India has no AI Act. That does not make AI an unregulated space. The obligations that govern how organisations build, buy and use AI are spread across data protection, cybersecurity, intellectual property, intermediary regulation, sectoral rules and, for many Global Capability Centres (GCCs), foreign law. The principal data protection obligations take effect on 13 May 2027, and the work required to meet them cannot begin in April 2027.

This article sets out what the law requires, where the exposure sits, and what a General Counsel, CISO or GCC leader should have in place before May 2027.

How India governs AI

On 5 November 2025, the Ministry of Electronics and Information Technology (MeitY) released the India AI Governance Guidelines. They are guidelines, not legislation. They favour innovation, rely on existing law and industry self-regulation, and propose an institutional framework led by an AI Governance Group rather than a new regulatory code.

No single statute therefore defines "AI compliance". Each AI system must be tested against several regimes at once: the Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules, the Information Technology Act, 2000 and its rules, the CERT-In Directions, the Copyright Act, 1957, and any sectoral regulator with jurisdiction. Distributed responsibility tends to go unowned, and that is the first governance gap to close.

The DPDP Act: the binding rulebook for AI that uses personal data

Commencement is phased

The DPDP Rules, 2025 were notified on 13 November 2025. Commencement is staged:

13 November 2025: the provisions establishing the Data Protection Board and its procedures came into force.
13 November 2026: Rule 4 and the provisions on Consent Managers commence.
13 May 2027: the operative obligations commence, including Sections 3 to 17 of the Act, Rules 3, 5 to 16, 22 and 23, and the penalty provisions in Sections 33 and 34. On the same date, Section 43A of the IT Act, the current basis for compensation claims over negligent handling of sensitive personal data, is omitted.

MeitY was reported in January 2026 to be considering a shorter period. No amendment to the commencement dates has been notified as at the date of this article, so 13 May 2027 remains the operative date.

Fiduciary or processor: the first question for every AI system

The Act places its obligations on the Data Fiduciary, the person who determines the purpose and means of processing. A Data Processor processes on a fiduciary's behalf. Under Section 8(1), the fiduciary remains responsible for compliance, including processing carried out by its processors, irrespective of any agreement to the contrary.

For an enterprise deploying a third-party AI tool, the vendor will usually be a processor and the enterprise the fiduciary. For a GCC, the analysis is often harder: the GCC may be a processor for its overseas parent for some systems and a fiduciary in its own right for others, such as employee data. That allocation determines who carries the obligations and what the intercompany agreements must say.

Lawful basis: narrower than many multinationals assume

The Act recognises two grounds for processing: consent under Section 6, and the "certain legitimate uses" in Section 7. Consent must be free, specific, informed, unconditional and unambiguous, given for a specified purpose and limited to the personal data necessary for it.

Section 7 is a closed list. It covers, among other things, data voluntarily provided for a specified purpose where the individual has not objected, legal obligations, court orders, medical emergencies and employment. It contains no general "legitimate interests" ground of the kind found in the GDPR. An organisation that assumes it can train or fine-tune models on customer data because the use serves a reasonable business interest will find no such basis in Indian law.

The analysis must therefore run by processing operation and purpose, not by technology:

Inference within the service the customer signed up for may fall within the original consent or within Section 7(a).
Training or fine-tuning a model on that data for a new purpose will usually require fresh consent.
Processing employee data through AI tools may rest on the employment ground in Section 7(i), but only to the extent the purpose genuinely relates to employment.
Research and statistical processing is exempt under Section 17(2)(b) and Rule 16 only where it follows the standards in the Second Schedule and the data is not used to take decisions specific to an individual.

Two further features of the Act affect AI design directly. Section 8(3) requires a fiduciary to ensure the completeness, accuracy and consistency of personal data likely to be used to make a decision that affects the individual. And Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer served. The Act does not say how erasure applies to data already absorbed into a trained model. That question needs to be answered in the system's design and documentation, not after a withdrawal request arrives.

Unlike the GDPR, the Act confers no specific right not to be subject to automated decision-making. Multinational parents that build their AI governance on that right should not assume an Indian equivalent.

Penalties

The Schedule sets maximum penalties by type of contravention. A penalty "may extend to" the stated amount. The Data Protection Board imposes one only where, after inquiry, it finds a significant breach, and it must have regard to factors including the gravity and duration of the breach and any mitigation:

failure to take reasonable security safeguards: up to ₹250 crore;
failure to notify a personal data breach: up to ₹200 crore;
breach of obligations concerning children: up to ₹200 crore;
breach of the additional obligations of a Significant Data Fiduciary: up to ₹150 crore;
any other breach of the Act or Rules: up to ₹50 crore.

