White paper on techno-legal AI governance (Office of the Principal Scientific Adviser, January 2026)

MeitY's India AI Governance Guidelines, released on 5 November 2025, concluded that a separate law to regulate AI was not needed at this stage and described a 'techno-legal approach' in which "digital architecture enforces what law requires". The Guidelines pointed to content authentication, privacy-preserving tools and transparency in automated decisions as places where such measures can work, and to the Data Empowerment and Protection Architecture (DEPA) as an example, including a possible 'DEPA for AI Training'.² In January 2026 the Office of the Principal Scientific Adviser (PSA), whose head chairs the proposed AI Governance Group, followed with a white paper that develops the idea. Prof. Ajay Kumar Sood wrote its foreword.¹

MediaNama reported the paper on 27 January 2026 (and updated its report on 29 January), linking the PDF named 'AI-WP_TechnoLegal.pdf'. The full PDF could not be retrieved for this entry, so the account below follows MediaNama's summary of its contents.¹³

According to MediaNama's summary, the white paper rejects a standalone or omnibus AI law. It says governance should work inside AI systems through technical controls across their lifecycle, anchored in existing legal and regulatory instruments. It proposes a 'law-plus' model in which sector-specific rules, subordinate legislation, regulatory guidance, standards and technical enforcement fill gaps on top of existing laws, and it rejects uniform obligations for all AI systems in favour of proportionate, context-sensitive regulation.¹

The position is consistent with the Guidelines, but it is more specific about mechanism. The Guidelines said existing laws on information technology, data protection, consumer protection and criminal law could address many AI risks, while listing 'new laws' as a long-term action item. The white paper elaborates how enforcement would be delivered, through technology built into systems and infrastructure.²¹

The paper defines techno-legal governance as the integration of legal instruments, rule-based conditioning, regulatory oversight and technical enforcement into AI systems by design, so that governance is an intrinsic feature of the system and not an external constraint applied after deployment. Its core characteristics are transparency, explainability, provability and enablement for innovation, tied to constitutional and developmental values. Governance is layered: from law to rules framed under it, then regulatory guidance, standards, and finally protocols and technical tools. It relies on automated checks and measurable accountability through logs, attestations and audit trails.¹

It distinguishes 'AI users', who interact with systems, from 'AI subjects', who are affected by AI decisions without necessarily knowing or consenting. It organises governance around five lifecycle stages:¹

The white paper names the institutions that the Guidelines proposed: an AI Governance Group chaired by the PSA, to coordinate ministries and regulators, align standards, identify regulatory gaps and guide policy; a Technology and Policy Expert Committee under MeitY; an AI Safety Institute to evaluate and test AI systems, develop safety tools, support capacity-building and engage internationally; and a national AI incident database through which public bodies, companies, researchers and civil society report AI failures to inform standards.¹

Its main recommendations, as summarised, are to use voluntary commitments and self-regulation (industry transparency reports, red-teaming and safety testing), supported by incentives for early adopters; to treat digital public infrastructure such as Aadhaar, DigiLocker and UPI as governance enablers for consent-based access, identity verification, auditability and interoperability; to use DEPA for purpose-limited, consent-driven data sharing with privacy-preserving techniques; and to embed techno-legal controls into DPI and DEPA workflows to reduce compliance friction at population scale.¹

MediaNama's own analysis identified several unresolved issues in the paper:¹

• Enforcement boundaries. The paper does not clarify who is accountable when AI failures cut across regulators, for example biased exclusions in an Aadhaar-linked welfare system.
• Redress. It does not explain how affected people, such as rejected job applicants, can learn that AI was involved or seek explanations and remedies.
• Escalation. It does not define when regulators should intervene if voluntary measures fail.
• Feasibility. Continuous monitoring, provenance tools and lifecycle audits assume technical capacity that startups and state agencies may lack, particularly in the near term.

The paper itself acknowledges tensions over privacy versus performance, governing 'AI subjects' as well as users, cross-border alignment and compliance costs.¹ The Guidelines made a related point about DEPA for AI Training: privacy-enhancing technologies can reduce benchmark performance, and the architecture has a limited role in governing downstream impacts once a model is trained, so it must sit within a wider architecture of ethical, regulatory and institutional oversight.²

Critics of the broader approach, including civil-society groups that commented on the earlier January 2025 draft report, have argued that principles and voluntary measures without binding enforcement leave gaps; those criticisms are covered in the entries on the draft report and the Guidelines.

As of 15 October 2026 the white paper is a non-binding statement from the PSA's office. Developments after its release complicate its position that no standalone law is needed. On 13 April 2026 MeitY constituted an AI Governance and Economic Group chaired by the IT Minister, which differs from the PSA-chaired group the white paper describes and does not include sectoral regulators.⁴ In June 2026 the IT Minister said in an interview that "there is a requirement for a new law", and on 9 July 2026 the MeitY Secretary said stakeholder discussions on a separate law for AI regulation would begin.⁵⁶ On 8 October 2026 Vaishnaw said that AI could not be regulated by law alone and that a techno-legal approach, with stakeholders and industry carrying much of the responsibility, was needed, and that MeitY would release a regulation-focused consultation paper within a month; MediaNama's report did not say whether the paper would build on this white paper or the Guidelines.⁷ The sources reviewed give no draft of any law, and do not say how the white paper's proposals would fit into it.