Legislative Jugaad: Why India’s "No New AI Law" Stance Creates a Compliance Minefield for Tech Lawyers

The Union Government has finally shown its hand on artificial intelligence, and the strategy is clear: innovation over regulation. By officially rejecting a bespoke AI regulatory framework this July 2026, the Ministry of Electronics and IT (MeitY) has effectively deputized the Digital Personal Data Protection (DPDP) Act, the Information Technology (IT) Rules, and our existing Intellectual Property statutes as India’s de facto AI regulators.

For policymakers, this sounds like a streamlined, pro-business approach. But for tech lawyers, privacy practitioners, and IP counsels advising clients on the ground, this reliance on a legislative patchwork translates into a massive, immediate compliance headache. We are now forced to shoehorn 21st-century generative AI issues into frameworks that are either constitutionally fraught or desperately awaiting amendment.

The DPDP Rules 2025: The De Facto AI Regulator

With the administrative rules for the DPDP Act—the Digital Personal Data Protection Rules, 2025—now officially in force, the compliance burden on data fiduciaries has crystallized. Under the new rules, consent must unequivocally be free, specific, informed, unconditional, and unambiguous via clear affirmative action.

Here is where the government's "DPDP is enough for AI" stance hits a wall in practice. If you are advising an AI startup scraping data to train Large Language Models (LLMs), how do you prove "specific and informed" consent for data subjects whose information was passively ingested? You cannot. Furthermore, the Rules explicitly state that the burden of proof for valid consent lies entirely with the data fiduciary. Because India’s DPDP Act lacks the broad "legitimate interest" exception found in the EU's GDPR, tech lawyers will have to aggressively overhaul their clients' Terms of Service to manufacture consent, or risk catastrophic penalties.

Constitutional Clouds Over the DPDP Act

Complicating this compliance mandate is the fact that the DPDP Act is currently fighting battles on multiple constitutional fronts. The Supreme Court has rightly issued notice to the Union regarding Section 44(3) of the DPDP Act, which surgically amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005.

"By removing the 'public interest' exception for the disclosure of personal information, the DPDP Act hasn't just protected privacy—it has inadvertently created an ironclad shield against transparency."

The Supreme Court’s decision to refer this to a larger bench is a massive development for writ litigators. An absolute ban on disclosing personal information under the RTI Act strikes at the heart of Article 19(1)(a). Coupled with the parallel PIL in the Delhi High Court challenging Sections 17–44 and the penalty schedules under Articles 14, 19, and 21, the DPDP Act is operating under a heavy constitutional cloud. Practice note: Advise your corporate clients to comply strictly with the 2025 Rules, but heavily caveat your memorandums—the penalty enforcement mechanisms could face judicial stays if the Delhi HC or Supreme Court finds the adjudicatory structure unconstitutional.

IT Rules 2026: The End of AI Safe Harbour?

If the DPDP Act handles the data, the February 2026 Amendments to the IT (Intermediary Guidelines) Rules handle the output. The shift in legislative language here is subtle but lethal for intermediary liability under Section 79 of the IT Act. platforms are no longer asked to "endeavour" to regulate synthetic content; they shall verify and label AI-generated content like deepfakes before publication.

By lowering the take-down threshold and shifting the burden of interpreting "good faith" onto the intermediaries, the safe harbour provision is effectively gutted for AI content. Social media platforms and generative AI hosts can no longer act as passive conduits. If your client hosts third-party AI content, their compliance teams must deploy mandatory technical labelling measures immediately, or risk losing Section 79 immunity.

The Silver Lining: Designs Act Overhaul

While privacy and IT lawyers navigate chaos, IP practitioners finally have a reason to celebrate. The DPIIT’s January 2026 proposed amendments to the Designs Act, 2000 are a masterclass in modernizing IP law. For years, IP lawyers have struggled to protect Graphical User Interfaces (GUIs), icons, and AR/VR interfaces, often resorting to weak copyright claims or passing-off suits because Section 2(d) of the Designs Act required application to an "article."

The proposed amendments fix this by:

• Extending statutory protection to virtual and non-physical designs, capturing the lucrative UI/UX and metaverse markets.
• Introducing a "5+5+5" renewable term, better suited for the fast-expiring aesthetic value of digital interfaces.
• Adding statutory damages up to ₹50 lakh for wilful infringement, giving real teeth to cease-and-desist notices.
• Providing a 12-month grace period for novelty, saving startups that accidentally disclose their designs before filing.

Furthermore, the proposal to join the Hague System will revolutionize outbound design filings for Indian tech companies, cutting down cross-border prosecution costs significantly.

The Verdict for Practitioners

The government’s refusal to draft a dedicated AI Act is not a reprieve from regulation; it is a reallocation of risk. Tech companies are now caught in a crossfire between strict DPDP consent rules, mandatory IT Rule labelling requirements, and constitutional challenges threatening the very fabric of India's privacy regime. Lawyers must pivot from looking for "AI compliance" to aggressively auditing their clients' data ingestion pipelines, intermediary safe harbour protocols, and UI/UX IP portfolios. The law hasn't stood still—it has just gone undercover.