India has chosen not to pass a dedicated AI law for now, so organisations building or deploying AI there must work out their duties from a non-binding national framework plus existing laws such as the IT Act and the DPDP Act. The India AI Governance Guidelines, published by the Ministry of Electronics and Information Technology (MeitY) through the Press Information Bureau in November 2025, set out seven principles ("sutras"), six pillars of recommendations, new institutions and an action plan. This guide summarises what the guidelines say, what is voluntary today and what may become mandatory, and what they mean for AI agents and the machine identities those agents use. It is written for compliance, security and AI platform teams with operations, customers or suppliers in India. For how India compares with other jurisdictions see the Global AI Regulation Map.
Status line (checked 27 October 2026): the guidelines are a policy framework, not legislation. They state that a separate AI law is not needed at this stage and recommend targeted amendments to existing laws and voluntary frameworks first. Amendments, rules and institutions they propose may since have been taken forward; check MeitY and PIB before relying on this summary.
Key takeaways
- No new AI law, for now. The guidelines conclude that existing laws, including the Information Technology Act and the Digital Personal Data Protection (DPDP) Act, can address many AI risks, provided enforcement is timely and consistent.
- Voluntary first, binding later. Principles, codes and self-certification are the starting point, proportionate to risk, and the guidelines say they may become mandatory if voluntary measures fall short.
- Accountability is graded. Responsibility is meant to scale with the function an organisation performs in the AI value chain, the level of risk and the due diligence it applied.
- AI agents are named. The guidelines say highly autonomous agents and multi-agent systems may need new governance and recommend monitoring standards, audit trails and human-in-the-loop controls at critical decision points.
- Incidents and grievances will need processes. A national AI incidents database and accessible grievance redressal are part of the action plan, so organisations should start recording AI incidents and complaints now.
Scope: who and what is covered
The guidelines are a whole-of-government framework rather than a statute with a defined scope. They address AI developers, deployers and the wider value chain (data, compute and model providers), regulators and government bodies. MeitY is described as the nodal ministry coordinating AI governance, while sectoral regulators such as the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) enforce rules in their own domains.
The seven sutras
| Sutra | What it asks of organisations (summary) |
|---|---|
| Trust is the Foundation | Build and deploy AI in ways that earn and keep public trust |
| People First | Keep human oversight and human interests at the centre |
| Innovation over Restraint | Favour enabling innovation while managing risk, rather than precautionary restriction |
| Fairness & Equity | Test for and mitigate bias and exclusion |
| Accountability | Assign clear responsibility across the value chain |
| Understandable by Design | Make systems explainable and disclose their use |
| Safety, Resilience & Sustainability | Build systems that are safe, robust and resilient |
The guidelines say the sutras are adapted from the RBI's FREE-AI Committee report and are intended to be technology-neutral. The summaries in the right-hand column are ours; read the source text for the full wording.
The six pillars
Recommendations are organised under Infrastructure, Capacity Building, Policy & Regulation, Risk Mitigation, Accountability and Institutions.
Key obligations
Because the guidelines are not binding, "obligations" here means expectations the guidelines set for industry, plus duties that already apply through existing law.
| Area | What the guidelines recommend | Binding today? |
|---|---|---|
| Risk framework | An India-specific risk framework based on evidence of harm, with attention to vulnerable groups such as children and women. Risk categories include malicious use, bias, transparency failures, systemic risk, loss of control and national security | No; framework to be developed |
| Voluntary frameworks | Principles, codes and self-certifications proportionate to risk, with incentives such as sandbox access and technical assistance | No |
| Grievance redressal | Organisations deploying AI should offer accessible, multilingual and timely complaint channels, separate from the incidents database | No (existing consumer and IT law duties still apply) |
| Transparency reports | Publish assessments of harm risks in the Indian context; share sensitive details with regulators confidentially | No |
| Incident reporting | A national AI incidents database fed by federated databases using a standard schema; reporting encouraged without penalties; CERT-In reporting to be leveraged | No for AI incidents as such; existing CERT-In cyber incident reporting duties apply separately |
| Content authentication | Review regulation of deepfakes, including provenance standards such as C2PA and watermarking, while noting their limits | Depends on IT rules in force; check current MeitY notifications |
| Techno-legal measures | "Compliance-by-design": embed legal requirements in system design; DEPA for AI Training given as an example | No |
| Personal data | DPDP Act applies; the guidelines note open rulemaking questions on AI training exemptions, purpose limitation, consent managers and "legitimate use" | Yes, through the DPDP Act and its rules |
Risk mitigation in more detail
The guidelines put most weight on evidence. The national incidents database is described as centralised but fed by federated local databases using a standard schema, with reporting encouraged without penalties so that organisations share real harm data. Techno-legal measures ("compliance-by-design") mean building legal requirements into systems, for example consent and purpose controls in data pipelines; the guidelines note trade-offs such as possible performance loss. On deepfakes, they call for global standards to certify authentic content but caution that watermarking and attribution tools have limits, so provenance should be one control among several.
