Regulating The AI In Indian Corporates - Insights From The EU Artificial Intelligence Act
Author: LawSphereX
Category: Corporate & Insolvency
Published:
Updated:
REGULATING THE AI IN INDIAN CORPORATES:
INSIGHTS FROM THE EU ARTIFICIAL INTELLIGENCE
ACT
Pratima Pawar, School of Law, Christ (Deemed to be University), Bengaluru
ABSTRACT
Indian companies are rapidly adopting Artificial Intelligence (AI) across their operational processes in various sectors including finance, compliance, decision making, logistics and supply chains and customer interactions. However, since India has no specific laws or regulations for AI, it is difficult for businesses to understand how to manage the associated risks and ensure that they operate ethically and accountably. In this paper, the researcher will explore the current regulatory frameworks in India for governing AI through other legislation, such as the IT Act, Companies Act 2013, Digital Personal Data Protection Act 2023 and sector-specific rules from regulators such as RBI and SEBI.
Here the researcher will also draw upon the EU's Artificial Intelligence Act (EU AI Act) which is a risk based framework and is the first comprehensive piece of legislation addressing the governance of AI. This study uses a doctrinal research methodology, therefore conducting a comparative legal analysis between the Indian and EU approaches to AI regulation. As indicated previously, there has been considerable academic interest in AI ethics and data protection issues, there appears to be a dearth of studies focusing on the regulation of AI from the corporate governance perspective. Therefore, the identified gap provides a significant basis for this study. Findings of this study show that at present, India is taking an open, innovation friendly approach to the regulation of AI.
However, there are insufficient, mandatory, audit requirements, risk classification models, and sufficient corporate accountability standards, compared with the structured framework of the EU's regulation. The researcher believes that India could derive benefits from selectively adopting some aspects of the EU's regulatory model, namely a graduated risk assessment regime, obligation of transparency and compliance responsibilities for boards of directors. The study recommends a balanced AI regulatory framework in India, which will allow for continued innovation, while promoting corporate governance and responsible business practices. Ultimately, future AI regulation in India should create a climate of trust, accountability and investor confidence, while still allowing for the rapid technological growth and development.
Keywords: Artificial Intelligence, European Union Artificial Intelligence Act, Indian Corporate Governance, Risk based approach and Comparative Regulatory Framework.
INTRODUCTION
Artificial Intelligence (AI) is rapidly changing the corporate landscape across the globe, impacting decision-making, operational efficiency, and structure of governance. In India, corporates are increasingly adopting AI technology across sectors such as finance, health care, manufacturing, e-commerce, and regulatory compliance. AI applications are not limited to automation, but extend to being an aid for strategic decision making such as predictive analytics, risk profiling, fraud detection and contract management. The ever-increasing use and dependence on AI raises issues in relation to accountability, transparency, and ethical governance, especially in corporate context, where algorithmic decisions can directly affect consumers, investors and compliance issues.
However, despite the ever-transformative role of AI, India still does not have an exclusive legislative framework for AI regulation in the corporate sector. India still relies on differentiation of law through various provisions of Information Technology Act of 2000, Companies Act, 2013, Digital Personal Data Protection Act of 2023, and sector specific guidance from bodies such as RBI and SEBI. This gap thus, becomes relevant and significant to study and hence this research looks at lessons from and possible application of the European Union AI Act (EU AI Act), being the first comprehensive AI legislation in the world. The background and need of the study is based on the absence of some form of enforceable and AI specific standards in India particularly in matters of risk classification, algorithmic accountability and auditability.
While the EU AI Act adopts a risk-based regulatory model as it implements further obligations regarding compliance, transparency and human supervision. The legal framework in India is still largely based on trust , sectoral and situational insight. The problem statement of this research is India’s current AI governance regimes do not afford sufficient legal certainty or operational clarity for corporates with risks arising in ethical accountability, consumer protection and corporate governance. Existing literature has largely covered AI in India from the perspective of data privacy, cyber security or ethical considerations. Very few studies have conducted a comparative study of the risk-based regulatory model as laid down in the EU and its applicability to the corporate governance context in India. This leaves a serious research deficit a problem that this paper seeks to address
namely a doctrinal and comparative legal study linking AI regulation to corporate governance structures in India. The objectives and aims of this study are fourfold. It examines firstly the existing Indian legal and regulatory framework governing AI incorporates. It then deals with the EU AI Act analysing it in terms of risk-based classifications, compliance obligations and its relevance to corporate governance. Thereafter it conducts a comparative analytical exercise identifying the gaps and challenges and lessons for the Indian regime to learn from the EU framework. Lastly, it evaluates the potential impact of the introduction of similar AI regulations in India from a legal, ethical and operational perspective.
