India AI Governance Tracker

Proposes new provisions across three SEBI regulatory frameworks placing full responsibility on regulated intermediaries for AI tools they use, whether built in-house or sourced from third parties.

• New Chapter IIIB (Reg. 16C) under the SEBI (Intermediaries) Regulations, 2008 covers data privacy/security, AI-output consequences, and legal compliance obligations.
• New Regulation 39B extends identical obligations to recognised stock exchanges and clearing corporations.
• New Regulation 82B applies the same standard to depositories, completing coverage across all major market infrastructure institutions.
• Core principle: regulated entities remain fully accountable for AI-driven outcomes regardless of whether the tool is built in-house or procured from a vendor.
• Aims to close a potential accountability gap where entities might otherwise disclaim responsibility for vendor-supplied AI tools.
• Part of a broader SEBI pattern — seen again in its 2025 consultation paper — of extending existing regulatory categories to cover AI rather than writing standalone AI rules.

A SEBI Working Group recommends guardrails for responsible AI/ML use in securities markets, centred on governance, investor protection, fairness, testing, and data protection.

• Model governance: requires skilled internal teams, senior management accountability, and periodic independent audits of AI/ML models.
• Investor protection: mandates clear disclosure of AI/ML use, model risks and limitations, plus grievance mechanisms aligned with SEBI's existing framework.
• Testing requirements: continuous monitoring including "shadow testing" (running new models in parallel before full deployment); documentation retained for at least 5 years.
• Fairness: requires bias mitigation processes and staff training on AI-specific risks.
• Proposes a tiered, risk-based regulatory approach — lighter-touch for non-customer-facing use, stricter where investor impact is direct.
• Product of a dedicated SEBI Working Group, suggesting this may evolve into binding regulation once the consultation period closes.

RBI's committee treats AI risk as largely already captured by existing financial regulation, recommending a technology-neutral, principles-based governance framework rather than standalone AI rules.

• Treats most AI risk as already captured by existing financial regulation rather than requiring an entirely new regime.
• Recommends a technology-neutral, principles-based governance framework layered onto existing RBI rules.
• Key safeguards: governance, board oversight, risk management, transparency, human oversight, cybersecurity, and vendor due diligence.
• Recommends classifying AI systems by risk level, with correspondingly stricter oversight for higher-risk applications.
• Encourages regulatory sandboxes so institutions can test AI use cases before full-scale deployment.
• Recommends phased implementation and proportional compliance burdens for institutions still early in AI adoption.

Requires every Regulated Entity to maintain a Model Risk Management Framework governing the full model lifecycle, with enhanced governance specifically for AI/ML models.

• Requires every Regulated Entity to maintain a Model Risk Management Framework (MRMF) covering the model's full lifecycle.
• The Regulated Entity remains accountable for model outcomes regardless of whether the model is built in-house or procured from a vendor.
• MRMF must cover governance structure, classification, approval, validation, monitoring, documentation, change management, and decommissioning.
• Oversight sits specifically with the Board, Risk Management Committee, and Senior Management.
• AI/ML models require enhanced governance addressing explainability, autonomy, bias, hallucination, overfitting, and data drift.
• Mandates meaningful human oversight: mechanisms for review, intervention, override, suspension and deactivation of AI systems.

Operationalises TRAI's spam-detection framework by turning AI-generated network intelligence into a coordinated, industry-wide enforcement mechanism against unregistered telemarketers.

• Terminating access providers must flag suspected spam numbers via AI/ML-based UCC_Detect systems.
• Flagged numbers must be shared with originating providers over the DLT platform within a strict 2-hour window.
• Originating providers must then notify the subscriber and identify the sender via KYC records.
• Identifiers must be shared across telecom operators to enable coordinated, industry-wide investigation.
• Explicitly protects providers from having to disclose proprietary AI models, algorithms, or risk-scoring methods.
• Regulates outcomes — detection and response speed — rather than mandating any specific underlying technology.

A comprehensive roadmap for adopting AI, ML and Big Data across telecom, concluding India should pursue a common cross-sectoral AI governance framework rather than telecom-specific rules.

• Reviews global regulatory developments on AI/Big Data in telecom, informed by extensive stakeholder consultation.
• Issued under a Department of Telecommunications reference tied to the National Digital Communications Policy, 2018.
• Recommends AI-specific digital infrastructure investment and improved access to quality datasets.
• Calls for skilling initiatives and industry-academia collaboration to build AI capacity in the telecom sector.
• Recommends privacy-enhancing technologies be built into AI/Big Data telecom applications.
• Concludes India should pursue a common, cross-sectoral AI governance framework rather than telecom-specific AI rules.

India's overarching, principles-based approach to AI governance — built around seven core principles rather than a single AI statute.

• Built around seven core principles: trust, people-first development, innovation, fairness, accountability, explainability, and resilience.
• Proposes an AI Governance Group to coordinate AI policy across ministries and sectors.
• Proposes an AI Safety Institute responsible for technical evaluation of AI systems and safety research.
• Combines existing law, voluntary standards, technical safeguards, and India's Digital Public Infrastructure into a single 'techno-legal' governance model.
• Deliberately favours self-regulation and innovation over prescriptive, pre-emptive statutory guardrails.
• As a framework document rather than binding law, its real-world effect depends heavily on how sectoral regulators implement its principles.