Suggested changes to existing law
- IT Act: amend to clarify how AI systems are classified and how liability applies. The guidelines note that the section 79 intermediary safe harbour may not fit AI systems that generate content.
- Copyright Act: consider allowing text and data mining with protections for rights holders; a DPIIT committee is reviewing this.
- PC-PNDT Act: review risks from AI analysis of radiology images being used for sex selection.
- Regulatory sandboxes: with legal immunities, conditional on evidence being published.
Timeline and current status
| Phase | Actions in the guidelines' action plan |
|---|---|
| Short term | Establish the AI Governance Group (AIGG) and constitute the Technology & Policy Expert Committee (TPEC); develop India-specific risk frameworks; regulatory gap analysis and proposed amendments; adopt voluntary frameworks and publish a master circular on applicable laws; prepare the incidents database and grievance redressal; develop liability regimes; expand access to data, compute and models; awareness and training; operationalise safety tools for bias mitigation, privacy and deepfake detection |
| Medium term | Common standards for content authentication, data integrity, fairness and cybersecurity; operationalise the national incidents database; amend laws to close gaps; pilot regulatory sandboxes in high-risk domains; support AI integration with Digital Public Infrastructure (DPI) |
| Long term | Continuous review; new laws for emerging risks and capabilities; global engagement and standards; horizon scanning and scenario planning |
The guidelines also refer to a compliance schedule from MeitY; check the source text and MeitY for its timing. They do not give calendar dates for the phases. This page has not confirmed which actions have been completed since publication, so treat the table as the plan, not the current state.
Institutions
- AI Governance Group (AIGG): a small, permanent inter-agency body for policy coordination and oversight.
- Technology & Policy Expert Committee (TPEC): set up by MeitY to advise the AIGG on risks, regulatory gaps, standards and testing.
- AI Safety Institute (AISI): research, risk assessment, testing, draft standards and capacity building on a hub-and-spoke model; represents India in the International Network of AI Safety Institutes.
Enforcement and penalties
The guidelines create no penalties of their own. Enforcement comes from existing law and sectoral regulators:
- Personal data processed by AI: the DPDP Act and its rules. See the India DPDP Act Guide for obligations and penalties.
- Online content and intermediaries: the IT Act and rules made under it, including intermediary due diligence.
- Cyber incidents: CERT-In reporting directions, which the guidelines propose to leverage for AI incidents.
- Financial services and markets: RBI and SEBI rules within their domains.
The practical enforcement risk today is therefore under these laws, not the guidelines. The guidelines' signal is that voluntary measures may become mandatory, so early adoption reduces later cost.
What it means for AI agents and non-human identities
The guidelines discuss highly autonomous agents and multi-agent collaboration directly and recommend monitoring standards, audit trails and human-in-the-loop controls at critical decision points. For loss-of-control risks they suggest human oversight in sensitive sectors, and circuit breakers and automated safeguards in fast systems such as algorithmic trading. In identity terms:
- Graded liability needs attribution: you can only show which function you performed and what due diligence you applied if each agent has its own identity, owner and logged actions. See the Agent Identity and Access Guide.
- Audit trails: log which agent identity acted, on whose behalf, with which tool and credential. See the AI Agent Audit Trails for Regulators Guide.
- Human-in-the-loop at critical points: require step-up approval before agents perform high-impact actions such as payments, account changes or data exports.
