India Built Sovereign AI Without an AI Act. Can It Scale Trust?

India has no standalone AI Act. Six months into its most consequential AI year, that absence is doing the work a statute would, and three sets of rules written since February are now filling in what the Act never will.

Three experts who helped frame India’s AI debate told Business Standard in late June 2026 that the no-AI-Act bet is being stress-tested by a harder question: whether governance can scale with AI, and at what speed. The answer is being written not in Parliament, but in seven guiding principles, a deepfake crackdown that took effect on February 20, and a quiet shift toward procurement as the country’s real AI regulator.

The Strategy That Rejected an AI Act

India’s AI ambitions are running through a stack of existing rules, not a single statute. The Press Information Bureau (PIB) confirmed on February 15, 2026 that the country had adopted “a principle-based AI governance framework anchored in seven Sutras” at the India AI Impact Summit held in New Delhi. The framework explicitly reaffirms what the government had signalled earlier: no dedicated AI Act, and no rush to write one.

That is an unusual position in 2026. The European Commission’s overview of the EU AI Act timeline shows the EU’s regulation entered into force on 1 August 2024 and was set to become fully applicable on 2 August 2026. India is choosing the opposite lane, leaning on the Digital Personal Data Protection Act of 2023, the Information Technology Act of 2000, and sector-specific rules from the Reserve Bank of India, the Securities and Exchange Board of India, and the Insurance Regulatory and Development Authority.

Three experts told Business Standard in late June 2026 that the model is now under live test. Rishi Agrawal, chief executive officer and co-founder of Teamlease Regtech, put the test plainly. “The real challenge is not whether India has an AI Act. It is whether every AI deployment has clear accountability, documented decision-making, continuous monitoring, audit trails and mechanisms to demonstrate compliance throughout the AI lifecycle,” he said.

Bruce Keith, chief executive officer and co-founder of the AI wealth-tech platform InvestorAi, drew the parallel with India’s earlier digital leaps. “India has an incredible track record in scaling digital infrastructure without a single dedicated law, as UPI and Aadhaar grew under a patchwork of RBI circulars, IT Act provisions, and sector-specific rules,” he said. His caveat followed: “Scaling adoption can definitely happen without a law. However, scaling it responsibly and accountably is where the gap begins to appear.”

When AI Gets It Wrong, the Bill Lands on the Deployer

The first place the gap shows up is accountability. AI’s move from productivity tool to decision-making layer, especially in welfare, finance, and healthcare, has exposed a fault line the Indian government has so far left to existing law and to procurement.

Agrawal’s reading is that responsibility must not be laundered through the model. “AI should never become a mechanism for diffusing accountability. Responsibility must continue to rest with the public authority deploying the system and the officials making the final decisions, not with the algorithm itself,” he said.

On that reading, the deploying institution takes the bulk of the responsibility; the model vendor carries a smaller one, focused on documentation and model quality. Agrawal argues that public-sector AI now demands governance “similar to financial controls. Defined ownership, independent validation, continuous monitoring, explainability, incident reporting and periodic audits are a must.”

Keith said the same gap is visible outside India. “This is a real accountability gap across the world, e.g. vendors usually try to limit liability or disclaim responsibility for ‘model behaviour’. This is unacceptable.” The European Commission has pressed vendors on this question for two years; the open question for India is whether its regulators can deliver the same pressure without a dedicated AI statute.

Deepfakes Just Became the Country’s First Real Test

The first concrete test arrived in February 2026. India notified amendments to the IT Intermediary Rules under gazette notification G.S.R. 120(E), signed by Joint Secretary Ajit Kumar, defining for the first time “synthetically generated information” and bringing AI-generated audio, video, and images under a formal regulatory framework. The rules took effect on February 20, 2026.

Agrawal warned that banning the technology was never going to work, and that the answer lay in trusted safeguards over restrictive regulation. Stronger governance, in his view, may accelerate adoption, and keep it credible as it grows.

“Deepfakes are fundamentally a trust problem. Banning technology is rarely effective because AI capabilities evolve faster than legal prohibitions.”

The new rules operationalise that shift. The most visible change is the shorter compliance clock for platforms:

The changes came with a quiet climbdown. A draft from October 2025 had demanded watermarks cover at least 10% of screen space on AI visuals; the Internet and Mobile Association of India and members including Google, Meta, and Amazon pushed back. The final rules “keep the labelling mandate but ditch the fixed-size watermark,” the Times of India reported. Rahul Agarwalla, managing partner at the AI-native venture capital firm SenseAI Ventures, told Business Standard that the harder work is not in flagrant cases, which already carry sanctions, but in the grey areas where the right balance in regulation is hard to find.

What India Released in February: The Seven Sutras

The Press Information Bureau release on AI Governance Guidelines on February 15, 2026 sets out the principle-based approach India prefers to a single statute. The Press Information Bureau framed the framework as “principle-based and techno-legal”, anchored in seven guiding Sutras.