The methodology of the research is doctrinal considering statutes, regulations, policy documents, judicial determinations and academic literature to furnish a systematic comparative perspective. This research while having a global approach remains locally contextualized considering India’s socio-economic and corporate governance context and its institutional readiness in that regard. This paper deals with the existing AI regulatory regime in India, the fundamental details of the EU AI Act and a comparative legal analysis revealing the gaps in corporate governance preparedness that would result from the application of the AI Act in India. It also explores the implications for corporate governance, compliance and risk management and duties of ethical accountability.
Finally, it gives suggestions for a lessoning of tolerable corporate governance standards against a risk based, accountable and innovation friendly AI regulatory regime applicable in India following the precepts of international best practice. This study thus provides new insights both academically and in the policy sphere while furnishing legislators, regulators and corporate boards of directors with foreseeable, actionable material as to how they should come up with an ethical, transparent, and future ready AI governance model in India.
LITERATURE REVIEW
1. The article “Artificial intelligence policy in India: a framework for engaging the limits of data
driven decision-making” by Vidushi Marda emphasizes the importance of a multidisciplinary approach related to AI policy development, regulation and deliberation. The author specifically recommends for the establishment of a nodal agency, the National Artificial Intelligence Mission which coordinates AI-related activities in India. The reason I choose this paper is that
it serves as a foundation for my research as it highlights the need for AI regulation in India1.
2. This article “Legal Implications in Artificial Intelligence” by Amarendar Reddy focuses on the
risks and challenges of granting legal identity or agenthood to AI technologies, mainly on the policy approaches and practices. The reason I choose this paper because the findings are relevant to the corporate sector as author highlights the need for clear legal frameworks to manage AI related risks and challenges. The author aims to explore the risks and challenges of giving legal identity or agency to AI technologies. The objective includes outlining policies and practices related to AI legal identity and agency, along with discussing viewpoints from consultants in the field2.
3. This articleelli, “ Artificial Intillegence and Law: Technological Approach, Opportunities and
Future Scope” by Saksham Tontar & Saloni Dutt, explores the role of Artificial Intelligence (AI) in the legal framework, discussing its impact on law firms and the legal profession. As this article is relevant to the current study which discusses about the legal framework of AI in the corporate sector. The aim of the author is to explore the role and impact of artificial intelligence in the legal profession. The goals include defining AI, discussing its types, and examining its applications in legal tasks3.
4. This article “ What’s Ahead for a Cooperative Regulatory Agenda on Artificial Intelligence?
by Meredith Broadbent discusses about the EU’s efforts to establish a regulatory framework for AI, focusing on cooperation, high risk systems and fundamental rights. This article is relevant to the present study as the connection to the study involves analysing how international cooperation and regulatory standards might shape India’s approach to AI regulation. The aim of the author is to explore the potential for a strategic partnership between US and Europe to counter china’s growing influence in AI. The objectives include coordinating AI R&D efforts and protecting fundamental rights of citizens through regulatory frameworks4. 1 Vidushi Marda, Artificial Intelligence Policy in India: A Framework for Engaging the Limits of Data-Driven Decision-Making, 376 Philos. Trans. R. Soc. A 20180087 (2018) available at https://doi. org/10. 1098/rsta. 2018. 0087 2 A.
Amarendar Reddy, Legal Implications in Artificial Intelligence, 5 Int’l J. L. Mgmt. & Human. 1766 (2022), available at https://heinonline-org-christuniversity. knimbus. com/HOL/Licens 3 Saksham Tontar & Saloni Dutt, Artificial Intelligence and Law: Technological Approach, Opportunities and Future Scope, Indian J. L.
& Legal Rsch. (2022), available at https://heinonlineorgchristuniversity.knimbus.com/HOL/Licens 4 Meredith Broadbent, What’s Ahead for a Cooperative Regulatory Agenda on Artificial Intelligence? (Ctr. for Strategic & Int’l Studs. 2021), available at https://www.jstor.org/stable/resrep30085
5. The article “Artificial Intelligence Policy” by Shrisha Rao and Deya Chatterjee discusses the
importance of AI for India’s digital India initiative and highlights the need for a legal framework to support its development. This paper is relevant to present study as it highlights the need for legal framework relating to AI and suggests ways to address the current gaps. The author aims to show how important AI is for India’s national interests and to criticize its current underdevelopment. The author’s criticism is that India lags behind certain countries like china, Europe in development of AI5.
6. The article “ Metamorphosis in Corporate Governance Due to Artificial Intelligence” by
Simran Karkhur focuses on the evolving role of artificial intelligence in corporate governance and discussing its potential benefits and limitations. This article is relevant to present study as it discusses about the benefits and drawbacks of AI in Indian corporate governance. The author aims to explain why corporate board members need to understand the basics of AI in order to fulfil their responsibilities6.
7. The article “ The EU’s AI act: A framework for collaborative governance” by Celso
CancelaOuteda discusses about the Artificial Intelligence Act (AIA) and its governance mechanisms, focusing on collaborative governance and stakeholder participation. This article is relevant to present study as it provides insights into EU’s approach to AI governance, by which we can analyse our mechanism for implementing AI regulation in Indian context. The author aims to provide a critical perspective on collaborative governance, highlighting both its strengths and which are the potential areas required to be improved7.
