India AI Governance Guidelines: Principles and Duties for AI Builders

The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology on 5 November 2025, set out India's approach to governing artificial intelligence. Unlike the EU, India decided that a separate AI law is not needed at this stage. Instead, the guidelines define seven principles, recommend institutions and tools, and rely on consistent enforcement of existing laws such as the IT Act, the IT Rules and the DPDP Act.

The guidelines themselves are voluntary, but they are not the whole picture. Binding rules already apply to AI products, most visibly the February 2026 IT Rules amendments on labelling synthetic content and faster removal of deepfakes. This guide explains the principles, pillars and recommendations, how existing laws apply to AI, and practical steps for companies building or deploying AI in India.

What are the India AI Governance Guidelines?

The guidelines were prepared by a drafting committee under the IndiaAI Mission, chaired by Prof. Balaraman Ravindran of IIT Madras, with members from MeitY, NITI Aayog, industry, academia and civil society. They were announced by the Principal Scientific Adviser and the MeitY Secretary. The document, titled "India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation", has four parts: the guiding principles, key issues and recommendations, an action plan, and practical guidelines for industry and regulators.

The overall stance is pro-innovation and risk-aware. The committee concluded that many AI risks, such as deepfakes, discrimination and misuse of personal data, can be addressed through existing laws, with targeted amendments where gaps appear, rather than a broad new statute.

The seven sutras

The guidelines adapt seven principles from the Reserve Bank of India's FREE-AI committee report:

1. Trust is the foundation: trust is essential for innovation, adoption and risk mitigation.
2. People first: human-centric design, human oversight and empowerment.
3. Innovation over restraint: responsible innovation is preferred over cautionary restraint, other things being equal.
4. Fairness and equity: avoid discrimination and promote inclusive outcomes.
5. Accountability: developers and deployers remain responsible according to their function and risk.
6. Understandable by design: disclosures and explanations that users and regulators can understand.
7. Safety, resilience and sustainability: systems that are safe, withstand shocks and are environmentally responsible.

The six pillars

Recommendations are organised under six pillars across three domains:

Domain	Pillars	Examples of recommendations
Enablement	Infrastructure; capacity building	Access to data and compute, use of digital public infrastructure, skills and awareness.
Regulation	Policy and regulation; risk mitigation	Review of existing laws, India-specific risk classification, techno-legal tools, voluntary frameworks.
Oversight	Accountability; institutions	Graded liability, transparency, grievance redressal, incident reporting, new coordinating bodies.

Proposed institutions

• AI Governance Group (AIGG): a small, permanent inter-ministerial body to coordinate AI policy across government.
• Technology and Policy Expert Committee (TPEC): experts advising the AIGG.
• AI Safety Institute (AISI): research and testing body for safety evaluation, standards and international engagement.

Sector regulators, such as RBI, SEBI and health authorities, remain responsible for AI use in their sectors.

No standalone AI law, for now

The guidelines state that, given the current assessment of risks, a separate law to regulate AI is not needed at this stage. Existing laws on information technology, data protection, consumer protection, intellectual property, criminal law and sector regulation can govern AI applications if enforced consistently. The committee recognised gaps, for example in copyright for AI training and in the classification of AI actors under the IT Act, and recommended targeted amendments and long-term consideration of new laws where needed.

Key recommendations

• Graded liability: liability based on the function performed, the level of risk, and whether due diligence was observed, with India-specific liability approaches to be developed.
• AI incident systems: an AI incidents database and grievance mechanisms, starting with voluntary reporting and growing into a national system.
• Content authentication and provenance: standards and techno-legal tools to identify AI-generated content and address deepfakes, which the committee called a growing menace needing immediate action.
• India-specific risk framework: a taxonomy of AI risks based on Indian evidence and context.
• Regulatory sandboxes for testing AI in controlled settings.
• Voluntary frameworks and industry self-regulation, supported by incentives.
• Techno-legal approaches: privacy-preserving technologies, consented data sharing for AI training, and compliance built into systems.
• Copyright: noting a DPIIT committee set up in 2025 to examine AI training and copyright.

