The Global Regulatory Landscape: EU, India and Beyond

AI is now regulated, but not in one way. The European Union has written a single, detailed law. India has chosen principles, existing laws and targeted rules. The United States relies largely on frameworks and state laws, and China on specific rules for specific technologies. If your solution may serve users across borders, or use their personal data, you need to understand all of these approaches.

Three ways to regulate AI

The European Union: the AI Act

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law. It entered into force on 1 August 2024 and applies in stages. Crucially, it reaches beyond Europe: it applies to providers placing AI systems on the EU market and to systems whose output is used in the EU, so an Indian company serving European customers can be covered.

Its central idea is that obligations should match the level of risk:

Prohibited practices include social scoring, AI that manipulates people or exploits vulnerabilities such as age or disability, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools, certain biometric categorisation (for example, inferring religion or sexual orientation), predicting crime purely from profiling, and, with narrow exceptions, real-time remote biometric identification in public spaces for law enforcement.

High-risk systems include AI used in hiring and worker management, education and exam scoring, access to essential private and public services (such as credit scoring and benefits), critical infrastructure, biometrics, law enforcement, migration, and justice, as well as AI that is a safety component of regulated products such as medical devices. Their providers must have:

Organisations that use high-risk AI (deployers) also have duties, such as assigning trained human oversight and keeping logs; some, including public bodies and those using AI for credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment. Separate rules cover general-purpose AI models (such as large language models): documentation, a copyright policy and a summary of training content, with extra evaluation, incident-reporting and cybersecurity duties for the most powerful models that pose "systemic risk". A voluntary Code of Practice, published in July 2025, helps providers comply.

• 1 August 2024The AI Act enters into force.
• 2 February 2025Prohibited practices banned; AI literacy duty begins for providers and deployers.
• 2 August 2025Rules for general-purpose AI models, governance bodies and penalties apply.
• 2 August 2026Original date for most remaining rules, including transparency duties and high-risk systems listed in Annex III.
• 2 August 2027Original date for high-risk AI embedded in regulated products (Annex I).

In November 2025 the European Commission proposed a "Digital Omnibus" package that would push some high-risk deadlines back, to as late as December 2027 for Annex III systems and August 2028 for product-related systems, partly so that technical standards are ready first. Check the current status before relying on any date.

India: principles, existing laws and targeted rules

India does not have a single, standalone AI law. Instead it combines a strong data protection law, rules for online platforms, national AI guidelines, sector regulators and major public investment. For anyone building AI in India, these are the pieces that matter.

1 · Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

The DPDP Act governs how digital personal data is processed, which includes data used to train or run AI. Its rules were notified in November 2025, with obligations phased in over the following months. Key ideas:

• Consent and notice: process personal data for a lawful purpose, generally with free, specific, informed consent after a clear notice (also available in Indian languages), or for certain "legitimate uses".
• Purpose limitation and minimisation: use data only for the stated purpose, keep it accurate, protect it with reasonable security safeguards and erase it when no longer needed.
• Rights of individuals ("data principals"): access, correction, erasure, grievance redressal and nomination.
• Children: verifiable parental consent is needed for under-18s, and tracking, behavioural monitoring and targeted advertising directed at children are restricted.
• Significant Data Fiduciaries (designated based on volume and sensitivity of data and risk) face extra duties such as data protection impact assessments and audits.
• Enforcement by the Data Protection Board of India, with penalties of up to ₹250 crore per breach.

One AI-relevant detail: the Act does not apply to personal data that the person themselves has made publicly available. That does not make all scraping safe; other laws, platform terms and ethics still apply.

2 · IT Rules: labelling AI-generated content

Amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, notified on 10 February 2026 and in force from 20 February 2026, introduced obligations for synthetically generated information: online platforms must ensure AI-generated content is labelled and act against unlawful synthetic content such as harmful deepfakes, or risk losing their legal protections as intermediaries.

3 · India AI Governance Guidelines (November 2025)

Released by the Ministry of Electronics and IT (MeitY), the guidelines set out a principle-based, pro-innovation approach: use existing laws where possible, fill gaps with targeted amendments, and rely on voluntary frameworks, standards and "techno-legal" tools rather than a sweeping new AI law for now. They are built on seven principles, or sutras:

The guidelines also propose institutions to coordinate policy, such as a high-level AI Governance Group supported by a technology and policy expert committee and the IndiaAI Safety Institute, which was announced in 2025.

4 · Sector regulators and public investment

In February 2026 India hosted the AI Impact Summit in New Delhi, continuing the global summit series that began at Bletchley Park (2023) and continued in Seoul (2024) and Paris (2025).

The rest of the world in brief

International agreements

• OECD AI Principles (2019, updated 2024): the first intergovernmental AI principles, adopted by many countries.
• UNESCO Recommendation on the Ethics of AI (2021): adopted by all UNESCO member states.
• G7 Hiroshima AI Process (2023): guiding principles and a code of conduct for developers of advanced AI.
• Council of Europe Framework Convention on AI (opened for signature September 2024): the first legally binding international treaty on AI, human rights, democracy and the rule of law.
• United Nations: in 2025 the General Assembly agreed to create an Independent International Scientific Panel on AI and a Global Dialogue on AI Governance.

What this means for you as a builder

You cannot track every law in every country, but you can design so that compliance is easy whichever rules apply. This is compliance by design:

• Classify your system's risk early, using the EU tiers as a useful mental model even if you only serve India.
• Collect personal data only with a clear notice, a lawful basis and the minimum needed (DPDP).
• Tell people when they are dealing with AI, and label AI-generated media.
• Keep documentation, logs and test results from day one; they are expensive to recreate later.
• Build in human oversight and a way for people to challenge decisions that affect them.
• Never build anything on a prohibited-practice list, such as social scoring or manipulation of vulnerable people.