India’s AI regulator, on the evidence of the past year, is not MeitY. Between 2 July and 12 September 2026 three Indian courts decided questions that shape how AI can be built and used here. Over the same period, and indeed since the Digital Personal Data Protection Act received assent in August 2023, no Indian regulator has imposed a single penalty on anyone for anything AI-related.
| Who acted | When | What it produced | Force |
| Supreme Court of India | 2 Jul 2026 | Orders set aside for resting on hallucinated citations; Bar Council directed to frame discipline | Binding precedent |
| Delhi High Court | 24 Jul 2026 | Training an LLM on news copy held prima facie within fair dealing | Interim, under appeal |
| Delhi High Court | 12 Sep 2026 | Permanent injunction against deepfake misuse of a person’s likeness | Binding inter partes |
| MeitY | 2 Jan 2026 | A letter to X Corp demanding a report in 72 hours | No sanction |
| Data Protection Board | Never | Nothing. It has no members | None |
| Parliament | Never | No AI Bill introduced | None |
India has one binding AI-specific rule, in force since 20 February 2026. Everything in the Digital Personal Data Protection framework that a company would recognise as an obligation is enacted and dormant until May 2027. India therefore has a gap of roughly twenty months, and courts are filling it.
Indian courts decided three AI questions while regulators wrote reports
The Supreme Court made hallucinated authority a rule-of-law problem
In Pooja Ramesh Singh v. Jammu and Kashmir Bank Ltd., 2026 INSC 668, decided on 2 July 2026, Narasimha and Aradhe JJ set aside orders of the National Company Law Tribunal and the National Company Law Appellate Tribunal because both rested on citations that did not exist. Six were defective: three wholly fabricated, two real judgments with invented paragraphs, one wrong citation with an invented paragraph. The Court’s framing is the part to carry into a governance policy:
a decision of a Court or an adjudicating authority based on material which is fake and hallucinated is no decision at all, and it amounts to subversion of the rule of law
India’s Supreme Court adopted what it called a zero-tolerance position on producing, citing or using AI-generated precedents without verification, and directed the Bar Council of India to frame guidelines and disciplinary measures. No fine was imposed. The sanction is that the output of the process was voided.
Read the reasoning rather than the headline, because organisations outside litigation are caught by it. The wrong being punished is not use of a model. The wrong is submitting model output as work product without checking it. Verification is a human-review control, it is auditable, and any organisation letting staff put generated text into a filing, a report or a board paper now has a documented judicial standard to meet.
The Delhi High Court put LLM training inside fair dealing, for now
ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, CS(COMM) 1028/2024 was decided by Justice Amit Bansal on 24 July 2026 on ANI’s interim injunction application. The application was dismissed. At paragraph 271 the Court recorded its prima facie view that storing ANI’s original literary works for training the models underlying ChatGPT falls under section 52(1)(a) of the Copyright Act and therefore does not infringe section 51, and that outputs generated through retrieval-augmented generation were not substantially similar to ANI’s works, with no memorisation or regurgitation established.
Two findings do more work than the result. At paragraph 189 the Court treated training as “completely an internal process” in which the training data “is never made available either in its natural language or tokenized form to any person.” At paragraph 190 it held that commercial purpose alone does not remove the section 52(1)(a) defence. Territorial jurisdiction was upheld under section 20 of the Code of Civil Procedure and section 62(2) of the Copyright Act, so a foreign model developer serving users here cannot displace an Indian court by pointing at where its servers sit.
Indian training-data policy should treat this as unsettled. The ruling is interim, the Court said its observations have no bearing on the final outcome of the suit, and ANI has appealed to a Division Bench headed by Justice V. Kameshwar Rao. Anyone building an Indian training-data policy on paragraph 271 should record that they know it is interim and under appeal.
Personality rights became the working deepfake remedy
In Rajat Sharma v. Tamara Doc, decided by Justice Jyoti Singh of the Delhi High Court and reported on 12 September 2026, the Court permanently restrained defendants from circulating deepfake video and images of the journalist and from misusing India TV’s intellectual property. Indian personality-rights litigation has grown faster than any regulatory process, and this order sits in that line.
