India AI Regulation: What's Law Now and What's Coming

A year ago, the government's answer to "does India need an AI law?" was no. Its AI Governance Guidelines, released on 5 November 2025, said "a separate law to regulate AI is not needed given the current assessment of risks." On 23 October 2026, IT Minister Ashwini Vaishnaw said the opposite: "the risks of AI have crossed a threshold where we should come up with a law and new regulations," People Matters reported, quoting PTI.

So India AI regulation is about to change. Here is what already applies to anyone posting, building or using AI in India, what changed in October, and what the coming consultation paper is expected to cover. We read the gazetted rules, PIB releases and the ministry's drafts on 2 November 2026, and we'll update this page when the paper is published.

Does India have an AI law?

Not a dedicated one. The 2025 guidelines are voluntary: they set out seven principles, from trust and putting people first to safety and resilience, and recommend voluntary measures rather than new legal duties.

What India does have is existing law applied to AI. The guidelines point to the Information Technology Act and the Bharatiya Nyaya Sanhita for deepfakes that impersonate people, and to the Digital Personal Data Protection Act for training AI on personal data without consent. The biggest piece is the February 2026 amendment to the IT Rules, which deals directly with AI-made content.

What the IT Rules say about AI content

The amendment, notified as G.S.R. 120(E) on 10 February 2026 and in force from 20 February, adds a definition of "synthetically generated information": audio, visual or audio-visual content created or altered by a computer that "appears to be real, authentic or true" and could pass for a real person or event. Two limits matter. Text isn't covered, and routine editing such as colour correction, noise reduction, transcription or compression is excluded, as are good-faith documents, presentations and educational material.

Platforms that offer tools to create such content must:

• Block four kinds of unlawful AI content: child sexual abuse material and non-consensual intimate images, false documents or electronic records, content about explosives and arms, and content that falsely depicts a real person or event in a way likely to deceive.
• Label everything else prominently, and for audio, through "a prominently prefixed audio disclosure".
• Embed permanent metadata or another provenance marker, where technically feasible, identifying the tool that made it, and not let anyone remove the label or metadata.

Large platforms, which the government defines as those with 50 lakh or more registered users in India, carry one more duty that reaches you directly. Before AI content goes live, they must ask users to declare whether it's synthetic, check that declaration, and label it. YouTube, for its part, already requires creators to disclose realistic AI-made content. Our Diwali AI photo guide shows what the rules mean for festival images.

How fast must platforms remove content?

The same amendment cut takedown deadlines sharply. From the rules and a PIB answer in the Lok Sabha on 6 August 2026:

Request	Deadline now	Before February 2026
Court order or government notice	3 hours	36 hours
Complaint about nudity, sexual content or impersonation, including morphed images	2 hours	24 hours
Complaint asking for removal	36 hours	72 hours
Other grievances	7 days	15 days

What changed in India AI regulation in October 2026

Two things, neither of them a new law.

On 8 October, MeitY's Cyber Laws Division sent an advisory to all social media platforms asking them to "identify and appropriately label/contextualise manipulated, synthetically generated or misleading content", especially around current events, and to give priority to complaints from government agencies, MediaNama reported from a copy it saw. An advisory isn't a gazetted rule, but this one isn't limited to audio and video, so in practice it reaches misleading text too.

On 31 October, MeitY launched a handbook on the Data Empowerment and Protection Architecture for AI training, a framework that lets institutions such as banks allow AI developers to train models on their data without handing it over. As the government's Principal Scientific Adviser Ajay Sood put it, "the model travels to the data, rather than the data travelling to the model." It is aimed at institutions, not at ordinary users.

One draft is still pending. In March and April 2026, MeitY proposed a second amendment requiring AI labels to stay visible for the whole length of a video; comments closed on 7 May, and we found no sign it has been notified.

What the coming AI law is expected to cover

On 8 October, Vaishnaw said the ministry would issue a consultation paper within a month, focused on safety and deepfakes, and that "the industry has to take the primary responsibility," ThePrint reported, citing PTI. The government broadcaster News On AIR said the paper would cover AI safety, cybersecurity, benefits and potential harms. On 23 October he said it was being drafted, would come within weeks, and would gather inputs from citizens and industry.