8. The article “ Managing the race to the moon: Global policy and governance in Artificial
Intelligence regulation- A contemporary overview and an analysis of socioeconomic consequences” by Yoshija Walter provides a comprehensive overview of global AI regulation and governance, focusing on socio-economic impacts and contrasting regulatory approaches across different regions, this paper is relevant to my study as it discusses about the global AI regulation which gives an idea to tackle with the contrasting regulatory approaches while implementing a regulation relating to AI in India. The author aims to explore current global 5 Shrisha Rao & Deya Chatterjee, Artificial Intelligence Policy, 115 Current Sci. 6 (2018), available at https://www. jstor. org/stable/10. 2307/26978340 6 Simran Karkhur, Metamorphosis in Corporate Governance Due to Artificial Intelligence, 4 Jus Corpus L. J. 19 (2014), available at https://heinonline-org christuniversity. knimbus.
com/HOL/License 7 Celso Cancela-Outeda, The EU’s AI Act: A Framework for Collaborative Governance, 27 Internet of Things (2024), available at www. sciencedirect. com/journal/internet-of-things
developments in AI policy and governance, particularly examining governance structure at governmental and corporate levels8.
9. The article “Artificial Intelligence In Corporate Governace” by Mustafa Kenan Ustahaliloglu
focuses on the integration of AI in corporate governance, exploring its impact on decisionmaking processes and legal, ethical, regulatory challenges it poses. This paper is relevant to my study as it discusses the legal gray areas, ethical considerations, and regulatory challenges facing for implementing the AI regulation. The author aims to clarify how organizations can navigate these challenges and provide practical advice for businesses. To investigate the use of AI in corporate governance, the author used a qualitative research method9. 10. The article Understanding dark side of artificial intelligence (AI) integrated business analytics: assessing firm’s operational inefficiency and competitiveness by Nripendra P. Rana and others focuses on understanding the dark side of AI integrated business analytics, suboptimal business decisions, and perceived risk.
This article is relevant to present study as it discusses about a need for pragmatic legal framework for AI adoption. The author aims to identify these factors and their impact on firms, particularly in the context of India. The study used a survey method to gather a data from 355 managers across various service sectors in India indicating quantitative approach10.
RESEARCH OBJECTIVES
1. To study the existing legal and regulatory framework governing the use of artificial intelligence (AI) in the Indian corporate sector. 2. To examine the EU Artificial Intelligence Act with the risk-based approach in addition to the compliance obligations, effectiveness of AI Governance with the European Corporate Governance model. 8 Yoshija Walter, Managing the Race to the Moon: Global Policy and Governance in Artificial Intelligence Regulation-A Contemporary Overview and an Analysis of Socioeconomic Consequences, 4 Discover Artificial Intelligence 14 (2024), available at https://doi.org/10.1007/s44163-024-00109-4
9 Mustafa Kenan Ustahaliloglu, Artificial Intelligence in Corporate Governance, 7(1) Corporate Law &
Governance Review (2025), available at https://doi.org/10.22495/clgrv7i1p11 10 Nripendra P. Rana et al., Understanding the Dark Side of Artificial Intelligence (AI)–Integrated Business Analytics: Assessing Firms’ Operational Inefficiency and Competitiveness, 31 Eur. J. Info. Sys. 3 (2022), https://doi.org/10.1080/0960085X.2021.1955628
3. To study the comparative differences in the regulatory framework of AI between Indian and the EU model along with the gap and challenges existing with the possibility of learning from the EU AI Act for Indian corporates. 4. To evaluate the legal, ethical and operational consequences of implementation of AI with a risk-based regulatory framework within Indian corporates.
RESEARCH QUESTIONS
1. How does the existing Indian legal and regulatory framework lay down regulation on the aspect of usage of AI incorporates, especially with regard to accountability, transparency and ethical compliance? 2. What are the significant provisions under the EU AI Act, particularly with regard to the risk-based approach and also the corporate compliance obligations which are envisaged therein for the purpose of AI Governance? 3. What is the gap area and the existing hindrances with the existing Indian regulatory framework of AI in comparison to the EU model and what are the lessons which can be learnt by Indian corporates? 4. What are the legal, ethical and operational consequences which would arise with respect to implementation of a risk-based regulatory framework of AI for corporates in India, and how can it be made applicable in the corporate context in India.
