There is no AI statute in India, and the one AI rule that binds you today is about labels

A business buying or building AI in India is usually told it faces a new compliance regime. It does not, yet. There is no AI statute. The Digital Personal Data Protection Act, 2023 is the instrument that will govern most AI use of personal data, and its substantive provisions are not in force: the commencement notification of 13 November 2025 puts sections 3 to 17, the data principal rights and the penalty section at 13 May 2027. The Data Protection Board exists but was still advertising for a chairperson and four members in May 2026. One AI-specific obligation does bind now, and it is narrow: the synthetic media provisions inserted into the Information Technology Rules in February 2026, which bind intermediaries rather than every company that uses a model. So the honest answer for most businesses is that the obligation is a dated clock, not a present duty, and the eighteen months are for building.

Is there an AI law in India?

No. The position the Ministry of Electronics and Information Technology has taken is the opposite: the India AI Governance Guidelines, published under the Ministry's imprint, record the view that a separate law to regulate AI is not needed at this stage, describe the measures they recommend as not legally binding, and suggest instead that the Information Technology Act, 2000 be suitably amended. The Guidelines set out seven principles and six pillars and propose three institutions, an AI Governance Group, a Technology and Policy Expert Committee and an AI Safety Institute.

That document is policy. It creates no duty, no filing, no penalty and no regulator with jurisdiction over a company's model. Read it to understand where the law is going. Do not budget for it.

What actually binds today

Two things, and neither is what most AI compliance conversation is about.

The synthetic media provisions of the Information Technology Rules. A notification of 10 February 2026 inserted a definition of synthetically generated information into the 2021 Rules and attached obligations to it: information of that kind must carry a prominent and easily noticeable label, it must be embedded with permanent metadata or another provenance mechanism, and the intermediary must not enable the label to be modified, suppressed or removed. The same amendment cut the takedown windows. These duties sit on intermediaries, and on a resource that enables a user to create or alter synthetic content. They are the sharpest live AI obligations in Indian law and they do not reach a company that simply uses a model on its own data. The second note in this pair deals with who is caught.

Section 43A of the Information Technology Act and the 2011 rules made under it. The DPDP Act will omit section 43A, but that omission is itself in the 13 May 2027 tranche. Until that date the older regime is the operative data security law, which matters because a security failure in an AI pipeline today is adjudicated under it and not under the Act everyone is preparing for.

For a person regulated by the Securities and Exchange Board of India there is a third, regulation 16C, dealt with under financial services below.

What the 13 May 2027 clock actually contains

The commencement notification split the Act into three tranches. From 13 November 2025: the definitions, the provisions constituting the Data Protection Board and its powers, and the amendment to the Right to Information Act. From 13 November 2026: two provisions, one of them the consent manager registration route. From 13 May 2027: applicability, notice, consent, the legitimate uses, the duties of a data fiduciary, the additional obligations of a significant data fiduciary, every data principal right, and the Schedule of penalties.

The Rules follow the same shape on the same dates, which is deliberate. Rule 4, on consent managers, opens a year before the consent obligations it serves. A consent manager has to be a company incorporated in India with a net worth of not less than two crore rupees and an independently certified interoperable platform, so the year is the registration runway.

One caution on the dates. A government press note gives 14 November 2025 as the notification date for the Rules while the notification itself is dated 13 November. If the Rules were published on the later day, each derived date moves by one day. Nothing in a compliance plan turns on a day, but a contractual deadline drafted against the wrong date is avoidable.

Can you train a model on data you already hold?

This is the question that decides most AI projects, and the answer after 13 May 2027 is usually no, not on the old notice.

The notice rule requires an itemised description of the personal data and the specified purpose or purposes, presented so as to be understandable independently of any other information. A notice given years ago to improve our products and services does not describe model training and does not itemise anything. Consent obtained against it does not carry forward to a new purpose.

There is no commercial legitimate interests ground in the Act. The legitimate uses listed in section 7 are voluntary provision for the stated purpose, a set of State functions, legal obligations, court orders, medical emergency, public health, disaster and public order, and employment purposes. Model training is not among them. The research exemption is narrower than it looks: it is available only where the personal data is not to be used to take any decision specific to an individual, which excludes most models worth building, and it is conditioned on standards that have not been prescribed.

The practical consequence is a re-consent exercise, and the eighteen months are what it is for.

What does publicly available mean?

The Act does not apply to personal data made publicly available by the individual it relates to, or by a person under an Indian legal obligation to make it public. The illustration in the Act is a person blogging her own views.

