The “No AI Act” Strategy: How Notified DPDP Rules and Stealth IT Amendments Just Rewrote India’s Tech Practice

The Illusion of the Indian AI Act

For the past two years, Indian tech lawyers and corporate counsels have been bracing for a monolithic, EU-style Artificial Intelligence Act. You can stop waiting. The regulatory roadmap for 2026 is now explicitly clear, and it requires a massive pivot in how we advise tech clients. MeitY Secretary S. Krishnan recently confirmed that the government will lean entirely on existing legal frameworks to govern AI, stepping in with new legislation only if "absolutely necessary."

Instead of a shiny new AI statute, the government is weaponizing the laws already on the books. The administrative rules for the Digital Personal Data Protection (DPDP) Act, 2023 have finally been notified, moving us from theoretical compliance to an enforcement-ready regime. Simultaneously, a February 2026 amendment to the IT Rules has fundamentally altered intermediary liability regarding deepfakes and AI-generated content. For practicing lawyers, the message is unequivocal: master the matrix of the DPDP Act, the IT Rules, and the Copyright Act, because that is your AI law.

DPDP Rules Notified: The "Wait and See" Era is Over

The notification of the DPDP administrative rules is the most consequential development for corporate and tech practices this year. We are no longer operating in the grace period. While reports indicate a phased transition, the substantive obligations—specifically around Significant Data Fiduciaries (SDFs), data breach reporting, and consent managers—are now concrete legal mandates.

The sharpest compliance thorn for consumer-facing companies (EdTech, gaming, social media) is the crystallization of the verifiable parental consent requirement under Section 9 of the DPDP Act. The rules now demand strict compliance from platforms processing children’s data. This creates a fascinating legal paradox for privacy counsels: How do you verify a parent's identity without violating the DPDP Act's core tenet of data minimization? Lawyers will need to draft highly specific, purpose-limited consent architectures to navigate this.

“The DPDP Act requires consent to be free, specific, informed, unconditional, and unambiguous. Boilerplate clickwrap agreements that bundle service provision with broad data harvesting are now legally dead on arrival.”

Furthermore, recent legal commentary solidifies that under Section 6 of the DPDP Act, the withdrawal of consent mandates the immediate cessation of processing and deletion of data, unless retention is strictly required by another law. This is going to be a nightmare for M&A due diligence. If a target company's data lake is polluted with data where consent was withdrawn but not deleted, the acquirer is buying a massive statutory liability.

Targeting AI Through the IT Rules Backdoor

Because there is no AI Act, the Ministry of Electronics and Information Technology (MeitY) is regulating AI output through intermediary guidelines. The February 2026 amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is a surgical strike on synthetic media.

The amendment drastically lowers the takedown threshold for synthetically generated information (deepfakes) and shortens response timelines. Here is why this matters for your practice: it directly threatens the safe harbour protection granted to intermediaries under Section 79 of the Information Technology Act, 2000.

Previously, platforms could afford a brief deliberative window upon receiving a grievance. Now, if an intermediary fails to execute an accelerated takedown of AI-generated misinformation or deepfakes, they risk losing their Section 79 immunity, opening them up to primary liability under the Bharatiya Nyaya Sanhita (BNS) and the IT Act. In-house counsels must immediately overhaul their grievance redressal SOPs to meet these hyper-compressed statutory timelines.

The IP Litigation Goldmine

MeitY’s assertion that existing Intellectual Property laws are sufficient to cover AI-related issues is arguably the weakest link in the government's current stance—and a massive opportunity for litigators. Relying on the Copyright Act, 1957 to resolve generative AI disputes is akin to using a scalpel to chop wood.

Section 2(d) of the Copyright Act inherently ties authorship to a human creator. When an AI model scrapes copyrighted Indian content to train its LLM, is it fair dealing under Section 52, or is it infringement? When a user prompts an AI to create a commercial artwork, who owns the copyright? The government’s reluctance to amend the Copyright Act to explicitly address text-and-data mining (TDM) or AI authorship means these questions will not be settled by parliament, but by the High Courts. We are about to enter a golden age of IP litigation in India, driven entirely by statutory ambiguity.

The Takeaway for Practitioners

The 2026 regulatory landscape requires Indian lawyers to be agile. Stop advising clients to wait for a comprehensive AI framework. Instead, you must immediately:

• Audit Data Flows: Re-map client data flows to ensure compliance with the newly notified DPDP rules, especially regarding verifiable parental consent and data deletion mechanics.
• Revamp Intermediary Policies: Update terms of service and grievance mechanisms for social media and content platforms to comply with the February 2026 IT Rule amendments regarding synthetic content.
• Prepare for IP Battles: Audit how your clients are using generative AI tools in their daily operations and ensure they have contractual indemnities in place, because Indian copyright law will not protect them from AI-generated infringement claims.

The government has shown its hand. The future of Indian tech regulation isn't about new laws; it’s about the aggressive, expansive enforcement of the ones we already have.