India has no standalone AI statute as of 2026 -- instead, MeitY published non-binding India AI Governance Guidelines around November 2025, and AI-related risk continues to be managed through existing sectoral laws like the DPDP Act, the IT Rules for AI-generated content, and separate guidance from regulators such as the RBI and SEBI for their own sectors.
A sectoral, soft-law approach -- not a single AI Act
India has not passed a horizontal, cross-cutting AI statute as of 2026. Instead, the Ministry of
Electronics and Information Technology (MeitY) published the India AI Governance Guidelines around November
2025 -- a non-binding governance framework setting out principles for trustworthy and responsible AI, rather
than enforceable legislation. AI-related legal risk in India is instead managed through existing sectoral laws
applied to AI-specific fact patterns.
How existing laws apply to AI
Where an AI system processes personal data, the Digital Personal Data Protection Act, 2023 and its 2025
Rules apply in the same way they would to any other data processing. Where AI is used to generate
synthetic or deepfake content, the IT Act, 2000 and IT Rules, 2021 framework -- including MeitY advisories
specifically addressing labelling of AI-generated content -- provide the applicable content-moderation and
intermediary-liability rules. Sector regulators have also issued their own AI-specific guidance rather than
waiting for a single central law -- the Reserve Bank of India for AI in lending and financial services, SEBI
for AI in securities markets and algorithmic trading, and health regulators for AI in medical devices.
What this means practically
For a business or individual dealing with an AI-related legal question in India, the right starting point
is to identify which existing sectoral law applies to the specific use case -- data protection, content
moderation, financial regulation, or otherwise -- rather than looking for a dedicated AI statute, since none
currently exists. This approach is expected to keep evolving, and future central legislation specifically
targeting AI cannot be ruled out, so this is an area where checking for updates before relying on the current
framework is particularly worthwhile. NRI founders building an AI-enabled product with Indian users or Indian
data flows should treat DPDP Act compliance -- consent mechanics, data-processing agreements, and cross-border
transfer conditions -- as the primary near-term compliance obligation, since that is the binding statute
currently in force, rather than waiting on a future AI-specific law that does not yet exist.
Is there an “AI Act” in India similar to the EU AI Act?
No -- India has not passed a dedicated, horizontal AI statute as of 2026. It instead relies on non-binding
guidance (the India AI Governance Guidelines) combined with existing sectoral laws like the DPDP Act and IT
Rules applied to AI-specific situations.
If my company uses AI to process customer data in India, which law applies?
The Digital Personal Data Protection Act, 2023 and its 2025 Rules apply to the personal-data-processing
aspect of an AI system in the same way they would to any other data processing -- there is no separate,
AI-specific data protection statute layered on top of the DPDP Act.
Do sector regulators like the RBI or SEBI have their own AI rules?
Yes -- rather than waiting for a single central AI law, regulators including the RBI (for AI in lending and
financial services) and SEBI (for AI in securities markets and algorithmic trading) have issued their own
sector-specific AI-related guidance within their existing regulatory mandates.
