AI regulation in India is about to move beyond guidelines. On October 8, 2026, Union IT Minister Ashwini Vaishnaw said the government will release a consultation paper on AI regulation within a month. "The time has come for AI regulations," he said at the launch of the World Bank's World Development Report.

The paper is not a law yet. But it will set the base for how India governs AI, and the minister was clear that industry will carry most of the weight. At Debugged Pro, we build AI features, apps and websites for clients in India and the USA. So we read the reports, the official guidelines and the IT Rules that already apply. Here is what changed this week and what we think teams should do about it.

Union IT Minister Ashwini Vaishnaw speaking, who announced a consultation paper on AI regulation in India — Union IT Minister Ashwini Vaishnaw. He said on October 8, 2026 that India will release a consultation paper on AI regulation within a month. Image: The Indian Express.

What Ashwini Vaishnaw Said About AI Regulation in India

Vaishnaw spoke at the event for the World Bank's new report on AI. According to Moneycontrol's report on the announcement, he said the consultation paper will form the basis for India's approach to regulating the technology.

He listed the areas the paper will cover:

Safety. He called safety related to AI use "the most important point."
A human-first approach. "Humanity has to be the most important part of this aspect," he said.
Skilling and inclusion. The paper will look at making sure no section of society is left behind.
Deepfakes. He called them a "nuisance which can cause huge problems in society" and said their quality improves every day.
Psychological harm. He said AI has played a role in some psychological disorders and that the paper will examine this too.

Two other points stood out to us. First, he said AI cannot be governed by legislation alone. "We have to bring a techno-legal solution," he said, as reported by The Economic Times. Second, he put the burden on companies. "The industry has to take the primary responsibility," he said, naming cybersecurity, safety, user harm and deepfakes as concerns.

The Timeline

The minister said the paper will come out "in a month's time from now," and the government will move forward with regulation based on the feedback. If that timeline holds, the paper could be out by early November 2026. Final rules will take longer, because public comments come first.

Why the Government Is Changing Course Now

This is a shift in tone. Until now, India has relied on existing laws and voluntary steps rather than a dedicated AI rulebook.

MeitY Secretary S Krishnan said as much at the same event, according to Storyboard18. He noted that the World Bank report suggests relying on existing laws and voluntary compliance first, then regulating at a more advanced stage. "Maybe some of those times have come," he said. He added that "the existential risks now are put out far more explicitly."

Krishnan also shared a few numbers that show how fast the government is building AI capacity:

New requests for proposals for 3,000 GPUs and 10,000 GPUs, with the second batch meant entirely for government use.
The government's AI data platform has crossed 16,000 datasets.
A target to train 10 million young Indians in AI within a year, set by the Prime Minister on August 15.

He also admitted that enterprise AI adoption is "still not at the level that everyone would desire." We covered that gap in our look at AI adoption in India and the World Bank report. More rules and more adoption at the same time is the reality businesses now face.

What Rules Already Apply to AI in India

A lot of teams assume there are no AI rules in India yet. That is not quite true. Several layers already apply to AI products today.

Cover of the India AI Governance Guidelines published by MeitY under the IndiaAI Mission — Cover of the India AI Governance Guidelines, released by MeitY under the IndiaAI Mission in November 2025. Image: MeitY / IndiaAI.

1. The India AI Governance Guidelines (November 2025)

MeitY released these guidelines on November 5, 2025. The official PIB release on the India AI Governance Guidelines describes four parts: seven guiding principles, recommendations across six pillars, an action plan and practical guidance for industry and regulators.

The seven principles, called sutras, are Trust is the Foundation, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability.

The document also said that "at this stage, a separate law to regulate AI is not needed given the current assessment of risks." It recommended a graded liability system based on the role a company plays, the level of risk and whether it did its due diligence. It also proposed an AI Governance Group, backed by a Technology and Policy Expert Committee and the AI Safety Institute.

The new consultation paper suggests the government now sees a need to go further than that position.

2. The IT Rules Amendment on Synthetic Content (February 2026)

India already regulates deepfakes through the IT Rules. MeitY notified an amendment on February 10, 2026, and it came into force on February 20, 2026. It covers what the rules call synthetically generated information, meaning AI-made audio, images or video that look real.

