The "AI Act" Mirage: Why MeitY’s Pivot to DPDP and IT Rules Changes Everything for Tech Lawyers

For the last three years, the Indian tech-law fraternity has been waiting with bated breath for a bespoke, omnibus Artificial Intelligence Act. We can finally stop holding our breath. The Ministry of Electronics and Information Technology (MeitY) has made its stance unequivocally clear: there will be no standalone AI legislation in the near future. Instead, the government is officially pivoting to a patchwork strategy, relying on the recently operationalised Digital Personal Data Protection (DPDP) Act, 2023, the existing intellectual property regime, and tightening the Information Technology (IT) Rules to govern the AI ecosystem.

For practicing lawyers and in-house counsel, this is a seismic shift in regulatory strategy. The era of theorising about future AI compliance is over. The government's message is simple: the laws you need to navigate the AI revolution are already on the statute books. This approach prevents the stifling of innovation, as MeitY Secretary S. Krishnan recently articulated, but it fundamentally shifts the burden of interpreting how these legacy frameworks apply to frontier technology directly onto the shoulders of legal practitioners and the judiciary.

The DPDP Rules are Live: Consent as a Governance Mandate

The linchpin of this "existing frameworks" strategy is the DPDP Act, which has now transitioned from a dormant statute to an enforceable reality. With the Centre finally notifying the administrative rules for the DPDP Act (following the January drafts), the regulatory grace period has unceremoniously ended.

If your clients are training AI models on scraped data or deploying consumer-facing Generative AI tools, the operational focus must immediately shift to Section 6 (Consent) and Section 8 (General Obligations of Data Fiduciary). Under the newly notified rules, consent is no longer a mere boilerplate exercise of hiding a pre-ticked box in a monolithic privacy policy. It is a strict governance obligation.

"The DPDP framework emphasizes clear notice, informed consent, and easy withdrawal of consent. For Data Fiduciaries, the legal risk has crystallized: you must be able to forensically prove valid notice and lawful consent if challenged before the Data Protection Board."

Practitioners need to audit their clients' data pipelines immediately. If an AI tool utilizes personal data to generate its outputs, the Data Fiduciary bears the burden of proving that the data principal gave unconditional, informed consent specifically for model training. The days of relying on vague "service improvement" clauses to harvest data are dead. If your client cannot demonstrate an untethered withdrawal mechanism under Section 6(4), they are exposed to crippling penalties under Section 33.

Shoehorning Generative AI into the Copyright Act

Perhaps the most contentious element of the government’s stance is the assertion that AI-related issues are "already covered to a significant extent" by existing IP Acts. As any IP litigator knows, forcing Generative AI into the confines of the Copyright Act, 1957, is like trying to fit a square peg into a round hole.

When an AI generates a piece of code or a marketing image, who is the author? Section 2(d)(vi) of the Copyright Act states that for any computer-generated literary, dramatic, musical or artistic work, the author is "the person who causes the work to be created." But does a prompter "cause" the creation, or does the developer of the foundational model?

By refusing to create an AI-specific IP framework, the government has essentially outsourced this policy decision to the High Courts. We are going to see a massive uptick in infringement suits where plaintiffs argue that foundational models ingested their copyrighted works without licenses. Defense counsel will have to aggressively deploy the fair dealing exceptions under Section 52, arguing that scraping for algorithmic training constitutes transformative use. Without a statutory safe harbour for text and data mining (TDM) in India, advising clients on AI model training just became one of the highest-risk areas of IP practice.

Policing the Output: IT Rules and Synthetic Content

While the DPDP Act governs the inputs (data) and the Copyright Act governs the ownership, the government is using the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 to regulate the outputs.

Instead of drafting an AI Act to combat deepfakes and algorithmic bias, the strategy is to impose tighter takedown timelines for synthetically generated information through amendments to the IT Rules. This drastically alters the intermediary liability landscape. The Section 79 safe harbour of the IT Act, 2000, is now contingent on hyper-vigilance. Social media platforms and AI hosts can no longer take a passive "wait for a court order" approach.

Under the enhanced due diligence obligations (Rule 3(1)(b)), intermediaries must proactively ensure their platforms do not host deepfakes or misleading AI-generated content. For tech lawyers, this means advising intermediary clients to implement automated filtering mechanisms and rapid-response grievance redressal systems, balancing the urgency of compliance against the constitutional scrutiny of potential free speech violations.

The Bottom Line for Practitioners

The message from the corridors of MeitY is clear: stop looking to the horizon for an AI law. The regulatory matrix is already here—it is just fragmented across data protection, IP, and intermediary rules.

For lawyers, this means breaking down the silos of traditional practice areas. You can no longer be just a "privacy lawyer" or just an "IP litigator." Advising a tech client in 2026 requires a synthesized understanding of how a single AI product interacts with the DPDP's consent requirements, the Copyright Act's authorship tests, and the IT Rules' takedown mandates. The legislative drafting might be lacking, but the advisory and litigation opportunities have never been richer.