New Delhi, October 2026 — India is moving from a largely voluntary, principles-based approach to artificial intelligence toward more structured regulation. In early October 2026, Union Minister for Electronics and Information Technology Ashwini Vaishnaw announced that the Ministry of Electronics and Information Technology (MeitY) would publish a regulation-focused consultation paper within a month. The paper is expected to address safety, a human-first approach, skilling, inclusivity, and the growing harms from deepfakes. Officials have described it as a potential foundation for future regulation.
This marks a clear shift. In November 2025, MeitY released the India AI Governance Guidelines under the IndiaAI Mission. Those guidelines deliberately avoided calling for a standalone AI statute. They argued that existing laws — the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 (and its 2025 Rules), consumer protection statutes, and sectoral regulations — could handle most risks if enforced properly. The emphasis was on voluntary commitments by industry, techno-legal solutions, and Digital Public Infrastructure, with mandatory rules only if voluntary measures proved inadequate.
By mid-2026, that stance had evolved. Vaishnaw and MeitY Secretary S. Krishnan began speaking publicly about the need for a dedicated framework because the world of AI differed fundamentally from the environment in which the IT Act was written in 2000. An AI Governance and Economic Group was constituted in April 2026 as a central inter-ministerial coordination body. The IndiaAI Safety Institute continued to take shape. Parallel developments included February 2026 amendments to the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules that specifically targeted synthetically generated information, and a Supreme Court draft set of regulations for the use of AI in the judiciary.
There is still no comprehensive, binding “India AI Act” in the statute book. What exists is a rapidly thickening web of guidelines, rule amendments, institutional mechanisms, and signals of forthcoming legislation. The consultation paper expected in November 2026 is the next major step. For ordinary users, technology businesses, and content publishers, the emerging rules already carry practical consequences and point toward a more demanding compliance environment.
The Current Regulatory Landscape
The India AI Governance Guidelines rest on seven principles often called “sutras”: trust as the foundation, people first, innovation over restraint, fairness and equity, accountability, understandable by design, and safety, resilience and sustainability. They favour regulating applications of AI rather than the technology itself, and they assign primary responsibility for risk management to industry while empowering sectoral regulators.
The most concrete binding changes so far concern synthetic media. The February 2026 amendments to the IT Rules introduced a definition of “synthetically generated information” (SGI) — audio, visual or audio-visual content that is artificially or algorithmically created, generated, modified or altered so that it appears real, authentic or true and is, or is likely to be perceived as, indistinguishable from a natural person or real-world event. Text generated by AI is not covered under this definition, though other provisions of the IT Act and Rules continue to apply to unlawful text.
Intermediaries that enable the creation or modification of SGI must ensure clear labelling and permanent, unique metadata or identifiers. Visual labels must occupy at least 10 per cent of the visible surface; audio labels must cover the initial portion of the content. Platforms are required to deploy reasonable technical measures to prevent the creation or dissemination of unlawful SGI, including deepfakes used for impersonation, non-consensual intimate imagery, or child sexual exploitation material. Takedown timelines have been sharply reduced: from 36 hours to three hours upon receipt of a court order or reasoned government notice for certain unlawful content. Grievance redressal timelines have also been shortened.
The Digital Personal Data Protection Act and its Rules impose obligations on the processing of personal data used to train or operate AI systems. Significant Social Media Intermediaries face additional due diligence, user declaration and verification requirements before publishing certain synthetic content.
Sectoral regulators continue to develop their own approaches. The Reserve Bank of India’s earlier FREE-AI framework influenced the national guidelines. The judiciary has floated its own draft rules emphasising human primacy, prohibiting risk-scoring tools for bail or sentencing, and requiring disclosure when AI is used to prepare court documents.
Implications for Users
For the average Indian user, the most immediate effects revolve around transparency, safety and redress. Labelling requirements for synthetic audio-visual content should make it easier to identify deepfakes and AI-generated media that previously spread unchecked. When a video of a public figure or private individual appears online, platforms are now under clearer obligations to mark it if it meets the SGI threshold and to act quickly when it is unlawful.
Users harmed by deepfakes — whether through non-consensual intimate imagery, financial fraud via voice cloning, or reputational damage — gain shorter pathways for takedown. The reduction from 36 hours to three hours for certain notices is significant in an environment where viral content can cause irreversible harm within hours. Psychological harms linked to deepfakes and AI-driven misinformation are expected to feature in the forthcoming consultation paper, suggesting future rules may address mental-health impacts more explicitly.
Data protection rules give users stronger rights over personal data used in AI systems. Individuals can seek information about processing, correction, and erasure under the DPDP framework, though the practical effectiveness of these rights against complex model-training pipelines remains to be tested.
There are also potential downsides. Over-cautious platforms may over-remove content, including legitimate satire, political commentary or artistic works that use AI tools. Users who rely on AI assistants for education, healthcare information or agricultural advice (examples frequently cited by ministers, such as language-localised tools for farmers) may face friction if providers tighten access or add layers of verification to comply with emerging safety expectations. The government’s simultaneous push for large-scale AI skilling — a target of one crore youth trained in AI skills — aims to equip users to navigate this environment, but access to quality training remains uneven across regions and socio-economic groups.
Inclusivity is repeatedly emphasised by policymakers. The consultation paper is expected to stress that “no person is left behind.” In practice, this could translate into requirements for multilingual interfaces, accessibility features, and safeguards against bias that disadvantages rural, linguistic-minority or low-literacy users. Whether such requirements become enforceable obligations or remain aspirational will depend on the final shape of any legislation.