- Circuit breakers: scoped, short-lived credentials and a tested kill switch let you stop an agent quickly. Revoking its credentials is the circuit breaker.
- DPI integration: the guidelines encourage linking AI with digital public infrastructure for identity, data exchange, authentication and payments. Agents that call such services hold high-value credentials and need the strongest machine identity controls.
Compliance steps
- Map your AI systems used in India, your role for each (developer, deployer, value chain supplier) and the sector regulator that applies.
- Confirm duties under existing law: DPDP Act, IT Act and rules, CERT-In directions and sector rules. These are binding now.
- Adopt a voluntary framework aligned to the seven sutras, for example by mapping your AI policy to them and to the NIST AI RMF Guide or ISO/IEC 42001 Guide controls you already use.
- Stand up grievance redressal for AI decisions and outputs: multilingual, accessible, with response times.
- Record AI incidents in a structured format now, so you can report to a national database when it exists.
- Give agents identities and audit trails, with human approval at critical decision points.
- Prepare content provenance for generative outputs (C2PA or watermarking), noting the guidelines' caution on their limits.
- Watch for change: a compliance schedule, master circular, risk framework and IT Act amendments are all signalled. Assign an owner to monitor MeitY and PIB.
| Guideline expectation | Equivalent control in common frameworks |
|---|---|
| Risk framework and assessment | NIST AI RMF MAP and MEASURE functions; ISO/IEC 42001 risk assessment |
| Accountability and graded liability | NIST AI RMF GOVERN; NIST CSF 2.0 GV.RR-02 roles and responsibilities |
| Audit trails for agents | NIST SP 800-53 AU-2 Event Logging, AU-12 Audit Record Generation |
| Human-in-the-loop | MITRE ATLAS human-in-the-loop mitigation for AI agent actions (check the current ATLAS ID) |
| Incident reporting | NIST CSF 2.0 RS.CO-02 (internal and external stakeholders notified) |
Small and large organisations
- Start-ups and small deployers: the guidelines lean towards enabling innovation ("Innovation over Restraint") and offer incentives for voluntary adoption, including sandbox access, public recognition, technical assistance and investment directed to responsible firms. A short AI policy mapped to the sutras, a grievance channel and an incident log are a proportionate start.
- Large enterprises and platforms: expect closer attention to transparency reports, value chain visibility and graded liability. The guidelines say regulators need better visibility into developers, deployers and the flow of data and compute, so be ready to describe your AI supply chain, including third-party models and APIs.
- Regulated sectors: follow the sector regulator first. Banks and payment firms should read the RBI FREE-AI Committee report from which the sutras are adapted, and securities firms should follow SEBI rules.
- Multinationals: map the sutras onto the controls you already run for the EU AI Act, NIST AI RMF or ISO/IEC 42001 rather than building a separate programme. Most expectations (risk assessment, transparency, accountability, human oversight) overlap.
Measuring progress
- Share of AI systems used in India with a named owner, role and risk rating (target 100%).
- Share of AI agents with a distinct identity, scoped credentials and an audit trail.
- Number of AI incidents logged per quarter, and time to triage.
- Grievances received about AI decisions or content, median response time and share upheld.
- Share of generative outputs carrying provenance marking where you have committed to it.
Practitioner checklist
- List AI systems and agents used in India with role, owner and sector regulator.
- Confirm DPDP Act, IT Act, CERT-In and sector duties for each system.
- Map your AI policy to the seven sutras and record gaps.
- Publish a multilingual grievance channel for AI-driven decisions and content.
- Start a structured AI incident log that can feed a future national database.
- Give every AI agent a distinct identity, scoped credentials, an owner and an audit trail.
- Require human approval for agent actions at critical decision points and test the kill switch.
- Assign someone to monitor MeitY and PIB for the compliance schedule, master circular and amendments.
Standards and references
- MeitY: India AI Governance Guidelines
- NIST: AI Risk Management Framework
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- MITRE ATLAS: Human In-the-Loop for AI Agent Actions
This guide summarises the India AI Governance Guidelines as published in November 2025 and is not legal advice. Related NHI Mgmt Group resources: Global AI Regulation Map · India DPDP Act Guide · AI Agent Audit Trails for Regulators Guide · EU AI Act Compliance Guide