AI regulation and governance

In short

AI regulation and governance is the set of laws, standards and internal controls that decide who may build or deploy an AI system, on what data, with what documentation, and who is answerable when it causes harm. For a data engineer it is not legal theory: it becomes concrete artefacts in the pipeline — consent flags, lineage, model registries, audit logs, retention jobs, incident reporting hooks. India has no single AI Act; governance runs through the Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, the IT Act, 2000 and IT Rules, 2021, sector regulators (RBI, SEBI, IRDAI, TRAI), CERT-In directions and voluntary frameworks (MeitY/NITI Aayog), while exporters must also meet the EU AI Act. It is examined in data-engineering, MLOps, cyber-law and IT-governance papers, and asked in interviews at TCS, Infosys, Wipro, Accenture, Deloitte, EY, banks and fintechs, where "how would you make this pipeline auditable?" is a standard round.

Explained

Why AI needs regulation beyond ordinary software

• Opacity: a trained model's decision rule is statistical, not written down — so accountability must be built from documentation and logs, not source code reading.
• Data dependence: harm often originates in training data (stale, unrepresentative, unlawfully collected), so data-protection law is the main lever on AI.
• Scale and speed: one flawed model decides lakhs of cases per day; errors become systemic rather than isolated.
• Non-determinism and drift: behaviour changes with retraining and with input distribution, so a one-time certificate is meaningless — governance must be continuous.
• Diffuse responsibility: data provider, model builder, fine-tuner, deployer and integrator are different firms; regulation works by assigning roles with duties.
• Governance vs regulation: regulation is external and binding (Acts, Rules, regulator circulars); governance is the organisation's internal system of policies, roles, reviews and evidence that demonstrates compliance.

India's legal framework

• DPDP Act, 2023 — India's data-protection law; applies to digital personal data processed in India, and to processing outside India aimed at offering goods or services to people in India. Non-personal and anonymised data fall outside it.
• Key DPDP roles: Data Fiduciary (decides purpose and means — the AI deployer), Data Processor (processes on its behalf — the cloud/ML vendor, bound by contract), Data Principal (the individual), Consent Manager (registered intermediary for giving/withdrawing consent).
• Consent and notice: processing needs free, specific, informed, unconditional, unambiguous consent with clear affirmative action, preceded by an itemised notice of purposes and rights, available in English and the Eighth Schedule languages. Alternative ground: legitimate uses (voluntary provision, State functions, employment purposes, medical emergency, etc.). There is no "legitimate interests" basis as in the GDPR.
• Principles carried into the Act: purpose limitation, data minimisation, accuracy, storage limitation (erase when purpose is over or consent withdrawn), reasonable security safeguards, accountability.
• Data Principal rights: access to a summary of data and processing, correction/completion/updation and erasure, grievance redressal, nomination. Note what is absent: no express right to explanation of an automated decision and no general right against solely automated decision-making (contrast GDPR Article 22) — an important exam comparison.
• Children and persons with disability: verifiable consent of a parent/lawful guardian for anyone under 18; tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
• Significant Data Fiduciary (SDF): notified by the Central Government on volume and sensitivity of data, risk to rights, electoral democracy, security and public order. Extra duties: an India-based Data Protection Officer answerable to the board, an independent data auditor, periodic Data Protection Impact Assessment and audit, and algorithmic due diligence — verifying that algorithmic software used for processing does not pose a risk to Data Principals' rights. This clause is the closest thing India has to a direct statutory duty on model behaviour.
• Breach duty and enforcement: intimate affected Data Principals and the Data Protection Board of India on becoming aware of a personal data breach; the DPDP Rules prescribe immediate intimation with the available particulars and a fuller report within 72 hours. Penalties are capped by Schedule 1 — up to ₹250 crore for failure of reasonable security safeguards, ₹200 crore for breach-notification or children-related failures, ₹150 crore for SDF duties, ₹50 crore otherwise, and up to ₹10,000 on a Data Principal for breaching their own duties. Appeals go to TDSAT. The Rules were notified on 13 November 2025 with phased commencement: the breach, security and other Data Fiduciary duties and these penalties apply from 13 May 2027; until then IT Act s.43A and the SPDI Rules 2011 govern.
• Cross-border: transfer allowed except to countries restricted by Central Government notification (a "blacklist" model, lighter than the earlier localisation proposals); sectoral localisation still applies, e.g. the RBI's 2018 payment-data storage mandate.
• IT Act, 2000 and IT Rules, 2021: intermediary due diligence, grievance officer, takedown timelines; the Act's offences (identity theft, obscenity, cheating by personation) are what deepfakes are actually prosecuted under. MeitY's March 2024 advisory asked platforms to label under-tested or unreliable AI outputs and prevent unlawful deepfakes; amendments on labelling synthetically generated information were moved in 2025–26 — confirm the notified text before relying on specific percentages or label sizes.
• CERT-In Directions, 2022 (under s.70B): report specified cyber incidents within 6 hours of noticing, keep ICT logs for 180 days within India, synchronise clocks to NIC/NPL NTP, retain KYC/subscriber records for 5 years.
• Other statutes that bite: Bharatiya Nyaya Sanhita, 2023 (cheating, forgery, obscenity), Copyright Act, 1957 (training-data and output questions, unsettled in India), Consumer Protection Act, 2019 (unfair trade practice via misleading AI claims), Competition Act, 2002 (algorithmic pricing/collusion), and the four Labour Codes in force from 21 November 2025 where AI is used in hiring or worker monitoring.
• Policy and soft law: NITI Aayog's National Strategy for AI (2018) and *Responsible AI for All* principles (2021); TRAI's 2023 recommendation for an independent statutory authority (AIDAI) and risk-based rules; the IndiaAI Mission (approved 2024, about ₹10,372 crore) with a Safe & Trusted AI pillar; MeitY's India AI Governance Guidelines (released November 2025) adopting a techno-legal, pro-innovation, existing-law-first approach with institutional mechanisms rather than a new Act; India hosted the AI Impact Summit in New Delhi in February 2026. BIS committee LITD 30 is developing Indian AI standards.
• Sector regulators: RBI — IT governance and outsourcing-of-IT-services directions, digital lending rules (no automatic credit-limit increase without consent), and the FREE-AI committee framework for responsible and ethical AI in finance; SEBI — intermediaries must report AI/ML usage in a quarterly return (2019 circulars) and remain responsible for AI outcomes regardless of vendor; IRDAI — information and cybersecurity guidelines; UIDAI/NPCI rules for Aadhaar and UPI data.

