Published: Published around November 2025 | Category: Technology & Data Protection | Status: Non-binding guidance -- not enforceable legislation; India still has no standalone AI statute.
Around November 2025, India's Ministry of Electronics and Information Technology (MeitY) published the India AI Governance Guidelines -- a non-binding framework setting out principles for trustworthy and responsible AI -- without enacting a dedicated, enforceable AI statute; AI-related legal risk in India continues to be managed through existing sectoral laws like the DPDP Act and the IT Rules applied to AI-specific fact patterns.
What changed
MeitY published the India AI Governance Guidelines as a policy framework setting out principles for
trustworthy, safe, and responsible AI development and deployment in India -- covering areas like
transparency, accountability, and risk-based oversight. Critically, this is guidance, not legislation: it
creates no new enforceable legal obligations, no new regulator, and no penalty regime of its own. India
still has no horizontal, cross-cutting AI statute comparable to the EU AI Act. Instead, the Guidelines sit
alongside existing sectoral laws -- the Digital Personal Data Protection Act, 2023 for AI systems that
process personal data, the IT Act and IT Rules for AI-generated or deepfake content, and sector-specific
guidance from regulators like the RBI and SEBI for AI use in their respective sectors.
Why it matters for NRIs
NRI founders and investors building or funding an AI-enabled product with Indian users or Indian data
flows should treat the DPDP Act -- not the Guidelines -- as the binding near-term compliance obligation,
since the Guidelines themselves create no enforceable rule. That said, the Guidelines are a reasonable
signal of the direction Indian AI policy is heading, and are worth monitoring for any NRI-run business
whose India-facing product could later fall within scope of future binding legislation, which has not been
ruled out. NRIs relying on AI tools for tasks involving Indian personal data (customer service, credit
scoring, content moderation) should confirm DPDP Act compliance for that specific use case now, rather than
waiting for AI-specific legislation that does not yet exist.
Articles on this platform affected by this change
This platform's AI & Emerging
Technology Regulation in India article was written to reflect this framework and the current sectoral,
soft-law approach to AI regulation in India. This is an area worth monitoring rather than treating as
settled: several jurisdictions globally have moved from non-binding AI guidance to binding legislation within
a few years of the guidance stage, and India's own approach could evolve the same way, so this update entry
-- and the underlying article -- will be revisited if MeitY or Parliament moves toward enforceable AI-specific
legislation.
Is the India AI Governance Guidelines document legally binding?
No -- it is a non-binding policy framework published by MeitY. It creates no enforceable legal obligation
of its own; AI-related legal risk in India continues to be governed by existing sectoral laws.
Does India have a dedicated AI law similar to the EU AI Act?
No -- as of this Guidelines publication, India has not passed a horizontal, cross-cutting AI statute. AI
use is regulated indirectly through existing sectoral laws (the DPDP Act, IT Rules, and sector-specific
regulator guidance) applied to AI-specific situations.
Which law should an NRI-run AI startup actually prioritize for compliance right now?
The Digital Personal Data Protection Act, 2023 and its 2025 Rules, for any AI system processing personal
data connected to India -- since that is the binding statute currently in force, unlike the non-binding AI
Governance Guidelines.
