Summary
- Released by MeitY under the IndiaAI Mission on 5 Nov 2025 (date per PIB, 6 Aug 2026). Drafted by a committee MeitY set up in July 2025, chaired by Prof. Balaraman Ravindran (IIT Madras), building on a January 2025 draft that drew more than 2,500 public submissions (Annexure 1).
- Core position: existing laws (IT Act, data protection, consumer protection, criminal law) can handle most AI risks today, so "a separate law to regulate AI is not needed" at this stage. Gaps should be fixed by targeted amendments.
- Built in four parts: 7 sutras (principles), recommendations under 6 pillars, a short, medium and long term action plan, and practical guidelines for industry and regulators.
- Proposes new institutions: an inter-ministerial AI Governance Group (AIGG), a Technology and Policy Expert Committee (TPEC), and a stronger role for the AI Safety Institute (AISI). Sector regulators such as RBI and SEBI keep enforcement powers.
- Leans on voluntary measures and "techno-legal" tools first (for example content provenance, privacy tech, bias detection), with some baseline measures possibly becoming mandatory as the industry matures.
The Seven Sutras
Adapted, as the document says, from the RBI FREE-AI committee's principles (see RBI FREE-AI).
| # | Sutra | Plain meaning |
|---|---|---|
| 1 | Trust is the Foundation | Without trust, adoption stalls |
| 2 | People First | Human-centric design, human oversight, human empowerment |
| 3 | Innovation over Restraint | Other things equal, favour responsible innovation over caution |
| 4 | Fairness and Equity | Inclusive development, no discrimination |
| 5 | Accountability | Clear allocation of responsibility and enforcement |
| 6 | Understandable by Design | Disclosures and explanations users and regulators can follow |
| 7 | Safety, Resilience and Sustainability | Secure, robust systems that withstand shocks and are environmentally sustainable |
Six Pillars and Main Recommendations
| Domain | Pillar | Key recommendations (paraphrased) |
|---|---|---|
| Enablement | Infrastructure | Widen access to data and compute; use digital public infrastructure (DPI) for scale and inclusion |
| Enablement | Capacity Building | Education, skilling and awareness for public, officials and regulators |
| Regulation | Policy and Regulation | Review existing laws, find gaps, use targeted amendments (copyright for training data, platform classification, possible new rights such as data portability) |
| Regulation | Risk Mitigation | India-specific risk classification framework based on evidence of harm; national AI incidents database (federated, no-penalty reporting, leveraging CERT-In); voluntary frameworks; techno-legal tools; content authentication and provenance standards for deepfakes |
| Oversight | Accountability | Graded liability by function, risk and due diligence; grievance redressal; transparency reports; self-certification and third-party audits; guidance such as a master circular on how existing laws apply to AI |
| Oversight | Institutions | Whole-of-government approach: AIGG, TPEC, AISI; MeitY as nodal ministry; sector regulators lead in their domains |
Proposed Institutions
- AI Governance Group (AIGG): small, permanent inter-agency body chaired by the Principal Scientific Adviser, with MeitY, MHA, MEA, DST, DoT, TRAI, CCI, the Data Protection Board, sector regulators (RBI, SEBI, ICMR, UGC and others), NITI Aayog and the PSA's office (composition described as illustrative). It coordinates policy, reviews gaps and oversees national initiatives.
- Technology and Policy Expert Committee (TPEC): expert panel set up by MeitY (frontier tech, ML, law and policy, public administration, national security) to brief the AIGG.
- AI Safety Institute (AISI): the "recently established" body for research, risk assessment, testing and draft standards, operating hub-and-spoke and representing India in the international network of AI safety institutes.
- Others named in the framework: CERT-In (AI-driven disinformation and cyber monitoring), Grievance Appellate Committees, BIS and TEC (standards).
Action Plan (Part 3)
- Short term: set up governance institutions; build India-specific risk frameworks; adopt voluntary commitments; suggest legal amendments; clarify liability; expand infrastructure access; launch awareness programmes.
- Medium term: publish common standards (content authentication, data integrity, cybersecurity, fairness); amend laws and regulations; operationalise AI incident systems; pilot regulatory sandboxes; integrate DPI with AI.
- Long term: keep engaging and reviewing; draft new laws if emerging risks and capabilities require it.
