Global perspectives on Artificial Intelligence ("AI") Regulation have varied—naturally, given the wide and novel applications of the technology. However, disparities in approaches make it extremely difficult to keep track of how regulations are evolving, and how different players in the AI market can expect to stay compliant with regulations and best practices moving forward. This piece looks to simplify (as much as possible) 3 things: (1) what we mean by AI, and what the components of AI Regulation are; (2) what the broad, principled approaches are, and which countries do what, and; (3) what scholars propose India must do to create a future-proof, rights-centric AI framework.
Naturally, this means that we will take a cross-jurisdictional approach, examining the USA, the European Union, China, and India.
What Is AI?
This question is deceptively simple. The manner in which AI is defined often determines the manner of regulation set to be followed. That is, if you define AI as a tool, you regulate the user. If you define it as a product, you regulate the manufacturer. If you define it as a "frontier" threat, you regulate the science itself. However, broadly, the OECD's definition of AI proves to be quite a helpful starting point:
An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment. (emphasis added)
Put (extremely) simply, the AI system is fed vast volumes of data, and is trained to recognize patterns in such data—known as the "training data." This constitutes the "training" segment of the AI lifecycle. Following this the AI is tested and tweaked, and then deployed. Following deployment, new learning is typically limited for this specific model. To understand how AI training, machine learning, neural networks etc. work in some detail, refer here.
The challenges faced in regulating AI stem from the core elements outlined in the definition.
First, the primary source of AI's decision making is the input it is trained on, which influences (sometimes negatively) the manner in which AI reacts to situations. A report in October 2025, for instance, disclosed that ChatGPT's decision making, and outputs were steeped in caste-bias—likely resulting from the nature of training data fed. The long-term harms of these biases are reinforcement of caste-based stereotypes, especially since India has emerged as ChatGPT's larger user-base. Similar concerns of bias emerge with respect to Grok—the AI agent associated with X (formerly Twitter).
Governing the training data, however, requires extensive disclosures by AI developers—something they are unlikely to be willing to comply with due to concerns regarding protecting trade secrets, intellectual property, or even market dominance.
Second, the question of what type of decision/output is generated by an AI system is based on the objectives set or the specific prompt/request by the user. The extent to which the AI system can autonomously act plays a huge role on how liability may be attributed through existing legal frameworks.
The most commonly used AI systems—Generative AI systems—operate with minimal autonomy, making attribution of liability relatively less complex. For instance, recently, several users on X were able to use Grok to generate sexually explicit images of women, including minors—even morphing publicly available photographs of the victims. While Grok typically has had guardrails in place to prevent such usage, an apparent lapse had occurred. The lapse notwithstanding, it is clear that Grok had exercised minimal autonomy over the task, and the images were a result of direct prompts—liability over which can be accurately identified using technologically neutral laws.
However, where the system is Agentic – operating with more autonomy, to fulfil a set task/objective, such as self-driving cars – identifying liability of harms becomes more complex, and is likely to require a deep dive on what exactly caused the harm, whether it was because of the training data, a hardware issue, or some externality. Determination becomes time-consuming and resource-intensive.
Third, academics point out that AI systems have become "black boxes," systems which can be understood in terms of their input and output, but whose internal workings are a mystery to (the average) observers. Generally, this is because the manner in which machines learn involves internalization of data that is not easily understood, much less audited, by humans. Consequentially, this opacity breeds difficult-to-regulate risks, and requires a nuanced solution which balances excessive disclosures with transparency.
These challenges are by no means exclusive, and often interact and compound the impact of one another. For instance, since AI systems are often black boxes, understanding biases in training data becomes impossible. Or, since autonomy impacts the manner of decision making, and its relationship with the user, it becomes difficult to determine where liability of the developer ends and where that of the user begins. Essentially, these challenges are interlinked: biased data, autonomy, and opacity together shape the core regulatory problem of AI.
As a result, contemporary regulatory efforts are structured around managing risks arising from biased training data, varying levels of autonomy, and the opacity of AI decision-making, rather than attempting comprehensive ex ante regulation.