Beyond Regulation: Is India Ready for a Risk-Based Legal Framework for Artificial Intelligence?

ABSTRACT:

Artificial intelligence (AI) presents significant opportunities for economic development, public administration and innovation, but also raises legal concerns relating to privacy, discrimination, transparency, accountability and fundamental rights. India has adopted a governance approach that combines existing legislation, sectoral regulation and policy guidance, while the European Union has introduced a comprehensive AI-specific regulatory framework through Regulation (EU) 2024/1689, commonly known as the AI Act. This article examines whether India's existing legal framework adequately addresses AI-related risks and evaluates the suitability of the EU's risk-based approach for the Indian context. Using doctrinal and comparative legal methodologies, it analyses constitutional protections, the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 and the India AI Governance Guidelines released in November 2025. It argues that India's existing laws provide important protections but do not, individually or collectively, establish a complete and uniform system of AI risk classification, lifecycle accountability and remedies for all AI-related harms. The article recommends a proportionate framework combining enforceable baseline safeguards, enhanced obligations for high-risk applications, sector-specific regulation and effective grievance redressal. It concludes that India should adapt the principles of the EU model to its constitutional, economic and institutional circumstances rather than reproduce it wholesale.

1. Introduction

Artificial intelligence is increasingly used in healthcare, finance, education, recruitment, public administration and online communication. These applications can improve efficiency and expand access to services, but they can also produce discriminatory outcomes, facilitate privacy violations, generate misleading content and influence consequential decisions without adequate explanation.

The legal challenge is not simply whether AI should be regulated. It is how legal obligations should correspond to the nature, probability and seriousness of the risks associated with different applications.

India's approach combines existing legislation, sectoral regulatory mechanisms and policy guidance. The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology (MeitY) on 5 November 2025, emphasise responsible innovation, human-centred governance, risk mitigation and the use of existing legislation wherever possible.

The European Union has adopted a more comprehensive legislative approach through Regulation (EU) 2024/1689, the Artificial Intelligence Act. It establishes differentiated obligations for prohibited AI practices, high-risk systems, certain transparency-sensitive applications and general-purpose AI models.

This comparison raises the central question of whether India's existing approach is sufficient or whether it needs a more explicit, enforceable risk-based framework. This article argues that India should strengthen AI-specific legal accountability through proportionate safeguards while avoiding unnecessary regulatory burdens and preserving constitutional protections.

2 India's existing legal framework - Constitutional protections

The Constitution of India does not expressly establish a separate fundamental right specifically addressing artificial intelligence. Nevertheless, Articles 14, 19 and 21 provide important safeguards against unlawful or arbitrary uses of AI.

Article 14 guarantees equality before the law and equal protection of the laws. AI systems used in recruitment, welfare allocation or public administration may raise equality concerns if they systematically disadvantage particular groups. Article 21 protects life and personal liberty and has been interpreted to include privacy.

In Justice K S Puttaswamy (Retd) v Union of India, the Supreme Court recognised privacy as a fundamental right and emphasised legality, legitimate state purpose and proportionality when assessing state interference with privacy.[3] These principles are relevant to biometric surveillance, profiling and automated public decisions.

In Shreya Singhal v Union of India, the Court struck down section 66A of the Information Technology Act 2000 for violating freedom of expression under Article 19(1)(a).[4] The judgment illustrates why digital regulation must be sufficiently precise and constitutionally proportionate. AI governance should therefore protect individuals without imposing vague restrictions on lawful expression or research.

3. The European Union's risk-based model

Regulation (EU) 2024/1689, the EU AI Act, establishes harmonised rules for AI systems and certain general-purpose AI models.[9] Unlike India's distributed approach, it provides a dedicated legal structure that differentiates obligations according to risk.

Article 5 prohibits specified AI practices considered unacceptable, subject to the provision's precise terms and exceptions. Article 6 and Annexes I and III identify high-risk systems and relevant classification criteria. High-risk obligations include risk management, data governance, technical documentation, record-keeping, human oversight, accuracy, robustness and cybersecurity.

The model's central strength is proportionality: an AI system used for a low-stakes task should not necessarily face the same obligations as one that materially influences employment, education or access to essential services. 

Transparency and implementation

Article 50 establishes specified transparency obligations, including requirements relevant to certain AI-generated or manipulated content. The Act also regulates general-purpose AI models and establishes EU-level and national supervisory arrangements.

The implementation timetable is progressive. As at 24 October 2026, general provisions and prohibitions have applied since 2 February 2025, while general-purpose AI rules and governance provisions have applied since 2 August 2025. The majority of the Act's rules, including Article 50 transparency requirements, began applying on 2 August 2026. Following amendments reflected in the official implementation timeline, certain high-risk obligations are scheduled for 2 December 2027 and 2 August 2028, depending on the category.[12] It would therefore be inaccurate to suggest that every AI Act obligation is already applicable.

The EU model also has limitations. Extensive compliance requirements may disproportionately burden smaller enterprises, and classification can become difficult when a system is used in several contexts. India should learn from the EU's enforceable safeguards while avoiding unnecessary administrative complexity.

