AI Safety Standards in India 2026: Laws, Rules, BIS Standards and Compliance Dates

AI Regulations in India 2026: Laws & Safety Rules

India does not have one overarching "AI Act" as of August 2026. Instead, AI systems operating in India are governed by a patchwork of existing digital, privacy, cyber, and sector-specific laws, supplemented by national guidelines and voluntary safety standards. Navigating AI compliance in India requires distinguishing between what is legally binding and what is merely recommended practice.

Classifying India's AI Framework

To assess compliance requirements accurately, every measure must be categorized into one of five distinct legal statuses:

1. Enacted law: Binding statutes passed by Parliament (e.g., Information Technology Act, Digital Personal Data Protection Act, Consumer Protection Act).
2. Notified rule or regulation: Binding secondary legislation issued by ministries or regulators (e.g., IT Rules, CERT-In cyber directions).
3. Draft or proposal: Documents released for public comment with no current legal force.
4. Government guidance or policy: Official strategies setting national direction but lacking statutory penalties (e.g., India AI Governance Guidelines).
5. Voluntary standard or industry practice: Technical frameworks that are optional unless mandated by a specific contract or sector regulator (e.g., BIS, ISO, NIST standards).

General Law vs. AI-Specific Rules

The absence of a specific "AI Act" does not mean AI is unregulated. Existing Indian laws apply directly to AI deployment:

• Information Technology Act, 2000 (Enacted law): Penalizes computer-related offences, data theft, and breaches of cybersecurity. AI systems causing denial of service or unauthorized access are captured here.
• Digital Personal Data Protection Act, 2023 (Enacted law - Phased): Governs how AI models collect, process, and store personal data. It mandates purpose limitation, data minimization, and user consent. It applies to training datasets and AI outputs containing personal information.
• IT Rules, 2021 & SGI Amendments (Notified rule): Specifically targets AI-generated synthetically generated information (SGI) and deepfakes. It imposes binding due diligence, labeling, and rapid takedown requirements on digital platforms.
• Consumer Protection Act, 2019 (Enacted law): Protects users against unfair trade practices and product liability, applicable if an AI service misleads consumers or causes financial harm.
• Copyright Act, 1957 (Enacted law): Determines the legality of scraping protected content for AI training data and the ownership of AI-generated outputs.

India vs. EU AI Act: The Legislative Approach

The European Union's AI Act is an Enacted law with extraterritorial reach, imposing strict, risk-based tiers (Unacceptable, High, Limited, Minimal) on AI systems. A company violating the EU AI Act faces massive statutory fines based on global turnover.

India has deliberately avoided this horizontal legislative model. The India AI Governance Guidelines (Government guidance) explicitly reject an immediate standalone AI law in favor of a sectoral, use-case-driven approach. The EU AI Act does not automatically apply to Indian companies unless they are deploying AI systems within the EU market or targeting EU citizens. Indian businesses operating domestically are governed by India's sector-by-sector regulatory matrix.

International Frameworks: ISO, NIST, and OECD

Global frameworks heavily influence Indian corporate compliance, but their legal status is strictly Voluntary standard or industry practice unless specifically incorporated into Indian law.

• ISO/IEC 42001: The global standard for AI management systems. The Bureau of Indian Standards (BIS) has adopted this to help Indian firms certify their AI governance.
• NIST AI RMF (Risk Management Framework): A US-developed voluntary standard highly respected globally for mapping, measuring, and managing AI risks. It is widely adopted by Indian IT service providers for global client compliance, but it is not an Indian statutory requirement.
• OECD AI Principles: International policy recommendations guiding trustworthy AI. India subscribes to these principles at a diplomatic level, influencing its domestic Government guidance, but they do not create binding corporate duties.

Sector-Wise AI Risks and Governance

Because India uses a sectoral approach, the risk and regulatory burden depend entirely on the industry context.

1. Banking and Financial Services

• Risk: Automated credit scoring bias, algorithmic trading crashes, synthetic identity fraud.
• Status: Governed by existing RBI master directions (Notified rules) and the 2025 RBI FREE-AI Committee report (Government guidance). Lenders must ensure algorithmic decisions do not violate fair lending rules and that human oversight exists for critical loan approvals.

2. Healthcare and Biomedical Research

• Risk: Misdiagnosis, patient data exposure, biased triage algorithms.
• Status: Governed by the DPDP Act (Enacted law) for health data privacy and ICMR Ethical Guidelines for AI in Biomedical Research (Government guidance). Software as a Medical Device (SaMD) is regulated under the Drugs and Cosmetics Act.

3. Education and EdTech

• Risk: Automated grading bias, excessive student profiling, data monetization of minors.
• Status: DPDP Act (Enacted law) strictly prohibits behavioral monitoring and targeted advertising directed at children. Parental consent is mandatory for processing minors' data in AI tutoring systems.

4. Recruitment and Human Resources

• Risk: CV screening algorithms discriminating by gender, caste, or region; automated video interview analysis relying on flawed emotion-recognition tech.
• Status: Covered by general constitutional and employment anti-discrimination principles. Companies must audit HR algorithms (Voluntary industry practice) to prevent systemic bias that could trigger legal liability.

5. Public Administration and Law Enforcement

• Risk: Predictive policing errors, facial recognition mismatches, algorithmic denial of welfare benefits.
• Status: Bound by Constitutional rights to equality and life (Article 14 and 21). Public procurement of AI requires rigorous algorithmic impact assessments (Government policy).

AI Governance Compliance Questions for Indian Businesses

To navigate this hybrid regulatory environment, Indian boards and technology officers must answer these core compliance questions:

1. Personal Data: Does the AI model collect, train on, or output digital personal data? (Triggers the DPDP Act).
2. Automated Decisions: Does the AI make decisions significantly affecting individuals (e.g., loans, hiring) without human intervention?
3. Generated Content: Does the platform host or generate synthetic audio/video? (Triggers IT Rules SGI labeling and takedown mandates).
4. Transparency: Are users explicitly informed they are interacting with an AI system rather than a human?
5. Vendor Contracts: Do enterprise agreements assign liability if a third-party foundational model hallucinates or breaches copyright?
6. Model Risk & Bias: Has the system been audited for bias against protected demographic groups using Indian datasets?
7. User Complaints: Is there a designated grievance officer to handle complaints regarding AI outputs?
8. Cybersecurity: Is the AI infrastructure integrated into the company's mandatory CERT-In breach reporting protocols?

AI Incident Checklist: Practical Steps

When an AI system fails, generates harmful content, or causes a data breach, organizations should follow this operational checklist to separate good practice from binding legal duties.

• Halt and Isolate (Voluntary Practice): Immediately suspend the affected model or API endpoint to prevent further harm.
• 6-Hour Cyber Reporting (Binding Rule): If the incident involves a cybersecurity breach, unauthorized access, or data leak, it must be reported to CERT-In within 6 hours under the 2022 CERT-In directions.
• Content Takedown (Binding Rule): If the incident involves unlawful synthetic media (deepfakes), social intermediaries must remove it within the mandated statutory windows under the IT Rules.
• Data Breach Notification (Binding Rule - Phased): Notify the Data Protection Board and affected users if personal data is compromised, as per the DPDP Act timeline.
• Root Cause Audit (Voluntary Practice): Conduct an algorithmic audit to determine if the failure was due to data drift, adversarial attacks, or model hallucination.

India AI Governance Timeline (2022–2026)

The next test for India's AI framework is not drafting more broad principles, but building enforcement capacity. A useful AI safety system requires evidence from real enterprise deployments, actionable audits, and clear judicial interpretation of how existing laws apply to algorithmic harm.