Key points from MeitY's FAQ on the 2026 IT Rules amendment:

Platforms that let users create synthetic content must label it prominently.
Labels must be backed by permanent metadata or a unique identifier, where technically feasible.
Platforms must not let users remove or hide those labels.
Large social media platforms must ask users to declare AI content and verify those declarations with technical tools.
Some takedown timelines dropped to three hours.

If your product generates images, video or voice, these rules may already apply to you. Our guide to the Google SynthID AI detector explains how watermarking and detection tools fit into this kind of labelling work.

3. Data Protection and Other Existing Laws

The Digital Personal Data Protection Act, 2023 governs how personal data is collected and processed, including data used to build or run AI systems. Consumer protection law, the IT Act and criminal law also apply when AI causes harm. The 2025 guidelines lean on these existing laws heavily.

How AI Regulation in India Could Affect Your Business

We do not know the exact text yet, so we will not guess at specific clauses. But the minister's words point in a clear direction. Here is how we read it for different kinds of businesses.

Who you are	What to watch	Likely first step
Startup building AI products	Safety duties, user harm, deepfake controls	Document how your model is tested and what it can generate
Agency building AI for clients	Who carries liability in the value chain	Clarify AI duties in contracts and statements of work
Brand using AI in marketing	Deepfakes, synthetic media labels	Label AI images and video and keep records
US company serving Indian users	Indian rules applying to your platform	Map which features reach users in India
Enterprise rolling out AI tools	Data protection, staff use, cybersecurity	Set an internal AI use policy and review vendors

For Agencies in India and the USA

This is the part that matters most to us. When the minister says industry must take primary responsibility, agencies sit right in the middle. We build the chatbot, the image tool or the recommendation engine. The client puts it in front of users.

The 2025 guidelines already talked about graded liability based on the function each player performs. If the new rules follow that idea, contracts will need to say clearly who tests the model, who handles complaints and who fixes problems.

For US agencies with Indian clients, or Indian teams like ours serving US clients, the same build may need to meet two sets of expectations. It is easier to design for that early than to patch it later.

A Practical Checklist to Prepare Now

You do not have to wait for the paper to start. These steps make sense under the current rules and will likely help under the new ones.

List every AI feature you run. Note what model it uses, what data it touches and who sees the output.
Mark the risky ones. Anything that generates realistic images, video or voice, or that affects money, health or jobs, needs a closer look.
Add labels to synthetic media. If you create AI images or video, label them and keep metadata where you can.
Keep a human in the loop. The minister stressed a human-first approach. Make sure a person can review and override important AI decisions.
Write down your testing. Record how you check for bias, wrong answers and misuse before each release.
Set up a way to report problems. Users should be able to flag harmful output, and someone should own the response.
Check your data practices. Review consent and data use against the DPDP Act, especially for training data.
Plan to respond to the paper. When it comes out, read it with your legal team and send comments if a rule would hurt your product.

If you want help building this into your process, our responsible AI governance services cover audits, policies and technical controls for AI products.

MeitY officials holding copies of the India AI Governance Guidelines at the launch event in New Delhi — Officials at the launch of the India AI Governance Guidelines in November 2025, the framework the new consultation paper will build on. Image: PIB.

What We Still Do Not Know

Some big questions remain open until the paper is out:

Will India write a new AI law, or amend existing laws like the IT Act?
Will the rules sort AI systems by risk level, as the 2025 guidelines suggested?
How will the "techno-legal" approach work in practice? It could mean tools like watermarking or detection built into the rules.
What will "primary responsibility" for industry mean for developers versus the companies that deploy AI?

We will read the paper when it is published and share a plain-language breakdown for our readers.

Key Takeaways

AI regulation in India is coming. The government plans a consultation paper within a month of October 8, 2026.
The paper will focus on safety, a human-first approach, skilling, inclusion, deepfakes and psychological harm.
The minister said industry must take primary responsibility and called for a techno-legal approach.
Existing rules already apply, including the 2026 IT Rules amendment on synthetic content and the DPDP Act.
The November 2025 guidelines said a separate AI law was not needed yet. That view now looks set to change.
Start now: list your AI features, label synthetic media, document testing and clarify liability in contracts.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with the design and development teams on websites, apps and AI projects for clients in India and the USA. He writes about practical AI changes that affect how businesses build and run their digital products.