Loading
India has deliberately chosen not to enact a dedicated AI law. Instead it governs AI through existing law, adapted and hardened for the technology: the Digital Personal Data Protection framework for personal data, SEBI rules for securities-market AI, the IT rules for AI-generated content, and sector frameworks such as the RBI FREE-AI recommendations, all under the umbrella of the voluntary MeitY India AI Governance Guidelines. This page sets out the instruments, the dates, and which ones are binding versus voluntary, with links to the primary sources.
Last reviewed: 22 July 2026 · A factual snapshot; AI policy is evolving, so confirm against the primary sources linked below
India has no horizontal AI Act, and none is formally proposed. Its approach, confirmed by the November 2025 India AI Governance Guidelines, is principles-based and pro-innovation: use and adapt the laws that already exist rather than build a single new statute. What has changed sharply through 2025 and 2026 is that those existing laws have been hardening around AI.
The Digital Personal Data Protection (DPDP) Rules were notified in November 2025 and are phasing in to 2027; SEBI made regulated entities strictly responsible for their AI use; MeitY brought in binding rules on synthetically generated content; and the Reserve Bank set out a framework for AI in finance. The result is a fast-moving patchwork of binding sector rules and advisory frameworks rather than one AI law.
The Digital Personal Data Protection Act, 2023 received presidential assent, giving India its first comprehensive data-protection statute. But it was not brought into force at the time: commencement was deferred pending implementing Rules.
The Ministry of Electronics and Information Technology (MeitY) issued a revised advisory asking large platforms to label AI-generated content and embed metadata to help trace deepfake-prone material. It was guidance rather than binding law.
SEBI amended its Intermediaries Regulations to add Regulation 16C, making any SEBI-regulated entity that uses AI or machine learning solely responsible for data privacy and security, for the outputs of those tools, and for compliance with the law. This is binding and in force.
The Reserve Bank of India released the report of its FREE-AI committee (Framework for Responsible and Ethical Enablement of Artificial Intelligence), a set of principles and 26 recommendations for AI in the financial sector. It is an advisory framework, not binding regulation.
MeitY released the India AI Governance Guidelines under the IndiaAI Mission, setting the national direction for safe and responsible AI. They are voluntary, principles-based guidance and confirm that India favours adapting existing law over enacting a dedicated horizontal AI law.
The Digital Personal Data Protection Rules, 2025 were notified in the Official Gazette, moving the framework from enacted-but-dormant to a phased roll-out. The Data Protection Board and definitions took effect immediately; consent-manager registration follows at around twelve months; and the core obligations commence on 14 May 2027.
The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 came into force, India's first binding rules defining synthetically generated information and requiring intermediaries to label it and attach metadata. AI-generated text is excluded, with good-faith and accessibility carve-outs.
With no single AI Act, the picture is a layered patchwork. The table below sorts the main instruments by whether they carry legal force, are advisory, or are still proposed, and notes where duties are phased in.
| Instrument | Status | Applies to / owner |
|---|---|---|
| DPDP Act 2023 and DPDP Rules 2025 | Binding (core duties from 14 May 2027) | Any organisation using personal data in AI (Data Protection Board of India) |
| SEBI Regulation 16C (AI accountability) | Binding | SEBI-regulated entities using AI or machine learning (SEBI) |
| IT Act 2000 and IT Rules 2021, incl. the 2026 deepfake amendment | Binding | Intermediaries and platforms handling AI-generated content (MeitY) |
| RBI FREE-AI framework (Aug 2025) | Advisory recommendations | Banks and financial institutions (Reserve Bank of India) |
| India AI Governance Guidelines (Nov 2025) | Voluntary guidance | All AI developers and deployers (MeitY, IndiaAI Mission) |
| SEBI responsible AI/ML guidelines | Proposed (consultation) | Securities-market participants (SEBI draft, June 2025) |
For the wider picture across jurisdictions, see our AI regulation by country comparison, and our detailed article on AI governance in India.
The practical map is sector by sector rather than a single checklist. Personal data used in AI falls under the DPDP framework, with a compliance glide path to May 2027; AI in securities markets is already caught by SEBI's strict-responsibility rule; AI-generated content is subject to the IT deepfake rules now in force; and AI in banking is shaped by the RBI FREE-AI recommendations, all beneath the voluntary MeitY guidelines.
The clear direction is toward more structured accountability, even without a single AI Act, so building governance now is the sensible response, particularly ahead of the DPDP core obligations in 2027. Our AI GRC guide covers how those pieces fit together, and a short governance assessment benchmarks where an organisation stands against a structured model.
No. India has no dedicated horizontal AI law, and none is formally before Parliament. It governs AI through existing laws applied to AI, principally data protection, securities regulation and the IT content rules, together with voluntary national guidelines. This is a deliberate, principles-based and pro-innovation approach.
The Digital Personal Data Protection Act, 2023 was passed in 2023 but held pending Rules. The DPDP Rules, 2025 were notified on 14 November 2025 with a phased commencement: the Data Protection Board and definitions took effect immediately, consent-manager registration at around twelve months, and the core obligations, including notice, consent, security, breach reporting, data-principal rights and penalties of up to 250 crore rupees, on 14 May 2027. So most substantive obligations are not yet operative, which gives an eighteen-month glide path.
The DPDP Act is technology-neutral and has no AI-specific provisions. An AI developer or deployer that decides the purpose and means of processing personal data is a Data Fiduciary and must obtain valid consent or rely on a limited legitimate use, respect purpose limitation and minimisation, and honour data-principal rights. Significant Data Fiduciaries must also exercise due diligence over algorithmic software so that it does not risk those rights.
SEBI Regulation 16C, in force since early 2025, makes any SEBI-regulated entity that uses AI or machine learning solely responsible for data security, the outputs of those tools and legal compliance; a more detailed responsible-AI framework is at consultation stage. The RBI published its FREE-AI framework of recommendations in August 2025, which guides financial-sector AI but is advisory rather than binding.
The IT Act 2000 and IT Rules 2021 apply, and the IT Amendment Rules, 2026, in force from 20 February 2026, are India's first binding rules on synthetically generated information. They require intermediaries to label such content and attach metadata, with carve-outs for AI-generated text and good-faith or accessibility uses.
Yes. MeitY released the India AI Governance Guidelines in November 2025 under the IndiaAI Mission. They are voluntary, principles-based guidance that sets the national direction, rather than a binding regulation, and they reflect India's choice to adapt existing law instead of enacting a standalone AI Act.
A short, free assessment benchmarks where your organisation stands against a structured AI governance model, a practical first step across India's layered rules and the DPDP glide path to 2027.
This page is general information describing the state of India AI policy as at 22 July 2026, not legal or compliance advice. India's framework is phasing in and evolving quickly; always confirm the current position against the primary sources linked above and obtain advice from your own qualified counsel before relying on it.