Reminds intermediaries that existing obligations under the IT Act and IT Rules apply equally to AI-generated content, issued after concerns over distorted AI depictions of religious scripture and beliefs.

• Clarifies that AI-generated content is treated no differently from other digital content under existing Indian law.
• Issued specifically in response to concerns over distorted AI depictions of religious scripture and beliefs.
• Expects platforms to apply proactive safeguards: content moderation, algorithmic controls, human oversight, and functioning grievance mechanisms.
• Encourages review of training data and model outputs specifically for accuracy on religious topics.
• Warns that failing to exercise due diligence risks loss of Section 79 safe harbour protection.
• Functions as an advisory reminder of existing obligations rather than a new binding rule.

Argues that compute, datasets and models are becoming as essential as electricity, and proposes treating AI infrastructure as a shared national resource.

• Frames compute, datasets, and trained models as becoming as essential to innovation as electricity or roads.
• Proposes public AI infrastructure be treated as a shared national resource under India's Digital Public Infrastructure model.
• Recommends publicly accessible compute resources for researchers and smaller organisations that cannot afford large-scale AI infrastructure.
• Calls for improved access to high-quality datasets, including government-held data where appropriate safeguards allow.
• Aims to let startups, researchers, and universities participate meaningfully in AI innovation, not only large technology firms.
• Positions democratised access as central to closing India's broader AI resource gap relative to better-resourced economies.

A framework for responsible government use of AI in Tamil Nadu, built around the DEEP-MAX assessment criteria for evaluating AI systems before deployment in public services.

• Built around the DEEP-MAX assessment framework for evaluating AI systems before deployment in public services.
• DEEP-MAX evaluates systems on transparency, accountability, misuse protection, ethics, fairness, and inclusion.
• Recommends ethical procurement standards specifically for government purchase of AI systems and tools.
• Calls for structured capacity building and training for public officials involved in deploying or overseeing AI.

Tamil Nadu's implementation strategy for accelerating AI adoption across government, industry, academia and startups, backed by an initial ₹13.93 crore budget.

• Implementation strategy translating the 2020 policy's principles into concrete funding and institutional support.
• Backed by an initial ₹13.93 crore budget for early-stage implementation.
• Led by the Tamil Nadu e-Governance Agency (TNeGA), with support from iTNT and ELCOT.
• Focused on building compute infrastructure and opening access to government datasets for AI use cases.

A time-bound blueprint integrating AI into healthcare, education, agriculture and fintech, aimed at data-driven digital governance.

• Time-bound blueprint (2025–2030) integrating AI across healthcare, education, agriculture, and fintech.
• Organised around six strategic pillars, including data governance and regional "AI factory" digital infrastructure.
• Targets capacity building for over 2.5 lakh individuals under the plan.
• Includes deep-tech startup facilitation through the i-Hub innovation campus.
• Guided by a ten-member expert taskforce overseeing rollout.
• Initial rollout phase focuses on building AI data repositories and running governance pilots before wider sectoral deployment.

Proposes a framework for using AI within the judiciary to assist — not replace — judges, with human oversight remaining central to all judicial decision-making.

• Permits AI for legal research, citation verification, translation, transcription, document summarisation, and case management support.
• Explicitly prohibits AI use for adjudication, sentencing, or any function requiring genuine judicial discretion.
• Requires impact assessments and pre-deployment testing before any high-risk AI system is used in the judiciary.
• Mandates periodic audits and incident recordkeeping for AI tools once deployed.
• Lawyers must disclose AI use when preparing pleadings submitted to court.
• Places ultimate responsibility on users to verify the accuracy of AI-generated content before relying on it.

Argues traditional law alone cannot keep pace with AI, proposing that legal rules be combined with technical safeguards — audits, testing, standards, monitoring.

• Argues traditional law alone cannot keep pace with the speed of AI development and deployment.
• Proposes combining legal rules with technical safeguards — audits, testing, standards, and ongoing monitoring — across an AI system's lifecycle.
• Recommends new institutions: an AI Governance Group (AIGG) and a Technology and Policy Expert Committee (TPEC).
• Also proposes an AI Safety Institute (AISI) and a national AI incident database to track failures and harms.
• Encourages voluntary industry commitments and standards to operate alongside existing laws like the IT Act and DPDP Act.
• One of the drafters, Vibhav Mithal, discussed this framework directly on the Everything TMT Podcast.

Introduces the 'Bill of Materials' concept for digital products — an ingredients list of the software, hardware, AI models and cryptographic components a system depends on.

• Introduces the 'Bill of Materials' concept — essentially an ingredients list of everything a digital system depends on.
• Covers software (SBOM), AI systems (AIBOM), hardware (HBOM), cryptography (CBOM), and quantum-resistant technology (QBOM).
• Aims to make it faster to identify vulnerable or compromised components once a security flaw is discovered.
• Provides practical guidance on how organisations should create, maintain, and share these component inventories.

Addresses cybersecurity risks from attackers using AI to automate reconnaissance, discover vulnerabilities, generate malware, and craft convincing phishing attacks.

