Skip to main content

    AI by country · South Asia

    AI in India: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in India know before starting with AI?

    India has no dedicated AI law as of 29 October 2026, and MeitY's India AI Governance Guidelines say one is not needed at this stage. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are the main laws for AI that uses personal data, and most of their duties for businesses start in May 2027. A company should plan for those dates now, check the 2026 IT Rules changes on AI-generated content, and follow its sector regulator, such as the RBI or SEBI.

    At a glance

    India at a glance

    Key facts about India
    Data protection lawDigital Personal Data Protection Act, 2023 and DPDP Rules, 2025, phased in from 13 November 2025 to May 2027
    RegulatorData Protection Board of India (under the DPDP Act); MeitY for IT rules; RBI and SEBI for finance
    AI policyIndia AI Governance Guidelines (MeitY, November 2025) and the IndiaAI Mission (2024). No dedicated AI law as of 29 October 2026
    Time zoneIST, UTC+5:30
    CurrencyINR (Indian rupee)
    Business languageEnglish and Hindi, plus many regional languages

    Why now

    Why India is worth watching

    Each point links to the document it comes from.

    • The DPDP Rules, 2025 were published on 13 November 2025. Consent manager rules start one year later and most duties for businesses start eighteen months later, in May 2027.[2]

    • MeitY released the India AI Governance Guidelines on 5 November 2025. They rely on existing laws and voluntary measures rather than a new AI law.[5]

    • The government approved the IndiaAI Mission on 7 March 2024 with an outlay of Rs 10,371.92 crore over five years.[6]

    • By August 2026, 237 projects had been approved for subsidised compute under the IndiaAI Mission, with 93.18 lakh GPU hours sanctioned.[6]

    • The IT Rules, 2021 were amended on 10 February 2026 to require labelling of synthetically generated audio, images and video.[7]

    • The RBI released draft guidance on model risk management, covering AI and ML models, on 24 June 2026.[9]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Digital Personal Data Protection Act, 2023 (No. 22 of 2023)

    Phased2023Personal data can be processed with consent after notice, or for certain legitimate uses. A data fiduciary must keep reasonable security safeguards and report breaches. The government may restrict transfers to countries it notifies (section 16). Penalties in the Schedule go up to Rs 250 crore for failing to keep security safeguards. A summary of the commencement notice says sections 3 to 17, which hold most business duties, start eighteen months after 13 November 2025.[1]

    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))

    Phased2025Rules 1, 2 and 17 to 21 started on publication on 13 November 2025. Rule 4 on consent managers starts one year later, and rules 3, 5 to 16, 22 and 23 start eighteen months later. Once in force, a breach must be reported to the Board with details within 72 hours (rule 7). Significant data fiduciaries must run a yearly impact assessment and audit, and check that algorithmic software they use does not risk people's rights (rule 13).[2]

    IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E))

    In force2026These amendments define synthetically generated information as audio, visual or audio-visual content made or changed by a computer in a way that appears real. Intermediaries must label it prominently and must not allow the label to be removed. Large social media platforms must ask users to declare synthetic content and check that declaration.[7]

    SEBI (Intermediaries) (Amendment) Regulations, 2025, regulation 16C

    In force2025Any SEBI-regulated person that uses AI or ML tools, built in-house or bought from a vendor, is solely responsible for investor data, for the output of those tools and for compliance with the law. It came into force on publication on 10 February 2025.[10]

    RBI draft Guidance on Regulatory Principles for Model Risk Management, 2026

    Draft2026The draft covers governance, risk management and oversight of models used by RBI-regulated entities, including AI and ML models and third-party models. Comments closed on 24 July 2026. We found no final version as of 29 October 2026.[9]

    Where AI fits first

    Where AI fits first

    Banking and lending

    Document checks for loan files, fraud alerts and customer service in English and regional languages.

    The RBI's FREE-AI committee report of August 2025 set out 7 sutras and 26 recommendations. The draft model risk guidance of June 2026 would add rules for AI models once final.[8]

    Securities and investment

    Research summaries, surveillance support and client query handling, with staff reviewing outputs.

    Regulation 16C makes the SEBI-regulated entity responsible for AI output, even when the tool comes from a vendor.[10]

    Media, marketing and online platforms

    Generated images, voice and video for campaigns and product content.

    The February 2026 IT Rules amendments require prominent labels on synthetic audio and video and stop platforms from allowing labels to be removed.[7]

    Education and consumer apps

    Tutoring and support assistants in Indian languages.

    The DPDP Act sets extra duties for children's data, including verifiable parental consent, once section 9 is in force.[1]

    Your first steps

    Your first steps

    1. List the personal data each AI system uses and the purpose, so you can write the notices the DPDP Rules require.
    2. Mark your calendar for mid-November 2026 (consent managers) and mid-May 2027 (most DPDP duties), counted from the 13 November 2025 publication.
    3. Set up a breach process that can give the Data Protection Board a detailed report within 72 hours.
    4. Label any synthetic audio, images or video you publish, and check what your platforms now require under the 2026 IT Rules changes.
    5. If you are regulated by SEBI or the RBI, give one named person ownership of every AI tool's output, including vendor tools.
    6. Read the India AI Governance Guidelines and adopt their steps for industry: publish transparency reports and offer a grievance channel.
    7. Ask whether you may be notified as a significant data fiduciary, which brings yearly impact assessments and audits.