LEGISLATIVE & REGULATORY FRAMEWORK FOR AI IN INDIA'S CORPORATE
SECTOR
The current legislative and regulatory framework for AI in India's corporate sector is disorganized, it is developed using both sectoral laws, policy advisories and other strategic initiatives versus a single AI specific law. While there are many regulations that govern how accountability, transparency and ethics are enforced within the broader digital governance laws, the regulations do not enforce accountability, transparency and ethics directly. The Companies Act, 2013 is the primary governing body of corporate management and it ensures that companies are managed by boards of directors who are subject to fiduciary and
regulatory duties. The use of AI will improve board level decision making and risk management by utilizing data driven insights, however, the existing company law has a requirement that while AI can provide information to directors. The final responsibility of the director rests with the individual director. Under section 149 of the Companies Act11, all directors must be natural persons, this means AI cannot be a director or a legal person responsible for corporate action. The foundational laws include the Information Technology Act, 2000 (IT Act). Which covers electronic transactions, cybersecurity and digital content.
Although the IT Act does not specifically cover AI, the act does contain sections that are applicable to AI, including section 43A, which requires compensation for the negligent handling of sensitive personal data, section 66D, which provides penalties for the impersonation of another through computer resources (for example, AI created deep fakes and fake content) and section 6712, which prevents the transmission of obscene material, this can be extended to generative AI systems that create offensive output13. Neither the IT Act nor the Companies Act addresses the complexities of accountability or the responsibilities associated with AI making autonomous decisions for corporate leaders.
For example, if a corporation generates financial disclosure or compliance report through AI, section 134 of the Companies Act requires that the human directors confirm the accuracy and fairness of the financial disclosure or compliance report, regardless of whether the directors relied heavily upon the AI system that generated the reports. The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India's first comprehensive effort to develop a framework for regulating personal data processing, which has implications for AI systems that operate based upon large datasets. The DPDP Act requires that users provide consent for their data to be used, require transparency into how data is utilized and require that data breaches be reported to authorities. Thus, the DPDP Act reinforces accountability and ethics in the utilization of AI14.
Concerns persist regarding the surveillance provisions of the DPDP Act and its ability to adequately address algorithmic opacity and bias. Statutory law is supplemented by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which places obligations on platforms including AI
11 The Companies Act, 2013, No. 18, Acts of Parliament, Section 149 (India).
12 Information Technology Act 2000
13 Tanvir Kaur, Regulating AI in India: A Comparative Analysis with International Standards, Econ. Sci., vol. 21, 1, (2025)., at 598-599 available at https://doi.org/10.69889/ksaa2139.
14 Ibid, 599.
intermediaries in order to ensure that they do not allow the dissemination of unlawful content. If non-compliance occurs, platforms lose safe harbour protections and are incentivized to ethically moderate AI content. At the policy level, several interventions have formed the foundation for India's AI governance framework. NITI Aayog's National Strategy for Artificial Intelligence (2018)15 and Principles for Responsible AI (2021) emphasize developing AI in ways that are inclusive, transparent and human-centered16. Both the national strategy and principles for responsible AI document risks associated with AI, including profiling, discrimination and opaque decisionmaking and advocate for the implementation of safeguards and accountable stakeholders17.
In addition, the national strategy emphasizes the misuse of consumer data by corporations, and advocates for regulatory oversight over such misuse. More recent advisories from the Ministry of Electronics and Information Technology (MeitY) represent a shift towards regulating AI directly. MeitY's March 2024 advisory requires platforms that utilize generative AI or LLMs to receive prior approval if the model is undertested or potentially biased. Furthermore, the advisory requires platforms to warn users of potential errors made by AI and to require that metadata be tagged onto AI-generated content, and to reinforce transparency and ethics18. Although, India's regulatory framework has evolved significantly, the lack of a centralized AI law continues to create regulatory ambiguity.
Existing laws have been criticized for failing to hold accountable AI for autonomous decisions, for creating liability for AI-related harm, and for governing foundational models19. The regulatory approach to date has focused primarily on high-risk AI applications, and as such, AI systems that are more general purpose continue to be poorly regulated20.
15 NITI Aayog, National Strategy for Artificial Intelligence (June 2018), available at
https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf 16 NITI Aayog, Responsible AI #AIFORALL: Approach Document for India: Part 1 – Principles for Responsible AI (Feb. 2021), available at https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf 17 Rahul Kailas Bharati, Navigating the Legal Landscape of Artificial Intelligence: Emerging Challenges and Regulatory Framework in India, YMER, vol. 23, no. 7, July 2024, at 701- 702, available at SSRN: https://ssrn.com/abstract=4898536
18 Supra note 13, at 599
19 Lucky & Vinit Kumar Sharma, Artificial Intelligence in Company Law and Corporate Governance: A Legal and Ethical Study, Int’l J. Res. Pub. & Revs., vol. 6, no. 1, Jan. 2025, at 5330-533, available at https://ijrpr.com/uploads/V6ISSUE1/IJRPR38219.pdf 20 Tanmay Mukund Pethkar, Artificial Intelligence (AI) in Corporate Governance: Transformative Trends and Legal Pathways in India, Chartered Secretary, Aug. 2024, at 94-95, available at
In conclusion, India's current regulatory environment provides a patchwork of laws related to digital governance, data protection and ethics. While the laws and regulations provide some degree of accountability and transparency for AI. The laws and regulations fail to provide a cohesive regulatory framework for AI. An AI-specific law is needed to provide clarity on the unique challenges that exist with autonomous systems, algorithmic bias and ethics in corporate environments.
