AI Regulation in India: Current Landscape, Key Laws, and Challenges

India does not have one comprehensive law that regulates every artificial intelligence (AI) system. Instead, existing laws apply depending on how an AI tool is built, what data it uses, and how its output is used. The Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the Information Technology Rules are important parts of this framework.

• The IT Act addresses cyber offences and intermediary liability, including certain cases involving impersonation, identity theft and privacy violations.
• The DPDP Act, 2023, provides a framework for processing digital personal data. Its provisions are being brought into force in phases under the 2025 commencement notification.
• The IT Rules amendment notified in February 2026 defines synthetically generated information and adds obligations relevant to certain AI-generated audio-visual content. It came into force on 20 February 2026.
• Consumer protection

Aspiring to build a career in AI Law? Explore legal career paths, understand the qualifications required and check your lawyer loan eligibility  to help manage eligible professional expenses.

India’s AI governance framework is spread across several laws and regulatory measures rather than one comprehensive AI statute. Some requirements are binding law, while policy principles and guidance may not have the same legal status.

• Technology and cyber laws address electronic activity, unauthorised access and certain online offences.
• Data protection rules apply where an AI system processes digital personal data, subject to the relevant commencement provisions and exceptions.
• Intermediary rules can impose due-diligence and grievance-related obligations on platforms that fall within their scope.
• Regulators may issue sector-specific requirements for areas such as finance, healthcare and insurance.
• Government AI strategies and ethical guidance can inform responsible development, but should not automatically be treated as binding legislation.

India does not currently have a single, dedicated AI law. Instead, artificial intelligence is governed by existing laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and applicable intellectual property and criminal laws. India uses this existing legal framework alongside AI-specific policies and guidelines to address data protection, accountability and responsible AI use.

The Information Technology Act, 2000 (IT Act) provides a legal framework for electronic records and addresses specified cyber offences. It can apply when AI systems or their users are involved in conduct covered by the Act.

• Sections addressing computer-related offences may apply to unauthorised access or damage involving computer resources.
• Sections 66C and 66D address identity theft and cheating by personation using computer resources, where the legal elements are met.
• Sections 66E, 67 and 67A address specified privacy and unlawful-content offences.
• Section 79 provides conditional protection from liability for intermediaries for third-party information. This protection depends on the statutory conditions and applicable due diligence; it is not a blanket exemption for every AI platform.

For example, using AI to create a fake identity or impersonate another person may raise issues under existing cyber laws. The outcome depends on the conduct, evidence and provisions that apply.

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data. It is relevant when an AI system collects, uses, analyses or otherwise processes digital personal data within the Act’s scope.

• Organisations should identify the personal data used by an AI system and the purpose for processing it.
• They should assess the applicable notice, consent or other permitted-use requirements, along with individual rights and security obligations.
• Data fiduciaries should consider their responsibilities for processing carried out by vendors or AI service providers on their behalf.
• The Act provides for financial penalties for specified contraventions, subject to the applicable provisions.

The DPDP Act received assent in 2023, and the Digital Personal Data Protection Rules were notified in November 2025. The commencement notification phases different provisions over time, so organisations should check which requirements are in force on the relevant date instead of assuming that every provision started at once.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended, set due-diligence requirements for intermediaries and address certain online content and grievance processes. Their application depends on the type of service and the relevant rule.

An amendment notified on 10 February 2026 came into force on 20 February 2026. It introduced a definition of “synthetically generated information” for specified audio, visual and audio-visual content and added requirements relating to such content. The amendment includes exclusions for certain routine editing, accessibility and good-faith uses that do not materially misrepresent the underlying content.

Platforms and other covered entities should review the amended rules to determine which identification, handling, removal and compliance duties apply to them. These requirements should not be described as applying identically to every person who uses an AI tool.

AI systems may also be affected by laws that apply to the product, service, output or transaction involved.

• Consumer Protection Act, 2019: may apply to misleading claims, unfair trade practices or deficient services involving AI-based products, depending on the facts.
• Intellectual property laws: Copyright, trademark and other rights may be relevant to training material, generated output or the unauthorised use of protected work. The legal position can depend on the material and circumstances.
• Contract law: Contracts can set terms for access to data, permitted uses, confidentiality, ownership, warranties and responsibility between parties, subject to applicable law.
• Sectoral regulation: Financial services, healthcare and insurance may be subject to additional laws, standards and regulator directions when AI is used in those activities.

No single rule resolves every AI-related issue. Organisations should assess the specific use case and seek specialist advice where legal rights or regulated activities are involved.

AI regulation must address fast-changing technology while keeping legal duties clear and enforceable. Common challenges include:

• Attribution of responsibility: It may be difficult to identify the respective roles of a developer, deployer, platform, vendor and user.
• Transparency: Some AI systems provide limited explanations for how an output or decision was produced.
• Bias and fairness: Training data or system design may lead to unequal or inaccurate outcomes.
• Privacy and security: Systems may process personal or confidential data and can be exposed to misuse or security incidents.
• Cross-border operations: AI services, data and providers may span multiple jurisdictions and legal regimes.
• Regulatory capacity: Effective oversight can require technical expertise, evidence and coordination across regulators.

These challenges make impact assessment, documentation, human review where appropriate, security controls and clear accountability useful parts of responsible AI governance.

India’s approach is developing through existing legislation, rules for digital platforms, data protection implementation and sector-specific oversight. This allows different risks to be addressed through the laws relevant to each activity, while new measures may clarify duties for emerging AI uses.

For organisations, long-term governance means tracking legal commencement dates and amendments, documenting how AI systems are used, checking data rights, reviewing third-party contracts and maintaining routes to report and correct harmful outputs. Policy guidance can support this work, but legal teams should distinguish guidance from binding requirements.

AI regulation in India is shaped by several laws rather than one comprehensive AI-specific statute. The IT Act, the DPDP Act and the amended IT Rules are important parts of the framework, alongside consumer, intellectual property, contract and sectoral laws. The DPDP Act’s provisions have phased commencement, and the 2026 IT Rules amendment on synthetically generated information took effect on 20 February 2026. Businesses should assess each AI use case against the rules that apply to it and monitor official notifications for changes.