Disclaimer

AI Regulation in India: Current Legal Framework

I. INTRODUCTION: WHY AI REGULATION IN INDIA MATTERS FOR BUSINESSES

India does not yet have a single, dedicated law that comprehensively regulates artificial intelligence. Instead, AI-related risks and uses are covered through a mix of existing laws, sector-specific guidelines, and emerging policy frameworks focused on data protection, digital governance, and responsible AI use.

AI systems in India intersect with several legal areas including data protection and privacy, information technology and cyber security, consumer protection, and sector-specific regulations. There is no standalone AI Act in force as of mid-2026.

II. WHAT LAWS CURRENTLY APPLY TO AI IN INDIA

Data protection and privacy are governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) which governs processing of personal data including data used to train or operate AI. Key obligations include lawful purpose, consent with exceptions, data minimization, and rights for individuals.

Information technology and cyber security fall under the Information Technology Act, 2000 and related rules covering electronic records, data security, and cyber offenses. Intermediary guidelines under the IT Rules, 2021 require platforms to take down unlawful content which affects AI-generated or AI-amplified content.

Consumer protection comes from the Consumer Protection Act, 2019 and e-commerce rules which can apply where AI-driven services mislead consumers, hide material information, or cause harm through unfair practices. Sector-specific regulations from RBI, SEBI, IRDAI, and TRAI issue guidelines on use of algorithms, data, and automation in their domains.

III. GOVERNMENT POLICY AND ADVISORY FRAMEWORKS

The National Strategy for Artificial Intelligence by NITI Aayog in 2018 outlines priority sectors like healthcare, agriculture, and education, along with principles like safety, reliability, and inclusivity. It is a strategy document, not law, but it guides public-sector AI projects.

Responsible AI principles from various ministries and NITI Aayog promote principles such as fairness, accountability, transparency, and non-discrimination for AI deployment, especially in public services. MeitY advisories on AI and generative models direct intermediaries and platforms on labeling AI-generated content, preventing deepfakes and synthetic media that violate existing laws, and ensuring compliance with IT Rules when deploying AI models.

These advisories clarify expectations but are not a substitute for legislation.

IV. HOW EXISTING LAWS COVER KEY AI RISKS

Privacy and data use: AI systems often rely on large datasets that may include personal data. The DPDP Act requires clear notice and valid consent with specified exceptions, purpose limitation where data is used only for stated purposes, reasonable security safeguards, and mechanisms for users to exercise rights including access, correction, and grievance redressal. Non-compliance can lead to penalties and enforcement action by the Data Protection Board.

Unlawful or harmful content: AI-generated text, images, audio, or video can raise issues under IT Act and IT Rules for unlawful content, impersonation, defamation, and fake news that violates law. Indian Penal Code or Bharatiya Nyaya Sanhita cover criminal provisions on cheating, forgery, and defamation. Copyright law applies where AI training or outputs infringe protected works. Intermediaries and platforms must act on takedown notices and follow due diligence requirements.

Algorithmic bias and discrimination: India currently has no specific anti-discrimination law focused solely on algorithms. However constitutional principles on equality and non-discrimination inform public-sector AI use. Consumer protection and sectoral regulators can act against unfair or discriminatory practices. Emerging responsible AI guidelines encourage bias testing, impact assessments, and human oversight especially in high-risk sectors like lending, hiring, and public welfare.

V. REAL LIFE SCENARIO

A fintech startup uses an AI model to score loan applicants. The model is trained on historical data that reflects past lending patterns. If the model systematically disadvantages certain communities, affected borrowers may complain under the DPDP Act if personal data is mishandled or used beyond consented purposes, under RBI guidelines if the bank or NBFC using the model violates fair practice norms, and under consumer protection law if the scoring process is opaque and misleading.

There is no specific algorithmic bias statute yet, but multiple existing laws can be invoked depending on the facts.

VI. COMMON MISTAKES AND MYTHS

Myth: There is no regulation of AI in India. Reality: While there is no dedicated AI Act, AI systems are already subject to data protection, IT, consumer, and sectoral laws.

Myth: If my AI is hosted abroad, Indian law does not apply. Reality: If you offer goods or services to users in India or process data of individuals in India, several Indian laws can still apply.

Mistake: Treating AI as a purely technical issue and ignoring legal obligations on data, disclosures, and consumer fairness.

Mistake: Assuming that government advisories have no force. They signal enforcement priorities and can be combined with existing laws in action.

VII. CHECKLIST FOR BUSINESSES USING AI IN INDIA

Map what personal data your AI system collects, processes, or infers. Ensure DPDP Act compliance including notice, consent where required, purpose limitation, and security. Review IT Rules obligations if you operate a platform or intermediary.

Check sector-specific rules from the RBI, SEBI, IRDAI, and TRAI if AI is used in regulated activities. Implement internal controls with human oversight for high-risk decisions, documentation of data sources and model logic as far as practicable, and grievance redressal mechanism for affected users.

Monitor government advisories on deepfakes, generative AI, and platform responsibilities.

VIII. FREQUENTLY ASKED QUESTIONS

Is there a specific AI law in India? No. As of mid-2026, India has no dedicated AI statute. AI is regulated through existing laws on data protection, IT, consumer protection, and sector-specific rules, along with policy frameworks and advisories.

Does the DPDP Act apply to AI training data? Yes, if the training data includes personal data of individuals in India. You must comply with notice, consent unless an exception applies, and other DPDP obligations.

Are deepfakes specifically regulated? There is no separate deepfake law, but deepfakes can violate IT laws, criminal provisions on cheating or forgery, defamation laws, and personality rights. Government advisories also direct platforms to act against harmful synthetic media.

Can foreign AI companies ignore Indian law? Not if they offer services to users in India or process data of individuals in India. Extraterritorial application is possible under data protection and other laws.

IX. KEY TAKEAWAYS

India's AI regulation is currently a patchwork of data protection, IT, consumer, and sectoral laws not a single AI Act. The DPDP Act 2023 is the most significant new law affecting AI that processes personal data.

Government strategies and advisories push for responsible AI but are not substitutes for legal compliance. Businesses should treat AI as a regulated activity by mapping data flows, following DPDP and IT rules, and aligning with sectoral guidelines.

If you are deploying AI in India, start by auditing your data practices and high-risk use cases against the DPDP Act and relevant sectoral rules rather than waiting for a dedicated AI law.