India Chose Not to Regulate AI. Here's What That Means for You.
India Chose Not to Regulate AI. Here’s What That Means for You.
By Akshay A. Walimbe
In February 2025, the European Union started enforcing its AI Act. Companies deploying AI in the EU now face mandatory risk assessments, transparency requirements, and fines of up to 35 million euros or 7% of global turnover for violations. Social scoring by AI? Banned. Emotion recognition in workplaces and schools? Banned. Real time biometric surveillance in public spaces? Banned, with narrow exceptions.
Nine months later, in November 2025, India released its AI Governance Guidelines.
They’re voluntary.
Let that sit for a moment. The world’s most populous country, home to over 800 million internet users, ranked third on Stanford’s 2025 Global AI Vibrancy Index (up from seventh the year before), with over $200 billion in AI investment commitments announced at the India AI Impact Summit in February 2026 chose to respond to the rise of AI with guidelines that nobody is required to follow.
This is not an accident. It’s a deliberate strategy. India is betting that innovation first, regulation later will position it as a global AI leader. Whether that bet pays off or leaves citizens exposed depends entirely on what happens next.
The Seven Sutras
India’s AI Governance Guidelines, released by MeitY on November 5, 2025 after receiving over 2,500 public submissions, are built around seven principles the government calls them “sutras”:
Trust. Embed transparency and governance at the foundation.
People First. Prioritise consumer safeguarding and human well being.
Innovation over Restraint. Support secure experimentation. Don’t stifle innovation.
Fairness and Equity. Ensure unbiased outcomes across demographics.
Accountability. Maintain clear responsibility for AI decisions and outcomes.
Understandable by Design. Design interpretable, explainable systems.
Safety, Resilience, and Sustainability. Ensure continuous monitoring, robustness, and environmental consciousness.
Read those carefully. Hard to disagree with any of them, right? Trust, fairness, accountability, safety these are motherhood and apple pie principles. Nobody stands up in a meeting and says, “I’m against accountability.”
The problem isn’t the principles. The problem is the enforcement mechanism.
There isn’t one.
What “Voluntary” Actually Means
India’s IT Secretary, S. Krishnan, put the philosophy plainly, as quoted in an EY analysis: “India has consciously chosen not to lead with regulation but to encourage innovation while studying global approaches.”
The Economic Survey 2025-26 was even more explicit: “Coordination first, capacity building next, and binding regulation last.”
Regulation last. Not regulation alongside. Not regulation concurrent. Last.
Here’s what that means in practice. If an AI system denies you a loan unfairly, there is no AI specific body you can complain to. If an algorithm excludes you from a government welfare programme as happened to nearly two million families in Telangana there is no AI accountability mechanism to challenge it. If a company deploys a biased hiring algorithm that systematically rejects candidates based on proxies for caste or gender, the AI Governance Guidelines suggest they shouldn’t do that. They don’t require them not to.
The guidelines propose three new institutions: an AI Governance Group (AIGG) chaired by the Principal Scientific Adviser, a Technology and Policy Expert Committee (TPEC), and an AI Safety Institute (AISI). These are promising in design. As of early 2026, they are in various stages of establishment but none appear to be operational in any binding enforcement capacity yet. The guidelines describe their setup as a “short term priority,” so this may change in the coming months.
India also has the AI (Ethics and Accountability) Bill, introduced in the Lok Sabha on December 17, 2025 by BJP MP Bharti Pardhi. It proposes an Ethics Committee, mandatory transparency requirements, and penalties of up to five crore rupees. There’s just one catch: it’s a Private Member’s Bill. According to PRS India’s parliamentary data, since independence in 1947, only 14 Private Member’s Bills have become law. The last one was in 1970.
The probability of this bill becoming law in its current form is, statistically speaking, close to zero.
The EU Said “Rules First.” India Said “Innovation First.”
To understand India’s choice, you need to understand what it’s reacting against.
The EU AI Act is the world’s most comprehensive AI regulation. It classifies AI systems into four risk categories: unacceptable (banned), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated). It bans specific practices outright. It mandates conformity assessments before high risk AI systems can be deployed. It created a new EU AI Office to oversee enforcement.