Practice matters more than rulemaking here: personality-rights litigation reaches a named defendant and a named platform far faster than an intermediary rule that nobody is enforcing. A deepfake takedown request is now as likely to arrive as a court order as it is to arrive from a ministry.
One binding AI rule exists, and nobody will say whether it works
India’s only binding AI-specific obligations were inserted into the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 by G.S.R. 120(E), notified 10 February 2026 and in force from 20 February 2026.
Indian law now defines synthetically generated information, at rule 2(1)(wa), as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that it appears real and depicts or portrays an individual or event in a way that is or is likely to be perceived as indistinguishable from a natural person or a real-world event.
Rule 3(3)(a)(i) then requires an intermediary offering such a computer resource to deploy reasonable and appropriate technical measures, including automated tools, so that users cannot produce synthetic material violating any law in force, with the Bharatiya Nyaya Sanhita, 2023, the Protection of Children from Sexual Offences Act, 2012 and the Explosive Substances Act, 1908 named alongside the Information Technology Act. Four categories are enumerated: child sexual exploitative and abuse material, non-consensual intimate imagery and content that is obscene, pornographic, paedophilic, invasive of bodily privacy, vulgar, indecent or sexually explicit; anything creating a false document or false electronic record; material relating to explosives, arms or ammunition; and false depiction of a real person or event likely to deceive.
Rule 3(3)(a)(ii) requires everything else synthetic to carry a label with prominent visibility that is easily noticeable and adequately perceivable, or a prominently prefixed audio disclosure, plus permanent metadata or provenance including a unique identifier for the computer resource that made it, so far as technically feasible. Rule 3(3)(b) forbids the intermediary from enabling modification, suppression or removal of that label or metadata.
Significant social media intermediaries carry more under rule 4(1A): before display, upload or publication they must require a user declaration, deploy technical measures to verify its accuracy having regard to the nature, format and source of the information, and label anything confirmed as synthetic. An intermediary that knowingly permitted, promoted or failed to act on synthetic content in contravention of the rules is deemed to have failed due diligence, which is what puts safe harbour under section 79 of the Information Technology Act at risk. There is no fine in this regime. The consequence is exposure to liability for user content.
The proviso is the scope test, and it excludes ordinary product behaviour
Engineers argued through the consultation that the draft would sweep in routine features. Their collective submission, reported on 13 January 2026, named image compression, brightness correction, filters, autocorrect and grammar suggestions. The final rule 2(1)(wa) carries a three-limb proviso that answers them.
Nothing counts as synthetically generated information where it arises from routine or good-faith editing, formatting, enhancement, technical correction, colour adjustment, noise reduction, transcription or compression that does not materially alter the substance, context or meaning; or from routine preparation of documents, presentations, PDF files, educational or training material and research outputs, including illustrative, hypothetical, draft, template-based or conceptual content, provided no false document or false electronic record results; or from use of computer resources solely to improve accessibility, clarity, quality, translation, description, searchability or discoverability without generating, altering or manipulating any material part.
So the scope question is not whether a feature uses a model. The test is whether the output materially alters substance, context or meaning, and whether it portrays a person or event in a way likely to be taken as real. A transcription tool sits outside. A tool that puts words in a named person’s mouth sits inside.
Two related corrections belong here. The draft of 22 October 2025 required a visual label covering ten per cent of display area and an audio disclosure in the first ten per cent of duration. Both were dropped before notification. Any checklist still quoting ten per cent is describing an abandoned proposal. And the draft Second Amendment Rules of 30 March 2026, which would require the label to be continuously and clearly visible throughout the duration of the content, remain a draft after consultation closed on 7 May 2026.
