India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (MeitY, November 2025)

India had no AI-specific statute when the Guidelines appeared, and government policy had alternated between regulation and self-regulation. Earlier documents included NITI Aayog's 2018 national strategy and 2021-22 responsible-AI papers, the 2024 MeitY advisory requiring government permission for under-tested AI models (partly rolled back after industry concerns),⁵ and the January 2025 report of a subcommittee of the advisory group chaired by the Principal Scientific Adviser (PSA). That group had been set up in 2023 and its subcommittee, which included Prof. Balaraman Ravindran, Debjani Ghosh and Sharad Sharma, prepared a draft report that MeitY published for public comment. The Guidelines say more than 2,500 submissions came in from government bodies, academic institutions, think tanks, industry associations, private companies and individuals.¹ MediaNama, in contrast, reported 650-plus inputs.²

MeitY then constituted a drafting committee in July 2025, chaired by Prof. Ravindran, with Abhishek Singh (Additional Secretary), Debjani Ghosh and Amlan Mohanty (NITI Aayog), Kalika Bali, Rahul Matthan, Sharad Sharma and officials of MeitY, IndiaAI and the Department of Telecommunications. Its terms of reference were to recommend a framework that promotes innovation while mitigating risks, to explain the rationale for India's approach, to build trust, and to give practical guidance to industry and principles to regulators.¹ The report was released on 5 November 2025, ahead of the India AI Impact Summit of February 2026.²

Part 1 adopts seven principles, which the committee says it adapted from the Reserve Bank of India's FREE-AI Committee report, so that they are technology-neutral and apply across sectors:¹

Part 2 makes recommendations under six pillars, grouped as enablement (infrastructure, capacity building), regulation (policy and regulation, risk mitigation) and oversight (accountability, institutions).¹

1. Infrastructure. Expand access to datasets, compute and digital public infrastructure (DPI). The Guidelines record, as of 31 August 2025, over 38,231 GPUs, 1,500 AIKosh datasets and 217 models, four supported sovereign-model startups and 30 applications at prototyping stage. They recommend incentives for data contributions, anonymised data-sharing frameworks, evaluation datasets and MSME financing, including tax rebates and AI-linked loans through SIDBI and Mudra.

2. Capacity building. Training for public officials, regulators and law enforcement, public awareness campaigns, and expansion to tier-2 and tier-3 cities and vocational institutes.

3. Policy and regulation. A comprehensive review of laws to find gaps, with targeted amendments. The committee's "current assessment" is that many AI risks can be addressed under existing law, for example deepfake impersonation under the Information Technology Act and the Bharatiya Nyaya Sanhita, and training on personal data without consent under the Digital Personal Data Protection Act. It flags the Pre-Conception and Pre-Natal Diagnostic Techniques Act for review because AI analysis of radiology images could be misused for sex selection, and sets out four areas of ongoing deliberation, described below.

4. Risk mitigation. An India-specific risk assessment and classification framework, a national AI-incident database, voluntary frameworks, techno-legal measures and safeguards against loss of control. The Guidelines list six risk categories: malicious use, bias and discrimination, transparency failures, systemic risks, loss of control and national security, and highlight children and women as vulnerable groups.

5. Accountability. A graded liability system, grievance redress, transparency about the AI value chain and enforcement of existing laws, backed by guidance such as a master circular.

6. Institutions. A whole-of-government approach, described below.

No standalone law. The Guidelines state that existing laws on information technology, data protection, consumer protection and criminal codes can govern AI applications, and that "at this stage, a separate law to regulate AI is not needed given the current assessment of risks", while insisting that timely and consistent enforcement of existing law is required. India's approach, they say, is to govern the applications of AI by empowering sectoral regulators and "not to regulate the underlying technology itself".¹ The long-term action plan nevertheless includes drafting new laws based on emerging risks and capabilities.¹

IT Act classification and safe harbour. The Guidelines say the IT Act is out of date for AI: roles such as developer, deployer and user need definition, and so do 'intermediary', 'publisher' and 'computer system'. They note that Section 79 immunity applies to intermediaries that do not initiate transmission, select the receiver or modify content, and that such immunity "would not be applicable to many types of AI systems that generate or modify content". They recommend suitable amendments to clarify classification, obligations and liability.¹

Liability. A graded system where responsibility is proportional to function, risk and due diligence. The Guidelines cite the RBI FREE-AI report's 'tolerant' stance towards first-time aberrations but stress that the rule of law is paramount.¹³

Data protection. Open questions include the exemption for training on publicly available personal data, whether purpose limitation fits how AI works, the role of consent managers and the research and legitimate-use exceptions; the committee recommends review by the AI Governance Group.¹

Copyright. The Guidelines note that Section 52 of the Copyright Act offers fair dealing only for limited private or research uses that may not cover modern AI training, and suggest that the committee set up by the Department for Promotion of Industry and Internal Trade (DPIIT) in April 2025 consider a balanced text-and-data-mining approach with protections for rights holders.¹ That DPIIT committee's working paper, reported in December 2025, proposed a mandatory blanket licence with statutory royalties and no creator opt-out, which MeitY supported and NASSCOM opposed.¹¹