• Addresses attackers using AI to automate reconnaissance and vulnerability discovery against target systems.
• Flags AI's role in generating malware and crafting more convincing, personalised phishing attacks.
• Recommends stronger cybersecurity governance and continuous, AI-aware monitoring of systems.
• Calls for improved supply-chain security given AI's role in automating attacks across interconnected systems.
• Recommends regular testing of existing security controls specifically against AI-assisted attack techniques.

Examines whether AI will make markets more competitive or concentrate power, mapping the AI stack from data and compute to foundation models and applications.

• Maps the full AI stack — from data and compute through to foundation models and consumer-facing applications.
• Finds large technology companies may gain durable advantages through control over data, compute, and foundation models.
• Flags algorithmic collusion as a specific competition risk where firms' pricing algorithms could coordinate without an explicit agreement.
• Also flags personalised pricing, where AI could be used to charge different consumers different prices based on inferred willingness to pay.
• Identifies high barriers to entry for smaller players lacking access to large-scale compute or proprietary datasets.
• Recommends transparency and regulatory coordination rather than new AI-specific competition law at this stage.

The MeitY Subcommittee's recommendations for an India-specific AI governance framework, which later informed the IndiaAI Governance Guidelines.

• Recommends a whole-of-government approach that balances AI innovation with public-interest safeguards.
• Sets out governance principles: transparency, accountability, safety, privacy, fairness, explainability, and human oversight.
• Favours strengthening existing legal frameworks and voluntary codes over introducing an immediate standalone AI law.
• Its recommendations directly informed the subsequent IndiaAI Governance Guidelines.

India's first dedicated regulation targeting AI-generated content and deepfakes — introducing a legal definition of synthetic media, mandatory labelling, and sharply compressed takedown timelines.

• Defines 'synthetically generated information,' specifically excluding routine AI editing, translation, and accessibility uses.
• Requires visible labelling and embedded metadata for AI-generated content permitted on a platform.
• Significant Social Media Intermediaries (SSMIs) must verify user declarations of AI-generated content using automated tools, not just accept them at face value.
• Cuts the takedown timeline for court/government orders from 36 hours to 3 hours.
• Cuts the takedown timeline for non-consensual intimate deepfakes from 24 hours to 2 hours upon complaint.
• Non-compliance risks loss of Section 79 safe harbour — covered in full on the Knowledge Base IT Act explainer.

Proposes a nationwide ethics and accountability framework for AI used in decision-making, surveillance, and algorithmic systems, with a central AI Ethics Committee.

• Creates a central AI Ethics Committee comprising academia, industry, civil society, and government representatives.
• The Committee is empowered to issue guidelines and investigate allegations of algorithmic bias.
• Applies broadly to developers, deployers, and users of AI systems across India, not just large platforms.
• Introduced in the House of the People (Lok Sabha) on 5 December 2025.
• Penalties include fines of up to ₹5 crore for violations.
• Also provides for licence suspension or revocation, and criminal liability for repeat violations.

Establishes a dedicated legal framework for the creation, distribution and detection of deepfakes, including a national Deepfake Task Force.

• Establishes a national Deepfake Task Force to assess the societal impact and prevalence of deepfakes.
• Task Force is empowered to fund and coordinate research into deepfake detection technology.
• Applies to intermediaries and social media platforms hosting or transmitting user-generated content.
• Task Force may recommend case-by-case penalties rather than applying a single fixed penalty scheme.
• Introduced in the House of the People (Lok Sabha) on 5 December 2025.
• Sits alongside the already-in-force IT Rules Amendment, 2026 as part of a broader statutory response to deepfakes.

Regulates intellectual and creative outputs generated by AI, including a conditional safe-harbour regime for AI intermediaries.

• Regulates intellectual and creative outputs generated by AI, addressing an emerging gap in Indian IP law.
• Introduces a conditional safe-harbour regime specifically for AI intermediaries.
• Safe harbour applies only where the intermediary doesn't initiate or control content generation and exercises due diligence.
• Requires technical safeguards to detect hate speech, CSAM, non-consensual deepfakes, and copyright infringement in AI outputs.
• Mandates periodic transparency reporting on takedowns and regulatory requests.
• Safe harbour is withdrawn where the intermediary abets or profits from unlawful AI-generated outputs.

The Department for Promotion of Industry and Internal Trade examines how India's copyright framework should respond to generative AI, focusing on whether AI developers should be allowed to use copyrighted works for training and, if so, under what conditions.

• Rejects both unrestricted text and data mining (TDM) exceptions and purely voluntary licensing as inadequate for India's legal and economic context.
• Proposes a hybrid licensing model built around a mandatory blanket licence for AI training on lawfully accessed copyrighted works.
• AI developers would not need to negotiate individual licences, but would pay statutory royalties through a government-designated collective management body.
• Argues the model reduces transaction costs for developers while providing fair, guaranteed compensation to creators.
• Frames broad access to diverse, high-quality training data as a way to mitigate AI bias and hallucination, not just a commercial concern.
• Presented as Part I of a broader consultation — Part II (expected) will address copyrightability, authorship, and liability for AI-generated outputs.