Clocks tightened across the board, and compliance data is withheld
The same instrument compressed every response window. Removal on actual knowledge, which arises only by court order or reasoned written intimation, moved from thirty-six hours to three. Complaints about material exposing private areas, nudity or sexual conduct moved from twenty-four hours to two. General grievance resolution moved from fifteen days to seven, and removal-request grievances from seventy-two hours to thirty-six.
Whether Indian platforms are meeting those clocks is not public. Answering a Lok Sabha unstarred question on 5 August 2026, the government declined to give complaint figures from the National Cyber Crime Reporting Portal, declined to say how many removal requests had issued since February, and gave no data on three-hour performance or on labelling compliance. In June a senior official had told MediaNama that government would not soften the labelling rule because “the compliance is very weak from the companies.” Both statements can be true. Neither is a measurement anyone outside government can audit.
Your training data this morning is governed by the 2011 rules, not the DPDP Act
Most coverage of AI regulation in India describes DPDP obligations in the present tense. DPDP obligations are not in the present tense, and something else fills the gap.
DPDP section 44(2) omits section 43A of the Information Technology Act, 2000. Section 44(2) has not commenced. So section 43A, and with it the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, remain in force today. India’s 2011 rules still carry the concept of sensitive personal data, which the DPDP Act abolishes, and still carry a compensation route for negligent handling that the DPDP Act replaces with regulatory penalty.
The result is a category mismatch which catches out teams building only to the newer statute. Under the 2011 rules, passwords, financial information, health condition, medical records, biometrics and sexual orientation are a distinct class with heightened handling duties. Under the DPDP Act there is no sensitive category at all: every item of digital personal data is treated alike. An AI training pipeline designed only against DPDP will be under-protecting the 2011 categories for the next twenty months.
The statute wakes in stages, and the dates are precise
Commencement of the Act was ordered by G.S.R. 843(E) and of the Digital Personal Data Protection Rules, 2025 by rule 1, quoted in full:
(2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette. (3) Rule 4 shall come into force one year after the date of publication of this Gazette. (4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
| Tranche | What it carries | Operative date |
| Publication | Rules 1, 2, 17 to 21; Act ss. 1(2), 2, 18 to 26, 35, 38 to 43, 44(1), 44(3) | 13 Nov 2025 |
| Twelve months | Rule 4 and First Schedule, consent manager registration; Act ss. 6(9), 27(1)(d) | 13 Nov 2026 |
| Eighteen months | Rules 3, 5 to 16, 22, 23; Act ss. 3 to 17, 27, 28 to 34, 36, 37, 44(2) | 13 May 2027 |
One caveat on arithmetic, because it is the detail most published timelines get wrong in one direction or the other. The gazette is numbered 760 and dated Thursday, 13 November 2025, and the notification is signed the same day, but the e-gazette identifier reads CG-DL-E-14112025-267650 and the Controller of Publications signature is timestamped 14 November. The trigger is “the date of publication in the Official Gazette,” so the tranches fall on either 13 or 14 of the relevant month. PRS Legislative Research records 14 November and several large firms publish 14 May 2027. Plan to the earlier date throughout, which is what this page does.
Watch for the date moving the other way. On 23 January 2026 MeitY circulated a consultation, comments due 4 February, proposing to compress the eighteen-month tranche to twelve and to bring rule 13(4) localisation and rule 15 into force immediately for Significant Data Fiduciaries. No amending instrument has been notified. A single short notification could pull the main deadline forward by six months.
Section 3 decides whether any of this reaches you at all
India’s territorial test is the first question any foreign provider should ask, and it is rarely stated. Section 3(a) applies the Act to processing of digital personal data within India where the data was collected in digital form, or in non-digital form and digitised later. Section 3(b) applies it to processing of digital personal data outside India where that processing is in connection with any activity related to offering goods or services to Data Principals within India.
Note what section 3(b) does not require. There is no establishment test, no targeting threshold expressed in users or revenue, and no monitoring-of-behaviour limb of the kind the GDPR uses. A model provider outside India offering a service to Indian users is inside scope on the face of the provision. A provider processing only non-digital records, or digital data never connected with an offering to people in India, is outside it.
