India Regulatory Crosswalk
Verification required. Claims on this page about Indian law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.
One row per instrument in the India AI Regulatory Hub, with the wiki controls that relate to it and its verification status. The last column is empty until a row has been confirmed against the primary text; record the primary URL and the date you retrieved it there.
The same data is available as a CSV file for GRC tooling: crosswalk.csv.
Legal force sorts each row under one of seven labels, so that law is not mistaken for guidance or for a voluntary framework. The label is this wiki's reading of the sources and carries the same verification caveat as the rest of the row.
| Label | Meaning |
|---|---|
| Binding law | Enacted law or regulation that applies generally in the jurisdiction, including provisions that start on a later date. |
| Binding in scope | Binding only on a sector, a free zone, a state or province, or public bodies. |
| Guidance | Published by a government or regulator, and not binding in itself. |
| Voluntary | A standard, code or framework that an organization chooses to adopt. |
| Proposed | A bill, draft or consultation, or a proposal that lapsed. It is not law. |
| Context | A policy, authority, programme or summary row that sets no rule. |
| Unclear | The sources used do not settle whether it binds. |
| ID | Instrument | Legal force | Type / status | Wiki controls | Verification tag | To verify | Primary URL and retrieval date |
|---|---|---|---|---|---|---|---|
| IN1 | Digital Personal Data Protection Act 2023 | Binding law | Binding; being implemented | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017; AI-CTRL-035 | Reported | Section numbers; penalty schedule | |
| IN2 | DPDP Rules 2025 | Binding law | Notified 13 Nov 2025 (gazette 14 Nov reported); phased | AI-CTRL-013; AI-CTRL-007; AI-CTRL-035 | Conflict | Exact phase dates; any shortening | |
| IN3 | Data Protection Board of India | Context | Established in law; not operational per Aug 2026 report | AI-CTRL-013; AI-CTRL-035 | Reported | Current status | |
| IN4 | India AI Governance Guidelines (MeitY) | Guidance | Non-binding; 5 Nov 2025 | AI-CTRL-012; AI-CTRL-039; AI-CTRL-041 | Reported | Institution names; text | |
| IN5 | RBI FREE-AI Committee report | Guidance | Non-binding; 13 Aug 2025 | AI-CTRL-011; AI-CTRL-014; AI-CTRL-023; AI-CTRL-037; AI-CTRL-041 | Reported | Recommendation list | |
| IN6 | RBI draft Guidance on Model Risk Management | Proposed | Draft 24 Jun 2026; comments to 24 Jul 2026 | AI-CTRL-011; AI-CTRL-037; AI-CTRL-038 | Reported | Final status | |
| IN7 | SEBI circulars on AI by market intermediaries | Binding in scope | Sector rules | AI-CTRL-011; AI-CTRL-014; AI-CTRL-038 | Reported | Circular numbers and scope | |
| IN8 | IRDAI: AI-cybersecurity readiness directive (May 2026); AI working group (Jun 2026) | Binding in scope | Sector directive and policy work | AI-CTRL-005; AI-CTRL-011 | Reported | Directive text | |
| IN9 | IT Rules amendments on synthetic content labelling | Unclear | Proposed or amended; reception mixed | AI-CTRL-039 | Conflict | Whether notified, effective date, scope | |
| IN10 | CERT-In incident reporting directions (2022) and AI guidance | Binding law | Binding directions; AI guidance unverified | AI-CTRL-035; AI-CTRL-005 | Recalled | Hour limit; AI guidance existence | |
| IN11 | IT Act 2000 and SPDI Rules | Binding law | Existing law until DPDP fully commences | AI-CTRL-005; AI-CTRL-013 | Recalled | Transition provisions | |
| IN12 | IndiaAI Mission | Context | Programme (Mar 2024; INR 10,372 crore) | None | Reported | n/a |