A discussion paper proposing a three-pillar framework to balance global data collaboration for AI with national data sovereignty, built around a four-tier, risk-based data matrix.

• Governance architecture rests on three pillars: compatibility, accountability and coordination.
• Compatibility = Shared technical standards, protocols, identity frameworks and metadata. Ensure data retains meaning across jurisdictions.
• Accountability = Minimum standards (like ISO 27001) that are fluid instead of static; i.e., they measure continuous, risk-adaptive assurance as AI systems and their risks evolve.
• Coordination = Nodal authorities, review mechanisms, and institutional cooperation between jurisdictions while respecting sovereign authority.
• Three pillars are supported by a four-fold risk based division of data:
• Tier 1, aggregate or statistical data: open, low-friction transfers.
• Tier 2, functional data: controlled transfers governed by differential privacy and contractual safeguards.
• Tier 3, controlled data: high-risk transfers subject to strict audit trails.
• Tier 4, sovereign data: strategic or security-sensitive data restricted to domestic model-to-data or federated processing.
• Designed to sit within the existing National Data Governance Committee (NDGC) and to complement Section 16 of the DPDP Act, 2023, without requiring new statutory legislation.

Odisha's state AI policy aims to use AI to drive progress in five priority sectors: health, education, agriculture, disaster management and governance. It is built around five strategic choices and a phased rollout, and is implemented through a new Odisha AI Mission.

• Targets five priority sectors: healthcare (diagnostics), education (personalised learning), agriculture (crop insights and insurance), disaster management (predictive climate modelling) and governance (fraud detection and project monitoring).
• Built on five strategic choices: task augmentation (AI supplements human labour rather than replacing it), scaling and importing existing solutions, partnerships with private firms and research institutions, a protective regulatory framework, and sustained long-term impact.
• Infrastructure pillar covers internet and digital literacy, compute and data infrastructure (with supercomputing for uses like precision agriculture and disaster management), and research centres building LLMs for Odia and tribal languages.
• Energy pillar calls for clean, energy-efficient power for AI data centres. Skills pillar covers AI literacy in schools and higher education, workforce upskilling and AI training for government officials.
• Policy pillar covers ethical use guidelines (algorithmic bias, data protection, transparency), data governance guidelines, cybersecurity standards and easier data access for researchers.
• Three-stage roadmap: Get Ready (1 to 2 months: readiness assessment, infrastructure gap mapping, vendor RFPs), Get It Done (9 to 15 months: pilots, stakeholder feedback, scaling) and Keep It Done (ongoing performance reviews every 2 to 4 months, tracked on a centralised state dashboard).
• Delivered through the Odisha AI Mission, a two-layer structure of an AI Taskforce and an AI Cell (see the Operational Guidelines entry).

Operational guidelines that set up the Odisha AI Mission and a six-phase funnel for taking AI solutions from idea to statewide scale.

• The Odisha AI Mission has two layers, an AI Taskforce and an AI Cell. Projects under the Mission are overseen by the Taskforce.
• The AI Taskforce tracks progress, recommends best practices and gives strategic guidance on partnerships.
• The AI Cell provides ground-level government support such as compute capacity and dataset standardisation for LLM training, keeps AI implementation aligned with the state's long-term vision, and reviews solutions continuously so they stay safe and trusted.
• A dedicated AI technology department within the Cell gives technical support for prototyping, piloting and scaling AI solutions, and can also support wider expansion strategies.
• Six-phase funnel: (1) ideation, where startups or private actors propose solutions or the Cell maps providers and screens for viability; (2) demo, testing whether the solution works and fits the Mission; (3) proof of concept in a time-bound sandbox; (4) pilot with cohorts and geographies representative of the intended users; (5) scaling and institutionalisation; (6) feedback loops and monitoring.

The Standing Committee on Communications and Information Technology, chaired by Dr. Nishikant Dubey, examined AI across finance, energy, security, defence and agriculture. Its non-binding report names compute, skills and data as India's core constraints and recommends faster IT Rules amendments and exploring standalone AI legislation.

• Names three fundamental constraints: limited compute, a shortage of AI skills and inadequate datasets, and calls data availability and accessibility the single biggest hurdle.
• Recommends data centres and AI labs across the country, AI studies from lower school standards, AI programmes in colleges, and wider fellowships and academic research in universities.
• Flags adoption risks including third-party dependencies, market concentration, lack of interpretability, data quality, privacy, cybersecurity, accountability and reliance on automated decision-making.
• Identifies farming-specific barriers: high upfront investment, poor rural internet, low trust and explainability in AI decisions, and regional language gaps.
• Highlights deepfakes, cyber threats, AI-driven surveillance and AI-enabled financial fraud as the main misuse risks.
• Notes the existing framework: the IT Rules 2021 (with proposed amendments for AI-specific mandates), the DPDP Act 2023 (unauthorised or excessive data collection, profiling and bias) and the Digital India Act under formulation.
• Recommends expediting the IT Rules amendments, exploring comprehensive standalone legislation to prevent AI misuse, and considering age restrictions for certain platforms.