Four provisions will do the real work on AI systems
Section 8(3) is the accuracy duty and the closest thing India has to a rule on automated decisions:
(3) Where personal data processed by a Data Fiduciary is likely to be (a) used to make a decision that affects the Data Principal; or (b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its completeness, accuracy and consistency.
The verb is “shall ensure,” unqualified, and the contrast is deliberate: the Second Schedule uses “reasonable efforts to ensure” for research processing. The trigger is that data is likely to be used in a decision affecting the person, with no requirement that the decision be solely automated, so a human reviewer does not switch the duty off and there is no Article 22 threshold to hide behind. Limb (b) attaches on disclosure alone, which reaches data piped into a third party’s model. Section 17(1) disapplies it for six listed grounds, including processing in India of data about people outside India under a foreign contract, and section 17(3) allows government to switch it off for notified classes including startups, which it has not done.
Section 9(3) is the hardest prohibition in the Act and it is almost never mentioned in AI coverage. A Data Fiduciary “shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.” There is no risk test, no proportionality qualifier and no legitimate-interest escape. Section 9(1) requires verifiable parental consent before processing a child’s data, and section 9(2) forbids processing likely to cause a detrimental effect on a child’s well-being. For a recommender, an ad-ranking system or any product with under-18 users, section 9(3) is a design constraint rather than a documentation exercise, and it carries a 200 crore ceiling.
Rule 13(3) is the only text in the framework containing the word algorithmic:
A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals.
The rule prescribes no methodology, no bias testing, no explainability standard and no external assessment, and its enumerated verbs do not include training, inference or profiling. Rule 13(3) also binds nobody twice over. Commencement falls in May 2027, and section 10(1) makes Significant Data Fiduciary status a government designation rather than a threshold a company crosses, resting on volume and sensitivity of data, risk to rights, sovereignty and integrity, electoral democracy, security of the State and public order. No numerical trigger appears in the Act or the Rules, and no entity or class has been designated. One correction that recurs in vendor content: the two crore and fifty lakh registered-user figures in the Third Schedule are erasure triggers under rule 8(1), not Significant Data Fiduciary thresholds.
Rule 7 and rule 8(3) will shape incident and retention design more than any AI-specific text. Rule 7 has no materiality threshold: any personal data breach triggers intimation to every affected person without delay, plus a two-stage notification to the Board, immediate and then detailed within seventy-two hours, extendable only on written request. Rule 8(3) then requires every Data Fiduciary to retain the personal data, associated traffic data and other logs of processing for a minimum of one year, and the Illustration removes any doubt about how that interacts with deletion requests: an e-book platform “must retain the order details, personal data, and logs of the processing … for at least one year from the date of the transaction, even if X deletes her account.” Rule 6(1)(e) imposes a parallel one-year log retention. A pipeline that honours erasure immediately and completely will breach rule 8(3).
Consent is the only broad lawful basis, and section 7 has no legitimate interests
The Act has no analogue of Article 6(1)(f) of the GDPR. Section 7 is a closed list of legitimate uses with no balancing ground. Training on personal data here therefore rests on consent under section 6, an enumerated section 7 use, or the research exemption in section 17(2)(b), which is “necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.”
The middle condition is the problem. A model trained under that exemption and then deployed to score an applicant, rank a candidate or price a policy for a named person sits badly against it, and no guidance, Board decision or judgment interprets the phrase, because the provision has not commenced. Note also that rule 16 restates the exemption without repeating the no-individual-decision condition; rule 16 is made under section 40 and cannot enlarge a statutory exemption, so the condition in the section continues to govern. Quote the section, not the rule.
Consent is no soft landing either. Rule 3 requires notice presented independently of any other information, with an itemised description of the personal data and a specific description of the uses to be enabled. A clause about improving our services will not carry model training, and repurposing data already held will need fresh consent rather than a revised policy.