Who it applies to
- Industry: anyone developing or deploying AI systems in India (Part 4, "Guidelines for industry").
- Government: ministries, sector regulators, standards bodies and advisory bodies (Part 4, "Guidelines for regulators", and the institutional framework).
- Foreign companies: no extraterritorial mechanism. The industry guidance says to comply with Indian laws, which reach foreign providers only as those laws do.
Key dates
- Final India AI Governance Guidelines released
Full date record
| Date | Event |
|---|---|
| 2023 | Government sets up a high-level advisory group under the Principal Scientific Adviser; it forms a subcommittee on AI governance |
| January 2025 | Draft subcommittee report published by MeitY for public feedback (more than 2,500 submissions) |
| July 2025 | MeitY constitutes the drafting committee |
| 2025-11-05 | Final Guidelines released |
| Not stated | The Guidelines say MeitY "may publish a schedule" for compliance with accountability measures in the next 9 to 12 months; no such schedule found as of 2026-10-19 |
Penalties and enforcement
- None. The Guidelines create no duties or penalties.
- They ask sector regulators to enforce existing laws "timely and consistently" when AI causes harm.
What it means for an Indian company
- Expect sector-led rules, not one AI Act. Watch RBI (RBI FREE-AI), SEBI (SEBI AI/ML Consultation 2025), TRAI (TRAI AI and Big Data Recommendations), ICMR (ICMR AI in Healthcare Guidelines) and MeitY's IT Rules (IT Rules Amendment 2026 (Synthetic Content)).
- Industry checklist from Part 4 (voluntary, but a sensible baseline):
- comply with all Indian laws and be able to demonstrate it when asked: SC-AI-009 Regulatory applicability register and horizon scanning
- adopt voluntary principles, codes and standards on privacy, security, fairness and transparency: SC-AI-001 AI governance policy approved by the board or top management, SC-AI-017 Fairness and discrimination testing of outputs
- run a grievance mechanism for AI harms with reasonable resolution times: SC-AI-028 Customer grievance redressal for AI
- publish transparency reports on risks of harm in the Indian context (share sensitive parts confidentially with regulators): SC-AI-025 Public AI transparency statement and notices
- use techno-legal tools such as privacy-enhancing tech, machine unlearning, algorithmic audits and automated bias detection: SC-AI-038 Independent bias audit, SC-AI-037 Internal audit of AI
- Get ready for incident reporting. A national AI incidents database is planned; having SC-AI-031 AI incident management and regulator reporting in place now makes future participation easy.
- Deepfake provenance is a stated priority. The Guidelines point to standards like C2PA; the 2026 IT Rules then made labelling binding (SC-AI-023 Label AI-generated and synthetic content).
- ISO/IEC 42001 aligns well with this voluntary posture and gives you something certifiable to show.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when India AI Governance Guidelines is done.
Glossary
- Sutra: a guiding principle; the Guidelines use seven.
- Techno-legal approach: building legal goals into technology itself, for example watermarks for provenance or privacy-preserving computation.
- Graded liability: responsibility that scales with what an actor does in the AI value chain, how risky it is, and whether it took due care.
- AI value chain: the chain of actors (data centres, model developers, deployers, users) involved in building and using AI.
- AI incident: an event where developing or using an AI system leads to harm (the Guidelines adopt the OECD definition).
- Regulatory sandbox: a supervised space where firms can test new products under relaxed rules.
- DPI: digital public infrastructure such as Aadhaar, UPI and DigiLocker.
- AIGG / TPEC / AISI: AI Governance Group, Technology and Policy Expert Committee, AI Safety Institute.
Key takeaways
- Voluntary national framework released 5 Nov 2025; no new AI law for now, existing laws plus targeted amendments.
- Seven sutras borrowed from RBI FREE-AI and adapted for all sectors.
- Six pillars across enablement, regulation and oversight; graded liability and an AI incidents database are the most consequential ideas.
- New coordinating bodies proposed (AIGG chaired by the PSA, TPEC), with the AI Safety Institute as the technical anchor; sector regulators keep enforcement.
- For companies: treat Part 4 as the baseline checklist (comply with laws, voluntary standards, grievance redressal, transparency reports, techno-legal safeguards).
Official sources
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.