India's AI policy context for practitioners, as of September 2026

A dated timeline, with sources

This table is deliberately short. It contains only items verified against official text for this article. Other government guidance on AI has been published and discussed; check the MeitY website for current advisories and guidelines, and read the documents themselves rather than news summaries.

The IndiaAI Mission: what it offers a practitioner

The Cabinet release describes the Mission as implemented by the IndiaAI Independent Business Division under Digital India Corporation. The components named in that release are worth knowing because each can touch your work:

• Compute capacity: AI compute infrastructure of 10,000 or more GPUs built through public-private partnership, and an AI marketplace offering AI as a service and pre-trained models. If you work at a startup or research group, this is a possible route to compute; check current access terms on the IndiaAI portal.
• IndiaAI Innovation Centre: development of indigenous large multimodal and domain-specific foundation models. Relevant when clients ask about Indian-developed model options.
• IndiaAI Datasets Platform: access to non-personal datasets for startups and researchers. Useful for building and evaluating systems without personal data.
• Application development, startup financing and safe and trusted AI: programmes that may fund or shape projects in your sector.

For careers, the practical takeaway is that questions about Indian-language models, domestic compute and public datasets will come up in client and employer conversations. Knowing the Mission's components lets you answer accurately and point to the source.

The DPDP framework: what it asks of your project

The Act applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. Its structure, read from the Act text:

The PIB release on the Rules adds operational points: standalone, clear consent notices; plain-language breach notices to affected individuals; verifiable consent before processing children's data, with limited exemptions; responses to rights requests within a maximum of 90 days; and enhanced obligations such as audits and impact assessments for Significant Data Fiduciaries.

Obligations fall on the Data Fiduciary — usually your employer or client, not you personally. Your job is to design systems that let them comply. For analyst-level implications, see DPDP Act basics for data analysts.

Questions to ask on every project

Use these in design reviews. Each maps to something above.

1. 1Does the system process personal data, and under which basis — consent or a legitimate use?
2. 2Is every field we collect or index necessary for the stated purpose?
3. 3Does any output feed a decision about a person? If so, how do we check accuracy?
4. 4If someone withdraws consent, can we delete their data from source tables, derived datasets, embeddings and logs?
5. 5What would we do in the first day after a suspected breach, and who notifies whom?
6. 6Is our client likely to be a Significant Data Fiduciary, with extra audit and assessment duties?
7. 7For compute or datasets, have we checked current IndiaAI programmes?

How to keep this current

Set a monthly reminder to check the MeitY and PIB websites for new notifications, and read the primary document before relying on any summary, including this one. Note the date you checked in project documentation. When a client asks "is this compliant?", answer with what you checked, when, and what their legal team must confirm — engineers design for compliance; they don't certify it.

If you advise clients on AI deployments, the responsible AI conversation scripts show how to raise these points in meetings. Governance mapping of this kind appears in the draft syllabus of FDE for Professionals; that programme has not yet been scheduled.