AI Governance in India: What the AI Governance Guidelines and the 2026 IT Rules Amendment Mean for Businesses

Businesses deploying artificial intelligence in India often ask the same question: is there an AI law? The short answer is no, not a single statute. The fuller answer is that AI is already regulated. Existing laws apply to it, the Government has issued governance guidelines, and specific rules now govern AI-generated content on online platforms.

This note sets out the framework as it stands in October 2026 and what it means for organisations that build or use AI.

The India AI Governance Guidelines

In November 2025, MeitY released the India AI Governance Guidelines under the IndiaAI Mission. The Guidelines chose not to introduce prescriptive AI regulation at this stage. They favour a principles-based approach, supported by existing law and voluntary measures.

The Guidelines set out seven principles, or "sutras": trust; people first; innovation over restraint; fairness and equity; accountability; understandable by design; and safety, resilience and sustainability.

They organise recommendations across six pillars: infrastructure, capacity building, policy and regulation, risk mitigation, accountability, and institutions. On the institutional side, they propose an AI Governance Group for whole-of-government coordination, a Technology and Policy Expert Committee, and a role for the AI Safety Institute in technical validation and safety research. They also lay the groundwork for a national system to report AI incidents.

What the Guidelines expect of industry

The Guidelines are not binding, but they signal what regulators will look for. The recommendations for organisations include:

• Grievance redressal. A clear channel for reporting AI-related harm, with defined response times.
• Transparency. Information on how AI systems are used, the risks identified and the mitigation applied.
• Voluntary frameworks. Adoption of industry principles, self-assessments and, for higher-impact systems, independent audits.
• Technical safeguards. Measures such as content authentication, bias testing and red-teaming.

The 2026 IT Rules amendment on synthetic content

The most concrete AI-specific obligations so far apply to online intermediaries. MeitY notified amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 on 10 February 2026, and they took effect on 20 February 2026. Among other things, the amendments:

• define "synthetically generated information", meaning audio, visual or audio-visual content created or altered by computer so that it appears real, with exclusions for routine editing and good-faith uses;
• require permitted synthetic content to be prominently labelled and to carry metadata or provenance markers that platforms must not allow to be removed;
• require significant social media intermediaries to obtain user declarations on whether content is synthetic, and to verify and label it; and
• shorten the time to act on government or court takedown orders to three hours.

Platforms that offer generative AI tools also face obligations to warn users and to prevent prohibited synthetic content.

Existing laws continue to apply

AI does not sit outside the general law. Several existing regimes already reach AI deployments:

• Data protection. The DPDP Act applies where personal data is used to train, fine-tune or run AI systems. From May 2027, notice, consent, purpose limitation and security obligations will apply in full. Significant Data Fiduciaries must also verify that algorithmic software does not pose a risk to Data Principals' rights.
• Consumer protection. Misleading claims about AI products, and dark patterns in AI-driven interfaces, can attract scrutiny.
• Sector regulators. Financial, health and telecom regulators continue to apply their own rules to AI used in regulated activities.
• Contract and liability. AI procurement contracts need to allocate responsibility for outputs, data use, intellectual property and security.

What boards should put in place

1. An AI inventory. A register of AI systems in use, built or bought, with their purpose, data sources and owner.
2. A risk classification. Higher scrutiny for systems that make or support decisions about individuals.
3. An AI policy. Approved uses, prohibited uses, human oversight and escalation.
4. Vendor terms. AI-specific clauses on training data, confidentiality, output ownership and audit rights.
5. Grievance and transparency. A route for affected individuals to raise concerns, consistent with the Guidelines.

Conclusion

India's approach to AI governance is deliberate. It is light on new statutes, but it is not a vacuum. Voluntary guidelines set expectations, targeted rules govern synthetic content, and the DPDP Act will apply in full from May 2027. Organisations that put basic AI governance in place now will be well placed as voluntary expectations become binding.

Frequently asked questions

Does India have an AI law?

Not a standalone statute. AI is governed through existing laws such as the IT Act and the DPDP Act, MeitY's India AI Governance Guidelines and targeted amendments to the IT Rules.

What do the 2026 IT Rules say about deepfakes?

From 20 February 2026, synthetically generated content must be labelled and carry provenance markers, and intermediaries must act on government or court takedown orders within three hours.

Does the DPDP Act apply to AI training data?

Yes, where the training or operation of an AI system involves digital personal data, subject to the Act's exemptions.

This article is for general information only and is not legal advice. It reflects the law as understood on 14 October 2026.