The international layer a student must know

• EU AI Act (Regulation 2024/1689): world's first horizontal AI law; in force from 1 August 2024, obligations phased — prohibitions and AI-literacy from February 2025, general-purpose AI model duties from August 2025, most high-risk duties from August 2026–27 (timelines were under review in late 2025, so verify).
  • Risk tiers: *unacceptable* (banned — social scoring, whether by public authorities or private actors, untargeted facial-image scraping, emotion recognition at work or school, certain predictive policing, manipulative techniques); *high-risk* (recruitment and worker management, credit scoring, education scoring, biometrics, critical infrastructure, medical devices, justice, migration) — needing a risk-management system, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, conformity assessment, CE marking and registration; *limited risk* (transparency only — disclose chatbots, label deepfakes and synthetic content); *minimal risk* (no obligation).
  • GPAI models: documentation, copyright policy, training-content summary; extra duties for models with "systemic risk".
  • Extraterritorial reach: an Indian IT-services firm supplying a high-risk AI system used in the EU is an in-scope provider — the main reason EU rules are tested in Indian placement interviews.
• GDPR: lawful basis, DPIA for high-risk processing, Article 22 safeguards on solely automated decisions with legal or significant effect, data-subject rights, 72-hour breach notice, fines up to 4% of global turnover.
• Soft frameworks: OECD AI Principles (2019, updated 2024), UNESCO Recommendation on the Ethics of AI (2021), G20 New Delhi Leaders' Declaration (2023), Council of Europe AI Convention (2024), US NIST AI Risk Management Framework 1.0 (Govern–Map–Measure–Manage, plus a Generative AI Profile).
• Certifiable standards: ISO/IEC 42001:2023 (AI management system — the auditable "ISO 9001 of AI"), ISO/IEC 23894:2023 (AI risk management guidance), ISO/IEC 22989 (terminology), ISO/IEC 24028 (trustworthiness), ISO/IEC 27001/27701 for information security and privacy.

