India AI Law: Why Founders Must Adopt a Graded Risk Strategy
India is moving toward a dedicated, risk-based AI law. Non-technical founders building AI products need to assess their risk tier and document data sources now to avoid expensive rebuilds later.
If you're a non-technical founder or SME operator building a software product today, AI is almost certainly central to your roadmap. Indian enterprise AI spending is projected to cross 21% of overall IT budgets by 2027, according to a September 2026 report by ServiceNow. But as adoption accelerates, so does regulation — the era of unregulated AI development is ending. The government is now advancing a dedicated India AI law to govern how intelligent systems are built, deployed, and made transparent.
Rather than a blanket ban or one-size-fits-all red tape, Indian policymakers have taken a more pragmatic route. By mid-2026, officials from the Ministry of Electronics and Information Technology (MeitY) confirmed the upcoming legislation will be anchored in a graded risk strategy.
For founders who rely on outside partners to build their technology, this is a critical inflection point. Your development team can't just ship features fast — it needs to engineer for legal compliance from day one. If your application falls into a "high-risk" tier, failing to document your AI's decision-making process or data provenance now will likely mean an expensive rebuild later.
Here's what you need to know about the upcoming India AI law, how to assess your product's compliance risk, and how to protect your IP and runway.
The Dawn of the India AI Law
For years, India's tech ecosystem assumed AI would be governed by tweaking existing statutes — the Information Technology (IT) Act, 2000, and the Digital Personal Data Protection (DPDP) Act, 2023. But the pace at which AI has evolved, from simple text generators to autonomous decision-making agents, forced a change in strategy.
A recent industry analysis found that India's physical AI boom is outpacing legacy laws — traditional product liability and consumer protection statutes don't account for autonomous algorithmic decisions. Recognizing the gap, the government pivoted.
The groundwork was laid by the November 2025 AI Governance Guidelines, which NASSCOM hailed as an innovation-centred blueprint. These introduced two oversight bodies: the Technology & Policy Expert Committee (TPEC) for technical advice, and the AI Safety Institute (AISI) for risk assessment. MeitY is now formalizing both into a standalone legal framework.
Policy experts and MeitY officials have been clear that a one-size-fits-all AI law won't work in India — the legislation will instead classify applications by their potential to cause harm.
Unpacking the Graded Risk Strategy
The core philosophy behind a graded risk strategy is proportionality: the compliance burden on your startup scales directly with your software's socioeconomic impact.
Low-Risk AI: Transparency Is Key
If your AI tool poses minimal threat to user safety or fundamental rights, the regulatory burden stays light — think customer service chatbots, internal productivity summarizers, grammar checkers, and e-commerce recommendation engines.
For these, the upcoming AI act India will mainly require transparency: notify users they're interacting with an AI system, and label or watermark AI-generated content such as deepfake marketing materials.
High-Risk AI: Strict Audits and Graded Liability
The picture changes if your product touches critical areas of human life. Officials drafting the framework have flagged healthcare diagnostics, banking and finance, automated loan underwriting, and critical infrastructure as high-risk sectors.
If your software decides whether someone gets a loan or needs a medical procedure, you're building a high-risk application, subject to:
- Algorithmic audits — proving your model doesn't exhibit demographic bias.
- Human-in-the-loop mandates — autonomous actions need a human override.
- Graded liability — if your AI causes financial harm through hallucination or biased training data, liability flows back to the company operating the software.
The "Build Now, Fix Later" Trap for Non-Technical Founders
Many non-technical domain experts have strong ideas for industry-specific AI products, and typically hire traditional software outsourcing agencies to build them. These agencies are incentivized to ship code fast, bill hours, and move to the next client.
To ship fast, standard dev shops often wrap an interface around a black-box Large Language Model (LLM), fine-tune it on unverified scraped data, and launch — without building auditing mechanisms, tracking data provenance, or isolating personally identifiable information (PII) from the AI's contextual memory.
That creates legal debt. Once AI compliance India mandates take effect, products handling sensitive data without documented provenance become illegal to operate. If a user demands deletion under the DPDP Act (fines up to INR 250 crore) and your AI has absorbed their data into its neural weights because your dev shop never separated the databases, you can't just patch it — you'll have to tear down the application and rebuild the data architecture from scratch.
This is exactly why standard outsourcing is a growing risk for AI startups, and why a Build-Operate-Transfer (BOT) model works better. At Ganakys, we don't just hand over a codebase and leave — we engineer the product to withstand rigorous compliance checks and operate it in the real world. Because we carry operational responsibility until your in-house team is trained and ready to take over, we're directly incentivized to keep AI pipelines legally sound, bias-free, and compliant with emerging regulations.
