Report on AI Governance Guidelines Development (MeitY subcommittee report, January 2025)

By 2024 Indian AI policy had swung between positions. In March 2024 MeitY issued an advisory asking companies to get government permission before deploying certain AI models, withdrew it after sharp criticism and replaced it with a softer one. In April 2023 the Minister had told Parliament that the government was not considering a law to regulate AI growth, and in October 2024 he said India would prioritise innovation over heavy regulation. On 11 December 2024 he told the Lok Sabha that the government was open to AI legislation if there was broad consensus and that "the legal framework has to change".⁹¹⁰ MediaNama's coverage described the position as fluctuating between self-regulation and a legal framework.⁷¹⁰

A multi-stakeholder advisory group under the Principal Scientific Adviser (PSA) had been formed in 2023 to examine AI issues, and it set up a subcommittee on AI governance that included Prof. Balaraman Ravindran, Debjani Ghosh and Sharad Sharma. By late 2024 this subcommittee had prepared a draft report, which reported to the PSA's office but had not been published.⁸⁹ On 7 October 2024 MeitY also held a roundtable titled 'Ensuring AI Safety: Building a Safe and Trusted AI Ecosystem in India', which civil-society groups such as Access Now attended (see the entry on the IndiaAI Safety Institute).³

MeitY released the report on 6 January 2025, and MediaNama's analysis of it was published on 8 January.²¹ Access Now, quoting page 3, noted that the report says AI governance should be driven by the need to prevent and "minimise risks and harms".³ According to the analyses by MediaNama, the Internet Governance Project and civil-society submissions, its main elements were:¹³⁴

Principles. A principles-based approach to 'responsible and trustworthy AI' with human-centred values, do no harm, inclusive and sustainable innovation, transparency, safety, reliability and robustness, privacy and security, and human oversight.

Institutions. MeitY, working with the PSA, should set up an Inter-Ministerial AI Coordination Committee or Governance Group to align institutions around a common roadmap, and a Technical Secretariat at MeitY to act as technical advisor and coordination point. The report also recommended an AI sub-group with MeitY to strengthen the Digital India Act and better redress and adjudication mechanisms extending to appellate level.¹

AI incident database. The Secretariat would create a repository of real-world AI problems to build evidence on actual risks. Public sector bodies deploying AI, including through public-private partnerships, would report initially; private entities would be encouraged to report voluntarily; the focus would be confidentiality and harm mitigation, and not an enforcement tool. CERT-In was suggested as manager. 'AI incident' would cover IT Act cyber incidents as well as malfunctions, discriminatory outcomes, system failures, privacy violations and safety issues.¹

Voluntary commitments. Disclosure of intended purpose, regular transparency reports, testing and monitoring of data quality and robustness, conformity assessments against responsible-AI principles, and security, vulnerability assessment and business-continuity measures.¹

Techno-legal tools. Borrowing from MeitY's Electronic Consent Framework, the report proposed unique, unchangeable identities for creators, publishers and platforms, watermarking of AI inputs and outputs, tracking of content such as deepfakes from creation to use and flagging of non-consensual or unlawful content, with inter-party contracts to share liability fairly.¹

Regulatory design. Regulation should aim to minimise the risk of harm, supported by traceability of data, models, systems and actors across the AI lifecycle and transparency about how liability and risk are allocated through contracts. It identified entity-based regulation (licensing), activity-based regulation (consumer protection, data protection, competition, copyright, employment) and combinations, and said risk depends on a system's capability and its deployment context, so that classifying systems by compute or data parameters alone may not work.¹

Copyright. The report raised, without answering, questions about training on copyrighted content without rightsholder approval and about whether AI-generated works can be copyrighted.¹

The comment window was about 20 days at first, which IFF called too short; it was extended to 27 February 2025 after civil-society groups objected.² MediaNama listed five published submissions and said MeitY had not said whether it would publish all comments.⁷

Internet Governance Project (IGP) argued that 'AI' is "a marketing term" for diverse computing applications, that AI should be treated as an extension of networked computing and not a new paradigm, that principles such as 'human-centered values' and 'do no harm' were too broad, that a generic self-regulatory approach would not work, that many liabilities are better handled through contracts, and that existing laws such as anti-discrimination law should apply. It cautioned against building new incident databases when global ones exist.⁴

Internet Freedom Foundation (IFF) objected to the short window and English-only, form-based consultation, to principles without binding enforcement and to over-reliance on self-regulation, and noted the report was largely silent on constitutional morality, which NITI Aayog's responsible-AI principles had recognised. It recommended a unified policy framework, risk-based categorisation drawing on the EU AI Act, grounding in Articles 14, 19 and 21, external audits and algorithmic impact assessments, and protection for gig workers against opaque algorithmic management.²

Access Now supported the principles but asked for governance anchored in proactive goals such as rights and opportunities for innovation, for transparency to include information on training datasets, for mandatory (not optional) disclosure commitments by government actors, for environmental impact assessments, and for stakeholder consultation in the Inter-Ministerial Committee. It urged that traceability measures not be applied to end-to-end encrypted platforms because they would force a change to their architecture.³

Dvara Research supported a lifecycle approach, asked for contestability and explainability to be added to the transparency principle, raised liability concerns about multiple actors, unclear fault definitions and probabilistic causation, and cautioned against relying solely on risk-based approaches, proposing a four-part risk qualification of probability, scale, autonomy and severity of harm.⁵ SFLC.in also filed recommendations.⁶

MediaNama's analysis noted that the report leaned heavily on self-regulation, that the DPDP Act's exclusion of publicly available data benefits AI scrapers, and that it was unclear how Significant Data Fiduciary obligations would apply to AI products.¹

The Guidelines of November 2025 explain that a drafting committee was formed after the submissions, more than 2,500 by their count (MediaNama reported over 650 inputs at the launch), to review stakeholder feedback and prepare the final framework.⁸¹¹ Many ideas in the draft carry through into the Guidelines: a high-level inter-agency body (the proposed AI Governance Group), technical advisory arms (the Technology and Policy Expert Committee and a resourced AI Safety Institute), the incident database, voluntary commitments and techno-legal approaches. The Guidelines are distinguished by seven sutras adapted from the RBI's FREE-AI report, a conclusion that no separate AI law is needed at this stage, a graded liability proposal and a phased action plan.⁸

The draft is significant as an early official statement of India's preference for a principles-based, harm-focused approach to AI governance, as distinct from a risk-tiered statute such as the EU's, and for the civil-society critique it drew on consultation, enforcement and self-regulation. It was never intended as a binding instrument.¹²

Current status. The draft is superseded by the 2025 Guidelines. As of 15 October 2026 the sources reviewed did not show that MeitY had published the individual submissions or a consultation summary.⁷⁸