Governance inside the organisation: structure and artefacts

• Three lines of defence: (1) product and data/ML engineering own controls; (2) model risk, privacy and compliance review and challenge; (3) internal audit gives independent assurance.
• Bodies and roles: AI/ethics review board or model risk committee; DPO; model owner and model validator (kept separate); Chief Data Officer; independent data auditor for SDFs; grievance officer.
• AI inventory/registry: every model with owner, purpose, risk tier, data sources, training date, version, approval status, monitoring plan and retirement date — the single artefact every auditor asks for first.
• Documentation artefacts: model cards (intended use, performance by subgroup, limitations), datasheets/data cards for datasets, system cards for composite products, DPIA/AIA reports, change logs, sign-off records.
• Lifecycle gates: problem definition and risk tiering → lawful-basis and data-sourcing review → DPIA → design and training with recorded lineage → pre-deployment validation and bias/robustness testing → approval and release → monitoring (drift, performance, complaints) → periodic revalidation → decommissioning with data erasure.
• Engineering controls that implement the law:
  • Consent and purpose metadata carried as columns/tags through the pipeline; purpose-based access so a marketing job cannot read KYC-purpose data.
  • Data lineage and immutable audit logs (who accessed what, which model version produced which decision) — required to answer access requests and to reconstruct an incident.
  • Pseudonymisation, tokenisation, k-anonymity or differential privacy for analytics; note that re-identifiable "anonymous" data is still personal data.
  • Retention and erasure jobs keyed to purpose expiry and consent withdrawal, propagated to backups, feature stores, embeddings/vector indexes and training snapshots — the step teams forget.
  • Reproducibility: versioned data, code, config and model weights, so a decision from last year can be re-derived.
  • Human-in-the-loop and appeal paths for consequential decisions; guardrails, prompt/response logging and content labelling for generative systems.
• Risk classification approach: tier by use-case impact (loss of liberty, livelihood, money, health) × autonomy of the decision × scale × population vulnerability; controls scale with tier, so low-risk experiments are not strangled.
• Assurance: internal self-assessment → independent internal audit → third-party audit/certification (ISO/IEC 42001) → regulator inspection; bias audits and red-teaming are the AI-specific additions.

DPDP compared with GDPR and the EU AI Act

• DPDP regulates *personal data*, is consent-first, has no sensitive-data category, no express automated-decision right, and caps penalties in rupees.
• GDPR regulates personal data with six lawful bases, special categories, DPIAs and turnover-linked fines.
• EU AI Act regulates *the AI system itself* by use-case risk, including models trained on non-personal data — it covers what data-protection law misses (safety, robustness, documentation, market surveillance).
• The three overlap: a hiring model in the EU needs GDPR lawful basis *and* AI Act high-risk conformity; the same product sold in India needs DPDP consent, IT Rules compliance and, if an SDF, algorithmic due diligence.

Limitations and open debates

• Innovation vs precaution: heavy ex-ante compliance raises cost for Indian startups and MSMEs; India has deliberately chosen guidelines over a new statute so far.
• Enforcement capacity: the Data Protection Board's strength, technical skill and case throughput are untested; appeals through TDSAT add delay.
• Definitional gaps: "anonymised", "synthetically generated", "AI system" and "significant" are contested; non-personal data and training-data copyright remain unlegislated in India.
• Extraterritorial friction: divergent regimes force firms to build to the strictest (the "Brussels effect"), while compute and foundation models sit outside national jurisdictions.
• Technical limits: explanations from post-hoc methods are approximations; fairness metrics conflict mathematically; audits of closed vendor models are shallow without access.

Key points

• DPDP Act, 2023 — India's data-protection law; consent-or-legitimate-use based; covers digital personal data, not anonymised or non-personal data.
• Data Fiduciary / Processor / Principal — decider of purpose / processor on contract / the individual whose data it is.
• Significant Data Fiduciary — government-notified; must appoint an India-based DPO and independent auditor, run periodic DPIA and audit, and do algorithmic due diligence.
• DPDP penalty ceilings — ₹250 crore (security safeguards), ₹200 crore (breach notice, children), ₹150 crore (SDF duties), ₹50 crore (residual); adjudicated by the Data Protection Board of India, appeal to TDSAT; enforceable from 13 May 2027.
• Breach reporting — DPDP (from 13 May 2027): inform Principals and the Board at once, fuller report within 72 hours; CERT-In: specified cyber incidents within 6 hours, logs kept 180 days in India.
• No explicit DPDP right to explanation — unlike GDPR Article 22; a frequent exam contrast.
• Cross-border transfer — permitted unless the country is restricted by notification; sectoral localisation (RBI payment data) still applies.
• EU AI Act risk tiers — unacceptable (banned), high-risk (conformity assessment), limited (transparency), minimal (free).
• High-risk duties — risk management, data governance, technical documentation, automatic logging, human oversight, accuracy/robustness/security, CE marking.
• NIST AI RMF — voluntary; four functions Govern, Map, Measure, Manage.
• ISO/IEC 42001:2023 — certifiable AI management system; ISO/IEC 23894 gives AI risk-management guidance.
• DPIA — documented assessment of rights impact before high-risk processing; AI impact assessment extends it to model behaviour.
• Model card / datasheet / AI inventory — the core evidence trio an auditor requests.
• Lineage + immutable logs + versioning — how reproducibility and the right to access are actually delivered.
• Erasure must propagate — backups, feature stores, embeddings and training snapshots, not just the primary table.
• Three lines of defence — build, challenge, audit; model owner and validator must be different people.
• Sector rules — RBI (IT outsourcing, digital lending, FREE-AI framework), SEBI (quarterly AI/ML reporting; intermediary stays liable), IRDAI (cyber/infosec).
• India's posture — no AI Act yet; IndiaAI Mission's Safe & Trusted pillar, MeitY India AI Governance Guidelines (2025), TRAI's proposed statutory authority.