A consultation paper is the start of the process, not the law itself. It will ask for public comments; any bill would follow later and would need Parliament. When it is published, the details to look for are who carries the duty (tool makers, platforms or users), whether it treats high-risk uses differently, and what it means for startups building on foreign models.

Your data and AI apps: the DPDP Act

India's data protection law is the other half of AI regulation for ordinary users. The government notified the DPDP Rules on 14 November 2025 with an 18-month phased compliance timeline, so most duties on apps and companies apply from 2027. Once they do, companies must give "standalone, clear and simple consent notices", answer your data requests within 90 days, and get verifiable parental consent before processing children's data. PIB's explainer says breaches of obligations relating to children can attract penalties of up to ₹200 crore.

For AI, that means an app that trains on your chats or photos will need a clear basis for using that personal data, which is why privacy policies and opt-outs are worth reading now. Our Sarvam AI app guide shows how one Indian app's own pages can disagree on training.

Deepfakes: which laws apply and how to report one

The government told the Lok Sabha that deepfakes can be prosecuted under the IT Act's sections on identity theft (66C), impersonation (66D), privacy violations (66E) and obscene or sexually explicit content (67, 67A), and under the Bharatiya Nyaya Sanhita's sections on cheating by personation (319), forgery including false electronic records (336) and public mischief (353), with organised cases under section 111.

If a deepfake targets you:

1. Report it to the platform's grievance officer. For intimate images or impersonation, the platform now has 2 hours to act.
2. File a complaint at cybercrime.gov.in or call the national helpline 1930. The government says deepfakes, financial fraud and content misuse are all reportable there.
3. Appeal to the Grievance Appellate Committee at gac.gov.in if the platform doesn't resolve it.

For the security side, our report on the CERT-In advisory on AI agents covers how attackers used AI agents against Indian firms.

What India AI regulation means if you post or build with AI

• Creators: when a platform asks whether your image, video or voice is AI-made, answer truthfully; on large platforms that declaration is now a legal requirement for the platform to collect. Don't crop out or strip AI labels and watermarks. Our free AI video generator guide explains why Google adds a visible mark in India.
• Small businesses: using ChatGPT or Gemini to write posts isn't regulated content in itself, since text sits outside the February definition, but realistic AI images of real people or events are. If you feed customer data into AI tools, plan for the DPDP duties that start in 2027.
• Everyone: treat a shocking video of a real person with suspicion, and report deepfakes on 1930 rather than forwarding them.

FAQ

Does India have a law on AI?

Not a dedicated one yet. AI is regulated through existing laws, chiefly the IT Act and IT Rules, the Bharatiya Nyaya Sanhita and the DPDP Act. IT Minister Ashwini Vaishnaw said in October 2026 that a consultation paper on an AI law would come in the coming weeks.

Is it illegal to post AI-generated images in India?

No. Posting AI images is legal, but platforms must label realistic AI images, audio and video, and large platforms must ask you to declare them. AI content that impersonates a real person to deceive, or that is sexually explicit without consent, is unlawful.

Do I have to label AI content on Instagram or YouTube in India?

Under the IT Rules in force since 20 February 2026, large platforms must ask users to declare synthetic content and must label it. If a platform asks, answer truthfully; the label itself is applied by the platform.

How do I report a deepfake in India?

Report it to the platform's grievance officer, which must act within 2 hours for intimate images or impersonation, then file a complaint at cybercrime.gov.in or call 1930. If the platform doesn't resolve it, appeal to the Grievance Appellate Committee at gac.gov.in.

When will India's AI law come?

There is no date. The first step, a consultation paper, was promised within a month on 8 October 2026 and within weeks on 23 October. A law would follow public comments and would need Parliament's approval.

Cover image: Parliament House, New Delhi. A.Savin, Free Art License, via Wikimedia Commons.