Key takeaways
- On 8 October 2026 the IT Minister said a consultation paper on AI regulation would come within about a month; we found no report that it has been published.
- There is no draft AI statute yet, so AI products are governed by the IT Act, the 2026 IT Rules, the DPDP Act and general law.
- Build now: data mapping, labelling of synthetic media, model documentation, an incident log and clear terms on liability.
- When the paper appears, a short evidence-based submission on how your product works is the best way to influence the outcome.
On 8 October 2026, IT Minister Ashwini Vaishnaw said the government would release a consultation paper on regulating artificial intelligence within a month. The paper, he said, would form the basis for future AI rules. For founders, the headline question is whether India is about to get a standalone AI law. The honest answer is that nobody outside government knows yet, but the direction of travel is clear enough to start preparing.
This guide explains what the minister actually said, what is still unknown, which Indian rules already apply to AI products today, and a practical compliance baseline that will help whatever form the new framework takes. It also explains how to take part in the consultation, because early comments from startups tend to shape the draft.
Where India’s AI regulation stands today
India does not yet have a statute dedicated to artificial intelligence. Until now, the government has relied on existing laws, on amendments to the IT Rules, and on non-binding policy. In November 2025, MeitY published the India AI Governance Guidelines, a framework that sets out principles and recommendations but does not impose binding duties (MeitY). The approach has been described as light-touch, with the government favouring innovation and voluntary measures over a new regulator.
That is changing at the edges. In February 2026, MeitY amended the IT Rules to regulate synthetically generated information, which brought AI-generated audio and video within the intermediary framework, with labelling duties and quick takedown timelines for platforms. Commentators have also noted that the government has increasingly relied on amendments and advisories under existing digital laws instead of fresh legislation (IAPP; Mondaq).
So the starting point for a startup is a patchwork. Data protection law, the IT Act, consumer law, copyright and sector rules each cover part of what an AI product does. What the consultation paper may add is a coherent framework on top, for example on safety, deepfakes and accountability. Until the paper appears, treat the existing patchwork as the law you must comply with and the likely themes of a new law as the direction you should prepare for.
What the minister said and what is still unknown
Speaking at an event in New Delhi on 8 October 2026, Mr Vaishnaw said the government would release a consultation paper on AI regulation within the next month, that it would seek stakeholder views, and that it would form the basis for future rules. Press reports of the event describe a focus on safety, deepfakes and a human-first approach, along with skilling, and quote MeitY’s secretary S. Krishnan as saying that certain threats had not yet been addressed and would be examined in the paper (The Print; Exchange4Media; Deccan Herald).
What the coverage does not say matters as much. The minister did not announce a draft law or a timeline for legislation, and did not say whether the process will end in a standalone statute, in amendments to existing laws or in another framework. A June 2026 report said he had called for a new AI law that goes beyond the IT Act, and commentators have noted that this is a shift from the ministry’s earlier position that no separate law was planned. But a statement of intent is not a draft.
Be careful with detail circulating online. Some blogs describe risk tiers, licensing regimes or penalties as if they were part of an official draft. We found no reliable source for those claims, and they should not drive compliance decisions. As of 29 October 2026 we also found no report that the consultation paper had been published, and the one-month target may slip. The safe course is to check MeitY’s website and treat anything not on it as speculation.
The rules that already apply to AI products
Several laws already bite. The Digital Personal Data Protection Act, 2023 applies to personal data used to train or run AI, and its main obligations take effect on 13 May 2027, with penalties of up to ₹250 crore for failing to take reasonable security safeguards. The IT Amendment Rules, 2026, notified on 10 February 2026, regulate synthetically generated information, meaning audio, visual or audio-visual content that has been created or altered so that it appears real, with labelling and metadata duties and extra steps for platforms with more than five million users.
Other laws apply by subject matter. The Consumer Protection Act, 2019 and the CCPA’s guidelines on dark patterns reach misleading AI claims and manipulative design. Copyright law governs training data and outputs, and the Delhi High Court’s July 2026 interim ruling in ANI v. OpenAI, which is on appeal, and the DPIIT’s December 2025 working paper on a mandatory licence, show how unsettled that area is. Personality rights, protected by the High Courts, apply to deepfakes of real people. And CERT-In’s directions require reporting of cyber incidents within six hours.
Sector regulators add their own expectations. A lender using AI to score customers, a health product making clinical claims and an ed-tech product serving children each face rules from the relevant regulator, and the DPDP Act is strict about children’s data. If your product sits in a regulated sector, your starting question for the consultation should be how the proposed AI framework will interact with the regulator you already answer to.