Implications for Businesses
Technology companies, startups and enterprises deploying AI face a shifting compliance burden. The earlier preference for voluntary commitments is giving way to clearer expectations of industry responsibility for cybersecurity, safety, user harm and deepfakes. Vaishnaw has stated that the bulk of regulatory responsibility will rest with industry and that pure legislation is insufficient; techno-legal solutions developed with stakeholders are preferred.
For AI developers and model providers, this may mean documented risk assessments, safety testing (potentially through the emerging IndiaAI Safety Institute), watermarking or metadata standards for outputs, and incident-reporting mechanisms. Companies offering generative tools that can produce SGI already face labelling and filtering obligations under the amended IT Rules. Failure to implement “reasonable and appropriate technical measures” could expose them to loss of intermediary safe-harbour protections and direct liability.
Data-intensive AI businesses must navigate the DPDP Act’s consent, purpose-limitation and security requirements. Training data that includes personal information of Indian residents triggers compliance duties even if processing occurs outside India in many cases. Significant Data Fiduciaries face heightened obligations.
Compute and infrastructure providers stand to benefit from government demand. MeitY has spoken of empanelling firms rather than traditional tenders for government AI use and has estimated demand for thousands of GPUs. Domestic GPU development and partnerships (including international compute capacity) are policy priorities. Startups that can demonstrate safety, localisation and compliance may find preferential access to public procurement and IndiaAI Mission support.
At the same time, compliance costs will rise. Smaller firms and pure research outfits may struggle with the technical and legal overhead of labelling systems, rapid takedown capabilities, bias audits and data-protection programmes. The government’s stated desire to balance innovation with safety will be tested by how calibrated the eventual rules prove to be. Overly rigid requirements could push some development offshore or favour large, well-resourced players.
Sector-specific businesses — fintech, healthtech, edtech, agritech — will also face parallel expectations from their regulators. An AI credit-scoring tool, diagnostic assistant or personalised learning platform must satisfy both horizontal digital rules and domain regulators.
Implications for Publishers and Content Platforms
News organisations, social media platforms, OTT services, digital news portals and user-generated content sites sit at the centre of the synthetic-media rules. As intermediaries, they must label permissible SGI, prevent unlawful SGI, respond to takedown notices within hours rather than days, and maintain grievance mechanisms with accelerated timelines for sensitive categories such as nudity or impersonation.
Significant Social Media Intermediaries face additional layers: user declarations before publishing certain synthetic content and technical verification. Platforms that host or enable generative AI tools carry heightened due-diligence duties.
For traditional and digital publishers, the rules create both protection and operational challenges. Clear labelling can help audiences distinguish authentic reporting from synthetic fabrications, preserving trust in an era of sophisticated disinformation. Rapid takedown of deepfakes impersonating journalists or fabricating events can limit damage. Yet the same rules risk chilling legitimate uses of AI in newsrooms — automated translation, summarisation, image generation for illustration, or data analysis — if disclosure and labelling requirements become cumbersome or if platforms interpret “indistinguishable from real” too broadly.
Publishers that themselves generate or commission synthetic content for storytelling, explainers or satire will need internal systems to apply labels and retain metadata. Failure could attract regulatory attention or civil claims. Political and election-related deepfakes remain a particular concern; platforms and publishers may face intensified scrutiny around election periods.
The reduced response windows place pressure on content moderation teams, especially for platforms operating at Indian scale. Automated detection tools will become essential, yet false positives that suppress lawful speech remain a risk. Smaller digital publishers and independent creators may find the compliance burden disproportionate compared with large platforms that can invest in specialised teams and technology.
Looking Ahead
The consultation paper expected shortly will test how India balances its dual ambitions: becoming a major AI innovator and protecting citizens from AI harms. Policymakers repeatedly stress that regulation must be techno-legal, industry-driven in implementation, and human-centric. They also note that existing laws already address many risks and that a new statute should fill genuine gaps rather than create overlapping bureaucracy.
Possible elements of future rules include clearer liability allocation across the AI value chain (developers, deployers, users), mandatory safety evaluations for high-risk applications, standardised labelling and provenance systems, enhanced transparency for automated decision-making that significantly affects individuals, and stronger remedies for victims of AI-enabled harms. Labour-market impacts are already within the remit of the AI Governance and Economic Group, so workforce transition measures may appear.
International context matters. Export controls on advanced models, global discussions on frontier AI risks, and the approaches taken by the European Union, the United States and other jurisdictions influence Indian thinking. India’s preference has been for lighter, more flexible frameworks that preserve innovation space while addressing concrete harms such as deepfakes.
For users, the trajectory points toward greater visibility of synthetic content and faster remedies, tempered by the risk of over-moderation. For businesses, it means investing in compliance infrastructure, safety processes and documentation while watching for opportunities in government compute programmes and skilling initiatives. For publishers, it requires robust systems for labelling, rapid response and internal AI governance, alongside the chance to differentiate authentic journalism in a noisy information environment.
India has not yet enacted a comprehensive AI law in 2026. It has, however, moved decisively from pure voluntary guidelines toward a hybrid regime of existing statutes, targeted rule amendments, institutional capacity-building and an imminent formal consultation. The shape of the eventual rules will determine whether the country achieves its stated goal: AI that serves human welfare, scales inclusively, and places safety and accountability at the centre without stifling the innovation it seeks to promote. Stakeholders across the ecosystem will be watching the consultation paper and the legislative process that follows with close attention.