Classifying Your AI Product's Risk Level
Before writing a line of code or signing a vendor contract, classify your product concept. Use the framework below to see where your application is likely to fall under the upcoming India AI law.
| Risk Tier | Example SME & Startup Use Cases | Expected Regulatory Burden | Immediate Action Items for Founders |
|---|---|---|---|
| Low Risk | Inventory forecasting, grammar tools, basic chatbots, internal meeting summarizers. | Minimal. Primarily focused on user transparency and content labeling. | Ensure UI/UX clearly states when users are interacting with AI. Label generated outputs. |
| Medium Risk | EdTech automated grading, HR resume screening bots, targeted advertising engines. | Moderate. Requires documentation of data sources and basic bias testing. | Implement clear data provenance. Ensure human oversight is available for contested decisions. |
| High Risk | Fintech credit scoring, medical diagnostic imaging, robotic process automation in manufacturing. | Severe. Mandatory algorithmic auditing, incident reporting, and strict data privacy enforcement. | Build modular "explainable AI" pipelines. Hire independent auditors. Maintain air-gapped PII databases. |
3 Proactive Steps for AI Compliance in India
You can't afford to wait for the official gazette notification to start your compliance journey. Designing a compliant architecture is complex enough; retrofitting a live AI product is far more expensive. Here are three steps to take now.
1. Architect for Strict Data Provenance
Data provenance is the ability to trace where information came from, how it was processed, and why the AI used it to make a decision. If you're using Retrieval-Augmented Generation (RAG) to power a legal or financial chatbot, your database must tag every text chunk with its source document and licensing rights.
When we engineer architectures at Ganakys — including the infrastructure behind our own Ganakys products like Codilla.ai — we enforce strict data firewalls, keeping the AI engine mathematically separated from private user data. This relies on vector databases that allow instant deletion of specific data points without retraining the core model.
2. Implement Guardrails and Explainability
In high-risk sectors, "black box" AI won't cut it. If an algorithm denies someone a loan, the forthcoming regulations will likely require you to explain why — "the neural network decided it" won't satisfy a regulator.
Your architecture needs programmatic guardrails: rule-based microservices that sit between the AI model and the end-user, fact-checking output in real time. If the AI generates a response that violates predefined safety parameters — say, dispensing medical advice when it's only meant to summarize symptoms — the guardrail blocks it and triggers a human handoff.
3. Move Beyond Standard Dev Shops
Without a technical co-founder, your choice of development partner determines your legal exposure. Evaluating your engagement models is critical in 2026 — a standard fixed-cost agency will build what you ask for, but won't proactively flag the legal risk of training a custom model on copyrighted data.
You need a partner who acts as an operator: monitoring the AI's behavior in production, tracking model drift (when accuracy degrades or bias creeps in over time), and adjusting the architecture as AISI releases new technical standards.
How the AI Act India Impacts Startup Fundraising
Beyond avoiding government penalties, a graded risk strategy is becoming a prerequisite for raising capital. VC firms in India and globally have updated their due diligence checklists in 2026.
Investors are wary of the liabilities tied to unregulated "AI wrappers." Pitch a healthcare AI platform without a clear data provenance pipeline, and VCs will flag it as a legal risk. Founders who can present a compliant, explainable architecture alongside a solid operational partner will command higher valuations and faster rounds. Preempting the upcoming software regulations India signals a resilient, enterprise-grade business — not a weekend hackathon project.
Frequently Asked Questions
Q: When will the new India AI law officially take effect? The exact legislative timeline depends on parliamentary scheduling, but MeitY has been accelerating the framework through 2026. With the AI Governance Guidelines active since late 2025 and bodies like the AI Safety Institute (AISI) already formed, founders should treat the graded risk strategy as the de facto standard today.
Q: Does the graded risk strategy apply to small startups, or only to big tech companies? It applies to the application, not the size of the company. A three-person startup building an automated loan underwriting tool faces the same high-risk auditing requirements as a multi-billion-dollar bank. Risk is tied to use case, which levels the playing field but demands real engineering rigor from startups.
Q: How does AI compliance in India differ from the EU AI Act? The EU AI Act is notably prescriptive, which has slowed some early-stage innovation in Europe. India's approach aims to balance citizen safety with economic growth — NASSCOM has praised the framework for prioritizing coordination and voluntary compliance tools over a punitive, centralized regulator.
Q: Can I use open-source AI models commercially under the new laws? Yes, but liability stays with you. If an open-source model you deploy generates illegal, biased, or harmful content, the graded liability framework holds you — the platform operator — legally responsible, not the model's original creator.
***
Building a scalable, compliant AI product takes more than API access — it takes enterprise-grade architecture and ongoing operational vigilance. If you have a domain-expert product vision but lack the engineering team to navigate this landscape, submit a BOT request to discuss how Ganakys can build, operate, and eventually transfer a risk-resilient AI platform to your business.