Formulas and examples

Example 1 — Risk tiering and residual risk of a loan-approval model. A NBFC's model auto-rejects applicants below a cut-off. Likelihood of a materially wrong rejection pattern L = 4; impact (livelihood, regulatory action, reputation) I = 5.

• Inherent risk R = 4 × 5 = 20 of 25 → high tier.
• Controls added: subgroup performance testing, human review of all rejections near the cut-off, monthly drift report, appeal channel. Tested effectiveness e = 0.65.
• Residual risk = 20 × (1 − 0.65) = 7.0 → medium, acceptable with quarterly revalidation.
• Legal consequence: in the EU this use is high-risk (creditworthiness) and needs conformity assessment; in India the lender remains answerable under RBI digital-lending rules and, if an SDF, must carry out algorithmic due diligence under the DPDP Act.

Example 2 — Is the control spend justified? A health-tech Data Fiduciary estimates a 6% annual chance of a reportable breach caused by over-retained training data. Expected cost per event: ₹18 crore penalty exposure + ₹4 crore remediation + ₹3 crore lost contracts = ₹25 crore.

• EAL before = 0.06 × 25 = ₹1.50 crore/year.
• A purge pipeline, access-control rework and logging cut the probability to 1.5%: EAL after = 0.015 × 25 = ₹0.375 crore/year.
• Benefit = 1.50 − 0.375 = ₹1.125 crore/year against an annual control cost of ₹40 lakh → net benefit ₹72.5 lakh/year, so the control is justified.

Example 3 — Breach notification timeline. A pipeline leak exposing customer PII is detected at 14:20 IST on 10 June 2027 (after the DPDP breach duty commenced on 13 May 2027).

• CERT-In reportable incident: 14:20 + 6 h = 20:20 IST, 10 June 2027.
• DPDP: intimate affected Data Principals and the Board immediately with available particulars; detailed report by 14:20 + 72 h = 14:20 IST, 13 June 2027.
• If the controller were also EU-facing, the GDPR supervisory-authority notice is due within 72 h, i.e. the same 13 June deadline.

Example 4 — Retention and erasure sizing. A recruitment platform holds 1,20,00,000 candidate records; stated retention is 36 months from last activity; 18% are beyond it. Each record also contributes to a feature store and an embedding index.

• N_erase = 1,20,00,000 × 0.18 = 21,60,000 records.
• Erasure must hit 5 stores: OLTP table, warehouse, feature store, vector index, and monthly training snapshots (36 retained).
• Deletions to execute = 21,60,000 × 5 = 1,08,00,000 delete operations; at 12,000 deletes/second the purge takes 1,08,00,000 ÷ 12,000 = 900 s = 15 minutes of job time.
• Evidence to keep: a deletion certificate per store plus the job log — deleting only the OLTP row is the classic audit failure.

Example 5 — Audit readiness score. Of 25 models in the inventory, mandatory artefacts are 6 each (model card, datasheet, DPIA, validation report, monitoring plan, approval record) = 150 required; 118 are present.

• Completeness = 118 ÷ 150 = 78.7%.
• 14 models were formally reviewed this year → coverage = 14 ÷ 25 = 56%, below a 100% annual target for high-tier models — the finding an ISO/IEC 42001 auditor would raise.

Where it is used

• IT services and GCCs (TCS, Infosys, Wipro, HCLTech, Accenture, Cognizant): "responsible AI" and AI-assurance practices that make client models EU AI Act and DPDP ready; roles — AI governance consultant, privacy engineer, model risk analyst.
• BFSI (HDFC Bank, ICICI, SBI, Bajaj Finserv, Razorpay, CRED): model risk management for credit scoring, fraud and collections under RBI/SEBI expectations, with validation documents, challenger models and audit trails.
• Healthtech and insurtech (Apollo, Practo, Policybazaar, HealthifyMe): DPIAs for health data, consent managers, anonymisation before model training, CDSCO rules where software is a medical device.
• Public-sector platforms (Aadhaar/UIDAI, DigiLocker, Bhashini, GSTN, IRCTC): purpose limitation, access logging and grievance redressal at national scale.
• Audit and consulting (Deloitte, EY, KPMG, PwC, Grant Thornton): independent data auditor and ISO/IEC 42001 readiness work created directly by the SDF obligations.
• Platform and generative-AI products: synthetic-content labelling, provenance metadata, prompt/response logging, red-team reports; MLOps/data-platform engineers implement consent columns, lineage, retention jobs and model registries that these obligations rest on.