The regulator exists as a legal person and nothing else
India’s Data Protection Board was established as a body corporate by a separate notification, G.S.R. 844(E), on the same day the Act commenced. Rule 17 sets up Search-cum-Selection Committees, with the Cabinet Secretary chairing for the Chairperson post. A MeitY circular of 6 May 2026 was still inviting applications to build a panel for that committee, advertising one Chairperson and four Member posts, minimum age 55, tenure capped at two years or age 65. A further call followed in June. LiveLaw reported on 1 August 2026 that no Chairperson and no Members had been appointed.
Two consequences follow for anyone waiting on enforcement. Consent manager registration under rule 4 falls due in November 2026 and must be done by a Board that has nobody in it. And the Board’s inquiry and penalty powers, sections 28 to 34, sit in the eighteen-month tranche, so even a fully staffed Board could impose nothing before May 2027. When the Schedule does commence it sets absolute rupee caps rather than a turnover percentage: 250 crore for failure of security safeguards under section 8(5), 200 crore for breach notification under section 8(6), 200 crore for the children’s provisions in section 9, 150 crore for Significant Data Fiduciary obligations under section 10, 10,000 rupees for a Data Principal’s own duties, and 50 crore as the residual.
India’s delivery record follows the same pattern. MeitY told the Rajya Sabha, in figures reported on 4 April 2026, that roughly 401 crore of the IndiaAI Mission’s approved 10,371.92 crore outlay had been released, with nothing drawn against the 1,000 crore budgeted for 2026-27.
The RBI has written the most demanding AI rules in India, and they are still a draft
Indian sectoral regulators are widely said to have produced only reports, which ignores what the central bank published on 24 June 2026. The Draft Guidance on Regulatory Principles for Model Risk Management, 2026 went out for comment until 24 July and reaches eleven categories of regulated entity, from commercial banks and NBFCs to payments banks, cooperative banks, asset reconstruction companies and credit information companies.
| Requirement in the draft | What it asks for |
| Board-approved framework | Governance, documentation, validation and monitoring owned at board level |
| Risk-based model tiering | All models tiered by materiality and complexity, reviewed annually |
| Model inventory | Active, inactive and decommissioned models, retained ten years or more, with owners and validators recorded |
| Independent validation | Before and after deployment, with reports to the Risk Management Committee within three months |
| Human oversight | Human-in-the-loop or human-on-the-loop, with staff able to challenge model outputs |
| Explainability thresholds | Higher thresholds for material decisions, compensating controls where full explainability is impossible |
| Kill switch | Mechanisms to override, suspend or deactivate a model |
| Third-party controls | Due diligence on external providers and contractual access to technical documentation |
Set that beside rule 13(3) and the asymmetry is stark. India’s data protection regulator asks a Significant Data Fiduciary, once designated, to observe due diligence to verify that algorithmic software is not likely to pose a risk. India’s banking regulator asks for a tiered inventory, independent validation, documented human challenge, explainability thresholds and a kill switch. If you run models in an Indian bank or NBFC, the draft above is your real AI governance obligation, and it will land long before any AI Act does.
India’s remaining sectoral picture is thinner. The RBI’s FREE-AI committee reported on 13 August 2025 with twenty-six recommendations, which is a report rather than a direction. SEBI’s consultation on responsible AI and ML usage has not been given effect, so SEBI’s binding AI instruments remain its 2019 circulars requiring brokers, market infrastructure institutions and asset managers to report the AI and ML systems they use, which are reporting duties carrying no governance standard. IRDAI constituted a working group on 18 June 2026 under Sandeep Shukla of IIIT Hyderabad with a three-month deadline that has now passed without a published report. What already binds across these sectors is not AI law at all: the RBI’s 2018 payment system data storage directive, its Master Direction on IT Governance, Risk, Controls and Assurance Practices, the outsourcing of IT services direction and CERT-In’s April 2022 directions with their six-hour incident reporting window apply to an AI deployment exactly as they apply to anything else.