The EU’s logic is: set the rules before the harms occur. Prevent damage rather than punish it after the fact.
India’s logic is the opposite: let the ecosystem grow, study what happens, and regulate only when necessary.
Both approaches carry risks. The EU risks stifling innovation companies might build AI products elsewhere to avoid regulatory burden. India risks the opposite harm occurs, compounds, and becomes structural before any rules catch up.
And India is not alone in this approach. The United States under the current administration has also pulled back from AI regulation. Executive Order 14179, signed in January 2025, was titled “Removing Barriers to American Leadership in AI.” It explicitly revoked the previous administration’s AI safety executive order and directed agencies to prioritise competitiveness over caution. A subsequent executive order in December 2025 went further, seeking to restrict states from independently regulating AI in “onerous and excessive” ways.
China, interestingly, took a third path. It has binding, targeted regulations for specific AI categories deepfake rules since January 2023, generative AI rules since August 2023, mandatory AI labeling since September 2025 but no single comprehensive framework. And it enforces them aggressively: a three month “Clear and Bright” campaign in 2025 took down 3,500 AI products and removed 960,000 pieces of illegal content.
India sits somewhere between the American “let it rip” and the European “regulate everything.” Given India’s strategic positioning it hosted the AI Impact Summit, led GPAI as chair, and secured 92 countries’ endorsement of its AI governance declaration the question is whether this middle path becomes a genuine model for the Global South, or remains a euphemism for “we haven’t decided yet.”
The SEBI Exception
Here’s what’s interesting: India already has proven it can regulate AI when it wants to.
SEBI the Securities and Exchange Board of India issued a circular on February 4, 2025 on algorithmic trading that is genuinely muscular. Every algorithmic order must carry an exchange assigned Algo ID traceable to its source. Algorithms are classified as “white box” (transparent logic) or “black box” (opaque, proprietary). Black box algorithm providers must register as research analysts. Open APIs are banned. Third party servers are prohibited unless integrated with the broker’s own system.
This is binding. Mandatory. Fully enforceable for all stock brokers from April 1, 2026. Non compliance has real consequences.
Why did SEBI regulate when MeitY didn’t? Because the harm was financial, visible, and measurable. According to NSE data, algorithmic trading already accounts for roughly 73% of stock futures volume. Flash crashes and market manipulation have documented histories. When money is at stake particularly the kind of money that flows through capital markets regulators move quickly.
But when the harm is denial of welfare benefits, or biased hiring, or privacy violations, or discriminatory credit scoring harms that fall on individuals rather than markets the regulatory response is voluntary guidelines and private member’s bills.
SEBI is the exception that proves the rule. India can do binding AI regulation. It chooses not to, except where financial stability is threatened.
What India Actually Regulates (And What It Doesn’t)
Let me give you the honest picture. Here’s what’s binding and what’s not, as of early 2026:
Banking and Finance (RBI): The FREE AI framework, released August 13 2025 7 sutras, 26 recommendations. Advisory only. Not binding. The RBI’s own survey of 612 regulated entities found that among those using AI, only 10% have bias mitigation protocols. Only 18% maintain audit logs. Only 15% use interpretation tools.
Capital Markets (SEBI): Algo trading circular. Binding. Mandatory from April 2026. The only sector with enforceable AI specific rules.
Insurance (IRDAI): Cyber security guidelines and regulatory sandbox. Partially binding for audit trails. No AI specific regulation.
Healthcare (ICMR): Ethical guidelines for AI in biomedical research. Advisory only. India has no specific legal regulation for AI in healthcare.
Cross sector (MeitY): AI Governance Guidelines. Voluntary. Data Protection Board established under DPDPA but full enforcement doesn’t begin until May 2027.
Deepfakes: IT Rules amended on February 10, 2026 to define “Synthetically Generated Information” and mandate platform takedowns non consensual intimate AI imagery within 2 hours, other unlawful AI content within 3 hours. This is binding but only on platforms, and only for content removal. It doesn’t address the creation or distribution of deepfakes at source.
