The Direction of AI Regulation (3/3)

India's Approach

As discussed, developing countries—India included—lack the same entrenched institutions that enable incorporating AI governance into existing frameworks. There is general agreement among stakeholders that, in India, a novel omnibus regulation is likely to do more harm than good, and that many risks posed by AI can be addressed through tech-neutral interpretations of existing laws—barring some novel risks. However, whereas industry stakeholders have pushed for self-regulation frameworks, academics are skeptical about the benefits of the same.

India's approach revolves around three key components: (1) sector-specific regulations; (2) the India AI Governance Guidelines, and; (3) the India AI Mission. On (1), appropriate agencies, such as the Reserve Bank of India ('RBI") for finance, the Indian Council of Medical Research ("ICMR") for healthcare, and SEBI for securities (here and here), take the lead in monitoring harms and enforcing regulations within their domains.

The India AI Governance Guidelines take an interesting approach, acting as a philosophical and strategic roadmap for India. The following components are important to understand:

1. The guidelines are grounded in seven principles—known as the "7 sutras"—Trust, People First, Innovation over Restraint, Fairness & Equity, Accountability, Understandable by Design, and Safety & Resilience. They are designed to be technology-agnostic and applicable across all sectors. These 7 sutras were drawn from the RBI Free-AI Framework, and simply may be understood as:

   a. Trust is the Foundation: AI systems must be reliable, transparent, and build public confidence. 

   b. People First: AI should support humans, prioritize citizen welfare, dignity, and inclusion. 

   c. Innovation over Restraint: Encourage new ideas while avoiding unnecessary restrictions. 

   d. Fairness and Equity: AI outcomes must be non-discriminatory and equitable. 

   e. Accountability: Clearly define responsibility for AI decisions and impacts. 

   f. Understandable by Design: AI systems and decisions should be interpretable for users and regulators. 

   g. Safety, Resilience, and Sustainability: AI must be secure, adaptable, and sustainable. 

2. The guidelines propose a "whole-of-government" approach, recommending the creation of the AI Governance Group (AIGG) for policy coordination and the AI Safety Institute (AISI) for technical validation and safety research.

3. They emphasize "compliance-by-design," using technology architectures like Digital Public Infrastructure (DPI) to make regulatory principles automatically enforceable. This means that policy measures are codified into the underlying technical standards and protocols of an AI system, including verifiable techno-legal safeguards in specific high-risk areas to provide verifiable results

These guidelines supplement the India AI Mission – the third component of India's AI regulation framework, which looks to democratize AI benefits and foster technological self-reliance by operationalising AI development and adoption. It is built on 7 pillars:

1. IndiaAI Innovation Centre: Focuses on developing and deploying indigenous Large Multimodal Models and domain-specific foundational models

2. IndiaAI Application Development Initiative: Develops, scales, and promotes impactful AI solutions for large-scale socio-economic transformation

3. AIKosh Platform: Unified hub center for datasets, models, AI sandbox and more to enable AI Innovation

4. IndiaAI Compute Capacity: Focuses on building a scalable AI ecosystem with 10,000+ GPUs via public-private partnerships, offering AI services and resources

5. IndiaAI Startup Financing: This pillar supports and accelerates deep-tech AI startups by providing streamlined access to funding for innovative AI projects.

6. IndiaAI FutureSkills: This pillar aims to expand AI education at all academic levels and establish Data and AI Labs in Tier 2 and 3 cities

7. Safe & Trusted AI: Focuses on ensuring responsible AI via projects, tools, checklists, and governance frameworks for responsible development and use

The Guidelines set out India's thinking on how AI should be governed, while the Mission provides the infrastructure and institutional support needed to put that thinking into practice. In simple terms, the Guidelines define the direction, and the Mission enables execution.

One clear point of overlap is the "Safe and Trusted AI" pillar of the IndiaAI Mission. The Guidelines describe themselves as providing the ethical and technical foundation for this pillar. While the Mission funds practical tools such as systems to detect bias or deepfakes, the Guidelines lay down the core principles—the seven Sutras—that shape how these tools should be built and used. This relationship is operationalised through institutions such as the AI Safety Institute (AISI), which conducts technical testing and safety research, and works alongside the AI Governance Group (AIGG) and the Technology & Policy Expert Committee (TPEC) to translate governance principles into technical oversight.