Content authentication. The Guidelines recommend an expert committee on global standards for content authentication and provenance (citing watermarking and C2PA) and ask the AIGG to review the regulatory framework for deepfakes.¹

AI Governance Group (AIGG). A "small and effective decision-making body" chaired by the PSA, with MeitY, the Home and External Affairs Ministries, DST, DoT, regulators (TRAI, CCI, the Data Protection Board, RBI, SEBI, ICMR, UGC), NITI Aayog and the PSA's office. Its functions are to coordinate policy across ministries and regulators, issue guidelines on compliance with local laws, oversee national governance initiatives and study risks, regulatory gaps and the need for legal amendments.¹

Technology and Policy Expert Committee (TPEC). A MeitY-constituted group of experts in frontier technology, machine learning, emerging-technology law, public administration and national security that briefs the AIGG.¹

AI Safety Institute (AISI). The main technical body for safe and trusted AI, to be adequately resourced and to work on a hub-and-spoke model (see the separate entry).¹

Sectoral regulators such as RBI and SEBI keep enforcement powers, and MeitY is the nodal ministry, working with the AISI and CERT-In.¹

The action plan has three horizons:¹

Part 4 gives practical guidelines. Industry should comply with all Indian laws, adopt voluntary measures, publish transparency reports, offer grievance redress and consider techno-legal tools. Regulators should avoid compliance-heavy regimes such as mandatory approvals unless necessary, prioritise real and present harms and review frameworks periodically. MeitY may publish a compliance schedule within 9 to 12 months.¹

Reaction at the launch stressed that the Guidelines are not regulation. MeitY Secretary S. Krishnan spoke of "a conscious and deliberate approach of not leading with regulation", and Prof. Ravindran said the committee was "not calling it the AI Regulation of India".² Krishnan told an industry event in December 2025 that "my own inclination always is to avoid putting in a new law", while noting that the Digital India Act, once expected to carry AI provisions, had not been introduced.⁵

Several follow-up steps have been taken:

• In January 2026 the Office of the Principal Scientific Adviser published a white paper on techno-legal AI governance that builds on the Guidelines. It rejects an omnibus AI law in favour of a 'law-plus' model of sectoral rules, standards and technical enforcement, and proposes lifecycle controls and a national incident database.⁶
• On 13 April 2026 MeitY constituted an AI Governance and Economic Group (AIGEG), chaired by the Minister of Electronics and IT, merging the AIGG proposal with an AI Economic Council suggested in the Economic Survey. It does not include TRAI, the CCI, the Data Protection Board or sectoral regulators such as RBI and SEBI, which the Guidelines had listed for the AIGG, a point MediaNama highlighted.⁷
• The Guidelines' call for a national AI-incident database had not, in the sources reviewed, been shown to be operational by October 2026.¹

Critics point out that the Guidelines are not enforceable. At the launch officials said they have no legal enforceability, and MediaNama noted that they do not define legal liability or penalties.⁵ Speakers at a MediaNama discussion of the January 2025 draft argued that self-regulation has failed in other domains and that AI rules should be sector-specific, and the draft itself acknowledged that a fragmented sectoral approach could create gaps.⁴

MediaNama's analysis of the PSA's January 2026 white paper noted that it does not clarify who is responsible when AI failures cut across regulators, how affected people can obtain remedies, or when regulators should step in if voluntary measures fail.⁶ On data protection, MediaNama observed that the DPDP Act's treatment of publicly available personal data benefits AI companies that scrape such data.³

In April 2026 the Parliamentary Standing Committee on Communications and Information Technology asked the government to examine the feasibility of a comprehensive AI law, while MeitY replied that existing laws were sufficient.⁸ MediaNama also highlighted the difference between the Guidelines' list of regulators for the AIGG and the membership of the AIGEG.⁷

As of 15 October 2026 the Guidelines remain the government's main framework document on AI governance, with a mix of steps taken (the AIGEG and the PSA white paper) and recommendations that have not been shown to be implemented, such as the master circular and the sandbox pilots.

The policy position has moved. In an interview reported on 11 June 2026, IT Minister Ashwini Vaishnaw said that "there is a requirement for a new law" because the IT Act of 2000 does not fit today's AI landscape and that MeitY was discussing a framework with industry. On 9 July 2026 Secretary S. Krishnan said MeitY would begin stakeholder discussions on a separate law for AI regulation and then start drafting.⁹¹⁰ MediaNama presented this as a shift from the position that Krishnan had stated in December 2025.⁵¹⁰ On 8 October 2026, at the launch of the World Development Report 2026, Vaishnaw said that the time for AI regulation had come and that MeitY would release a regulation-focused consultation paper within a month. He named safety, a human-first approach, scaling and inclusivity as its themes, said AI could not be regulated by law alone and that a techno-legal approach with stakeholders was needed, with industry carrying much of the responsibility for cybersecurity, safety, user harm and deepfakes. MediaNama's report did not say whether the paper would be public or whether it would build on or revise the Guidelines.¹² The Guidelines themselves leave room for legislation, with 'new laws' listed as a long-term action item.¹