On 8 October 2026, at the India launch of the World Bank's World Development Report 2026, IT Minister Ashwini Vaishnaw said he would ask the ministry to produce a "regulation-focused consultation paper, which focuses on safety" within about a month, according to PTI's report. As of 1 November we could not confirm that it has been published. The announcement still matters, because it signals a change in posture, and the design of that change will decide whether India's AI sector gains certainty or inherits a compliance burden.
The case for moving beyond voluntary compliance
The strongest argument for the shift is simple. Voluntary regimes work until a harm becomes visible and costly, and deepfakes are now at that point. Vaishnaw called them a "nuisance which can cause huge problems in society" and said industry must "take the primary responsibility." If firms that build and deploy generative tools bear no enforceable duty, the cost of a fabricated video lands on the person depicted, who has the least ability to prevent or repair it. A regulator that waits for voluntary norms to mature may find that trust has eroded first.
The ministry's own timeline also supports revisiting the question. ThePrint reports that the November 2025 guidelines contemplated mandatory requirements if voluntary compliance over 9-12 months proved inadequate. MeitY Secretary S. Krishnan said "maybe some of those times have come." A review at that point is what the framework promised.
What the existing framework already says
The India AI Governance Guidelines describe a "techno-legal framework supported by voluntary measures and Digital Public Infrastructure." They set out seven sutras, including "Innovation over Restraint" and "Accountability," and make recommendations across six pillars: infrastructure, capacity building, policy and regulation, risk mitigation, accountability and institutions. They also propose an AI Governance Group, a Technology and Policy Expert Committee and an AI Safety Institute. The new paper should be read against this text, not as a blank slate.
It should also be read against the World Bank report it was launched with. The WDR 2026 page says governments "should rely on voluntary industry standards as a starting point for building trustworthy AI." It adds that where markets do not protect people, governments should use existing laws to address harms, and that regulators should pursue international cooperation to avoid "unnecessary barriers." That is a sequence of voluntary standards, then existing law, then targeted rules. It does not call for a horizontal AI statute. Krishnan's framing is that the report recommends a similar sequence to India's. The Bank's sequencing is also the strongest argument against jumping to a broad new regime.
India already regulates AI-generated content
The paper will not land in a regulatory vacuum. MeitY notified amendments to the IT Rules on 10 February 2026, effective 20 February. According to the Internet Freedom Foundation's analysis, they require intermediaries offering generation tools to label synthetic content clearly and prominently. They also require "permanent metadata or technical provenance mechanisms" that "cannot be modified, suppressed, or removed," and they impose Rule 4(1A) declaration and verification duties on platforms with over 50 lakh users.
This matters for two reasons. First, the deepfake problem Vaishnaw cited already has a binding instrument, so the consultation should begin by asking what that instrument has and has not achieved. Second, IFF argues the rules overreach, with an overbroad definition, labelling that compels speech, and timelines it calls "impossibly short." Those are advocacy claims, but they point to a real risk. Rules written quickly around a vivid harm tend to sweep in satire, journalism and routine editing.
A narrower test for the consultation
A proportionate paper would do four things.
- Name the harm and the evidence. Non-consensual intimate imagery, electoral deception and fraud impersonation are distinct problems with distinct remedies. A paper that lumps them under "safety" will produce obligations too vague to comply with and too broad to enforce evenhandedly.
- Assign duties by role. Vaishnaw says industry should carry most of the responsibility. That is defensible for those who control model access and distribution, but it should not extend to a small developer who has no control over downstream misuse.
- Test existing law first. The IT Act, the criminal law and the data protection regime already reach fraud, impersonation and privacy violations. The paper should show where enforcement has failed because of a statutory gap, not because of capacity.
- Protect lawful expression. Any synthetic-media duty needs explicit exceptions for parody, reporting and good-faith editing, plus a route to challenge mistaken takedowns.
The scale of public investment adds a reason for care. ThePrint notes that the IndiaAI Mission was approved in March 2024 with an outlay of Rs 10,372 crore. The state is financing compute and capacity so that Indian developers can compete. A regulatory regime that raises the cost of building domestic models would work against its own industrial policy, and larger foreign firms are better placed to absorb that cost.
What to watch
The first signal will be whether the paper arrives as a genuine consultation with specific questions and a meaningful comment period, or as a near-final design. The second will be whether it treats the "human-first" and "leave no one behind" themes as constraints on the drafting or as slogans. The third will be whether it commits to review mechanisms and sunset triggers, so that rules written for 2026's deepfakes do not harden into obligations for a different technology in 2030.
The move from voluntary compliance to regulation is legitimate, and the ministry's own guidelines anticipated it. The test is whether the paper regulates demonstrated harms with the lightest instrument that works, and says so in terms industry, civil society and courts can hold it to.