AI Regulation in India and the Danger of Simply Copying Someone Else's Law

India's approach to regulating artificial intelligence has, for several years now, been described by critics as an absence rather than a policy: no dedicated AI statute, no equivalent of the European Union's risk-tiered AI Act, and a reliance instead on advisory documents from NITI Aayog, sporadic guidance from the Ministry of Electronics and Information Technology, and the general-purpose provisions of the Information Technology Act, which was drafted in 2000 and amended in 2008, long before anyone contemplated generative models producing synthetic video at scale. The criticism is not wholly unfair. But the implicit assumption behind it, that India is simply lagging in a race whose destination other jurisdictions have already correctly identified, deserves more scrutiny than it usually receives.

What the EU actually built and why

The European Union's AI Act, which entered into force in 2024, classifies AI systems into risk tiers, from unacceptable risk applications that are banned outright, such as social scoring, to high-risk systems in domains like employment and credit scoring that face extensive documentation, testing and human oversight obligations, down to minimal-risk applications that face almost no obligations at all. This is a serious, carefully constructed piece of legislation, and it emerged from a specific European context: a mature single market with harmonised consumer protection traditions, a regulatory culture accustomed to ex ante compliance regimes following GDPR, and, candidly, a technology sector that produces relatively few of the frontier AI systems the Act is chiefly worried about, which gives European regulators less to lose by regulating strictly. The United States, at the other extreme, has largely avoided binding federal AI legislation, leaving governance to a mix of executive orders, sectoral agency guidance from bodies like the FTC, and state-level laws, a posture that reflects an economy whose competitive advantage rests substantially on the very frontier AI labs a stricter regime might constrain.

Why India's conditions differ from both

India's position resembles neither. It is not, like the EU, a market that primarily imports and deploys AI systems built elsewhere and can therefore regulate deployment without much fear of driving away domestic innovation; India has a fast-growing base of AI application companies, from healthcare diagnostics startups to agricultural advisory platforms built on models like Krutrim and various fine-tuned open-weight systems, that a EU-style ex ante compliance burden would burden disproportionately relative to their scale. Nor is India, like the United States, home to the handful of frontier labs, OpenAI, Anthropic, Google DeepMind, whose light-touch treatment reflects a calculated national bet on maintaining leadership in the technology's most consequential frontier. India's stake in AI is overwhelmingly in application and deployment, in using AI to extend healthcare diagnostics into underserved districts, to translate government services into regional languages, to improve crop yield prediction, domains where the harm from over-regulation is a plausible, near-term innovation loss, while the harm from under-regulation is a more diffuse, longer-term accountability gap.

The advisory approach's real weakness

None of this excuses the genuine weaknesses in India's current advisory approach. NITI Aayog's National Strategy for Artificial Intelligence and its subsequent responsible AI papers articulate sound principles, safety, accountability, inclusivity, but principles without an enforcement mechanism or a designated regulator function more as a statement of intent than as governance. When a lending algorithm denies credit disproportionately to applicants from certain districts, or a hiring tool systematically screens out older candidates, there is currently no clear regulatory body an aggrieved applicant can approach that specifically understands algorithmic decision systems, as opposed to the Reserve Bank of India's grievance mechanisms designed for conventional lending disputes or the Ministry of Labour's mechanisms designed for conventional hiring discrimination. The gap is not the absence of a law with the word intelligence in its title; it is the absence of institutional capacity to investigate algorithmic harm within regulators that already have jurisdiction over the underlying sector.

Building around existing sectoral strength

This suggests a more promising direction than either importing the EU's tiered statute or waiting indefinitely in the American posture of ad hoc guidance: strengthening sectoral regulators that already possess domain expertise, the RBI for financial AI applications, the Insurance Regulatory and Development Authority for underwriting algorithms, the Medical Council-successor National Medical Commission for diagnostic AI, and requiring each to develop specific, binding guidance for AI systems within their existing jurisdiction, rather than creating a new horizontal AI regulator that would need years to build the domain fluency these bodies already possess. This model, sometimes called sectoral or use-case regulation, has precedent in how India has handled other cross-cutting technologies; data localisation rules for payments came from the RBI specifically, not from a general data regulator, and that specificity made the rules more workable in practice.

The deepfake and safety-critical exceptions

Certain AI harms are genuinely horizontal and cannot be left to sectoral regulators alone, and here a more centralised, EU-style approach has real merit. Deepfake-enabled non-consensual imagery, election-related synthetic media, and safety-critical autonomous systems, such as those governing vehicle or drone behaviour, pose risks that cut across sectors and require the kind of clear, enforceable prohibition the IT Rules amendments of 2023 gestured toward but did not fully codify with AI specifically in mind. The government's proposed amendments requiring labelling of AI-generated content are a reasonable start, though enforcement mechanisms remain thin and largely dependent on platform self-reporting.

The honest position, then, is neither the alarmist claim that India is dangerously unregulated nor the complacent claim that the current advisory patchwork is sufficient. It is that India's AI governance should be built around where its actual exposure lies, in deployment and application across a billion-plus population with uneven digital literacy and weak individual recourse mechanisms, rather than around a template designed for a market that produces the frontier systems it fears. Copying the EU's AI Act wholesale would burden precisely the domestic application layer India most needs to grow. Copying America's light touch would leave precisely the accountability gaps India can least afford in domains like credit and healthcare. The right law is the one that starts from India's own risk profile and works backward, not one borrowed off a shelf because it is the version already written.