Read the limb carefully, because it turns on who made the data public and not on whether the data is reachable. Data scraped from a third party aggregator was not made public by the individual, and the aggregator is not usually under any Indian legal obligation to publish it. A scraping pipeline justified on this limb is resting on the illustration rather than on the words.

What is the exposure, worked

The Schedule sets absolute rupee ceilings and not a percentage of turnover, which is the structural difference from the European regime and the reason the numbers look disproportionate for a mid-size company. Failure to take reasonable security safeguards carries up to INR 250 crore. Failure to notify a breach carries up to INR 200 crore. The obligations of a significant data fiduciary carry up to INR 150 crore. Anything else carries up to INR 50 crore.

Take a company on these assumptions, each of which is ours and not the Act's: an Indian private limited company with turnover of INR 400 crore, not notified a significant data fiduciary, which fine tunes a licensed model on eight lakh existing customer records after 13 May 2027; the original notice said only that data would be used to improve products and services; the training corpus sits unencrypted and is taken; the company reports to the Board eleven days after it knows, against a seventy two hour rule; and a hundred and forty erasure requests go unanswered past ninety days. On those facts the heads are a security safeguards breach, a notification breach and a residual breach covering notice, consent and rights. The ceilings add to INR 500 crore, or one and a quarter times turnover. Had the company been notified a significant data fiduciary and skipped the impact assessment, audit and algorithmic due diligence, add the INR 150 crore head.

Two honest qualifications. The company is responsible for its processor's acts, because the Act fixes responsibility on the fiduciary irrespective of any agreement to the contrary, so a vendor indemnity reallocates money and not liability. And nobody knows what the Board will actually impose, because the Board has decided nothing and has no members. The only express proportionality lever is the direction to consider the likely impact of the penalty on the person.

Where practitioners differ

Four points are genuinely open, and a plan that assumes one reading should say so.

Whether the publicly available limb travels with the data or attaches only to the act of making it public. The words support the narrower reading, the illustration is written in absolute terms, and there is no judgment either way.

Whether the residual penalty is one ceiling or one ceiling per contravened provision. The Schedule entry is singular.

Whether model weights and embeddings are themselves personal data. If they are, the erasure duty reaches the model and the argument for retraining starts. The Act and the Rules say nothing about weights, and the proposition is commentary. We read the duty as attaching to the personal data and the corpus, and we would not build a retraining obligation into a contract on the strength of the contrary view.

Whether the algorithmic due diligence owed by a significant data fiduciary is a process duty or an outcome duty. It is drafted as observing due diligence to verify that the measures are not likely to pose a risk, which is process wrapped around an outcome test. A documented assessment is the conservative answer.

What changes by sector

Financial services. The heaviest, because a second layer already binds. The Securities and Exchange Board of India has notified regulation 16C of the Intermediaries Regulations, 2008, in force from its publication in the Gazette on 10 February 2025. Under it a regulated person using AI or machine learning tools, whether built in house or procured, is solely responsible for the privacy and integrity of investor data, for the output of the tools it relies on, and for compliance. That is outcome responsibility, with no vendor defence, and it is a different standard from the reasonableness tests in the Act. Unlike the Act, it is in force today.

Healthcare and pharma. Note first that the Act creates no sensitive personal data category, so health data gets no heightened consent standard. The exposure comes from volume and from designation risk, and from the narrowness of the medical emergency and public health grounds, neither of which covers routine diagnostic model training.

Technology services. The widest split in the Act. Where an India based business processes the personal data of individuals outside India under a contract with a person outside India, most of the regime is switched off and only the responsibility and security safeguard duties remain. The same company's India facing product carries everything. Offshore delivery and domestic product are two different compliance positions in one company.

Manufacturing. The lightest, because industrial AI mostly processes machine and sensor data that is not personal data at all. Where AI touches the workforce, the employment ground is unusually broad and extends to safeguarding the employer from loss or liability. The ceilings do not change by sector; the probability of designation and the number of individuals do.

What this note does not claim

It does not state the law after 13 May 2027 as applied, because no Indian court has decided anything under the Act or the Rules and the Board has issued no order. It does not say whether any entity has been notified a significant data fiduciary; we found no such notification, which is consistent with the provision not having commenced but is not a negative confirmation. It does not reproduce the terms of the two Ministry advisories of March 2024 on AI models, which we have not read in primary form. It does not cover the Reserve Bank's committee report on AI in the financial sector, which we could not retrieve. The figures in the worked example are statutory ceilings and assumptions, not a prediction of any penalty.