That’s it. One binding sector specific regulation (SEBI), one binding platform obligation (deepfake takedowns), and everything else is advisory, voluntary, or not yet enforced.
The Gap That Should Worry You
India’s DPDPA the Digital Personal Data Protection Act is the closest thing the country has to a horizontal data and AI governance law. It was enacted in 2023. The rules were notified in November 2025. Full enforcement doesn’t begin until May 2027.
That’s a four year gap between enactment and full enforcement. Four years during which AI deployment in India has accelerated exponentially. According to the EY CII Report of November 2025, 47% of Indian enterprises now have live generative AI deployments. Twenty four percent of enterprise leaders are already deploying agentic AI. The AI agents market in India is projected to grow from $0.28 billion in 2024 to $3.55 billion by 2030, according to industry research.
The money is flowing in far faster than the guardrails are being built. India announced $200 billion in AI investment commitments at the AI Impact Summit in February 2026 including $110 billion from Reliance and $100 billion from Adani. That same month, the total number of AI specific enforcement actions taken by any Indian regulator was zero.
Two hundred billion dollars of investment commitments. Zero enforcement actions. That ratio tells you something important about the current state of AI governance in India though defenders of the approach would argue that premature regulation could have prevented those investments from materialising in the first place.
The Self Regulation Question
India’s guidelines operate on a fundamental assumption: that companies will self regulate. That the combination of market incentives, reputational risk, and voluntary principles will produce responsible AI deployment without the need for enforceable rules.
History suggests otherwise.
As a TechPolicy.Press analysis pointed out, India’s track record with self regulation includes the Medical Council of India corruption scandal, the Satyam accounting fraud, and the Nirav Modi PNB heist episodes that, in their view, “highlight the inherent limits of industry led oversight.” Others would counter that India has also built effective regulatory institutions in sectors like telecom and securities when the need became clear, and that the current approach is a phased strategy, not a permanent absence of rules. Self regulation works when the incentives to comply are stronger than the incentives to cut corners. In a market racing to deploy AI at scale, where first mover advantage is measured in months and investor pressure is measured in quarters, the incentives all point in one direction: move fast, worry later.
The AI Governance Guidelines themselves acknowledge this tension. The documents include a notable statement: “There is an urgent need for a comprehensive review of relevant laws to identify regulatory gaps relating to AI systems.”
That acknowledgment is significant. It suggests the government sees the voluntary phase as transitional, not permanent. The question is how long the transition takes.
What This Means for You
If you’re a business leader deploying AI in India, you’re operating in a regulatory vacuum that won’t last forever. The direction is clear governance frameworks are being built, institutions are being proposed, and the DPDPA will eventually be enforced. Companies that build compliance infrastructure now will be ahead when the rules tighten. Companies that treat “voluntary” as “optional” are building technical and legal debt that will come due.
If you’re a product manager building AI powered features, you’re currently making ethical decisions that no regulation requires you to make. The absence of enforceable rules doesn’t mean the absence of harm. Your AI systems are making decisions that affect people’s lives, and the accountability framework hasn’t caught up.
If you’re a consumer, a job seeker, a loan applicant, a welfare beneficiary you are currently less protected from AI driven harm than your counterparts in the EU. The tools to challenge unfair algorithmic decisions, to demand explanations for automated rejections, to hold deployers accountable for biased outcomes those tools are on a roadmap, not in your hands.
If you’re a policymaker, the window is narrowing. India positioned itself as the Global South’s voice on AI governance hosting the AI Impact Summit where 92 countries endorsed its declaration and 13 frontier model developers signed the New Delhi Frontier AI Commitments. That is genuine leadership. The world is now watching whether India can back those commitments with action, or whether the sutras remain sutras wisdom without enforcement.
The rules are being written right now. Are you at the table?
I’m have written a book about exactly this how AI and automated systems make decisions about your life, where accountability disappears, and what we can do about it. If you want to know morea about this book or order a copy, you can do it here: https://akshaywalimbe.com/beyond-bias/