The Sutras, as MeitY calls them, name the values every AI system in India is now expected to honour. They are not statutory duties, but they signal where existing regulators will press hardest:

• Trust is the Foundation
• People First
• Innovation over Restraint
• Fairness and Equity
• Accountability
• Understandable by Design
• Safety, Resilience and Sustainability

The Guidelines also create three new institutions to operationalise them. The AI Governance Group, the Technology and Policy Expert Committee, and the AI Safety Institute will not write new law, per the PIB release. Their job is to apply the Sutras across sectors, advise on enforcement, and test models for safety. These three bodies take on the operational role that a standalone AI Act would otherwise provide. An explainer on what the Sutras mean for enterprise compliance notes that existing laws, including the DPDP Act 2023 and the IT Act 2000, already apply to AI systems.

Sovereignty Still Has Blind Spots

The sovereign AI debate is often framed as technological independence, but experts told Business Standard that complete self-reliance may not be realistic. The PIB release quantifies how far India has pushed: 38,000 GPUs are now onboarded under the IndiaAI Mission through the subsidised national compute facility, with AIKosh hosting more than 9,500 datasets and 273 sectoral models.

• 38,000 GPUs onboarded under the IndiaAI Mission
• 9,500+ datasets hosted on AIKosh
• 273 sectoral models in the AIKosh catalogue
• 500 PhDs, 5,000 postgraduates and 8,000 undergraduates supported through capacity programmes
• 40+ petaflops under the National Supercomputing Mission

Keith said the most attractive frontier, local-language models, still depends on the foreign foundations it is built on. “From an India perspective, the biggest opportunity is creating local language models, but if they are built on an open-weight foundation model released by a foreign lab, the base architecture, training methodology, and safety behaviour are still externally determined,” he said.

Agrawal’s prescription is narrower than full self-reliance. “India’s objective should, therefore, be to reduce critical dependencies where they matter most: sensitive public-sector data, critical government workloads, indigenous language models, trusted infrastructure and governance capability.” On his reading, sovereignty narrows to the list of priorities the country can actually control.

Procurement Is Becoming the De Facto Regulator

Agrawal’s answer to the gap is to build governance into the buying. He told Business Standard that a public-sector governance framework should establish common standards across government for procurement, risk assessment, model documentation, independent audits, explainability, human oversight, and continuous monitoring. Governance, in his view, “should not end when an AI system is procured. It should extend throughout the system’s lifecycle from vendor evaluation and deployment to ongoing performance monitoring, incident management and retirement.”

Rahul Agarwalla at SenseAI Ventures said procurement is where the action sits now. “Procurement should be the key focus, as this will drive sovereign AI adoption. Explainability and audits can come later, once AI reaches a higher level of maturity,” he said. Keith added that procurement is the most practical place to begin, while warning that audit capacity still remains limited.

Public-sector buyers beyond welfare and defence will be tested against this same framework. NPCI chief Dilip Asbe’s roadmap for AI past a billion UPI users puts fraud detection, AI-issued credit, and voice onboarding for the next 500 million users at the centre of the next phase, and each of those choices will run through the procurement gates the new Guidelines are now setting.

Frequently Asked Questions

Does India have an AI Act?

No. India has no standalone AI Act. The Press Information Bureau confirmed on February 15, 2026 that the country is relying on the Digital Personal Data Protection Act of 2023, the Information Technology Act of 2000, sector-specific regulators from RBI, SEBI, and IRDAI, and the new AI Governance Guidelines to govern AI.

What are India’s seven AI Sutras?

India’s seven Sutras, released in the AI Governance Guidelines on February 15, 2026, are: Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; and Safety, Resilience and Sustainability.

What do India’s February 2026 deepfake rules do?

The Indian government notified amended IT Intermediary Rules under gazette notification G.S.R. 120(E), effective February 20, 2026. The rules define “synthetically generated information”, require labels and persistent metadata on AI content, and cut platform takedown windows to as little as 3 hours for some lawful orders.

Will procurement become India’s main AI regulator?

That is where the country is heading. Agrawal told Business Standard in June 2026 that a public-sector governance framework anchored in procurement is the practical next step; Agarwalla said procurement should drive sovereign AI adoption ahead of explainability and audits.

What three new AI institutions did India announce?

The February 2026 Guidelines created the AI Governance Group, the Technology and Policy Expert Committee, and the AI Safety Institute to operationalise the seven Sutras across sectors and test models for safety.

Disclaimer: This article reflects the situation as of publication in late June 2026, drawing on the Press Information Bureau’s February 15, 2026 release on the AI Governance Guidelines and expert interviews published by Business Standard. AI governance in India is evolving, and the regulatory landscape may change. Consult a qualified legal or compliance professional before relying on any of the specific provisions summarised here. Figures are accurate as of publication.