THE EU ARTIFICIAL INTELLIGENCE ACT: RISK-BASED REGULATION,
OBLIGATIONS OF COMPLIANCE
AND
CORPORATE
GOVERNANCE
IMPORTANCE
The European Union Artificial Intelligence Act (AI Act) is the first universal extensive legal mechanism for the regulation of artificial intelligence technology in the world. It adopts a radically risk-based regulatory mentality which is aimed at reconciling innovation on the one hand and the fundamental rights, safety and democratic values which the EU embodies on the other. This regulatory outlook attempts to calibrate the obligations created on service providers by reference to the risk which AI applications pose, in order to avoid the hazards of overregulation and to ensure the achievement of proportionality in the legislative process21. The AI Act categorizes AI applications according to four levels of risk, that is to say unacceptable, high, limited and minimal.
Applications coming within the term unacceptable risk, cognitive behavioural influence and social scoring or subliminal messaging, are prohibited under Article 5. High risk applications, which cover amongst others, applications used in employment, law enforcement and biometric identification, are obliged to carry substantial compliance obligations22. These obligations attach to risk management systems (Article 9), data governance principles (Article 10), technical documentation (Article 11), human oversight (Article 14) and conformity assessment (Article 43)23. Limited risk applications are obliged to certain transparency requirements, informing users, for example, that they are interacting with an AI https://www. icsi. edu/media/webmodules/CSJ/August-2024/16. pdf 21 Martin Ebers, Truly Risk-Based Regulation of Artificial Intelligence: How to Implement the EU’s AI Act, 16 Eur. J.
Risk Reg. at 684, 686-687 (2025), available http://dx. doi. org/10. 2139/ssrn. 4870387
22 Yavuz Selim Balcioglu et al., A Turning Point in AI: Europe’s Human-Centric Approach to Technology Regulation, 23 J. Resp. Tech. 100128, at 2-3 (2025), available at DOI:10.1016/j.jrt.2025.100128 23 Maria de Lourdes Haynes, Governing at a Distance: The EU AI Act and GDPR as Pillars of Global Privacy and Corporate Governance, SSRN Preprint, at 6-7 (2024), available at SSRN: https://ssrn.com/abstract=5501087
application (Article 52). Minimal risk applications are unencumbered with obligations of any kind24. This tiered effect is intended to ensure that the regulatory burden is proportionate to the likely effect of each application of AI technology on society as a whole25. From a compliance perspective, the AI Act imposes extensive obligations on service providers, deployers, importers and distributors. These obligations include record keeping (Article 12), declarations of conformity (Article 47) and informed Consent for real-world AI testing (Article 61). The enforcement mechanisms also are effective with penalties of up to €35 million or 7% of global turnover for breach of the provisions on prohibited provisions26. The relevance of the AI Act to corporate governance is profound.
It repositions compliance as an obligation of the business that requires board involvement in the categorizing of risk of AI applications, documentation of AI systems within the business and oversight of applications of AI based facilities. Corporations will occupy hybrid roles in the field of AI technology as they will be service providers, deployers and importers, with multiple levels of responsibility attaching to such27. This hybrid role entails significant legal, regulatory and governance challenges in enunciating governance systems which ensure that the business strategy of innovation is reflective of the obligations of legality and ethics28. The extraterritorial effect of the AI Act will augment the global relevance of its effect.
The operation of the AI Act to any organization which markets AI systems in the EU or which provides goods the output which is used within the Union territory, will have implications outside the EU of the law regardless of where the manufacture of the product or provision or service occurs. It serves to bring about regulatory harmonization, within the EU and internationally, to the standards and norms imposed in the EU and enhances the role of the EU as the present-day champion of setting norms for governance in the digital economy29. The establishment of the Industrial AI Authority, the establishment of European Artificial Intelligence Board and the implementation of national competent authorities further promotes
24 Supra note 19, at 687
25 Celso Cancela-Outeda, The EU’s AI Act: A Framework for Collaborative Governance, 27 Internet of Things 101291, at 2-3 (2024), available at https://doi.org/10.1016/j.iot.2024.101291 26 Saksham Tontar & Saloni Dutt, Artificial Intelligence and Law: Technological Approach, Opportunities and Future Scope, Indian J.L.