The Advertising Standards Council of India (ASCI), the advertising industry's self-regulatory body, issued final guidelines on when advertisers must disclose synthetically generated content (SGC) and which uses are not allowed. They focus on consumer outcomes and preventing deception rather than restricting the technology, and take effect three months after publication.

• Defines SGC as any audio, visual or audiovisual advertising content artificially created, generated or altered so that it portrays people or events as authentic or indistinguishable from reality.
• Prohibited regardless of labels: fabricated endorsements or testimonials from real people who did not approve or use the product, visual exaggeration of product results (for example an AI-generated lean body image for a weight-loss product), depicting non-existent travel or hotel locations, and unauthorised use of copyrighted works or deepfakes without consent.
• Labelling is mandatory for synthetic brand ambassadors or influencers, replicating a real person's likeness or voice for personalised marketing, 3D demonstrations of non-existent products such as unbuilt housing, synthetic sound effects relating to core product features, and paid or sponsored AI chatbot recommendations, which must read 'Sponsored by [Brand]'.
• No label is needed for routine colour correction, lighting adjustments, noise reduction, decorative background elements, fantastical effects such as flying cars, copy generation and accessibility features such as subtitles and captions.
• Unlike the IT Rules, which require intermediaries to label all synthetic content, these guidelines apply to advertisers and require labelling only where the content materially influences consumer decisions.
• Issued after a draft released in May 2026 and stakeholder consultation. ASCI is a self-regulatory body, so the guidelines are non-binding in the statutory sense.

Issued by the Government of Haryana as the administrative policy gateway for its IT, AI and emerging technology push, setting the state's vision for attracting large-scale industrial and capital investment.

• Serves as the official preamble and administrative policy gateway issued by the Government of Haryana.
• Sets out the state's vision to attract large-scale industrial and capital investment across artificial intelligence, information technology and emerging enterprise sectors.
• Lays the ground for frameworks that position Haryana as a regional hub for technology parks, enterprise hubs and modern industrial digital infrastructure.
• Focuses on lowering administrative friction and structuring policy incentives so that Haryana becomes a primary regional destination for cutting-edge technology companies.

A draft five-year (2026 to 2031) state AI strategy aiming to attract over ₹10,000 crore in AI investment, create 1.5 lakh jobs, skill 2 lakh youth and deploy at least 50 statewide AI use cases.

• Targets over ₹10,000 crore in AI investment, 1.5 lakh direct and indirect jobs, 2 lakh youth skilled and at least 50 statewide AI use cases, with a minimum of one per department.
• Establishes Compute-as-a-Service (CaaS) as state-backed digital public infrastructure: 2,000+ GPUs (at least 1,000 concentrated in one region) with tiered pricing for public bodies, researchers and startups.
• Sets up 6 divisional Centres of Excellence and 5 Innovation Regions with dedicated AI Innovation Cities.
• Launches the M-Hub accelerator and Global Capability Centre parks in Mumbai, Pune, Nagpur, Chhatrapati Sambhajinagar and Nashik, and supports 5,000 MSMEs.
• Financial incentives include ₹2,000 crore for a 20% capital subsidy on new or expanding AI units, 100% stamp duty exemption and reimbursement of IPR and patent costs.
• Still a draft, so targets and incentives may change before the policy is finalised.

A critical-severity advisory warning that autonomous AI software agents are operating as active cyber attack vectors, citing incidents where research agents breached their assigned boundaries and where threat actors abused open-source agentic frameworks.

• Rated Critical severity and issued on 15 October 2026.
• Task boundary violations: AI agents undergoing evaluation research exceeded their assigned authorisations and gained unauthorised access to live Indian ICT assets, reading business records and confidential data.
• The affected organisations did not detect the intrusions themselves. The breaches came to light through disclosures by the model developers.
• Open-source offensive exploitation: threat actors abused publicly available agentic frameworks to run automated reconnaissance, exploitation and financial intrusions at machine speed.
• Root weaknesses: exposed keys and credentials in public code repositories, deprecated or test APIs left reachable online, plaintext payment keys and over-permissive cloud roles.
• Developer directives: isolate evaluation workloads with default-deny network egress, use synthetic targets and credentials, suppress any keys encountered from future runs, and notify CERT-In and affected entities immediately on any unauthorised access.

A five-year AI/ML strategy aligned with Viksit Rajasthan 2047, run through a hub-and-spoke model with a state data exchange, AI sandboxes, large skilling targets and fiscal incentives.

• Five-year strategy aligned with Viksit Rajasthan 2047, operating as a hub-and-spoke model anchored by iStart innovation launchpads.
• Establishes RajDEx (Rajasthan Data Exchange) as the exclusive platform for monetised or subsidised dataset access.
• Sets up AI sandboxes for safe pre-deployment testing.
• Skilling targets: AI courses in 3,000+ schools, 10,000 youth trained in LLM skills and 20,000 government officials upskilled.
• Incentives include a 20% employee AI training reimbursement (up to ₹800 per worker per month), a 5% top-up on IP acquisition costs for AI patents (capped at ₹25,000) and AI cloud credit reimbursements for startups using IndiaAI GPU infrastructure.

TRAI's Third Amendment to its 2018 anti-spam regulations adds AI/ML-based spam detection, advance declaration of A2P calls and graded enforcement against misuse of headers and content templates. It builds on the February 2026 UCC detection direction already on this tracker.

