Why Indian Regulators Are Moving Cautiously on AI Governance Compared to the EU

As governments around the world decide how to regulate artificial intelligence, two very different approaches have emerged. The European Union has passed a comprehensive, risk-based law covering AI systems across sectors. India has so far chosen a lighter, more flexible path that relies on existing laws, sector regulators and guidance rather than a single AI statute. This article explains the India AI regulation approach compared to EU rules, why India has taken a more cautious path and what the difference means for Indian businesses.

India's AI policy is actively evolving, and new guidelines, advisories or legislation may change the position described here. Before making compliance decisions, check the latest framework from the Ministry of Electronics and Information Technology (MeitY) and relevant sector regulators, and seek professional legal advice.

The EU approach: a comprehensive AI law

The EU Artificial Intelligence Act, which entered into force in August 2024, is the world's most prominent comprehensive AI law. It classifies AI systems by risk:

• Unacceptable risk: certain practices are prohibited, such as some forms of manipulative AI and social scoring.
• High risk: AI used in areas such as employment, credit, education, critical infrastructure and law enforcement faces strict requirements for risk management, data quality, documentation, human oversight and accuracy.
• Limited risk: systems such as chatbots face transparency obligations, for example telling users they are interacting with AI.
• Minimal risk: most other AI applications face few specific obligations.

The Act also includes obligations for providers of general-purpose AI models. Its requirements are being phased in over several years, and the EU has discussed adjusting parts of the timeline. Penalties for serious violations can be substantial, reaching a percentage of global annual turnover.

How India regulates artificial intelligence today

At the time of writing, India does not have a single, comprehensive AI law equivalent to the EU AI Act. Instead, how India regulates artificial intelligence relies on several layers:

• The Information Technology Act, 2000 and related rules: govern intermediaries, online content and cyber security, and apply to AI platforms in various ways.
• The Digital Personal Data Protection Act, 2023: sets rules for processing personal data, which affects AI systems that use such data. Our guide on DPDP Act compliance for AI startups covers this.
• Sector regulators: regulators in areas such as banking, securities, insurance and healthcare can issue rules or guidance for AI use in their sectors. The Reserve Bank of India, for example, has published work on responsible AI in financial services.
• Government advisories and guidelines: MeitY has issued advisories to platforms on AI-related issues, such as deepfakes and misinformation, and has published policy documents on AI governance.
• Consumer protection and other general laws: laws on consumer rights, discrimination, contracts and intellectual property apply to AI-related activities as they do to others.

This layered India AI policy framework emphasises using existing legal tools and adapting them, rather than creating a new regulatory regime specifically for AI.

Why India is moving cautiously

Several reasons explain India's more cautious approach.

Innovation priorities. India sees AI as a major economic opportunity and wants to build domestic capabilities. The government's IndiaAI Mission, approved in 2024 with a significant budget, focuses on computing infrastructure, datasets, skills and startups. Heavy regulation early on could, in this view, slow innovation and disadvantage Indian companies.

Avoiding premature rules. AI technology changes rapidly. Policymakers worry that detailed rules written now may become outdated or regulate the wrong things. A flexible approach allows adjustment as the technology and its risks become clearer.

Sector-specific risks. The risks of AI in lending differ from those in healthcare or social media. Sector regulators with domain expertise may be better placed to address them than a single horizontal law.

Development context. India's priorities include using AI for public services, agriculture, healthcare and language access at scale. Regulation that raises compliance costs could limit these applications.

Learning from experience. India's experience with AI advisories has shown the challenges of quick regulatory action. A 2024 MeitY advisory on AI models drew criticism from industry and was subsequently revised, illustrating the difficulty of regulating a fast-moving field.

AI regulation India vs EU AI Act: key differences

Comparing AI regulation India vs EU AI Act highlights several structural differences:

• Legal form: the EU has a single binding law; India relies on existing laws, sector rules and guidance.
• Scope: the EU Act applies horizontally across sectors; India's approach is more sector-specific.
• Risk classification: the EU uses formal risk categories with defined obligations; India has no equivalent statutory classification at present.
• Compliance burden: EU high-risk AI systems face detailed documentation and assessment requirements; Indian businesses face fewer AI-specific obligations, though data protection and sector rules still apply.
• Philosophy: the EU emphasises precaution and fundamental rights protection; India's India AI governance policy emphasises innovation, flexibility and principles-based governance.

