India does not have a single codified statute regulating AI. Central laws frequently referred to or applied in the context of AI are discussed below.

1. Information Technology Act, 2000 (IT Act), and Rules:

• • The IT Act, which pre-dates mainstream AI by several years, is India’s information technology law statute. It focuses on internet-based principles (such as electronic contracts, signatures and records), offences (such as unauthorised access, identity theft, cheating by impersonation and publication of obscene/sexually explicit material), intermediary liability and safe harbour, among others.
  • The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules): These rules impose due-diligence obligations on intermediaries. Among other obligations, intermediaries are required to publish their rules, privacy policies and user agreements on their websites/apps and take reasonable steps to prevent users from engaging in unlawful activities, such as hosting, displaying, uploading or sharing obscene content, impersonating others, etc. Intermediaries are also obligated to take down unlawful content in a time-bound manner.
  • The IT Rules were amended in February 2026 to define ‘synthetically generated information’ (SGI) (which covers AI-generated works within its ambit). The amended rules imposed additional due diligence obligations on intermediaries, specifically in connection with SGI. They require intermediaries to deploy technical measures and tools such that users cannot create, publish or transmit SGI in violation of any law. The amended IT Rules also impose mandatory labelling and identification requirements (use of metadata, unique identifiers) to identify the source of SGI content created. Significant Social Media Intermediaries (i.e. those with over five million registered users) have to ensure that users declare SGI content, such content is appropriately labelled, and appropriate measures are used to verify such declarations. This obligation needs to be discharged before the content goes live on the platform.
  • The framework under the IT Act and IT Rules have been collectively used to tackle online harms, including those stemming from use of AI. The Ministry of Electronics and Information Technology (MeitY), India’s central authority for information technology, also issued advisories in December 2023 and March 2024, directing intermediaries to abide by the IT Act and the IT Rules, highlighting that its principles apply to issues such as online misinformation and AI-generated deepfakes. The March 2024 advisory urged platforms to ensure that their computer resources, including those using AI models, do not allow bias or discrimination. It also detailed requirements for labelling and metadata on AI-generated content. Additionally, it recommended that untested or unavailable AI models are appropriately labelled before being made available to users.

2. Digital Personal Data Protection Act, 2023 (DPDPA): India’s privacy law, which is set to come into effect by May 2027, aims to protect the processing of personal data of individuals by giving them broad rights, including the right to consent to the processing of their data, and the ability to modify or withdraw any such consent. Once fully operational, the law will have implications for AI models, which often rely on large datasets for training and may scrape, collect or process personal data without obtaining the requisite consents, giving rise to potential privacy violations.
3. (Proposed) Digital India Act (DIA): MeitY proposed the DIA as a successor to the IT Act, aimed at covering emerging technologies, online safety, cybersecurity and digital user rights. Early consultations in 2023 suggested it would place specific obligations on social media platforms, e-commerce entities and AI systems, with a particular focus on ‘high-risk’ AI. The DIA has not progressed since then, with limited information of its drafting progress or enactment in the public domain to date.

In addition to these central laws, sectoral regulators have issued sector-specific guidelines, advisories and voluntary frameworks to address AI in their respective domains. Some of these are discussed in the Regulatory guidance/voluntary codes section.