Interview questions

• Q: Does India have an AI law? A: Not a dedicated one; AI is governed through the DPDP Act, 2023, the IT Act and IT Rules, CERT-In directions, sector regulators and non-binding frameworks such as MeitY's India AI Governance Guidelines, with a new statute still under debate.
• Q: Who is a Data Fiduciary and who is a Data Processor in an ML project? A: The company that decides the purpose and means of processing is the Fiduciary and carries the legal duty; a cloud or ML vendor processing on its instructions is a Processor, bound only by contract and liable to the Fiduciary.
• Q: What extra duties does a Significant Data Fiduciary have? A: An India-based DPO reporting to the board, an independent data auditor, periodic DPIAs and audits, and algorithmic due diligence to verify its software does not risk Data Principals' rights.
• Q: Can anonymised data be used freely for training? A: The DPDP Act covers only personal data, so genuinely anonymised data is outside it — but if records can be re-identified by linkage, they are still personal data and the exemption fails.
• Q: What are the EU AI Act risk tiers and where does a resume-screening model sit? A: Unacceptable, high, limited and minimal; recruitment and worker-management systems are high-risk, needing risk management, data governance, documentation, logging, human oversight and conformity assessment.
• Q: Your model must be explainable to a regulator. What do you produce? A: The model card and DPIA, the training-data lineage, feature definitions and validation results, subgroup performance, the decision log for the specific case with model version, and the human-review and appeal record.
• Q: A user withdraws consent. What has to happen in the data platform? A: Stop processing on that basis and erase the personal data across OLTP, warehouse, feature store, vector index and backups, propagate to processors, and keep evidence; an already-trained model is usually retained but must be retrained if the data materially drove it — document the decision.
• Q: What are the Indian breach-reporting clocks? A: CERT-In: specified cyber incidents within 6 hours of noticing; DPDP (from 13 May 2027 under the DPDP Rules 2025): intimate affected Data Principals and the Data Protection Board on becoming aware, with the detailed report within 72 hours; until then IT Act s.43A and the SPDI Rules 2011 govern.
• Q: Difference between a DPIA and a model validation report? A: A DPIA assesses risk to individuals' rights from the processing and is a legal/compliance artefact; validation tests whether the model is statistically fit — accuracy, stability, subgroup performance — and is a technical artefact. Both are needed.
• Q: Is ISO/IEC 42001 certification a legal requirement in India? A: No — it is a voluntary certifiable AI management system standard, but it is commonly used as audit evidence and is increasingly asked for in enterprise and government procurement.
• Q: Who is liable if a vendor's AI model wrongly rejects a bank customer? A: The regulated entity deploying it — SEBI and RBI expectations make outsourcing a transfer of work, not of accountability; contractual recourse against the vendor is separate.
• Q: How would you make an LLM feature compliant? A: Define purpose and lawful basis, keep personal data out of prompts or mask it, pin and version the model, log prompts and outputs with retention limits, add guardrails and human review for consequential outputs, label AI-generated content, and record red-team and evaluation results in the AI inventory.

Common mistakes

• Treating DPDP as a renamed GDPR — writing about "legitimate interests", special categories or a right to explanation that the Indian Act does not contain.
• Quoting ₹250 crore as the penalty for any violation; it is the ceiling for one obligation (security safeguards), and the Board assesses proportionately.
• Confusing the CERT-In 6-hour cyber-incident report with the DPDP 72-hour detailed breach report, or missing one of the two.
• Assuming the EU AI Act is irrelevant to an Indian firm; it applies by market, so Indian providers and deployers serving the EU are in scope.
• Deleting only the primary table on an erasure request, leaving the feature store, embeddings, logs and training snapshots untouched.
• Equating fairness or accuracy testing with governance — without an inventory, documentation, approval records and audit trail there is no evidence of compliance.
• Writing "consent taken" as a boolean without purpose, timestamp, version of notice and withdrawal path — the pipeline then cannot prove lawful basis for any specific use.

Related topics

AI ethics, bias and responsible AI · MLOps and model deployment · Data warehousing and ETL · Cloud data platforms: BigQuery, Snowflake and Databricks · Information security and cyber law (IT Act, 2000) · Data pipelines: Airflow and Kafka