enforcement of AI-related rules in India is distributed across sectoral regulators rather than concentrated in a dedicated AI authority: the Ministry of Electronics and Information Technology, the Securities and Exchange Board of India, the Reserve Bank of India and the Central Drugs Standard Control Organisation each supervise AI within their own statutory remit. SEBI's enforcement reach includes Regulation 16C of the SEBI (Intermediaries) (Amendment) Regulations, 2025, in force since 10 February 2025, which makes stock exchanges and market infrastructure institutions solely liable for the outputs of the AI/ML tools they deploy. Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, in force since 20 February 2026, failure to meet synthetically generated information due-diligence or takedown deadlines exposes an intermediary to loss of safe-harbour protection under section 79 of the Information Technology Act, and non-compliance with the labelling, verification or takedown due-diligence duties is itself deemed a failure of due diligence carrying the same consequence. Rule 4(1)(a) of the IT Rules requires significant social media intermediaries to appoint a resident Chief Compliance Officer who carries personal answerability for due-diligence failures. At state level, Karnataka's Platform Based Gig Workers (Social Security and Welfare) Act, 2025 requires aggregators to inform gig workers of automated monitoring and decision-making parameters and to prevent resulting discrimination, with breach attracting a fine starting at Rs. 5,000, though the Act does not specify a clear ceiling or enforcing authority. India has no horizontal AI-specific statute setting fixed or turnover-based penalty tiers comparable to the EU AI Act; enforcement therefore proceeds through these sector-specific instruments. The Delhi High Court is separately seized of ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, concerning the use of copyrighted material to train AI models.

India has no dedicated AI regulatory sandbox instrument on record. The material bearing on flexible or transitional treatment of AI sits within sector-specific regulatory frameworks: the Reserve Bank of India's FREE-AI report, published 13 August 2025, sets out seven guiding sutras for AI development and risk mitigation in the financial sector, framed as non-binding guidance rather than a sandbox scheme. More broadly, India's sector-specific AI rules sit under SEBI, RBI and IRDAI authority, each operating under its own parent statute, rather than under a common AI statute or a dedicated sandbox regime.