The Policy Shift

The Indian Ministry of Electronics and Information Technology has initiated a formal departure from the legacy Information Technology (IT) Act of 2000, signaling that existing frameworks are insufficient to govern modern AI capabilities. Union Minister Ashwini Vaishnaw confirmed that the government is actively architecting a new legislative framework, prioritizing a balance between high-velocity innovation and systemic safety.

What Happened

Minister Ashwini Vaishnaw stated in a recent interview that the 24-year-old IT Act, which predates the current wave of generative AI, cannot accommodate emerging risks like autonomous vulnerability detection and synthetic media manipulation. The government is now entering a consultation phase with industry stakeholders to codify these new requirements, prompted by global concerns over models capable of high-speed code exploitation—most notably Anthropic’s Claude Mythos.

Why It Matters

First-order: Domestic and international AI developers operating in India should expect a shift toward mandatory compliance audits, transparency requirements, and liability frameworks for AI-generated output. This will likely move beyond the light-touch approach applied to standard software services.

Second-order: If the proposed framework mirrors European-style rigidity, capital allocation for India-based AI training compute and foundation model R&D may shift to regions with clearer, more permissive sandbox environments. Conversely, a balanced approach could position India as a unique, safe-harbor hub for enterprise-grade AI deployment.

Third-order: This signals a multi-year trend toward ‘algorithmic sovereignty,’ where nation-states aggressively legislate the specific capabilities of models allowed within their borders, significantly increasing the complexity of global GTM strategies for AI-native startups.

What To Watch

  • Regulatory Sandboxes: Watch for the release of draft guidelines in the next 90 days that define ‘high-risk’ AI applications vs. general-purpose tooling.
  • Liability Standards: Monitor whether the new law assigns legal responsibility for security breaches directly to model providers or the end-user enterprises.
  • Cybersecurity Thresholds: The government is likely to implement stricter ‘export-style’ controls on high-capability models like Claude Mythos to prevent misuse by non-state actors.