• AI/ML spam control (UCC_Detect): Terminating Access Providers must deploy AI/ML systems that analyse calling behaviour and flag high-probability UCC senders, sharing them with Originating Access Providers on the DLT platform within 2 hours.
• A2P declaration: Application-to-Person call ranges must be pre-declared on DLT platforms, and undeclared A2P calls are treated as UCC.
• Series protection: call management apps are barred from blanket-blocking or spam-tagging designated commercial and government series (140xx and 160xx).
• Strict enforcement: blacklisting and disconnection of resources across multiple providers if a sender has 5 content templates blacklisted for wrong categorisation.
• Notified on 18 September 2026 after a draft published on 13 March 2026. Some provisions (A2P declaration, Virtual Network Operator interface, header and content template misuse, A2P charge) take effect after 60 days.

A NITI Aayog proposal on a framework to evaluate data-centre proposals by balancing investment, infrastructure readiness, economic value and long-term sustainability.

• Core approach: Assess projects before approval, identify infrastructure and resource constraints early, compare proposals consistently, and link incentives to measurable outcomes
• Pillar 1: Power and Energy: Assess total campus electricity demand, grid capacity, transmission and substation upgrades, firm power supply, renewable energy and storage arrangements. Set commissioning milestones and monitor power usage, efficiency and resilience.
• Pillar 2: Water and Cooling: Evaluate long-term water availability, basin stress, competing users and peak-season demand. Prioritise fit-for-use water, recycled and non-potable sources, efficient cooling technologies, and safeguards against straining existing freshwater supplies.
• Pillar 3: Siting and Environmental Sustainability: Assess land suitability, climate and disaster risks, connectivity, environmental impacts and community concerns before construction. Plan for waste management, decommissioning and lifecycle liabilities.
• Pillar 4: Economic and Strategic Value: Calculate the project's net economic contribution after accounting for State incentives and support. Assess local hiring, skills development, research, domestic procurement, vendor development and indigenous technology, and link incentives to measurable outcomes.
• Pillar 5: Policy, Governance and Implementation: Assign each approval condition to a responsible entity, establish a digital single-window clearance mechanism, publish approval timelines and track compliance, incentives, resource use and disaster-recovery arrangements.
• State Government's role: Coordinate departments and utilities, verify infrastructure readiness, define approval conditions, designate suitable data-centre zones, and monitor delivery against agreed milestones.
• Central Government's role: Develop common standards, templates and guidance for grid assessments, energy and water efficiency, incentives, approval processes and compliance monitoring.

A MeitY advisory telling intermediaries and platforms that LLMs and generative AI on their services must not enable unlawful content or discrimination, that under-tested models should carry harm labels, and that deepfake-capable synthetic content must be labelled or carry permanent metadata.

• Use of LLMs or generative AI on a platform must not let users host, display, upload, modify, publish, transmit, store, update or share unlawful content as set out in Rule 3(1)(b) of the IT Rules, or violate any other provision of the IT Act, 2000.
• Computer resources and AI must not enable discrimination of any kind.
• Untested or unreliable AI models should be made available only after labelling the possible harms in their output. Platforms may use pop-ups or equivalent mechanisms to inform users.
• Where a platform allows synthetic content that could be used as a deepfake or for misinformation, content created, generated or modified through its software or other computer resource must be labelled or embedded with permanent unique metadata or an identifier showing it is AI-generated.
• This revised advisory supersedes MeitY's 1 March 2024 advisory, dropping the earlier requirement to seek explicit government permission before deploying under-tested models and replacing it with labelling.
• Issued under reference eNo.2(4)/2023-CyberLaws-3. Its labelling and metadata expectation was later written into binding rules by the IT Rules Amendment, 2026 (also on this tracker).

A MeitY circular constituting the AI Governance and Economic Group (AIGEG), the high-level inter-ministerial body introduced in the India AI Governance Guidelines to steer a whole-of-government approach to AI governance, supported by a Technology and Policy Expert Committee.

• A high-level, inter-ministerial body meant to steer a whole-of-government approach to AI governance, aligning the actions of ministries, departments, regulators and advisory bodies around a coherent national strategy.
• Introduced in the India AI Governance Guidelines.
• The Economic Survey separately identifies the need for a coordinating authority that can align AI deployment with labour realities and social stability priorities.
• Supported by a Technology and Policy Expert Committee (TPEC), which advises the AIGEG on global developments, emerging technologies, risks, regulation and other evolving priorities in AI policy and governance.
• Chaired by the Minister of Electronics and IT, with the Minister of State for Electronics and IT as Vice Chairperson.
• Members: the Principal Scientific Adviser, the Chief Economic Adviser, the CEO of NITI Aayog, the Secretaries of the Department of Telecommunications, the Department of Economic Affairs and the Department of Science and Technology, and a representative of the NSCS. The Secretary, MeitY, is Member Convener.

NITI Aayog's national AI strategy, built around the #AIforAll framework, sets out how India can use AI for economic growth, social development and inclusive growth, with a focus on five priority sectors.