& Legal Rsch. (2022), available at https://heinonlineorgchristuniversity.knimbus.com/HOL/Licens 27 Nripendra P. Rana et al., Understanding the Dark Side of Artificial Intelligence (AI)-Integrated Business Analytics: Assessing Firms’ Operational Inefficiency and Competitiveness, 31 Eur. J. Info. Sys. 3 (2022), https://doi.org/10.1080/0960085X.2021.1955628
28 Supra note 19, at 688- 689
29 Meredith Broadbent, What’s Ahead for a Cooperative Regulatory Agenda on Artificial Intelligence? Ctr. for Strategic & Int’l Studs. (2021), available at https://www.jstor.org/stable/resrep30085
this collaborative method of governance 30. The coordination of governance at multi-level, including stakeholders, enhances responsive regulatory development which will revel in the ongoing review of and responsiveness to the effect of technological development and societal feedback in this regard. As a result, the system of governance regulating artificial intelligence will have the potential to range changing technological development in the field which it is to govern. The embedding of the legal, ethical and strategic elements of technology in the structures of organization structures in the legislation of governance of the AI Act institutionalizes accountability, transparency and trust in respect of AI based systems and on the fundamentals of good corporate governance in the digital age31.
BRIDGING THE REGULATORY GAP: ASSESSING THE INDIAN AI REGULATORY
ENVIRONMENT COMPARED TO THE EU MODEL AND RECOMMENDATIONS
FOR INDIAN CORPORATIONS
Compared to the EU's comprehensive Artificial Intelligence Act (AI Act) the AI regulatory environment in India remains fractured and underdeveloped. Although, India has progressed toward developing an AI regulatory environment, through recent developments such as the National Strategy for Artificial Intelligence (2018), the Principles for Responsible AI (2021), and the Digital Personal Data Protection Act (2023), the development of this regulatory environment has been disjointed, unenforceable, and has lacked sector specificity; whereas the EU's risk-based legislation provides for coherence, enforceability, and sector specificity. The EU AI Act categorizes AI systems into three broad categories of unacceptable, high, and low risk, which are then subject to proportionate obligations related to the potential harm that could be caused to fundamental rights, safety, and democratic values32.
For example, high-risk AI systems will be subject to a number of stringent requirements, including the requirement for risk management, data governance, transparency, and human oversight33. In contrast, India does not have a classification system that is legally binding, nor do Indian corporations have
30 Supra note 23, at 3
31 Yoshija Walter, Managing the Race to the Moon: Global Policy and Governance in Artificial Intelligence Regulation-A Contemporary Overview and an Analysis of Socioeconomic Consequences, 4 Discover Artificial Intelligence 14 (2024), available at https://doi.org/10.1007/s44163-024-00109-4 32 Harshit Bidhuri, Regulating Artificial Intelligence in India: Bridging the Legal Vacuum, 11 Int’l J. L. 112, 113 (2025), available at https://www.lawjournals.org/assets/archives/2025/vol11issue4/11086.pdf
33 Regulation (EU) 2024/1689, art. 6, 2024 O.J. (L 1689).
statutory obligations to comply with a classification system that would provide them with guidance on how to meet obligations of varying risk levels34. As a result of the lack of a classification system, Indian corporations are unsure of what level of compliance they must achieve to meet regulatory obligations, as well as uncertainty regarding liability issues, and uncertainty concerning the application of ethical considerations. One significant gap in the regulatory structure of India is the lack of a clear and legally binding obligation of liability and accountability. The EU AI Act establishes conformity assessments and post-market monitoring of high-risk systems, thereby establishing a basis for tracing AI systems and obtaining redress35.
Similarly, India lacks a statutory provision that clearly states who would bear responsibility if AI systems were to cause damage whether it was the developer of the AI system, the deployer of the AI system, or the data controller of the data being processed by the AI system36. This lack of clarity regarding liability and accountability creates reputational and legal risks for Indian corporations using AI systems in highly regulated industries such as healthcare, finance and surveillance. Another area where India lags behind the EU is in terms of regulating algorithmic bias and fairness. The EU AI Act includes provisions that require fairness audits and data quality standards as part of the compliance architecture of the AI Act37.
Similarly, India's policy documents acknowledge the existence of bias in AI systems, but establish no binding obligations for detecting bias, mitigating bias, and providing explanations for AI decisions38. Given the diversity of India, the failure to regulate algorithmic bias and fairness may further exacerbate social inequities in India, and may create litigation and public relations challenges for Indian corporations deploying AI systems in sensitive areas. Lastly, India lags the EU in terms of technical standards. The EU AI Act establishes a basis for compliance with the AI Act by developing harmonized standards for complying with the AI Act by bodies such as CEN-CENELEC JTC 21, thereby creating a basis for legal certainty, and
34 Supra note 30, at 113-114
35 Robert Kilian et al., European AI Standards - Technical Standardisation and Implementation Challenges under the EU AI Act, 1 Eur. J. Risk Reg. 1, 2-3 (2025), available at http://dx.doi.org/10.2139/ssrn.5155591 36 Keval Govardhan Ukey & Tanavi Prasad Naik, Legislative Gaps in India’s AI Regulation: Need for a Dedicated AI Law, 27 Afr. J. Biomed. Res. 634-635 (2024), available at https://doi.org/10.53555/AJBR.v27i2.8260
37 Supra note 19, at 684- 688
38 Vidushi Marda, Artificial Intelligence Policy in India: A Framework for Engaging the Limits of Data-Driven Decision-Making, 376 Phil. Trans. R. Soc. A 20180087, 6-7 (2018), available at https://doi.org/10.1098/rsta.2018.0087
access to markets39. In contrast, Indian corporations do not have the same structured pathway to compliance with the EU AI Act, and instead rely upon voluntary guidelines and sectorspecific codes of conduct for compliance with regulatory obligations. Therefore, Indian corporations have difficulty scaling up use of AI systems, achieving cross border interoperability of AI systems, and attracting investors to fund use of AI systems. From a corporate governance perspective, the EU model embeds oversight of AI systems within organizational accountability, by mandating that boards of directors engage in discussions regarding the use of AI systems, and document the oversight activities of boards40. By contrast, Indian firms operate in a regulatory grey area, without a statutory mandate to integrate AI governance into fiduciary structures.
