AI, data and emerging technology

There is no AI statute in India today. A business that builds or buys artificial intelligence is governed by laws written for other purposes: the Information Technology Act, 2000 and the rules under it, the Digital Personal Data Protection Act, 2023, the law of contract, intellectual property law and the directions of sector regulators. The legal position is therefore a matter of how those laws apply to a particular system, and of the dates on which some of them begin.

The one binding AI-specific obligation

The only binding obligation directed at AI today is the synthetic media regime inserted into the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 by G.S.R. 120(E) of 10 February 2026. It binds intermediaries. It does not bind every business that uses a model, and whether a given business is an intermediary for this purpose is itself a question of fact. For a person or company that has been impersonated by synthetic media, the same rules and the remedies before the High Courts are the relevant framework. The related practice area on technology, data and product deals with intermediary obligations more generally, and white-collar and cyber defence with the criminal law, including offences under the Bharatiya Nyaya Sanhita, 2023, that may arise from impersonation and fraud.

Data, and a dated clock

The substantive provisions of the Digital Personal Data Protection Act, 2023 are not in force. G.S.R. 843(E) of 13 November 2025 brings sections 3 to 17 and the Schedule of penalties into force on 13 May 2027, and rule 4, on consent managers, from 13 November 2026. Until then, section 43A of the Information Technology Act, 2000 and the rules made under it in 2011 are the operative data security regime. For AI, the practical consequence is a dated clock rather than a present duty: personal data gathered or used to train or operate a model today will be subject to the Act's consent, notice and purpose provisions from the commencement date.

Contracts and diligence

Agreements for AI systems raise questions that standard technology terms do not always settle: who warrants what about training data, how an indemnity is framed where output may infringe a third party's rights, what the supplier may do with the customer's data, and what a purchaser or investor should ask in diligence about the provenance of a model. These are questions of drafting under the Indian Contract Act, 1872, and the related practice area on IP and licensing covers the licensing side.

Intellectual property

The Copyright Act, 1957 and the Patents Act, 1970 were not drafted with models or generated output in mind, and the questions of authorship, ownership and patentability are open. Trade secret protection, which in India rests largely on contract and equity, is often the instrument on which the value of a model actually depends.

Sector regulators

This page does not cite a particular direction from a financial services or health regulator. Each such instrument is read against the entity it binds, so a direction addressed to one class of regulated entity says little about another. Where one applies, it applies to a regulated entity regardless of the absence of a general AI law, and it is read alongside the statutes above.

What binds an Indian business using AI today?

Three things, in outline: the data security regime under section 43A of the Information Technology Act, 2000, the law of contract and intellectual property, and, where the business is a regulated entity or an intermediary, the directions or rules that apply to it. The remainder of the framework is a calendar, not a present obligation.