India has nothing on employment, and the absence should be stated rather than implied. There is no law regulating AI in hiring, promotion or dismissal, no bias-audit requirement of the New York City or Colorado kind, and no notice duty to a candidate screened by a model. Section 8(3) will reach the accuracy of the personal data used in such a decision from May 2027, and will not reach the model itself.
The voluntary layer, and a government that changed its mind
MeitY published the India AI Governance Guidelines on 5 November 2025, from a committee chaired by Professor Balaraman Ravindran of IIT Madras. Seven sutras are named: Trust is the Foundation, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability, over six pillars covering infrastructure, capacity building, policy and regulation, risk mitigation, accountability and institutions. Its position on legislation was explicit: “At this stage, a separate law to regulate AI is not needed given the current assessment of risks.” The document creates no obligation and carries no penalty.
Indian implementation drifted from the design. What was constituted on 16 April 2026 is the AI Governance and Economic Group, chaired by Minister Ashwini Vaishnaw, merging the recommended coordinating body with the Economic Survey’s proposed AI Economic Council; reporting on membership indicates the independent sectoral regulators are not on it, which matters given that the RBI has just written the country’s most demanding model governance rules. A Technology and Policy Expert Committee followed on 18 April 2026 under the Secretary, MeitY. The IndiaAI Safety Institute, announced on 31 January 2025, has funded thirteen responsible AI research projects and published no model evaluation.
Then India’s position reversed. Minister Vaishnaw said in June 2026 that India needs a new AI law, and MeitY Secretary S. Krishnan said on 9 July 2026 that the ministry would “start a process of drafting.” As at today there is no bill, no published draft and no consultation paper. The Digital India Act has never been introduced.
The numbers explain why the gap is uncomfortable
Stanford’s AI Index 2026 policy chapter counts AI-related bills passed into law across the G20 between 2016 and 2025. India passed one. The United States passed twenty-five and South Korea seventeen. The same report’s research chapter puts India second in the world for AI researchers at 50,460, behind the United States on 220,520 and ahead of Germany. Second in people, near the bottom in law.
Indian readiness for the deadline that does exist is poor. EY India, reporting in January 2026 from a survey of more than 150 professionals, found over 83 per cent had not begun full-scale DPDP implementation, around 81 per cent had not drafted or updated aligned privacy policies, and roughly 70 per cent found the Act difficult to interpret. Healthcare and life sciences were worst placed at 9.9 per cent started.
Deployment is running ahead of all of it. Deloitte’s March 2026 India findings put at-scale AI usage in Indian enterprises at 40 per cent against a 28 per cent global average, and named regulatory and compliance requirements the top barrier to integration at 39 per cent, ahead of cost at 12 and infrastructure at 5. And IBM’s Cost of a Data Breach Report of 3 August 2026 put the India average at 255 million rupees, an all-time high, 15.9 per cent up year on year, with 26 per cent of malicious breaches AI-generated and shadow AI adding 17.9 million rupees where present.
What to build before the statute wakes
India’s 2027 duties include three that cannot be satisfied retrospectively, because they are satisfied by records that either exist or do not.
| Obligation | Live from | Evidence you need to be producing |
| IT Rules r. 3(3), 4(1A) | Now | Labels and provenance metadata applied at generation, declaration and verification logs, takedown timestamps against the three-hour and two-hour clocks |
| Verified human review of model output | Now, by precedent | A record that generated text in filings, reports and advice was checked against source before it left the building |
| RBI model risk management | On finalisation | Tiered model inventory, independent validation reports, documented human challenge, explainability thresholds, kill-switch test records |
| DPDP r. 6(1)(c) and (e) | 13 May 2027 | Access logs for personal data retained one year, with monitoring and review evidence |
| DPDP r. 7 | 13 May 2027 | Breach intimation without delay and a detailed report within 72 hours, with no materiality threshold |
| DPDP s. 8(3) and s. 9(3) | 13 May 2027 | Accuracy of personal data used in decisions, and proof that no tracking or targeted advertising reaches children |
Two design decisions are worth making now rather than under deadline pressure. The first is the collision between rule 8(3)’s one-year minimum retention and an erasure pipeline built to delete on request, which has to be resolved in architecture, not policy. The second is the section 9 question, because a product that cannot tell which users are children cannot show that it complied with a flat prohibition.