Significant Data Fiduciaries: where AI-specific duties already exist

The Central Government may notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary (SDF), having regard to factors including the volume and sensitivity of personal data processed and the risk to individuals' rights. Large enterprises and GCCs processing data at scale should assess the likelihood of designation now.

An SDF must appoint a Data Protection Officer based in India, appoint an independent data auditor, and conduct periodic Data Protection Impact Assessments and data audits. The DPDP (Removal of Difficulties) Order, 2026, published in October 2026, clarified that the audit obligation in Section 10 is a "data audit". Rule 13 then adds three requirements of direct relevance to AI:

a DPIA and audit once in every twelve months, with significant observations reported to the Board;
due diligence to verify that technical measures, including algorithmic software, used to process personal data are not likely to pose a risk to individuals' rights;
measures to ensure that personal data specified by the Central Government, on a committee's recommendation, is not transferred outside India.

The algorithmic software duty is the closest Indian law currently comes to a statutory AI risk assessment. For an SDF, an undocumented model is a compliance gap.

Cross-border transfers

Section 16 permits transfer of personal data outside India except to countries the Central Government restricts by notification, and it preserves any Indian law that imposes a higher degree of protection, including sectoral localisation requirements. Rule 15 adds that transfers remain subject to requirements the Government may specify for making data available to a foreign state or its agencies. For an SDF, Rule 13(4) can localise specified data altogether. A GCC sending Indian personal data to models hosted by its parent abroad must assess each of these layers, not only the general permission.

Training data, scraping and copyright

The Act does not apply to personal data made publicly available by the individual to whom it relates, or by a person under a legal obligation to publish it. The statutory illustration is an individual who shares her personal data publicly while blogging. The exclusion turns on who made the data public. Data republished by a third party, scraped datasets of mixed provenance and purchased datasets fall outside it and need their own lawful basis.

Data protection clearance is not copyright clearance. On 24 July 2026, in ANI Media v OpenAI, a single judge of the Delhi High Court refused an interim injunction, holding on a prima facie basis that storing the plaintiff's works to train a model could qualify as fair dealing under Section 52(1)(a) of the Copyright Act. The court also held that training on servers outside India did not place the activity beyond the Act. The order is interim, the suit is pending, and claims based on reproduction in outputs remain open for trial. Separately, a DPIIT committee working paper of 8 December 2025 proposed a mandatory blanket licence for AI training with royalties payable by developers. That proposal is at consultation stage and is not law.

For enterprises, the more immediate risks sit in contracts: confidential and client information entered into third-party AI tools, ownership of prompts, fine-tuning datasets and outputs, and whether the vendor indemnifies against infringement claims.

AI systems inside the cybersecurity perimeter

Three distinct record-keeping obligations apply, and they should not be merged:

DPDP Rule 6(1)(e): a Data Fiduciary must retain logs and personal data, maintained for detecting and investigating unauthorised access, for a period of one year, unless another law requires otherwise. This applies from 13 May 2027.
DPDP Rule 8(3): personal data, associated traffic data and processing logs must be retained for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule.
CERT-In Directions of 28 April 2022: covered entities, including body corporates, intermediaries, data centres and service providers, must maintain logs of their ICT systems securely within Indian jurisdiction for a rolling period of 180 days, and must report specified cyber incidents to CERT-In within six hours of noticing them.

Breach reporting under the DPDP Rules runs in parallel: the affected individuals and the Board must be informed without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows longer. An incident in an AI pipeline that exposes personal data can trigger both regimes, on different clocks, to different authorities.

AI creates a specific tension here. Prompt and output logs often contain personal data. They must be kept long enough to satisfy security and CERT-In requirements, yet personal data must be erased when its purpose ends. Retention schedules need to address AI logs expressly.

Generative AI and the IT Rules, 2026

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E)) were notified on 10 February 2026 and came into force on 20 February 2026. They regulate "synthetically generated information": audio, visual or audio-visual content artificially or algorithmically created, generated, modified or altered so that it appears real, authentic or true and depicts an individual or event in a manner likely to be perceived as indistinguishable from a natural person or real-world event. Routine or good-faith editing, the routine creation of documents, presentations and training materials, and accessibility uses are excluded.