Consequently, Indian firms lack the ability to align their strategies of innovation with risk management of ethics. Indian corporations can learn from the EU model in several ways to close the existing gaps between their own regulatory environments and those of the EU: 1. Develop internal risk classification frameworks that reflect the sensitivity of their respective sectors. 2. Implement voluntary conformity assessments and fairness audits for AI systems. 3. Establish board level AI ethics committees to oversee the deployment and compliance of AI systems. 4. Participate with international standardization organizations to prepare for regulatory convergence across borders. In summary, while India's AI governance is evolving, the EU AI Act represents a strong template for balancing the benefits of innovation with the rights-based protections established by the EU AI Act.
Accordingly, Indian corporations need to take proactive steps to internalize these lessons to ensure their long-term viability, and to create trust in the use of AI-driven transformations in India.
ASSESSING THE LEGAL, ETHICAL, AND OPERATIONAL CONSEQUENCES OF
39 Supra note 33, at 4-5
40 Mustafa Kenan Ustahaliloglu, Ar4ficial Intelligence in Corporate Governance, 7 Corp. L. & Governance Rev. 123, 125- 126 (2025), available at hKps://doi.org/10.22495/clgrv7i1p11
EU-STYLE AI REGULATION IN INDIA’S CORPORATE SECTOR.
The proposed Artificial Intelligence Act of the European Union (EU) constitutes a unique effort to regulate AI through a risk-based framework that balances innovation with fundamental rights. The Act provides detailed requirements ranging from bans on systems that present unacceptable risks to mandatory compliance by high-risk applications, which together could provide an effective model for responsible AI governance. If India were to introduce the EUstyle AI regulation, it would have significant effects on India’s corporate sector (underpinned by legal, ethical and operational considerations). Legally, the Indian corporate sector does not recognize any law related to the regulation and control of AI. Companies Act, 2013 defines directors as natural persons, which excludes AI systems from playing a role at the board level where important decisions are taken41.
AI systems may well assist directors in such decisions but cannot legally hold any fiduciary responsibility or liability under the extant law42. The adoption of a regulatory regime, similar to the EU-style AI legislation, would, therefore, require subsidiary amendments to existing legislation to define AI systems, develop jurisdictions, standards which can be enforced and standards of transparency, explain ability and oversight by human beings which would need to be instituted4344. The most serious problem however of an absence of specific AI law in India will lead to the problems of liability which are involved in algorithmic decisions, where algorithmic decisions affect the interests of shareholders, customers and employees45.
In the absence of some degree of statutory clarity, directors will be placed in a worse position because they might be subject to greater liability because of governance and strategy decisions being placed in the hands of AI. Ethically the implementation of AI to satisfy corporate governance needs will raise many questions relating to bias, discrimination and opacity. The EU AI Act requires fairness audits and prohibits social scoring which impacts dignity and equality46. In contrast, the regulatory regime in India is diffuse with the framework of
41 Companies Act, No. 18 of 2013, section 2(34) (India).
42 Ashish Makhija, Corporate Directors-Roles, Responsibility, Powers and Duties of Directors 112, 1st edn., (LexisNexis 2016). 43 Simran Karkhur, Metamorphosis in Corporate Governance Due to Artificial Intelligence, 4 Jus Corpus L.J. 19,
44 -25 (2024), available at https://heinonline-org christuniversity.knimbus.com/HOL/License
45 A. Amarendar Reddy, Legal Implications in Artificial Intelligence, 5 Int’l J.L. Mgmt. & Human. 1766, 176869 (2022), available at https://heinonline-org-christuniversity.knimbus.com/HOL/Licens 46 Sudha Hegde & Arundhati, Regulate to Safeguard: A Critical Analysis of the European Union’s First-of-ItsKind AI Act and the Indian Scenario, CMR Univ. J. Contemp. Legal Aff. 23-24 (2024), available at https://www.researchgate.net/publication/396290614_Regulate_To_Safeguard_A_Critical_Analysis_of_the
acceptable ethical principles described in policy documents such as NITI Aayog’s Responsible AI framework which is not enforced47. Studies have shown that AI systems trained on data sets that are prejudiced perpetuate discrimination in hiring, credit scores and performance scoring48. In the varied socio-economic milieu of India, these risks are accentuated by language, caste and gender discrimination49. In the absence of binding ethical safeguards, the introduction of AI may worsen exclusion and reduce trust in corporate institutions50. In operational respect the introduction of EU type AI regulations would require total restructuring of corporate processes. High risk AI systems from recruitment, financial forecasting or compliance would mandatorily require risk assessment, documentation and ongoing monitoring before deployment51.