The two frameworks also divide responsibilities between enablement and safeguards. The Mission focuses on building capacity by providing shared compute resources and datasets, including access to large-scale GPUs and the AIKosh data platform. The Guidelines, on the other hand, recommend how this infrastructure should be used to manage risks—such as testing AI systems for bias at scale and developing standard datasets for safety evaluation.

Both the Mission and the Guidelines build on India's experience with Digital Public Infrastructure (DPI). The Mission uses AI to strengthen public digital systems, including multilingual tools like Bhashini. The Guidelines ensure that such systems are designed with built-in safeguards, encouraging privacy, transparency, and accountability to be embedded directly into the technology rather than added later.

Finally, the two are coordinated through a shared rollout timeline. In the short term, the Mission expands access to AI infrastructure while the Guidelines put governance bodies in place. Over time, as AI use grows across sectors like healthcare and agriculture, the Guidelines focus on setting standards and reviewing systems to ensure they remain safe, inclusive, and aligned with public objectives.

Put simply, for now, India does not envision an intensive, enforcement reliant framework, and instead looks to start building institutions from a techno-legal perspective, ensuring that decisions are taken on the basis of regulatory clarity and technical know-how. Here's how India stands with respect to the 4 primary questions:

1. What objective does the state wish to fulfil through AI regulation? – The development of the IndiaAI Mission was done so with the objective of building a comprehensive ecosystem that drives innovation, supports startups, strengthens data access, and ensures the responsible use of AI for public good through which India wishes to become a "global leader" in AI in 2035.

2. What is AI governed as? -- India adopts a unique approach, clarifying that it does not intend to regulate "AI as a technology" but rather AI applications, AI risks, and AI outcomes, primarily through sectoral regulators. In other words, AI is treated as an application, a risk-vector, an infrastructural medium and an economic value chain, depending on sector-specific context. Further, India leans more towards a risk-centric approach by organising governance primarily around categories of harm—bias, misinformation, systemic risk, national security—rather than model types or technical thresholds. Put simply—India looks to mainly regulate consequences, not the models themselves, which is why AI is regulated through many laws but no single statute.

3. Who is responsible for majority of compliance? -- India's approach appears to be a "lifecycle-centric approach," where accountability is attributed differently at different parts of the AI value chain. Broadly, this approach begins with a fundamental question: where in the AI lifecycle does the actor lie? That is, there needs to be clarity on what the role of this actor in the AI ecosystem is, and accountability should be divided on that basis. Let us look at what this looks like stagewise:

   a. Stage 1: Conception – This is where the AI system is conceptualised. It becomes important to delineate clear ethical boundaries and ensuring the intended use case justifies the potential risks to users and society.

   b. Stage 2: Pre-training – This is where vast datasets for AI training are collected. Accountability looks like auditing datasets for historical bias, representative gaps, and consent violations.

   c. Stage 3: Training – Here, the datasets are fed into the AI system and patterns are internalised. Accountability could require rigorous testing for algorithmic fairness and technical robustness to ensure the model performs reliably across diverse groups.

   d. Stage 4: Deployment – The system is released into the market. Deployment must only be done once the developers are satisfied that adequate stress testing and audits have been carried out to mitigate potential risks. This includes validating what guardrails have been set up as well.

   e. Stage 5: Monitoring – This is an accountability mechanism by itself – feedback loops are maintained, and in case harm is caused/seems likely, there should be a clear channel for human intervention.

Importantly, this does not mean that the entire load falls on AI developers. The need for transparency has been recognized across the AI value chain so regulators can trace harms back to the lifecycle stage where they arose. This enables stage-specific enforcement, rather than treating AI harms as indivisible outcomes.

4. Should compliance be ex ante or ex post? -- This question actually loses value, considering that specific compliances are envisioned to be sector specific. From a birds-eye view, the MeitY has made it clear that India favours a light-touch approach with regulatory sandboxes – which primarily means ex-post accountability. Nonetheless, sector specific modifications may require ex-ante compliances as well.

Take for instance the RBI's Free-AI Framework. Through Annex IV (AI Specific Enhancements in RBI Master Directions), the RBI proposes mandatory AI-related pre-emptive compliances for Registered Entities including AI use disclosure, specific threat responses and security protocols, transparency requirements, etc. A proposed Board Policy on AI (Annex V) even recommends incorporating AI-specific considerations into the administrative functioning of Registered Entities.

