India AI Governance Guidelines
India · Guideline · Ministry of Electronics and Information Technology (MeitY), Government of India
Our summary
A comprehensive framework to balance AI innovation with risk mitigation in India. It establishes seven guiding principles, recommendations across six pillars including infrastructure, capacity building, policy and regulation, and creates institutional mechanisms through the AI Governance Group and AI Safety Institute. The guidelines apply across sectors and prioritize inclusive development while addressing potential harms from algorithmic bias, misinformation and security risks.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
4 sections
Jump to a chapter
Part 3 Action Plan
India's action plan to implement AI governance establishes specific short-term priorities including creating the AI Governance Group and Technology & Policy Expert Committee, developing risk frameworks and incident databases, and launching public awareness programs, followed by medium-term actions such as publishing standards, operationalizing a national incidents database, amending laws, piloting regulatory sandboxes, and integrating Digital Public Infrastructure with AI. Implementation is structured across government agencies, with the AI Governance Group coordinating overall policy formulation, the Ministry of Electronics and Information Technology serving as nodal ministry, sectoral regulators including the Reserve Bank of India and Securities and Exchange Board of India issuing domain-specific rules, advisory bodies providing strategic guidance, standards bodies developing certification standards and engaging globally, and CERT-In monitoring AI-driven disinformation and cybersecurity.
Part 4 Practical Guidelines for Industry
Industry actors in India must comply with applicable Indian laws and are encouraged to adopt voluntary measures on privacy, fairness, transparency, grievance redressal, and risk disclosure; regulators should balance innovation support with risk mitigation using flexible frameworks prioritizing present harms and least-burdensome instruments. India's governance framework draws on approaches used in other jurisdictions (mandatory guardrails in high-risk settings, statutory risk-based frameworks, voluntary guidelines with sectoral implementation, or principles-based approaches) and leverages existing Indian statutes covering impersonation, deepfakes, data protection, consumer protection, and cybersecurity, along with AI-specific frameworks from sectoral regulators including the RBI, SEBI, IRDAI, TEC, ICMR, CERT-In, NCIIPC, and BIS. Voluntary frameworks include responsible AI principles, collective industry commitments, technical standards, and third-party audits with public disclosure or regulator certification.
Part 2 Methodology for the use of formal methods
Lists ISO/IEC standards adopted or under development by the Bureau of Indian Standards covering AI systems, including standards on big data, AI concepts and terminology, machine learning frameworks, risk management, trustworthiness, neural network robustness, use cases, ethical concerns, quality evaluation, AI governance, management systems, software engineering, life cycle processes, data quality and frameworks, with additional standards on reliability assessment, de-identification, verification and validation, benchmarking, and generative AI output data quality under development.
Part 1 Overview, terminology, and examples
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.