Contact usGet started

Frameworks · India

AI governance frameworks and AI regulation in India

India has no standalone AI law. It governs AI through existing law, chiefly the DPDP Act and Rules for personal data and the IT Rules, which since February 2026 carry specific duties for AI-generated content. Sector regulators such as the RBI set expectations for the institutions they supervise, and MeitY's voluntary India AI Governance Guidelines sit above them all.

Who regulates AI here

India

India governs AI through voluntary national guidelines and its data protection law, with sector guidance from regulators.

Voluntary frameworkIndia AI Governance GuidelinesMeitY's India AI Governance Guidelines, released 5 November 2025. Seven sutras, six pillars, action plan and practical guidance for industry and regulators.Released 5 November 2025. Voluntary. No AI-specific law; existing laws apply.LawDPDP Act and RulesDigital Personal Data Protection Act 2023 and DPDP Rules 2025India's DPDP Act 2023 and DPDP Rules 2025 as they apply to AI. Phased commencement to 13 May 2027, and DPIA, audit and algorithmic due diligence for SDFs.Act enacted 11 August 2023. Rules published 13 November 2025 with phased commencement. Most obligations apply from 13 May 2027.LawIT Rules on synthetic contentIT Rules amendments on synthetically generated informationIndia's February 2026 IT Rules amendments on synthetically generated information. Labels, metadata, SSMI declarations, three-hour takedowns and who it covers.Notified 10 February 2026 (G.S.R. 120(E)). In force since 20 February 2026. Further draft amendments consulted on to 7 May 2026.Regulator guidanceRBI FREE-AIFramework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial SectorReserve Bank of India's FREE-AI committee report of 13 August 2025. Seven sutras and 26 recommendations on AI for banks, NBFCs and other regulated entities.Committee report published 13 August 2025. Recommendations, not binding directions. RBI issued related draft model risk guidance on 24 June 2026.

All India frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in India

Frameworks elsewhere

Guides

Questions

Does India have an AI law?

Not a standalone one. India governs AI through existing law, including the Information Technology Act and IT Rules, the Digital Personal Data Protection Act 2023 and sector rules. MeitY's India AI Governance Guidelines of November 2025 recommend using current law where possible and amending it where a risk is not covered.

Does India regulate deepfakes and AI-generated content?

Yes. Amendments to the IT Rules in force since 20 February 2026 require intermediaries that offer tools for realistic synthetic audio, images or video to block unlawful synthetic content, label the rest and embed provenance metadata. Significant social media intermediaries must also collect and verify user declarations.

When do the DPDP Rules apply?

In phases from 13 November 2025. Rule 4 on Consent Managers applies from 13 November 2026, and most obligations, including notice, security, breach intimation and data principal rights, apply from 13 May 2027.

Are the RBI's AI expectations binding on banks?

Not yet. The FREE-AI framework of August 2025 is a committee report, and the model risk guidance of 24 June 2026 was released as a draft for comment. Banks and NBFCs should still treat both as a clear signal of what supervisors will look for.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us