Writ Petition Article 2026 Guide
When a government department cancels a licence, blacklists a supplier or refuses a statutory approval, the affected business often asks...
Read More →
Businesses adopting AI in India often ask the same question: is there an AI law we must comply with? The short answer is no — India has chosen not to enact a dedicated AI statute for now. The longer answer matters more: the legal obligations already exist, spread across data protection, information technology, consumer and sectoral law.
Businesses adopting AI in India often ask the same question: is there an AI law we must comply with? The short answer is no — India has chosen not to enact a dedicated AI statute for now. The longer answer matters more: the legal obligations already exist, spread across data protection, information technology, consumer and sectoral law.
On 5 November 2025, the Ministry of Electronics and Information Technology released the India AI Governance Guidelines. They set out seven guiding principles, adapted from the Reserve Bank of India's work on responsible AI in finance: trust, people-centricity, innovation over restraint, fairness, accountability, understandability by design, and safety.
The Guidelines are not binding legislation. Their significance is in how they will be used: as a reference point for sector regulators, which keep enforcement powers in their own domains, and as an interpretive aid when questions of negligence, due diligence or rights arise.
Where binding obligations already apply
Personal data. Training, fine-tuning or running AI on personal data engages the Digital Personal Data Protection Act, 2023 and its Rules — notice, purpose, consent, security and retention all apply.
AI-generated media. Amendments to the IT Rules, notified on 10 February 2026 and in force from 20 February 2026, require intermediaries to label "synthetically generated information" — realistic AI-generated or altered audio, images and video — and tighten takedown timelines for unlawful content.
Sector rules. Banking, insurance, securities and telecom regulators expect AI used in regulated activities to meet their existing standards on fairness, outsourcing, explainability and grievance handling.
Contract and consumer law. Misleading AI-driven outputs or undisclosed automated decisions can create liability under ordinary contract and consumer protection principles.
1. Inventory your AI use. List every AI tool and model in use or in development, including features embedded in software you already license. Note what data each uses and what decisions it influences.
2. Tier by risk. A drafting assistant for internal emails is not a credit decision engine. Classify uses by their effect on people and the business, and apply controls proportionately.
3. Keep humans responsible for consequential decisions. Define where AI may recommend and where a named person must decide — for example, on legal conclusions, approvals, claims or employment matters.
4. Fix your vendor contracts. AI vendor terms should address data use (including whether your data trains their models), confidentiality, security, intellectual property in outputs, audit rights and liability.
5. Record what you did and why. Documented risk assessments, testing and review decisions are the evidence regulators, courts and counterparties will ask for
6. Plan for incidents. Decide how you will detect, escalate and correct harmful or inaccurate AI outputs, and how this connects to your data breach procedure.
India's light-touch approach gives businesses room to innovate, but not room to ignore the law. Organisations that build governance into their AI use now — rather than retrofitting it after a complaint or a regulatory change — will adopt AI faster and with fewer surprises.
This article is for general information only and is not legal advice.
India AI Governance Guidelines — AZB & Partners
Analysis of the Guidelines — Mondaq
IT Amendment Rules, 2026 — Nishith Desai Associates
Mandatory AI labelling — Hogan Lovells
