Loading…
Loading…
India is shaping its own path on AI governance, balancing innovation with responsibility. What the 2026 landscape means for companies building AI in India.
India is taking a distinctive path on AI governance. It is both a major producer of AI and one of the world's largest markets for it, and its policy reflects that dual role. Rather than copying the prescriptive model of the European Union, India favours clear principles, sector-specific guidance and industry responsibility, backed by government oversight.
The Ministry of Electronics and Information Technology has worked closely with industry, academia and civil society to shape this framework. The aim is to encourage adoption while addressing real concerns about bias, privacy, safety and accountability. The result is pragmatic policy that responsible companies can build within.
Several developments are shaping the landscape this year. The proposed Digital India Act is expected to address algorithmic transparency, data governance and liability. Regulators in banking, healthcare and telecommunications are issuing guidance for AI within their sectors.
The Reserve Bank of India's FREE-AI framework sets expectations for explainability, fairness and human oversight in financial AI, including credit decisions. In healthcare, the Central Drugs Standard Control Organisation (CDSCO) is developing guidance for AI-based medical devices and diagnostic tools.
For a company like Aptibit, building AI products that serve many sectors, the right response is to engage early with regulators and build governance into products from the start rather than retrofitting it later.
Responsible AI is more than compliance. It is a competitive advantage. Products built with fairness testing, explainability and strong safeguards earn the trust of customers and regulators alike. At Aptibit, these principles run through our entire development process.
In Visylix, our automated AI video surveillance platform, that means privacy and accountability by design. Access is governed by 46 permissions across 4 roles, with Active Directory and LDAP sign-in. Every action sits in a tamper-evident audit trail. Faces, plates and custom zones are redacted when footage is exported, and face recognition includes consent and erasure controls, with every match raised for an operator to confirm. The companies that set the highest standards today will lead their markets tomorrow.
India's approach is informed by global developments while remaining its own. The EU AI Act, whose main obligations are scheduled to apply from August 2026, is one reference point. The more flexible approaches of the United States, Singapore and Japan offer others. India is drawing on several models and adapting them to its own context.
For Indian companies with global ambitions, this means building products that work across several regulatory regimes. A video analytics platform used in India meets one set of expectations; the same platform used in Europe may fall under the AI Act's high-risk rules. Designing for both from the outset is far more efficient than adapting later.
International cooperation on AI safety is also accelerating. India's active role in the Global Partnership on AI and the G20 discussions on AI ensures Indian perspectives help shape international norms.
The most important step is to treat governance as a core product capability, not a box to tick. That means investing in explainability, bias testing, thorough logging and meaningful human oversight.
Companies should also engage with sector regulators, take part in industry efforts to define good practice, and contribute to the public conversation. At Aptibit Technologies, we intend to lead by example, building AI that is powerful, transparent, fair and accountable. The future of AI in India depends on the industry showing that innovation and responsibility go hand in hand.
Not a single, unified AI Act. The Digital Personal Data Protection Act, 2023 governs personal data, including data used by AI systems. The proposed Digital India Act and advisories from the Ministry of Electronics and Information Technology (MeitY) address specific AI concerns, and sector regulators such as the RBI in finance and the ICMR in health add their own guidance. The pieces are steadily coming together.
The EU sorts AI systems into risk categories and sets detailed obligations for each. India relies more on principles and on sector regulators, with the DPDP Act setting the baseline for data protection. The Indian approach favours innovation while enforcement mechanisms mature.
Start with DPDP Act readiness: clear consent, collecting only the data you need, a plan for breach notification, and a way for people to access, correct or erase their data and raise grievances. Next, document where training data came from and how models make decisions. Finally, if you sell into regulated sectors, understand what each sector regulator expects.
There is no single statute, but there is a growing body of court decisions, state policies and draft guidance. Public-sector use must pass tests of necessity and proportionality, and private use of face recognition falls under DPDP consent requirements.
It means concrete outputs: documents that set out each model's known limits, bias testing on Indian data, structured attempts to misuse the system before attackers do, human approval for consequential decisions, and audit logs you could hand to a regulator. If your process cannot produce these, it is not ready for regulated use.
The direction is clear, particularly for AI that affects people's rights in areas such as credit, housing and employment. Disclosure requirements similar in spirit to the EU AI Act are likely over the next few years. Companies that build transparency in early will adapt far more smoothly than those who add it later.