    AI services for India

    AI consulting and development for teams in India

    We work remotely with companies in India, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    ZigmaNeural is an Indian company and works on IST, UTC+5:30, the same time zone as clients in India. Our working hours of 9:30 to 18:30 IST are the same as a normal Indian business day, so the overlap is the full day. We work remotely with clients, in India and elsewhere.

    Questions

    Common questions about AI in India

    Does India have an AI law?

    Not as of 29 October 2026. MeitY's India AI Governance Guidelines say a separate AI law is not needed at this stage, and existing laws on IT, data protection and consumer protection apply instead.

    When do I have to comply with the DPDP Act?

    The DPDP Rules were published on 13 November 2025. Consent manager rules start one year later and most duties for businesses start eighteen months later, in May 2027. MeitY was reported in early 2026 to be considering a shorter 12-month timeline, but we found no notified change as of 29 October 2026.

    What are the penalties under the DPDP Act?

    The Schedule sets maximum penalties. Failing to keep reasonable security safeguards can cost up to Rs 250 crore. Failing to report a breach, or breaching duties on children's data, can cost up to Rs 200 crore each.

    Can I send personal data to an AI service abroad?

    Generally yes. Section 16 lets the government restrict transfers to countries it notifies, and rule 15 lets it set requirements for data made available to foreign states. Significant data fiduciaries may also have to keep some notified data in India.

    Do I need to label AI-generated content?

    Platforms covered by the IT Rules must label synthetically generated audio, images and video. Text-only content is outside that definition. If you publish through platforms, expect them to ask you to declare such content.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Ministry of Law and Justice, via MeitY, 2023-08-11. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)(meity.gov.in)
      Full title and what we used it for

      The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Primary. Gazette text read in full. Used for consent, security safeguards, children's data (section 9), transfers (section 16) and the penalty Schedule.

    2. [2] Ministry of Electronics and Information Technology (MeitY), 2025-11-13. Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))(meity.gov.in)
      Full title and what we used it for

      Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)). Primary. Gazette text read in full. Used for the commencement schedule in rule 1, breach reporting (rule 7), significant data fiduciary duties (rule 13) and transfers (rule 15).

    3. [3] Taxmann, 2025-11-14. Govt notifies commencement dates for DPDP Act(taxmann.com)
      Full title and what we used it for

      Govt notifies commencement dates for DPDP Act. Secondary summary of commencement notice G.S.R. 843(E) of 13 November 2025, used for which sections of the Act start after eighteen months. We could not open the notice itself.

    4. [4] MeitY, IndiaAI Mission, 2025-11-05. India AI Governance Guidelines(static.pib.gov.in)
      Full title and what we used it for

      India AI Governance Guidelines. Primary. Read in full text. Used for the seven sutras, the finding that a separate AI law is not needed at this stage, and the steps for industry.

    5. [5] Press Information Bureau, 2025-11-05. MeitY unveils India AI Governance Guidelines(pib.gov.in)
      Full title and what we used it for

      MeitY unveils India AI Governance Guidelines. Primary government release. Used for the release date and the focus on using existing laws.

    6. [6] Press Information Bureau, 2026-08-06. Government expands sovereign AI infrastructure through IndiaAI Mission…(pib.gov.in)
      Full title and what we used it for

      Government expands sovereign AI infrastructure through IndiaAI Mission and semiconductor initiatives. Primary government release. Used for the IndiaAI Mission approval date, outlay and compute figures.

    7. [7] MeitY, 2026-02-10. IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021,…(meity.gov.in)
      Full title and what we used it for

      IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, updated as on 10.02.2026. Primary consolidated text showing the G.S.R. 120(E) amendments of 10 February 2026. Used for the definition of synthetically generated information, labelling and user declarations.

    8. [8] Reserve Bank of India, 2025-08-13. Report of the Committee to develop a Framework for Responsible and Ethi…(rbi.org.in)
      Full title and what we used it for

      Report of the Committee to develop a Framework for Responsible and Ethical Enablement of AI (FREE-AI) in the Financial Sector. Primary press release. Used for the 7 sutras, 26 recommendations and six pillars. It is a committee report, not a binding direction.

    9. [9] Reserve Bank of India, 2026-06-24. Draft Guidance on Regulatory Principles for Model Risk Management, 2026(rbi.org.in)
      Full title and what we used it for

      Draft Guidance on Regulatory Principles for Model Risk Management, 2026. Primary. Used for the draft date, scope covering AI and ML models, and the 24 July 2026 comment deadline.

    10. [10] Securities and Exchange Board of India, 2025-02-10. SEBI (Intermediaries) (Amendment) Regulations, 2025(sebi.gov.in)
      Full title and what we used it for

      SEBI (Intermediaries) (Amendment) Regulations, 2025. Primary gazette text read in full. Used for regulation 16C and commencement on publication on 10 February 2025.

    11. [11] dpdprules.org, 2026-10-29. Is the DPDP Act in force? Status, dates and deadlines(dpdprules.org)
      Full title and what we used it for

      Is the DPDP Act in force? Status, dates and deadlines. Secondary tracker, accessed on this date. Used only to check that no change to the commencement periods had been located, and for the reported 12-month proposal of January 2026.

    This is general information, not legal advice. Commencement dates are counted from the 13 November 2025 Gazette date, and some summaries count from 14 November, so check the exact day with a qualified Indian lawyer. Laws and drafts change quickly. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in India?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score