India and the EU share the objective of encouraging responsible AI development but differ in regulatory structure. India relies on constitutional protections, existing statutes, sectoral rules and governance guidance; the EU has consolidated significant AI-specific duties in a binding regulation.

The Indian approach offers flexibility and can accommodate sectoral differences. However, dispersed obligations may create uncertainty about who must test a system, disclose its limitations or provide remedies after harm. The EU model provides greater formal clarity, although implementation costs and technical complexity remain concerns.

India's constitutional context is particularly important. Algorithmic systems may reproduce social inequalities when trained on incomplete or unrepresentative datasets. Risk assessment should therefore consider language diversity, gender, disability, socioeconomic disadvantage and unequal access to digital services.

India's guidelines recognise fairness, inclusion and accountability, but these principles need practical effect. Where an AI system materially influences a consequential decision, individuals should receive appropriate notice, an accessible means of challenging the outcome and meaningful human review.

At the same time, a comprehensive statute should not impose identical duties on every application. Excessive licensing, documentation and approval requirements could discourage startups and beneficial research. India's strongest option is a hybrid framework: enforceable baseline protections, enhanced obligations for high-risk systems and sector-specific rules where technical expertise is essential.

4. Comparative analysis and critical assessment

India and the EU share the objective of encouraging responsible AI development but differ in regulatory structure. India relies on constitutional protections, existing statutes, sectoral rules and governance guidance; the EU has consolidated significant AI-specific duties in a binding regulation.

The Indian approach offers flexibility and can accommodate sectoral differences. However, dispersed obligations may create uncertainty about who must test a system, disclose its limitations or provide remedies after harm. The EU model provides greater formal clarity, although implementation costs and technical complexity remain concerns.

India's constitutional context is particularly important. Algorithmic systems may reproduce social inequalities when trained on incomplete or unrepresentative datasets. Risk assessment should therefore consider language diversity, gender, disability, socioeconomic disadvantage and unequal access to digital services.

India's guidelines recognise fairness, inclusion and accountability, but these principles need practical effect. Where an AI system materially influences a consequential decision, individuals should receive appropriate notice, an accessible means of challenging the outcome and meaningful human review.

At the same time, a comprehensive statute should not impose identical duties on every application. Excessive licensing, documentation and approval requirements could discourage startups and beneficial research. India's strongest option is a hybrid framework: enforceable baseline protections, enhanced obligations for high-risk systems and sector-specific rules where technical expertise is essential.

5. Recommendations for India

India should adopt the following measures to strengthen its existing approach.

First, establish a statutory risk-classification framework. AI applications should be classified according to their intended purpose, foreseeable harm and effect on fundamental rights. Clearly defined prohibited practices and high-risk categories would improve predictability and direct enforcement towards serious harms.

Secondly, impose proportionate duties on developers and deployers. Developers should provide appropriate technical documentation and disclose known limitations. Organisations using AI in consequential decisions should assess risks, maintain records, monitor performance and ensure meaningful human oversight.

Thirdly, strengthen transparency and remedies. Individuals should receive appropriate notice when AI materially influences a consequential decision and have access to a meaningful review process. Grievance mechanisms should identify the competent authority and provide accessible routes to redress.

Fourthly, improve regulatory coordination. they should coordinate with sectoral regulators and technical institutions to develop common standards, share expertise and avoid overlapping obligations. Existing regulators should retain responsibility for risks within their statutory mandates.

Fifthly, support responsible innovation. Regulatory sandboxes, accessible testing facilities and simplified compliance guidance can assist smaller enterprises. Such measures should not remove essential safeguards for individuals or the public.

Finally, review the framework periodically. Risk classifications and technical standards should be updated through evidence-based consultation. Regular review would allow India to respond to new capabilities without imposing unnecessary restrictions on beneficial innovation.

These reforms would build on India's existing governance guidelines while addressing the difference between voluntary principles and enforceable legal duties.

6. Conclusion

India has developed an important foundation for AI governance through constitutional protections, digital legislation, sectoral regulation and the India AI Governance Guidelines. Nevertheless, the existence of these instruments does not guarantee that all significant AI risks are covered by clear duties, coordinated enforcement and effective remedies.

The EU AI Act demonstrates the value of classifying systems according to risk and allocating specific responsibilities to relevant actors. Its approach offers useful lessons concerning prohibited practices, high-risk systems, transparency and accountability. However, its regulatory complexity also demonstrates why implementation must remain proportionate.

India should not simply copy the EU model. It should develop a hybrid framework that reflects its constitutional principles, socioeconomic diversity, institutional capacity and innovation priorities. Such a framework should combine enforceable baseline safeguards, enhanced obligations for high-risk applications, sector-specific standards and accessible grievance mechanisms.

India is ready to advance towards risk-based AI governance, but readiness must be demonstrated through effective implementation rather than policy commitments alone. Converting guiding principles into clear legal responsibilities and practical remedies would help ensure that technological progress remains consistent with equality, privacy, accountability and human dignity.