How to prepare: an AI compliance baseline
Start with an inventory. List every AI system you build, buy or embed: what it does, who uses it, what data it takes in, which model or vendor sits underneath, and where outputs go. Founders are often surprised by how many AI features arrived through vendors and tools. The inventory lets you answer the question any regulator will ask first, which is what you are running and why.
| Area | What to put in place | Why now |
|---|---|---|
| Personal data | Map data flows, notices, consent and retention for training and use | DPDP Act obligations apply in full from 13 May 2027 |
| Synthetic content | Label audio and visual outputs and keep declaration and verification records | Already required under the February 2026 IT Rules where they apply |
| Model governance | Document datasets, testing, known limits and an incident log | Likely to be the core of any future AI statute |
| Liability | Terms of use, output guardrails and a grievance route | Safe harbour for AI outputs is untested |
| Copyright | Keep provenance records for training data | Courts and the DPIIT are still working out training rules |
Then classify the risk of each system in plain terms. Does it affect people’s access to credit, jobs, health or education? Does it generate realistic audio or video? Does it serve children? Does it make decisions without a human check? Keep a one-page note per system on the risks and the controls. Add the basics: documented sources and licences for training data, security testing before release, human oversight for consequential decisions, logs that let you reconstruct what the system did, and a process for users to complain and for you to fix and report incidents.
Finish with contracts and governance. Ask AI vendors for warranties on training data, notice of model changes, security commitments and cooperation in an investigation, and make sure your customer contracts allocate responsibility for AI outputs sensibly. Name one person who owns AI compliance, give them a seat in product decisions, and write a short policy on acceptable use of AI tools by staff. None of this is excessive, and all of it is likely to be needed whether the new framework is a statute, a code or a set of amended rules.
Taking part in the consultation, remedies and quick answers
When the consultation paper appears, read the questions before the proposals, because the questions show where the government is undecided. Respond with evidence, not slogans: how your product works, what compliance would cost a company your size, and which proposed duties are unclear. Industry bodies such as Nasscom and IAMAI usually file consolidated responses, and a short individual response from a startup adds a perspective that large firms do not. If the eventual rules are challenged as exceeding the government’s powers, the usual route is a writ petition, and the safest preparation is a record of good-faith compliance. Keep your inventory current, review it when the paper is published and again when a draft appears, and revisit your contracts and policies once you know what the framework requires. If you receive a notice or advisory in the meantime, take advice before responding.
Related reading: whether an AI product is an AI intermediary under Section 79, MeitY’s October 2026 AI labelling advisory, the draft IT Rules change on binding MeitY advisories, labelling AI-generated content under the IT Rules 2026, who is liable when an AI agent causes harm, the EU AI Act for Indian SaaS companies and DPDP Act compliance for startups; also ads inside AI answers and Indian advertising law; also India’s deep tech startup category.
Quick answers
Does India have an AI law?
Not yet. India regulates AI through existing laws, the IT Rules (including the February 2026 amendments on synthetic content) and non-binding guidelines. A consultation paper on further regulation was announced on 8 October 2026.
Will India’s AI regulation be a standalone law?
That has not been confirmed. The minister did not say whether the consultation will lead to a standalone statute, amendments to existing laws or another framework.
What should a startup do before the consultation paper is published?
Inventory your AI systems, document training data sources and licences, classify risks, put human oversight and incident processes in place, review vendor contracts and prepare to respond to the paper.
Does India have an AI law today?
Not a standalone one. AI products are covered by the IT Act, 2000, the IT Rules as amended in February 2026, the DPDP Act, 2023, copyright law and general contract and consumer law. The India AI Governance Guidelines of November 2025 are non-binding.
Should a startup wait for the consultation paper before preparing?
No. Most of the likely themes, such as data governance, labelling, testing and accountability, are already covered by existing law or good practice, so work done now is unlikely to be wasted.
Final word
Halverton & Co. is an Indian law firm advising founders, startups, technology companies and investors on Indian law, including AI governance, DPDP compliance, technology contracts and regulatory strategy for AI startups. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for technology-driven businesses. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.
This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create an advocate-client relationship. Halverton & Co. is an Indian law firm.
Sources
Related practice area
Technology & AI Law
Contracts, data protection and AI policies for products that handle other people’s data.
View the practice areaComments
No account needed. Comments are reviewed before they appear, so yours will show here once approved. Please do not share confidential details or describe your own legal matter: replies are general discussion, not legal advice, and do not create an advocate-client relationship. For your own situation, write to office@halvertonandco.com.
