India will soon have a dedicated law on Artificial Intelligence, Union Minister Ashwini Vaishnaw indicated while speaking at the NDTV World Summit last week. The announcement comes at a critical juncture.
AI is already being deployed across financial services, healthcare, education, commerce, media and public administration, while the law governing its use remains dispersed across multiple statutes and regulations. India does not yet have a statutory definition of artificial intelligence. The existing framework is instead assembled from different legal instruments. This fragmented framework should not necessarily be regarded as a regulatory failure. It may instead offer a useful starting point for designing the next stage of AI regulation. India may not need an omnibus AI statute. It needs a regulatory framework that governs the use and consequences of AI across sectors. AI is not a single technology performing a single function. Its legal and social risks are determined substantially by the context in which it is deployed. An AI system used in healthcare presents different concerns from one used in advertising. An algorithm deployed for recruitment raises different issues from one used for financial credit assessment, while AI used in justice delivery carries consequences fundamentally different from those arising from a generative AI system producing commercial content. That points towards a sector-specific model, supported by a set of common principles applicable across the AI ecosystem. Liability must be at the centre of the framework The most consequential legal issue arising from AI may ultimately be liability. An AI system may make an incorrect medical recommendation, misread a radiology report, produce a flawed financial assessment or draft a contract that exposes a party to an unforeseen liability. It may also make an error while processing or consolidating large volumes of data. Under the present legal framework, an AI system cannot itself be treated as a legal person capable of bearing liability. The allocation of liability cannot, however, be uniform. An erroneous AI recommendation in healthcare may affect life and health; an automated decision in financial services may cause substantial economic loss; and an error in justice delivery may affect liberty or fundamental rights. The acceptable threshold of risk, the degree of human oversight and the consequences of failure will necessarily vary between sectors.
READ | India Weighs US-Style Frontier AI Safeguards As Government Prepares New Law The regulatory framework should therefore focus less on regulating AI as a technology and more on regulating specific uses, identifiable risks and resulting harm. Responsibility must therefore be located within the human and institutional chain surrounding the system with the developer, deployer, operator, professional, user or organisation, depending upon the circumstances. The Digital Personal Data Protection Act, 2023, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, framed under the Information Technology Act, 2000, and, where relevant, the Copyright Act, 1957, apply depending on the nature of the activity or harm involved from deepfakes and misuse of personal data to copyright infringement and other forms of digital harm.
The most difficult part of AI regulation may ultimately be enforcement. An AI model may be developed in one country, trained using data originating across several jurisdictions, deployed through infrastructure located elsewhere and used by an individual in India. Responsibility can consequently be distributed across multiple entities and jurisdictions. Developers of high-risk systems should be required to maintain technical documentation and records of testing and risk assessment. Deployers should be responsible for appropriate human oversight, monitoring and incident reporting. Organisations using AI for consequential decisions should remain accountable for those decisions even where the underlying system has been developed by a third party. The framework should also establish a mandatory incident-reporting mechanism for serious AI-related failures and provide regulators with powers to investigate, order corrective measures, suspend or restrict the deployment of high-risk systems, and impose proportionate penalties. Individuals affected by consequential AI decisions should have access to review and redress, including human intervention where appropriate. Cross-border enforcement will require a parallel mechanism of regulatory cooperation, information sharing and recognition of enforcement measures. Where the relevant developer or service provider is outside India but the AI system has substantial effects within India, the regulatory framework should provide a clear basis for asserting jurisdiction and imposing compliance obligations. Without these mechanisms, even a carefully drafted AI statute risks becoming a statement of principle rather than an effective regulatory instrument. Innovation and accountability must move together India enters this debate with an expanding ecosystem of companies, researchers, entrepreneurs and technology developers. Regulation must protect against genuine risks without making experimentation commercially or legally untenable. Equally, innovation cannot become a shield against accountability.
A workable Indian framework should therefore impose identifiable obligations on every significant actor in the AI supply chain. The appropriate model is therefore likely to be a principles-based, risk-sensitive and proportionate regulatory framework – stringent where AI can affect fundamental rights, health, financial security or public safety, and more flexible where the risks are limited.