Another example is the proposed amendment to the IT Rules 2021, which sets minimum labelling requirements for synthetically generated information, establishing platform accountability for identifying AI content, and defining obligations for intermediaries (like social media) to remove unlawful synthetic content, aiming for transparency and user safety while increasing compliance for tech companies.

This, however, brings up some important questions. It has been clarified that "transparency" does not mean full model disclosure or source-code openness, and is only limited to making the roles, decisions, and safeguards at each stage of the AI lifecycle visible enough for accountability and enforcement. Further, the previously discussed ex-ante compliances work excellently for the training, testing and deployment stage. However, what does this accountability really look like at the pre-training and training stage? That is to say, whereas there exists clarity on question such as who trained the model, or who is responsible for emergent harms, there is minimal clarity on to preventive checks. This is especially important considering that some harms (such as the Grok fiasco discussed earlier) are a result of human actions and can trample over the dignity and rights of individuals—making ex post accountability mechanisms of minimal value. Matters of criminal liability, for instance, cannot be sector-specific developments, but balancing the need for guardrails with innovation has been envisioned to be the question of the hour.

Another question that has yet to be answered is the nature of data used. India's data economy is vast, and the datasets used include copyrighted information, personal data, and other data that may be protected in any other way. The DPIIT has attempted to address concerns regarding training on copyrighted data, but this attempt seems premature and with some flaws that yet need ironing out. Nevertheless, the bigger concern is the usage of personal data in AI training, often scraped from public sources like social media. This raises significant privacy concerns regarding consent, repurposing, and potential re-identification, requiring strict data minimisation, anonymisation, pseudonymisation. Scholars predict that the DPDP Regime will be interpreted to govern training and pre-training given the "broad definition of the term 'processing'."

However, at the end of the day, India is genuinely doing something right. The Governance Guidelines are unique, flexible and recognize India's ground realities. Unlike the USA, EU or China, India's approach focuses on capacity building along with some guardrails, and views AI from the lens of Digital Public Infrastructure. This is visible in clear recommendations to link AI with Aadhaar, UPI and DigiLocker. Critics insist that the Governance Guidelines are inadequate, since there are no binding, "real" actions that have been introduced. While well-placed, these criticisms bring two real risks:

1. While the "innovation-regulation" dichotomy is flawed, premature risk-prevention measures pose the risk of contradicting the broader nature and direction of AI governance proposed. Where governance is still evolving at the level of principles, institutions, and technical capacity, early hard-coding of obligations may constrain future regulatory flexibility rather than enhance protection.

2. Excessive granularity will lead to incomplete regulation. The DPIIT Working Paper, for example, attempts to address the very granular harms arising from usage of copyrighted information in datasets. This is a highly contested downstream issue, but the steps recommended by the DPIIT are not supported by a general framework governing datasets as a distinct regulatory object. Questions of data provenance, consent, representativeness, licensing, personal data protection, and cross-border data flows remain largely unaddressed.

Final Thoughts

India's approach to AI governance is distinct not because it regulates less, but because it regulates differently. Rather than rushing into an omnibus AI law, India has chosen to first build institutional capacity, technical expertise, and shared infrastructure. For a developing country without deeply entrenched regulatory systems, this sequencing is pragmatic and well-judged.

The India AI Governance Guidelines set the principles and direction, while the IndiaAI Mission provides the tools and institutions to put those principles into practice. Together, they reflect a lifecycle-based, sector-led, and risk-centric model that keeps regulatory options open at a time when AI technology and its harms are still evolving. The focus on Digital Public Infrastructure and compliance-by-design allows governance to scale through architecture, not just enforcement.

The open questions around training-stage accountability, data use, and dignity-based harms are not failures of this approach. They are the pressure points of a framework that has deliberately postponed rigid rules in favour of flexibility and learning. Whether India can address these issues without losing that flexibility will determine how this model matures.

India also has a rare advantage: the freedom to start fresh. Without legacy regulatory baggage, it can design AI governance around today's realities rather than yesterday's laws. If calibrated carefully, India's approach offers a credible alternative to both heavy-handed regulation and unchecked market-led development.