Content authentication and deepfakes in more detail

The guidelines treat content authentication, meaning the ability to tell whether content was generated or modified by AI, as central to AI governance. They point to unique identifiers and provenance metadata as used in the C2PA industry standard, watermarking, and forensic attribution tools, while noting their limits, such as the ability of bad actors to strip watermarks and risks to privacy. The committee called harmful deepfakes a growing menace requiring immediate action, and recommended an expert committee to develop standards and a review of the regulatory framework. That review was followed quickly by binding change: the February 2026 amendments to the IT Rules introduced labelling, metadata and user declaration requirements for synthetically generated audio and video, and much shorter removal deadlines for non-consensual deepfake imagery.

The action plan

• Short term: establish the governance bodies, develop India-specific risk frameworks, adopt voluntary measures, propose legal amendments, set up incident and grievance systems, and expand access to data and compute.
• Medium term: publish common standards for content authentication, fairness and other issues, operationalise a national AI incidents database, pilot regulatory sandboxes, and integrate AI with digital public infrastructure.
• Long term: review the effectiveness of the approach, consider new laws where needed, and contribute to global standards.

Practical guidelines for industry

Part 4 of the guidelines tells anyone developing or deploying AI in India to:

• Comply with all Indian laws, including those on information technology, data protection, copyright, consumer protection and offences against women, children and other vulnerable groups.
• Be able to demonstrate compliance when asked by agencies or sector regulators.
• Adopt voluntary measures such as principles, codes and standards on privacy, security, fairness, inclusivity, non-discrimination and transparency.
• Create a grievance redressal mechanism for reporting AI-related harms and resolve issues within a reasonable time.
• Publish transparency reports that evaluate the risk of harm to individuals and society in the Indian context, sharing sensitive parts confidentially with regulators.
• Explore techno-legal solutions such as privacy-enhancing technologies, machine unlearning, algorithmic auditing and automated bias detection.

Accountability mechanisms without a law

Because voluntary frameworks are not legally enforceable, the guidelines describe other mechanisms to create accountability: transparency reports with red-teaming results and impact assessments, self-certification validated by auditors or standards bodies, internal policies and service terms that reflect commitments, regulator and parliamentary scrutiny, monitoring by competitors and civil society, and compliance built into system design. The guidelines note that MeitY may publish a schedule for compliance with these measures within 9 to 12 months, and that binding enforcement may follow if voluntary compliance is not enough. Companies should therefore treat these measures as likely future expectations rather than optional extras.

Grievance redressal for AI harms

The committee recommends that organisations deploying AI establish accessible and effective grievance mechanisms as part of their accountability obligations. Channels should be clearly visible, available in multiple languages and formats, free from retaliation, and responsive within reasonable timelines. Feedback should be analysed and used to improve products, creating a loop between user experience and risk mitigation. These grievance systems are separate from the proposed national AI incidents database. For platforms that are intermediaries, the IT Rules already require a Grievance Officer and set response deadlines, so AI-related complaints can be built into the same process.

Guidance for regulators

The guidelines also tell regulators to support innovation while addressing real and present harms, keep frameworks flexible and reviewable, avoid compliance-heavy measures such as mandatory approvals or licensing unless necessary, choose the least burdensome instrument that works, and encourage techno-legal approaches. They note open questions for data protection, such as exemptions for training on publicly available personal data, how purpose limitation fits modern AI, and the role of consent managers in AI workflows. Sector regulators, such as RBI with its FREE-AI framework, may set more specific expectations for their industries.

Binding laws that already apply to AI in India

Law	How it applies to AI
IT Rules 2021, as amended in 2026	Labelling and metadata for synthetically generated audio and video, user declarations on large platforms, 2 to 3 hour removal deadlines.
IT Act 2000	Safe harbour for intermediaries, offences such as impersonation and publishing obscene content.
DPDP Act	Consent and purpose limits for personal data used in training and inference, rights of data principals, security safeguards.
Consumer Protection Act 2019	Misleading claims about AI products and unfair practices such as dark patterns.
Copyright Act 1957	Use of copyrighted works in training and outputs, under review.
Sector rules	RBI's FREE-AI framework for financial services, health and other sector guidance.

Is it mandatory or voluntary?

The guidelines are voluntary policy guidance, but they reflect the government's expectations and will shape future rules, procurement and enforcement. The laws they point to are mandatory. Companies that align with the guidelines now will be better prepared for any binding requirements that follow.

