India has built its approach to responsible AI incrementally rather than through a single omnibus statute. The sequence matters, because each document does a different job.
- June 2018 — the National Strategy for Artificial Intelligence, published under the banner “AI for All”, setting a roadmap across five priority sectors and naming five barriers to adoption.
- February 2021 — Approach Document for India, Part 1: Principles for Responsible AI, establishing the seven principles.
- August 2021 — Part 2: Operationalizing Principles for Responsible AI, moving from statement to implementation.
- November 2022 — a third paper applying the framework to a concrete use case: facial recognition technology.
These are non-binding. They matter anyway, for two reasons. They supply the vocabulary Indian sectoral regulators now draw on, and they are grounded in the fundamental rights afforded by the Constitution rather than imported wholesale from other jurisdictions.
The seven principles
The 2021 approach document sets out seven principles for responsible management of AI systems:
- Safety and reliability
- Inclusivity and non-discrimination
- Equality
- Privacy and security
- Transparency
- Accountability
- Protection and reinforcement of positive human values
The document splits its concerns into system considerations — how decisions are made, who is included, who is accountable — and societal considerations, notably the impact of automation on employment. That second category is comparatively distinctive; many international frameworks treat labour impact as out of scope entirely.
Translating principles into engineering practice
Principles are easy to endorse and hard to act on. The translations below are where we find the work actually lands.
Inclusivity and non-discrimination: language is a first-order concern
In the Indian context this extends well beyond the protected characteristics that dominate Western fairness literature. A system evaluated only on English inputs, or trained largely on urban data, will underperform for large parts of the population in ways aggregate accuracy conceals entirely.
The practical expression is disaggregated evaluation: measure performance separately by language, region, channel and device class. A model at 91% aggregate accuracy might be at 96% for English web users and 68% for a regional-language voice channel. Only disaggregation surfaces that, and the DPDP Act’s requirement that notices be available in any of the 22 Eighth Schedule languages on request signals which way the regulatory wind blows.
Transparency: logging designed for reconstruction
Operationally, someone affected by a decision should be able to learn that AI was involved and understand the basis on which the decision was made. That requires decision logging designed for later reconstruction — feature values, model version, decision path, captured at inference time.
This is an architectural choice made early. It cannot be added as a reporting layer afterwards, because the evidence simply was not captured.
Accountability: a named human with authority to stop it
Each deployed system needs a named owner with the authority to suspend it. Accountability diffused across a vendor, a platform team and a business unit reliably produces no accountability at the exact moment it is needed.
The RBI’s FREE-AI framework makes the same move for financial services, placing responsibility with the deploying entity rather than the model provider.
Privacy and security: now with statutory teeth
This principle has moved from aspiration to law. The DPDP Rules were notified in November 2025, with full enforcement expected by May 2027 and penalties reaching ₹250 crore per violation.
For AI systems the operative questions are concrete: what personal data enters training sets and on what lawful basis; what enters prompts and retrieval context at inference; how long it persists in trace logs; and whether an erasure request can actually reach every derived copy — vector indexes, cached embeddings, evaluation datasets.
How the layers fit together
| Layer | Instrument | Force |
|---|---|---|
| National principles | NITI Aayog Responsible AI approach documents (2021–22) | Non-binding guidance |
| Personal data | DPDP Act 2023 and DPDP Rules 2025 | Statutory; penalties to ₹250 crore |
| Financial services | RBI FREE-AI report (Aug 2025) | Recommendatory, convertible to Master Directions |
| Securities markets | SEBI Regulation 16C (Feb 2025); June 2025 consultation on responsible AI/ML | Regulation plus proposed guidance |
| Ecosystem | IndiaAI Mission | Capability and infrastructure building |
The encouraging news for practitioners is how consistent these layers are. Human oversight of consequential decisions, transparency about AI involvement, accountability with the deploying organisation, fairness across populations, and security of personal data recur throughout. A team that builds for those five properties is substantially aligned regardless of which framework is invoked in the room.
Where implementations typically fall short
- Treating responsible AI as a pre-launch review. These principles describe properties of a running system. Fairness measured once is fairness unknown thereafter — models drift as populations change.
- Evaluating only on aggregate metrics, which hides precisely the disparities the principles exist to address.
- Assuming vendor components inherit the vendor’s compliance posture. Accountability follows deployment, not procurement.
- Logging enough to debug but not enough to explain. Engineering traces and decision evidence are different artefacts with different retention needs.
- Ignoring the societal limb. The Indian framework explicitly contemplates employment impact; deployment plans that never mention workforce effect are answering a narrower question than the framework asks.
Frequently asked questions
What are NITI Aayog’s seven principles for responsible AI?
Safety and reliability; inclusivity and non-discrimination; equality; privacy and security; transparency; accountability; and protection and reinforcement of positive human values. They were set out in the February 2021 approach document, Part 1.
Are NITI Aayog’s AI principles legally binding?
No. They are non-binding guidance. However, they inform sectoral regulation that does carry force — and the privacy principle now has statutory backing through the DPDP Act and Rules.
How many responsible AI documents has NITI Aayog published?
Three in the responsible AI series: Part 1 on principles (February 2021), Part 2 on operationalising them (August 2021), and a third paper applying the framework to facial recognition technology (2022). These build on the 2018 National Strategy for Artificial Intelligence.
What does responsible AI require in practice for Indian deployments?
At minimum: disaggregated evaluation across languages and regions rather than aggregate accuracy alone; decision logging designed for reconstruction; a named accountable owner with authority to suspend the system; continuous rather than one-off fairness measurement; and an erasure path reaching every derived copy of personal data.
This article summarises publicly available policy material for general information and is not legal advice.
