/ AI Regulation Status · Updated 2026-10-22

India AI regulation, principles-based + sector-specific.

India has NOT yet enacted a comprehensive AI-specific law (unlike EU AI Act). Instead, the framework is layered: MeitY advisories (soft regulation), DPDP Act 2023 (data processing), sector-specific regulators' AI frameworks (RBI, SEBI, IRDAI), and pending Digital India Act (DIA) consolidation. For foreign AI / GenAI companies in India, this means navigating multiple parallel rules. Here's the complete 2026 practitioner's framework.

Get a firm quote → WhatsApp instead

Written by CA Durgesh Chavda

Chartered Accountant (ICAI) · Founder, Bharat Quantum Prospera · US incorporation, India-US DTAA, FEMA ODI, NRI taxation, cross-border structuring · LinkedIn

/ Current regulatory layers

Five parallel rules.

MeitY (Ministry of Electronics and Information Technology) advisories: periodic AI advisories (March 2024, December 2024, 2025 advisories) addressing deepfake labelling, GenAI output moderation, AI model registration (for specified large models), accountability.
DPDP Act 2023: applies to AI processing of personal data of Indian residents. Consent, data principal rights, Data Fiduciary / Significant Data Fiduciary tier, cross-border transfer blocklist.
Digital India Act (DIA) draft: consolidation of IT Act 2000 + specific AI provisions pending. Expected to be comprehensive digital governance law covering AI, intermediary liability, online gaming, deepfake, etc. Draft under consultation.
Sector-specific AI frameworks:
— RBI: AI/ML use in financial services - specific caution advisories; model risk management expectations.
— SEBI: AI in securities markets - framework for AI-based advisory, algorithmic trading approval.
— IRDAI: AI in insurance underwriting + claims - specific explainability requirements.
— IndiaAI Mission (2024): INR 10,372 crore outlay for compute infrastructure, model development, startup ecosystem. Mix of policy + capacity-building.
Copyright Act interaction: AI training on copyrighted data, output copyrightability - ongoing judicial consideration.

/ Specific obligations in 2026

What's enforceable now.

Deepfake labelling (MeitY March 2024): AI-generated or AI-modified content must be labelled by intermediary platforms. Automated detection + removal mechanism required.
Large model registration (MeitY): Specific generative AI models at defined threshold may require MeitY intimation / registration before deployment to Indian users.
Content moderation (IT Rules 2021 Amendment): Intermediary rules require Indian representative appointment + content moderation framework + grievance redressal.
DPDP consent for AI training: using Indian user data for AI model training requires explicit consent under DPDP (purpose limitation + consent granularity).
Children's data (DPDP + MeitY advisories): no behavioural monitoring + no targeted advertising + verifiable parental consent for AI products aimed at children.
Harmful content: AI-generated content causing harm (hate speech, misinformation, sexual content involving minors) attracts intermediary liability + IPC criminal consequences.

/ For foreign AI / GenAI companies in India

The compliance stack.

Indian intermediary status under IT Act + Rules - likely applies to foreign AI product offering services to Indian users.
Indian representative appointment (per IT Rules 2021 Amendment).
DPDP compliance for processing Indian user data in training + inference.
Content moderation framework compliant with Indian intermediary rules.
Deepfake labelling on AI-generated / AI-modified content.
Grievance redressal mechanism for Indian users.
Sector-specific compliance if AI product deployed in regulated sectors (financial, insurance, securities, healthcare).
Data localisation where applicable (RBI payment data, SEBI records).
OIDAR GST if B2C paying Indian customers.

/ Looking ahead to DIA + comprehensive AI law

What's coming.

Digital India Act (DIA) is expected to consolidate IT Act + specific AI/digital provisions. Draft under consultation; final enactment timeline uncertain (likely 2026-2027).
Comprehensive AI-specific law (analogous to EU AI Act): under policy discussion. Likely risk-tiered (low / medium / high / unacceptable risk) similar to EU framework.
Likely obligations in future comprehensive AI law: AI system registration, risk classification, impact assessment, transparency, accountability, red-teaming for high-risk AI, human oversight.
Prudent approach for foreign AI companies: build on top of DPDP + MeitY + sector-specific frameworks now; expand to meet future comprehensive AI law when enacted.

Last updated: 2026-10-22.

/ Ready when you are

Foreign AI / GenAI product serving Indian users?

Layered compliance: DPDP + MeitY + intermediary rules + sector-specific. BQP integrated AI compliance stack. Scope-based engagement + co-ordinated with foreign AI counsel.

Get a firm quote → WhatsApp Durgesh

FAQ

Common questions, answered.

Does India have a comprehensive AI-specific law?

Not yet (October 2026). India's AI regulation is layered via multiple existing frameworks: MeitY advisories, DPDP Act 2023, sector-specific regulators (RBI, SEBI, IRDAI), IT Act 2000 + Intermediary Rules 2021. Comprehensive AI-specific law under policy discussion but no draft legislation yet. Digital India Act (DIA) draft would consolidate IT Act + specific AI provisions; enactment pending.

Does MeitY's deepfake advisory apply to foreign AI companies?

Yes - intermediaries offering services to Indian users (including foreign AI companies) must label AI-generated / AI-modified content, provide automated detection + removal mechanism. MeitY March 2024 advisory remains in effect; subsequent advisories build on this framework. Non-compliance intermediary consequences under IT Act / IT Rules.

Can I use Indian user data to train my AI model without DPDP consent?

No - DPDP Act requires lawful basis (consent or legitimate uses per Section 7) for processing personal data of Indian residents. AI model training on Indian user data = processing requiring either explicit consent (preferable) or justified legitimate use. Purpose limitation + consent granularity apply. Training on scraped Indian personal data without consent = DPDP breach + up to INR 250 crore penalty.

Is my foreign GenAI product deployment regulated in India?

Depends on activity type + user base. Pure B2B API offering to Indian enterprise customers (who themselves handle end-user compliance) - lighter touch. B2C deployment to Indian consumers (chatbot, image generation, voice synthesis for Indian users): intermediary rules + DPDP + MeitY advisories + sector-specific if deployed in regulated sector. Appoint Indian representative + grievance officer; align content moderation.

How does India's AI regulation compare to EU AI Act?

India: layered / sector-specific / principles-based (as of 2026). EU: comprehensive risk-tiered legislation. Convergence likely over time as India moves toward comprehensive AI law (via DIA + separate AI legislation). Prudent approach: EU AI Act-compliant foreign AI companies have strong foundation for India; India-specific adjustments needed for DPDP, intermediary rules, sector-specific frameworks.

Does BQP help foreign AI / GenAI companies with India compliance?

Yes - DPDP applicability + consent flow + Data Protection Officer appointment, MeitY advisory compliance (deepfake labelling, large model registration), intermediary rules compliance (Indian representative + grievance officer + content moderation), sector-specific framework compliance (RBI / SEBI / IRDAI if applicable), OIDAR GST registration, data localisation architecture advisory. Integrated compliance stack. WhatsApp +91 78018 87130.