How to apply the guidelines, step by step

1. Inventory AI use: models, features, vendors, data sources and affected users.
2. Classify risk for each use case by impact on people, using the sutras as a lens.
3. Check binding laws: DPDP consent and notice, IT Rules for synthetic content, consumer protection and sector rules.
4. Label AI-generated content and preserve provenance metadata where your product creates or hosts synthetic media.
5. Design for human oversight on decisions that affect people's rights or finances.
6. Test for bias and errors using Indian languages and demographics.
7. Set up grievance and incident handling for AI harms.
8. Document models, data, evaluations and decisions.
9. Align with a management framework such as ISO/IEC 42001.

Documentation you will need

• AI system inventory and risk classification.
• Data sources, consent and licensing records.
• Model and system documentation, such as model cards.
• Evaluation and bias testing results.
• Human oversight procedures.
• Content labelling and provenance approach.
• Grievance and incident logs.
• Vendor assessments for third-party models and APIs.

Common mistakes

• Assuming no AI law means no obligations; existing laws apply fully.
• Training on personal data without a DPDP-compliant basis.
• Generating realistic images or voices without labels or metadata.
• No grievance route for users harmed by AI outputs.
• Testing only in English, missing errors in Indian languages.
• Relying on vendors' claims without evaluating third-party models.

Best practices, tools and technologies

• Use model evaluation suites with Indian language and context datasets.
• Apply content provenance standards such as C2PA to generated media.
• Log prompts and outputs where lawful, with retention limits.
• Use privacy-preserving techniques such as anonymisation and federated learning.
• Use the NIST AI RMF for risk management structure.
• Monitor deployed models for drift and misuse.

We build AI features with labelled outputs, human review steps, logging and evaluation through our custom software development and SaaS product work.

How India compares with other approaches

Jurisdiction	Approach
India	Principle-based guidelines plus existing laws and targeted amendments.
European Union	Binding, risk-based AI Act with obligations phased in to 2028.
United States (Colorado)	State law on high-risk AI and algorithmic discrimination.
Global standards	ISO/IEC 42001 management system and NIST AI RMF.

Real-world example

An Indian edtech company adds an AI tutor that generates explanations and a voice feature that reads them aloud in Hindi and Tamil. It obtains DPDP-compliant consent from adult learners and verifiable parental consent for minors, labels the synthetic voice as AI-generated, keeps a human review queue for flagged answers, tests accuracy and bias across languages, offers a grievance form for incorrect or harmful outputs, and documents the system in line with ISO/IEC 42001.

Next steps

1. Inventory and classify your AI use.
2. Check DPDP and IT Rules obligations.
3. Label synthetic content.
4. Set up grievance and incident handling.
5. Watch for the AIGG, AISI and legal amendments.

Frequently asked questions

Does India have an AI law?

Not a standalone one. The November 2025 guidelines concluded a separate AI law is not needed at this stage and rely on existing laws.

Are the India AI Governance Guidelines mandatory?

No. They are voluntary guidance, but existing laws such as the IT Rules and DPDP Act are binding.

What are the seven sutras?

Trust is the foundation, people first, innovation over restraint, fairness and equity, accountability, understandable by design, and safety, resilience and sustainability.

Who prepared the guidelines?

A drafting committee under MeitY's IndiaAI Mission, chaired by Prof. Balaraman Ravindran of IIT Madras.

Do AI-generated images need labels in India?

Yes, under the IT Rules amendments in force from 20 February 2026, where they meet the definition of synthetic content.

What is graded liability?

Liability based on the function an actor performs, the level of risk and whether due diligence was observed.

Will there be an AI incident database?

The guidelines recommend AI incident reporting systems in the short term, growing into a national database.

Does the DPDP Act apply to AI training?

Yes, where training or inference uses digital personal data, subject to its exemptions.

How do the guidelines compare with the EU AI Act?

The EU has a binding risk-based law; India relies on principles, existing laws and targeted amendments.

Which standards help with compliance?

ISO/IEC 42001 for AI management systems and the NIST AI RMF for risk management are widely used.

Should companies publish AI transparency reports?

The guidelines recommend it, evaluating the risk of harm in the Indian context and sharing sensitive details confidentially with regulators.

What is the AI Safety Institute?

A proposed body for testing and evaluating AI systems, developing standards and representing India in global AI safety work.