Apply for the beta

AI rules in India in 2026: what a business must do

India has no single AI law in 2026, but guidelines, labelling rules, CERT-In documents and the DPDP Rules already apply to a business using AI. A plain guide.

By Sourav De · · 7 min read

Part of the guide: India's technology ecosystem: DPDP, data, sovereign tech

Two colleagues in a small Indian office reading a thick bound document together at a table, one pointing to a line

The short answer: as of November 2026 India does not have one AI Act. What a business faces is a set of instruments of different weight: the India AI Governance Guidelines, which are recommendations; amended IT Rules on AI-generated content, which are law and in force since 20 February 2026; CERT-In documents on AI security; a framework from the RBI for the financial sector; and the DPDP Rules, whose main duties arrive around May 2027. For most companies the practical duties are four: obey the existing laws when you use AI, label synthetic media you publish, protect personal data you feed to AI, and keep a record of which AI you use.

This is a guide for owners and managers, not legal advice. Where a rule is uncertain or not yet in force, we say so.

Does India have an AI law?

Not a single one. The government's stated approach is to rely on existing law and add to it where gaps are found.

The Ministry of Electronics and Information Technology unveiled the India AI Governance Guidelines on 5 November 2025. A Press Information Bureau backgrounder dated 15 February 2026 describes them as "a principle-based AI governance framework anchored in seven Sutras". Its key reasoning is that "many AI-related risks can be addressed under current laws", while noting "an urgent need for a comprehensive review of relevant laws to identify regulatory gaps".

The guidelines recommend new institutions, "including the AI Governance Group, Technology & Policy Expert Committee, and AI Safety Institute". We could not confirm from an official page whether these bodies are operating yet.

Two lines are worth quoting for business owners, because they set the tone. Organisations are asked to "Comply with all Indian laws and regulations", and regulators are told that proposed frameworks "should avoid compliance-heavy requirements (for example, mandatory approvals, licensing conditions, etc.) unless deemed necessary".

So the guidelines are not a licence regime, and they are also not nothing: they show how regulators have been asked to think.

Which rules are already binding?

The existing law. Consumer protection, contract, employment, copyright, the IT Act and criminal law all apply to what you do with AI. If an AI tool misleads a customer, "the AI did it" is not a defence.

The rules on AI-generated content. The amended IT Rules were notified on 10 February 2026 and, as Outlook Business reported, came "into force on February 20, 2026". They require synthetically generated audio and visual content to be prominently labelled so that it is easily recognised, and they cut the time for an intermediary to remove content after a government or court order from 36 hours to 3 hours. The duties fall mainly on platforms. An analysis by the law firm Nishith Desai Associates notes that plain text is not covered and routine good-faith editing is excluded.

For an ordinary business this means: if you publish an AI-made video, voice or image that could pass for real, label it clearly. A further draft proposing continuous visible labels was open for comment until May 2026. We did not find it finalised.

CERT-In's Directions of 2022. The six-hour reporting rule for cyber incidents and the 180-day log rule apply whether or not AI is involved.

What has CERT-In said about AI?

Two documents in 2026.

The Blueprint for defending against AI-assisted exploitation, version 1.0 dated 25 May 2026, is advice. Its own words: "Organisations are encouraged to implement the recommendations contained in this blueprint in a risk-informed manner". It gives target times for fixing weaknesses, the tightest being to "patch, mitigate, or remove exposure within 12 hours where feasible" for the most critical internet-facing systems.

The AI Security Auditing Guidelines, version 1.0 dated 4 November 2026, go further. They set out how AI systems should be audited and include requirements such as: "The organisation shall maintain an AIBOM for production AI systems proportionate to system complexity and risk." An AIBOM, or AI Bill of Materials, is a list of the models you use, their providers and versions. The document also refers to reporting AI-related security incidents within the six-hour timeline and keeping logs for 180 days.

We must be careful here. The document is eight days old as we write. It uses the word "shall", but we could not confirm what legal force it carries or from what date. Read it as a strong signal of what auditors will ask, and check with your adviser before treating it as a legal obligation.

What about the financial sector?

The Reserve Bank of India published the report of its committee on a Framework for Responsible and Ethical Enablement of AI (FREE-AI) on 13 August 2025. The RBI's press release describes 7 Sutras, six strategic pillars and 26 recommendations. It is a committee report. We did not find RBI directions that make its recommendations binding, so regulated entities should watch for those.

How do the DPDP Rules affect AI use?

More than any AI-specific document, for most companies.

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, per the PIB. Compliance is phased over eighteen months, with the main obligations around May 2027. Every time an employee pastes a customer list, a CV or a salary sheet into an AI tool, personal data is being processed, by you and by that tool's provider. You need a lawful basis, reasonable security, and a plan for breaches. The PIB backgrounder puts the highest penalty at up to ₹250 crore.

That is why an AI policy for staff is no longer optional housekeeping. Our articles on shadow AI and where your AI is processed deal with this directly.

Does the EU AI Act matter to an Indian company?

It can, if you sell AI-based products or services into the European Union. Take advice on whether you are covered. On timing, the European Commission's page, updated on 19 October 2026, says the bans on prohibited practices have applied since 2 February 2025, and that the rules for high-risk systems in sensitive areas now apply from 2 December 2027. If a European customer sends you an AI questionnaire, this is where it comes from.

What should a business actually do now?

  • Write a one-page AI policy. Which tools are allowed, and what must never be pasted into them.
  • Make a list of the AI you use: tool, provider, what data it sees, where it is processed. This is your AI bill of materials in its simplest form.
  • Label AI-made images, audio and video that you publish.
  • Keep a human responsible for any decision about a customer or an employee.
  • Treat AI incidents as security incidents, with the six-hour rule in mind.
  • Prepare for the DPDP duties before May 2027, not after.

Where does DNX OS fit?

DNX OS is a standalone operating system for businesses whose assistant, Nova, runs on the PC itself. For the list above, that helps in two concrete ways: the AI your staff use daily is one known item on your list, and personal data given to it is not sent to an outside provider. It does not make you compliant by itself. The policy, the labelling and the records are still yours to keep.

DNX OS is in beta from December 2026 and launches in January 2027. If you would like to try it, apply for the beta. For how the assistant asks before acting, see AI agents at work.

What is still uncertain?

  • The legal force and start date of CERT-In's AI audit guidelines.
  • The final form of the continuous-label draft for synthetic content.

Sources

All sources were opened on 12 November 2026.

Keep reading