Govern365 exists to hold that mapping: provision to artefact, kept as a standing record rather than reconstructed the week a regulator asks. Because one control usually answers several regimes, an organisation running models here and in the European Union can evidence the section 8(3) accuracy duty and the EU AI Act data governance requirements from a single set of records, and the same validation file answers the RBI draft’s independent-validation requirement. Our AI compliance evidence guide sets out the artefact types, and the global AI regulation tracker places this jurisdiction beside the others with their real commencement dates.
Sequence the programme plainly. Treat the IT Rules as live if any product makes or hosts synthetic media. Treat the Supreme Court’s verification standard as live for every team putting model output into work product. Treat the RBI draft as your programme if you are a regulated financial entity. Treat May 2027 as a build deadline rather than a filing deadline, and watch three things that would move it: a notification compressing the tranche, a first designation of Significant Data Fiduciaries, and the appointment of Board members.
Frequently asked questions
Does India have an AI Act?
No. There is no AI Act, no AI Bill before Parliament and no published draft. The only binding AI-specific rules are the amendments to the Information Technology Rules 2021 made by G.S.R. 120(E), in force since 20 February 2026, covering synthetically generated information. MeitY said in July 2026 it would begin drafting AI legislation.
Is the DPDP Act in force?
Partly. Provisions establishing the Data Protection Board, the rule-making powers and the Right to Information amendment took effect in November 2025. Consent manager provisions follow at twelve months. The substantive obligations, data principal rights, cross-border rules and the whole penalty regime commence at eighteen months, in May 2027.
What law governs AI training data in India right now?
Section 43A of the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules, 2011, because section 44(2) of the DPDP Act, which repeals section 43A, has not commenced. The 2011 rules still recognise a sensitive personal data category that the DPDP Act abolishes.
Does the DPDP Act apply to a company outside India?
Section 3(b) applies the Act to processing of digital personal data outside India where that processing is connected with any activity related to offering goods or services to Data Principals in India. There is no establishment requirement and no user or revenue threshold on the face of the provision.
Has any regulator fined a company over AI?
No. MeitY wrote to X Corp on 2 January 2026 over Grok generating sexualised imagery and demanded a report within 72 hours; content was removed and no penalty followed. The Data Protection Board has issued no orders and has no appointed members. The Competition Commission published a market study in October 2025 and found no contravention.
Is training an AI model on copyrighted content lawful here?
At interim stage the Delhi High Court held in ANI Media v. OpenAI on 24 July 2026 that storing works to train an LLM prima facie falls within section 52(1)(a) of the Copyright Act and does not infringe. The ruling is interim, the Court said it has no bearing on the final outcome, and it is under appeal before a Division Bench.
Can we use AI-generated legal or regulatory content in filings?
Only if it is verified. In Pooja Ramesh Singh v. J&K Bank, 2026 INSC 668, the Supreme Court set aside tribunal orders that rested on six defective citations, three of which did not exist, and directed the Bar Council of India to frame disciplinary guidelines for advocates submitting fake material.
What does rule 13(3) of the DPDP Rules require?
Due diligence by a Significant Data Fiduciary to verify that technical measures including algorithmic software are not likely to pose a risk to the rights of Data Principals. The rule sets no methodology, no bias testing and no explainability standard, commences in May 2027, and binds nobody until the government designates Significant Data Fiduciaries, which it has not.
Does India regulate AI in hiring?
No. There is no Indian law on AI in recruitment or employment decisions, no bias-audit requirement and no candidate notice duty. From May 2027 section 8(3) will require accuracy of the personal data used in a decision affecting a person, which reaches the inputs rather than the model.
