Under the Indian constitutional framework, the executive (MeitY) cannot create new penal sanctions or civil fines through administrative guidelines issued without a parent Act passed by Parliament.

The November 5, 2025 MeitY guidelines state explicitly in Part 1 that they are advisory, voluntary, and pro-innovation. Therefore, classifying the 7 Sutras as "mandatory laws" is legally erroneous. We classify them strictly as Voluntary but Signaled.

Most tech summaries overlook the Consumer Protection Act. If a commercial AI service scores, admits, declines, or grades an individual, that individual is legally a "consumer" under Section 2(7).

Under Section 2(47) (Unfair Trade Practice) and Rule 5(4) of the Consumer Protection (E-Commerce) Rules, 2020, denying a consumer an accessible human grievance channel or misrepresenting AI accuracy constitutes an actionable statutory offense today.

Unlike the EU GDPR which allows processing under legitimate interest balancing tests, Section 9(3) of India's DPDPA 2023 contains an absolute statutory bar: "A Data Fiduciary shall not undertake tracking or behavioural monitoring of children."

For any Ed-Tech AI tracking student keystroke latency, response hesitation, or webcam gaze without verifiable parental consent, the statutory exposure is immediate and severe (fines up to ₹200 Crore).

While national guidelines remain voluntary, the February 2026 amendment to Rule 3 of the IT (Intermediary Guidelines) Rules is a binding statutory notification.

It creates an enforceable legal duty for any deployer or intermediary generating synthetic media to embed permanent machine-readable watermarks and honor expedited takedowns: 2 hours for non-consensual sexual deepfakes (Rule 3(2)(b)) and 3 hours for court- or government-notified unlawful content (Rule 3(1)(d)).