The obligations fall on intermediaries. An intermediary whose computer resource enables the creation, modification or dissemination of such content must deploy technical measures to stop unlawful synthetic content, and must prominently label all other synthetic content, with embedded metadata or provenance identifiers to the extent technically feasible. Significant social media intermediaries must also obtain user declarations and verify them. Takedown timelines were shortened, and failure to observe due diligence can cost an intermediary its safe harbour under Section 79 of the IT Act.

These Rules do not impose a general labelling duty on every AI output. An internal chatbot or an AI-drafted report is not within them. An enterprise that offers customers a public-facing tool capable of generating realistic images, audio or video should assess whether it is acting as an intermediary.

Sectoral expectations

The Reserve Bank of India published the report of its FREE-AI Committee on 13 August 2025. It sets out seven principles and 26 recommendations, including a board-approved AI policy, an AI inventory, risk-based audits and AI incident reporting. The report is a committee report, not an RBI direction, and its recommendations are not binding instructions. RBI's existing binding directions on IT governance, outsourcing and cyber security continue to apply to AI-driven activity. Outside financial services, the report is a useful benchmark for what a governed AI estate looks like.

The GCC challenge: two legal systems, one AI estate

Many GCCs treat foreign AI law as a group-policy matter. It may be a direct legal one.

The EU AI Act applies to providers placing AI systems or general-purpose AI models on the EU market irrespective of where they are established, and to providers and deployers established outside the EU where the output of the AI system is used in the EU. An Indian GCC that develops a system used by its parent's EU operations may therefore fall within the Act directly, depending on whether it is the provider, the deployer, or neither. The Act's original prohibitions have applied since 2 February 2025 and its general-purpose AI model obligations since 2 August 2025. Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, deferred the obligations for high-risk systems listed in Annex III to 2 December 2027.

For each significant system, a GCC must settle its role under the EU AI Act and under the DPDP Act, where data and outputs flow, and how liability is allocated with its parent. Those answers belong in the intercompany agreements, not only in group policy.

Developer, deployer and accountability

An enterprise that builds or fine-tunes its own model carries obligations across the lifecycle: lawful basis for training data, copyright exposure, accuracy, pipeline security and documentation. An enterprise that deploys a vendor's tool carries a narrower set: lawful basis for the data it supplies, vendor due diligence, contractual protection and control of use. The most common exposure is neither. It is employees using public AI tools without approval, with client and personal data leaving the organisation without a contract, a record or a lawful basis.

Governance fails when it sits with one function. The board should approve AI policy and receive periodic reporting on AI risk. The General Counsel owns lawful basis, contracts and regulatory exposure; the CISO owns security, logging and incident response; the Data Protection Officer, where appointed, owns DPDP compliance and any DPIA; technology leadership owns the inventory and the controls that make policy enforceable.

A 90-day programme

Days 1 to 30: discover and assess

Inventory every AI system in use, including vendor tools and unapproved use.
Map the personal data each system uses, its source and its flows, including transfers outside India.
Determine the organisation's role for each system: fiduciary or processor; provider, deployer or developer.
Identify copyright and confidentiality exposure in training data and inputs.

Days 31 to 60: establish governance

Adopt an AI use policy approved by the board or leadership.
Confirm a lawful basis for each processing purpose and update notices and consent flows.
Review vendor and intercompany agreements for data use, training rights, security, audit, incident notice and indemnities.
Set human review requirements for AI outputs that affect individuals.

Days 61 to 90: operationalise

Align log retention with DPDP Rules 6 and 8 and the CERT-In Directions.
Build an incident playbook covering the six-hour CERT-In and 72-hour DPDP timelines.
Conduct risk assessments for higher-risk systems, and a DPIA where SDF designation is likely.
Report readiness to the board, with owners and dates for open items.

Conclusion

India has chosen to govern AI through the laws it already has. The burden has not disappeared; it has been distributed across data protection, cybersecurity, intellectual property, contract and sectoral regulation, and for GCCs across borders. Organisations that map their AI estate against those obligations now will meet May 2027 with evidence. Those that wait will meet it with an incident.

This article states the law as at 3 November 2026. It is for information only and is not legal advice.

Zuber Syed, Founder and Managing Partner, Zuber & Partners LLP, Hyderabad

AI Governance in India: What Enterprises and GCCs Must Have in Place Before May 2027