AI & emerging technology law in India, argued by lawyers who read the model card before the contract.

Not yet, and not imminently. MeitY's AI governance drafting committee — constituted in July 2025 — assessed that a horizontal AI statute is not needed at this stage, concluding that the DPDP Act 2023, the IT Act 2000, the IT Intermediary Rules, and sector-specific regulation from RBI, SEBI, and IRDAI already provide adequate coverage when applied through a risk-based lens. The voluntary India AI Governance Guidelines, released in February 2026, supplement this with seven principles rather than new binding law. The practical implication: your AI compliance obligations are already in force, distributed across statutes you may already be tracking for other reasons.

The original 2 August 2026 deadline for high-risk AI system obligations has been postponed following a political agreement reached by EU negotiators on 7 May 2026 as part of the "Digital Omnibus on AI." Under the revised timeline, Annex III (use-based) high-risk systems now face obligations from 2 December 2027, and Annex I (product-embedded) high-risk systems from 2 August 2028. Two things to note: this agreement still requires formal adoption, expected around June–July 2026, and the prohibited-practices regime — the strictest tier — has applied without delay since February 2025 regardless of the Omnibus. Companies that paused EU AI Act preparation entirely on the strength of a headline are taking on unnecessary risk.

Yes, without exception for the fact that the processing happens inside a model rather than a conventional database. Any AI system that ingests, processes, stores, or outputs personal data belonging to individuals in India is subject to the full DPDP Act 2023 framework, as operationalised by the DPDP Rules 2025 (notified 14 November 2025 via Gazette G.S.R. 846(E)). This includes consent-collection architecture, purpose limitation, data minimisation, defined breach-notification timelines, and data principal rights such as erasure and access — all building toward the 13 May 2027 full-compliance deadline.

You remain the Data Fiduciary — and the liable party — regardless of what your vendor's standard terms say. Most off-the-shelf LLM API agreements are drafted for a US or EU regulatory baseline and do not address DPDP-specific requirements such as breach-notification timelines to the Data Protection Board of India or data principal rights fulfilment. A vendor contract review before signature, not after an incident, is the difference between a negotiated data processing addendum and an indemnification fight.

Yes, and the difference is not academic. Findings from a legal assessment conducted by a law firm under attorney-client privilege are, in general, protected from compelled disclosure in litigation or a regulatory investigation. Findings from a standalone technical audit or management-consulting review typically carry no such protection — meaning an unfavourable finding can itself become discoverable evidence used against the organisation that commissioned it. This is the structural reason companies increasingly route AI risk assessments through counsel rather than directly through a consulting engagement.

Usually sooner than founders expect, for one specific reason: the cost of building governance in from day one is a fraction of retrofitting it after a funding round's due diligence, an enterprise customer's vendor security questionnaire, or a DPDP complaint surfaces a gap. Investors and enterprise buyers increasingly ask AI governance questions directly, and a founder who can produce a coherent answer — rather than an improvised one — closes faster.