Both approaches share some goals, such as safety, accountability and protection against harm. The difference lies mainly in how and when to impose binding obligations.

Where the two approaches may converge

Despite their differences, the two approaches may converge over time. Both India and the EU are concerned with deepfakes, misinformation, data protection and AI used in high-stakes decisions. Indian sector regulators may develop requirements for AI in areas such as lending or insurance that resemble the EU's treatment of high-risk systems. International standards for AI management and risk assessment are also creating common practices that companies follow regardless of where they operate. Anyone studying the India AI regulation approach compared to EU rules should therefore watch for gradual alignment on specific issues, even if the overall legal structures remain different.

Criticisms of each approach

Each approach has critics. The EU's comprehensive law has been criticised as complex, costly to comply with and potentially slowing European innovation. Supporters argue it provides legal certainty and strong protections for citizens.

India's lighter approach has been criticised for leaving gaps in protection, particularly for people affected by AI decisions in areas like lending, employment and public services, and for relying on advisories that can create uncertainty. Supporters argue it allows India to adapt as risks become clearer and supports innovation.

Why Indian businesses should still care about the EU AI Act

Even though the EU Act is European law, it can affect Indian businesses. Companies that provide AI systems used in the EU, or whose AI outputs are used there, may fall within its scope. Indian IT services firms, SaaS companies and AI startups serving European clients may need to meet its requirements, and European customers may ask suppliers to demonstrate compliance. Many global companies also align their internal AI governance with the strictest major framework they face, which can make EU standards a practical reference point worldwide.

What Indian businesses should do now

• Comply with data protection law: the DPDP Act is the most significant current legal obligation affecting many AI applications.
• Follow sector rules: businesses in finance, healthcare and other regulated sectors should track their regulator's guidance on AI and technology risk.
• Adopt internal governance: create policies for responsible AI use, as described in our guide on AI usage policies.
• Check international exposure: if you serve clients in Europe or other regulated markets, assess whether their AI rules apply to you.
• Monitor policy developments: follow MeitY announcements and industry bodies, as India's approach may change.
• Consider ethics as well as law: fair and transparent AI use builds trust, as discussed in our article on the ethics of using AI for customer decisions.

What could change

India's approach may evolve. Possible developments include more detailed government guidelines on AI governance, sector-specific rules from regulators, provisions in a future replacement for the IT Act, and rules on specific issues such as deepfakes or AI-generated content labelling. Global developments, including how the EU Act works in practice, may also influence Indian policy. Businesses should treat the current position as a snapshot rather than a settled framework.

Summary: India AI regulation approach compared to EU

The India AI regulation approach compared to EU rules is lighter, more flexible and more sector-specific. The EU has a comprehensive, risk-based AI Act with binding obligations, while India relies on existing laws such as the IT Act and DPDP Act, sector regulators and government guidance, emphasising innovation and adaptability. Each approach has trade-offs between protection, certainty and flexibility. Indian businesses should comply with data protection and sector rules, adopt internal AI governance, assess EU exposure if they serve European clients and monitor India's evolving policy closely.

Frequently asked questions

Does India have an AI law?

At the time of writing, India does not have a single comprehensive AI law. AI is governed through existing laws, sector rules and government guidance, but this is evolving, so check MeitY's latest position.

How is India's approach different from the EU AI Act?

The EU has a binding, risk-based law across sectors; India uses a lighter, sector-specific approach focused on innovation and existing legal tools.

Does the EU AI Act apply to Indian companies?

It can, if they provide AI systems used in the EU or their AI outputs are used there. Companies serving European clients should seek legal advice.

Which Indian law matters most for AI businesses today?

The Digital Personal Data Protection Act is particularly important for AI systems that process personal data, alongside sector-specific regulations.