Sutra Check
sutracheck.in
Run Check
FEATURE 6LIVING REGULATORY TIMELINE

What Has Changed Since November 2025

India's AI regulatory posture is evolving rapidly — moving from early advisory guidelines toward phased statutory enforcement under DPDPA and binding synthetic media labeling under the IT Rules. Here is the verified chronological ledger with exact official citations.

August 11, 2023BINDING LAW / RULEEnacted Law
Parliament of India / Ministry of Law and Justice

DPDPA Enacted (Act No. 22 of 2023)

India’s first dedicated data protection statute receives Presidential assent, laying the legal foundation for AI training and inference data rights.

Statutory Substance: Establishes the Data Protection Board of India, defines Data Principal rights, prohibits behavioral monitoring of children (§ 9, carrying fines up to ₹200 Crore), and sets statutory security breach penalties up to ₹250 Crore (§ 8(5)).
Official Source:The Gazette of India, CG-DL-E-12082023-248045
August 18, 2025BINDING LAW / RULEOfficial Guidelines
Reserve Bank of India (RBI)

RBI Releases FREE-AI Committee Report

The original institutional blueprint for India’s AI principles: Framework for Responsible, Ethical, and Efficient AI in Financial Services.

Statutory Substance: Formulates the seven governance pillars that were subsequently adapted by MeitY into the national 7 Sutras. Mandates board-level AI policy, human-in-the-loop credit denial review, and tiered incident reporting.
Official Source:RBI Bulletin / Department of Regulation Report 2025
November 5, 2025ADVISORY / PROPOSEDOfficial Guidelines
Ministry of Electronics & Information Technology (MeitY)

MeitY Issues India AI Governance Guidelines

MeitY unveils national voluntary framework built around the 7 Sutras, proposing AIGG, TPEC, and the AI Safety Institute of India (AISI).

Statutory Substance: The document adopts an "Innovation Over Restraint" stance, explicitly clarifying that the 7 Sutras do not impose independent penal sanctions, but provide industry benchmarks and signal future regulatory standards.
Official Source:MeitY / IndiaAI Mission Release Doc. AI-2025/NOV-05
November 14, 2025BINDING LAW / RULENotified Rules
MeitY / Central Government

DPDP Rules 2025 Formally Notified

Gazette notification of implementation rules kicks off an 18-month phased compliance clock for all data processors in India.

Statutory Substance: Outlines procedures for verifiable parental consent mechanisms, detailed breach notification timelines (immediate alert, formal report in 72h), and Consent Manager registration.
Official Source:Gazette of India Extraordinary Part II Sec 3(i)
December 17, 2025ADVISORY / PROPOSEDProposed Bill
Parliament of India (Private Member’s Bill)

AI Ethics & Accountability Bill Introduced (Lok Sabha)

Proposed legislation seeking statutory AI review boards, mandatory ethical certifications, and penalties up to ₹5 Crore.

Statutory Substance: Not currently law. It signals parliamentary appetite for binding accountability, though the central executive continues to prioritize the voluntary MeitY guidelines route.
Official Source:Lok Sabha Legislative Bills Register 2025, Bill No. 59 of 2025
February 16-20, 2026BINDING LAW / RULENotified Rules
MeitY / IndiaAI Mission

India AI Impact Summit & IT Synthetic Media Amendment

Government formally presents the 7 Sutras on global stage and notifies binding IT Rules Amendment requiring watermarks on synthetic content.

Statutory Substance: Mandates that all AI generators, platforms, and intermediaries embed permanent digital watermarking on AI-generated media and comply with expedited takedowns: 3-hour removal for court/government orders (Rule 3(1)(d)) and 2-hour removal for non-consensual sexual deepfakes (Rule 3(2)(b)).
Official Source:IT (Intermediary Guidelines) Amendment Rules, 2026 Notification (G.S.R. 120(E))
November 14, 2026BINDING LAW / RULEEnforcement Milestone
Data Protection Board of India

DPDPA Phase 1 Compliance Deadline (Approaching)

Mandatory operationalization of Data Protection Officers (DPO), Consent Managers, and formal Grievance Redressal mechanisms.

Statutory Substance: Companies processing personal data for AI training or deploying consumer AI interfaces must have an active Grievance Officer and compliant privacy notices.
Official Source:DPDP Rules 2025 Implementation Roadmap
May 13, 2027BINDING LAW / RULEEnforcement Milestone
Data Protection Board of India

DPDPA Full Statutory Enforcement Deadline

The 18-month transition grace period ends. The Data Protection Board initiates audits and financial penalties up to ₹250 Crore.

Statutory Substance: Full enforcement across all entities, including Significant Data Fiduciaries (mandatory DPIA, independent audits) and complete strict liability for child data violations.
Official Source:MeitY Notification No. S.O. 4821(E)
Take Action On Recent Changes
CHECK IMPACT
Run Risk Classifier →

Assess whether recent IT Rules or DPDPA notifications alter your compliance classification.

ACTIVE RULES
Statutory Mandate Matrix →

Review current penalty amounts and binding clauses currently enforceable in courts.

ANALYSIS
India AI Governance Guide →

Read comprehensive legal analysis on how these timeline milestones shape operational strategy.