Sectoral regulators should establish appropriate standards for testing, transparency, human oversight, auditability, accountability and liability. The higher the potential impact on life, liberty, financial security or fundamental rights, the greater the regulatory obligations should be. A three-tier regulatory architecture The legislative framework may operate through three interconnected layers. The first should be a horizontal layer of common principles applicable across the AI ecosystem. These should include transparency, accountability, risk assessment, human oversight, data governance, documentation, auditability and safeguards against prohibited or unacceptable uses. These principles would establish the basic legal obligations applicable irrespective of the sector in which an AI system is deployed. The second should be sector-specific regulation. Existing regulators and statutory authorities should determine the obligations applicable to AI within their respective domains. The Reserve Bank of India, for example, would be better placed to prescribe standards for AI used in regulated financial services than a central AI statute attempting to prescribe identical rules across every industry. Similar sector-specific frameworks could operate in healthcare, employment, education, telecommunications, insurance and justice delivery. The third should be a clear institutional and enforcement framework. The central legislation should establish the common principles and allocate regulatory responsibilities, while sectoral regulators should have the power to classify high-risk uses, prescribe compliance standards, require impact assessments and audits, mandate human oversight, investigate violations and impose proportionate sanctions. Individuals affected by an AI-enabled decision should have access to a clear mechanism for explanation, review and redress, particularly where the decision affects fundamental rights, health, livelihood or significant financial interests. This model would allow India to establish common national standards without imposing identical regulatory obligations on fundamentally different applications of AI. The case against an omnibus statute An all-encompassing AI statute presents a separate institutional risk. Legislation attempting to regulate every aspect of AI would inevitably require extensive delegated legislation, executive rules, technical standards and sector-specific regulations. Instead of simplifying the regulatory environment, it could create another layer of overlapping obligations. India already has an extensive legal architecture governing privacy, intellectual property, consumer protection, financial services, healthcare, telecommunications and criminal liability. Where an AI-related activity is already governed by a sectoral statute or regulator, the AI framework should supplement that regime rather than create parallel and potentially conflicting obligations. Privacy must be built into the architecture The other central issue is data privacy. AI systems depend extensively on data its collection, processing, analysis and, in many cases, its use in training models. This brings AI directly into contact with the fundamental right to privacy and India’s data protection framework. The regulatory framework will need to address the use of personal data for training and deployment, lawful processing, sensitive personal information, retention and secondary use of data, and the treatment of personal information that becomes embedded within AI systems. It will also need to consider the rights of individuals where AI systems generate inferences or make consequential decisions about them. These issues cannot be addressed separately from India’s existing data protection regime. The objective should be to reconcile two legitimate interests: enabling the development and deployment of AI while ensuring that technological progress does not come at the expense of individual rights. Regulate principles, not technological iterations The principal difficulty with technology-specific legislation is its durability. Technology evolves faster than the legislative process. The experience of regulating the internet, social media and digital platforms demonstrates the limitations of rules drafted around particular technological forms. AI intensifies that problem. A statute that attempts to define every model, application or technological capability risks becoming obsolete. The more durable approach is to legislate around principles, risk categories, prohibited outcomes and accountability, rather than particular technological iterations. This is where international experience becomes relevant. The European Union has adopted a comprehensive, risk-based approach through the EU AI Act, while the United States has proceeded through a more decentralised framework combining federal initiatives with sectoral regulation and state-level interventions. Other jurisdictions have adopted different combinations of legislation, executive action, technical standards and regulatory guidance. India should study these models without assuming that any one of them can simply be transplanted into the Indian legal system. India’s scale, digital infrastructure, regulatory institutions and developmental priorities are distinct. Enforcement will determine whether regulation works The legislative exercise should operate at two levels. At the macro level, policymakers must consider AI’s implications for rights, markets, employment, competition, privacy and society. At the operational level, regulation must recognise that the risks and responsibilities associated with AI will vary substantially between sectors. The objective should neither be to regulate AI out of existence nor to leave an increasingly consequential technology without meaningful safeguards. India’s task is to build a legal architecture in which innovation can move quickly, but accountability moves with it. That is likely to provide a more durable foundation for India’s AI policy than attempting to regulate an entire technology through a single, sweeping statute.
The regulatory response should therefore be proportionate to the risk and consequence of the AI application. Because regulation without an identifiable regulator, defined responsibility and effective remedies risks becoming largely declaratory, this is critical. The purpose of an AI framework should therefore not be to displace these laws but to operate alongside them.
Any future AI legislation should contain an express compatibility provision making clear that it operates in conjunction with existing legislation, including the Digital Personal Data Protection Act, 2023, the Copyright Act, 1957, and the Information Technology Act, 2000 and rules framed under it.