• Vision: promote inclusive AI leadership through the #AIforAll framework, using AI for economic growth, social development and inclusive growth.
• Priority sectors: healthcare, agriculture, education, smart cities and infrastructure, and smart mobility and transportation.
• Key barriers: limited AI research expertise, inadequate data ecosystems, high adoption costs, low awareness, privacy and security risks, and weak stakeholder collaboration.
• Research and development: establish Centres of Research Excellence (COREs) for foundational research and International Centres of Transformational AI (ICTAIs) for applied research and deployment.
• Skills and employment: strengthen AI education, skilling and reskilling, industry-academia collaboration, and employment opportunities in emerging areas.
• AI adoption: develop a National AI Marketplace for data collection, data annotation and deployable AI models, and encourage adoption across government, public-sector enterprises, startups and industry.
• Government's role: facilitate infrastructure, research, partnerships and AI adoption, particularly in sectors with significant social impact.
• Ethics and governance: promote fairness, accountability and transparency, establish data protection and sectoral regulatory frameworks, and address privacy, security, bias and intellectual property concerns.

NITI Aayog's approach paper sets out principles for the responsible design, development and deployment of AI in India, grounded in constitutional values and the Indian legal and regulatory context.

• Examines both system-level risks affecting individuals who interact with AI and broader societal impacts.
• Seven principles: safety and reliability, equality, inclusivity and non-discrimination, privacy and security, transparency, accountability, and protection of positive human values.
• Safety and reliability means AI systems function as intended with adequate safeguards against errors and harm. Equality means people in the same relevant circumstances are treated equally by AI systems.
• Inclusivity and non-discrimination aims to stop AI reinforcing historical and social inequalities or unfairly excluding people from opportunities, services and benefits.
• Privacy and security covers protecting personal and sensitive data and safeguarding AI systems against unauthorised access and manipulation.
• Transparency lets stakeholders understand AI systems and scrutinise their design, functioning and decisions to the extent possible, while accountability makes those involved in AI design, development and deployment responsible for their actions.
• Protection of positive human values means AI should promote human values and not undermine social harmony.
• Key risks identified: opaque decision-making, algorithmic bias, exclusion from essential services, unclear liability, privacy violations, security vulnerabilities, job displacement and malicious psychological profiling.
• Implementation approach: calibrate governance measures to the risks of different AI applications while enabling innovation.

The second NITI Aayog paper translates the seven Responsible AI principles into practical governance mechanisms for government, industry and research institutions, built around risk-based regulation and a proposed Council for Ethics and Technology.

• Objective: translate the seven Responsible AI principles into practical governance mechanisms across government, industry and research institutions.
• Risk-based regulation: match regulatory scrutiny to the likelihood and severity of harm, and consider regulatory forbearance and self-regulation for lower-risk applications.
• Testing and deployment: use regulatory sandboxes and controlled deployments to evaluate AI risks before wider implementation.
• Institutional coordination: proposes a multidisciplinary, apex-level Council for Ethics and Technology (CET) to support sectoral regulators, develop policy guidance and facilitate research.
• Government capacity: strengthen regulatory capacity, raise awareness, build institutional expertise and develop context-specific standards, guidelines and benchmarks.
• Public procurement: align government procurement of AI systems with Responsible AI principles, with particular attention to high-risk applications.
• Private-sector governance: encourage ethics-by-design, internal ethics boards, self-assessment tools, external audits and clear allocation of responsibility within organisations.
• Research and collaboration: promote multidisciplinary research, responsible research practices and methods for assessing the social impact of AI, alongside knowledge-sharing, open tools and collaboration between government, private actors and researchers.
• Lifecycle approach: integrate risk assessment and responsible practices throughout AI design, development, deployment and subsequent monitoring.
• Core policy balance: minimise AI-related harm while preserving innovation, research and the social and economic benefits of AI.

A NITI Aayog framework that gives States a common way to evaluate data-centre proposals, balancing investment, infrastructure readiness, economic value and long-term sustainability across five pillars.

• Core approach: assess projects before approval, identify infrastructure and resource constraints early, compare proposals consistently, and link incentives to measurable outcomes.
• Power and energy: assess total campus electricity demand, grid capacity, transmission and substation upgrades, firm power supply, and renewable energy and storage arrangements, with commissioning milestones and monitoring of power usage, efficiency and resilience.
• Water and cooling: evaluate long-term water availability, basin stress, competing users and peak-season demand. Prioritise fit-for-use, recycled and non-potable water, efficient cooling technologies, and safeguards against straining existing freshwater supplies.
• Siting and environmental sustainability: assess land suitability, climate and disaster risks, connectivity, environmental impacts and community concerns before construction, and plan for waste management, decommissioning and lifecycle liabilities.
• Economic and strategic value: calculate the project's net economic contribution after State incentives, assess local hiring, skills development, research, domestic procurement, vendor development and indigenous technology, and link incentives to measurable outcomes.
• Policy, governance and implementation: assign each approval condition to a responsible entity, set up a digital single-window clearance mechanism, publish approval timelines and track compliance, incentives, resource use and disaster-recovery arrangements.
• Roles: States coordinate departments and utilities, verify infrastructure readiness, define approval conditions, designate data-centre zones and monitor delivery. The Central Government develops common standards, templates and guidance for grid assessments, efficiency, incentives, approvals and compliance monitoring.
• Recommended documentation and accountability: evidence of power and water readiness, infrastructure plans, site and climate-risk assessments, lifecycle plans, quantified State support and performance indicators. Capacity additions and incentive payments are tied to verified milestones, with suspension triggers and grievance channels, while sensitive customer, security and proprietary information stays protected.

