National frameworks inform India’s approach to AI regulation, with sector-specific initiatives in finance and health sectors.

Laws/Regulations directly regulating AI (the “AI Regulations”)

Currently, there are no specific codified laws, statutory rules or regulations in India that directly regulate AI.
Nevertheless, various frameworks are being formulated to guide the regulation of AI, including:

• The National Strategy for Artificial Intelligence (June 2018),¹ which aims to establish a strong basis for future regulation of AI in India.

• The Principles for Responsible AI (February 2021),² which serve as India’s roadmap for the creation of an ethical, responsible AI ecosystem across sectors.

• The Operationalizing Principles for Responsible AI (August 2021),³ which emphasizes the need for regulatory and policy interventions, capacity building and incentivizing ethics by design with regards to AI.

Status of the AI Regulations

As noted above, there are currently no specific laws or regulations in India that directly regulate AI.

Other laws affecting AI

There are various laws that do not directly seek to regulate AI, but may affect the development or use of AI in India. A non-exhaustive list of key examples includes:

• The Information Technology Act 2000,⁴ together with the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules 2011. This is set to be replaced by the Digital India Act 2023 (currently in draft form).
• The Digital Personal Data Protection Act 2023 which, at the time of publication, is yet to come into force.⁵

These laws are designed to be technology-agnostic (i.e., the principles in these laws are intended to apply, regardless of which technologies are in use).

Intellectual property laws may affect several aspects of AI development and use.

Definition of “AI”

As noted above, there are currently no specific laws or policies in India that directly regulate AI. As such, there is no single legally recognized definition of “AI” in India.

However, the Principles for Responsible AI describe AI as “a constellation of technologies that enable machines to act with higher levels of intelligence and emulate the human capabilities of sense, comprehend and act. Computer vision and audio processing can actively perceive the world around them by acquiring and processing images, sound, and speech. The natural language processing and inference engines can enable AI systems to analyse and understand the information collected. An AI system can also take decisions through inference engines or undertake actions in the physical world. These capabilities are augmented by the ability to learn from experience and keep adapting over time.”⁶ It remains to be seen to what extent this description will be adopted more widely.

Territorial scope

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. Accordingly, there is no specific territorial scope at this stage.

Sectoral scope

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. Accordingly, there is no specific sectoral scope at this stage. Nevertheless, there are certain sector-specific frameworks that have been implemented in India to regulate the use of AI. A non-exhaustive list of key examples includes:

• In the finance sector, the Securities and Exchange Board of India issued a circular in January 2019 on reporting requirements for AI and machine learning applications and systems offered and used.⁷
• In the health sector, the strategy for National Digital Health Mission identifies the need for the creation of guidance and standards to ensure the reliability of AI systems in health.

Compliance roles

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. Accordingly, there are currently no specific or unique obligations imposed on developers, users, operators and/or deployers of AI systems.

Core issues that the AI Regulations seek to address

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. Nevertheless, the National Strategy for Artificial Intelligence (2018) promotes the need for ‘responsible AI’, stressing the importance of being conscious of “the probable factors of the AI ecosystem that may undermine ethical conduct, impinge on one’s privacy and undermine the security protocol.” The Principles for Responsible AI also note that failing to manage AI systems responsibly may have significantly detrimental economic effects.⁹

Risk categorization

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. AI is also not generally classified according to risk in the relevant frameworks and principles. The current focus of officials and lawmakers appears to be more on the use of AI in high-risk sectors (such as health and finance)¹⁰ rather than AI systems that are in of themselves considered high risk.

Nevertheless, the draft Digital India Act 2023 is expected to regulate high-risk AI systems and delineate specific “no-go” areas for companies and internet intermediaries employing AI and machine learning in consumer-facing applications.

Key compliance requirements

As noted above, there are currently no specific laws or regulations in India that directly regulate AI.

Nevertheless, the Principles for Responsible AI¹¹ identify the following broad principles for responsible management of AI, which can be leveraged by relevant stakeholders in India:

• The principle of safety and reliability
• The principle of equality
• The principle of inclusivity and non-discrimination
• The principle of privacy and security
• The principle of transparency
• The principle of accountability
• The principle of protection and reinforcement of positive human values

Regulators

Currently, there is no AI-specific regulator in India. As such, the Ministry of Electronics & Information Technology is the executive agency for AI-related strategies and has constituted committees to bring in a policy framework for AI.

The Ministry of Commerce and Industry has also established an ‘Artificial Intelligence Task Force,’¹² with the aim of eventually establishing some form of AI regulatory authority.

Enforcement powers and penalties

As noted above, there are currently no specific laws or regulations in India that directly regulate AI. As such, enforcement and penalties relating to creation, dissemination and/or use of AI are governed by related violations in non-AI legislation.

1 https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf.
2 https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf.
3 https://www.niti.gov.in/sites/default/files/2021-08/Part2-Responsible-AI-12082021.pdf.
4 https://eprocure.gov.in/cppp/rulesandprocs/kbadqkdlcswfjdelrquehwuxcfmijmuixngudufgbuubgubfugbububjxcgfvsbdihbgfGhdfgFHytyhRtMjk4NzY.
5 https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf.
6 See Principles for Responsible AI, p.7.
7 https://www.sebi.gov.in/legal/circulars/jan-2019/reporting-for-artificial-intelligence-ai-and-machine-learning-ml-applications-and-systems-offered-and-used-by-market-intermediaries_41546.html.
8 See National Strategy for Artificial Intelligence, p.85.
9 See Principles for Responsible AI, p.8.
10 See https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf, p.29.
11 See Principles for Responsible AI, pp.41-42.
12 See https://www.aitf.org.in/.

[View source.]