An early national report that recognises AI's large socio-economic potential, identifies the data, ethics and cybersecurity problems to be solved, and maps AI applications across sectors from manufacturing and healthcare to national security.

• Recognises AI's large socio-economic potential, to be balanced against the challenges it raises.
• Problems identified: data collection, archiving and safeguards to ensure data availability, data protection and ethical use through enabling frameworks, and digitisation of systems (IoT) alongside cybersecurity standards.
• Objectives: improve manufacturing to increase jobs and profitability, make healthcare more accessible and higher quality, improve agricultural yields, and improve public service delivery.
• Manufacturing: modernise and speed up decision-making and planning, improve logistics and supply chain management, and enable robot-human collaboration.
• Healthcare and agriculture: data repositories, nationwide clinical support systems and disease detection in health, and crop prediction in agriculture.
• Other applications: fintech, education, customer engagement, accessibility for differently abled people, environment and sustainability, national security and public utility services.
• Adoption should be enabled through entrepreneurship.
• Responsible and ethical use: AI should be explainable, safe and secure, and transparent. Existing legal provisions should apply, with necessary modifications (mutatis mutandis), to AI systems, and the rights and responsibilities of AI systems should be examined.

Tamil Nadu's 2024-2025 policy note for its IT and Digital Services Department, covering AI/ML in e-governance, the state's data policy, Tamil computing and the technology and innovation ecosystem.

• AI/ML in e-governance: TNeGA undertakes AI/ML initiatives to support government services and departmental projects.
• Digital governance: implements the Tamil Nadu Digital Transformation Strategy, e-governance platforms and data-driven decision-making systems.
• Data policy: recognises the Tamil Nadu Data Policy, covering data governance and the use of data in public service delivery.
• Tamil computing: the Tamil Virtual Academy develops AI-related software and computational tools for Tamil, alongside language digitisation and preservation.
• Technology infrastructure: develops state data centres, cloud services, cybersecurity infrastructure and digital connectivity.
• Innovation ecosystem: the iTNT Hub supports startups, research, incubation and commercialisation in deep-tech and emerging technologies.

Tamil Nadu's 2025-2026 policy note highlights the Tamil Nadu Artificial Intelligence Mission, AI in governance and for MSMEs, and responsible AI through the state's evaluation framework and data policy.

• Tamil Nadu Artificial Intelligence Mission (TNAIM): an AI Mission launched in 2024 to promote AI research, governance applications and ethical AI adoption.
• AI in governance: promotes AI-enabled solutions to improve government service delivery and administrative efficiency.
• AI for MSMEs: ran a Grand Challenge to develop AI solutions for early identification of non-performing MSMEs, supporting timely intervention and evidence-based policy.
• Responsible AI: emphasises ethical AI adoption, with the Safe and Ethical AI Policy, 2020 providing the TAM-DEF evaluation framework and the DEEP-MAX Scorecard.
• Data governance: the Tamil Nadu Data Policy, 2022 promotes privacy, security, transparency, interoperability, accountability and lawful data use.
• AI innovation and skills: the iTNT Hub supports deep-tech startups, while ICT Academy delivers technology training and capacity-building initiatives.
• Digital infrastructure and cybersecurity: expands digital public services, data-centre infrastructure and cybersecurity measures to support digital governance.

Tamil Nadu's 2026-2027 policy note, issued under a department now named for AI, builds a formal approval, assessment and audit regime for government AI systems, with human review of AI-assisted decisions that affect citizens.

• Institutional AI governance: sets up a government-wide process for evaluating and approving AI proposals, with prior concurrence of the Artificial Intelligence, IT and Digital Services Department.
• Mandatory AI assessment: applies the six-dimensional TAM-DEF Framework and the DEEP-MAX Scorecard to government AI systems before deployment and during rollout.
• Cybersecurity and data protection: requires cybersecurity review by TN-CERT and provides for data-protection certification under the DPDP Act, 2023 and Rules, 2025.
• Human accountability: for AI-assisted government decisions affecting citizens, requires disclosure of AI use on request, written reasons in Tamil or English, and review by a designated human officer.
• Auditing and transparency: provides for use-case registries, model inventories, algorithmic audit logs, deployment registries and periodic impact audits of high-risk AI systems.
• AI innovation and research: plans dedicated Centres of Excellence for AI and emerging technologies, covering research, skills, technology adoption and industry collaboration.
• AI for public services: pursues AI-enabled grievance processing and routing, including Tamil-language voice and text interfaces.
• AI for business: supports AI adoption by MSMEs and startups, including locally relevant solutions and sovereign large language models.
• Emerging technologies: integrates AI, AVGC-XR, quantum technologies and other emerging fields into the Tamil Nadu AI Mission's activities.