A compliance burden would thus fall upon small and medium enterprises (SMEs), many of whom lack the technical capacity or resources to provide such control processes52. Moreover, Indian companies would have to invest in literacy at the board level regarding AI, appoint Chief Technology Officers (CTO) and establish internal governance mechanisms regarding their deployment of AI53. The absence of a common platform for data and skilled workforce further complicates operational readiness54. Notwithstanding these difficulties, the EU AI Act contains many lessons that can be learnt. Its extraterritoriality in its effect in determining compliance of any provider whose output from AI is used in the EU illustrates how important it is for domestic regulation to be in accord with world standards55.
India’s Digital Personal Data Protection Act comes into force in 2023 but whilst a good development, it does not address itself to the accountability for algorithms or AI specific risks56. An AI specific law, closely dealing with locally accepted parameters but not _European_Union's_First_of_Its_Kind_AI_Act_and_the_Indian_Scenario
47 NITI Aayog, Responsible AI: Part 1 - Principles for Responsible AI (2021), available at
https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf 48 Betsy Anne Williams et al., How Algorithms Discriminate Based on Data They Lack: Challenges, Solutions, and Policy Implications, 8 J. Info. Pol’y 78, 85-86 (2018), available at DOI:10.5325/jinfopoli.8.2018.0078 49 Shrisha Rao & Deya Chatterjee, Artificial Intelligence Policy, 115 Current Sci. 1015, 1016 (2018), available at https://www.jstor.org/stable/10.2307/26978340
50 Ibid
51 Regulation 2024/1689, of the European Parliament and of the Council of 13 June 2024, on Artificial Intelligence and amending certain Union Legislative Acts, arts. 9-14, 2024 O.J. (L 1689) 1, available at https://eurlex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202401689
52 Supra note 19,at 684-688
53 Supra note 51, at 26
54 Riddhi Rastogi & Aniket Dwivedi, Bridging the AI Governance Gap: Lessons for India’s DPDP Act from the EU AI Act and Other Global Standards, 7 Int’l J. Multidisciplinary Res. 1, 4-5 (2025), available at https://doi.org/10.36948/ijfmr.2025.v07i04.50792
55 Regulation
(EU)
2024/1689, Art. 2(1)(c), available at https://eurlex.europa.eu/legalcontent/EN/TXT/PDF/?uri=OJ:L_202401689
56 Digital Personal Data Protection Act, No. 22 of 2023, Section 4 (India).
incompatible with that of an EU model, can engender innovation whilst safeguarding rights. In conclusion, the introduction of EU type AI regulations, to the corporate sector of India, would require a multi-pronged approach. That of legislative reform and codification of ethics, construction of operational capacity and education of stakeholders. The road ahead will be tortuous but it is of vital importance that AI be made a vehicle for transparent, accountable, inclusive, corporate governance.
CONCLUSION
The world around us is changing rapidly due to the use of Artificial Intelligence (AI) in the way that business is conducted. The impact that AI is having on corporate governance is becoming more profound every day. This paper has attempted to discuss four areas of importance in understanding how the regulation of AI systems, especially the AI Act of the European Union, would have an impact on the corporate world of today in India. In the first place, we have examined India's efforts, so far, in this area. It is mostly confined to policy guidelines like the Responsible AI framework of NITI Aayog and the Digital Personal Data Protection Act, 2023. These are all steps in the right direction, but they lack the legal force and certainty that is required if such guidelines are to be enforced so as to prevent wrongful actions.
In the second place, we have considered the structure of the EU AI Act. It classifies AI systems into various categories based on the risk that they create and imposes penalties and strict rules for high risk applications in order to protect the rights and safety of persons. It imposes stringent requirements for such things as transparency, human supervision and accountability. In the third place, we have compared the two systems of law and noted the difficulties to which Indian companies would be subjected. The absence of laws, rules, standards and enforcement would cause untold difficulties to corporations doing business within India. AI systems create a number of ethical problems and difficulties, such as bias in AI systems, unclear liabilities and lack of trust on the part of the stakeholders.
In the fourth place, we have considered what would happen if India provided regulations similar to those developed by the EU in the corporate sector. There would necessarily be the need to have updated regulations such as those of the Companies Act in order to provide for the roles and responsibilities of AI systems. There would also be the need for ethical safeguards to prevent injustices, discrimination, etc. , from taking place in AI systems. This is particularly important in a heterogeneous society such as India. There would also be the need for expenditures for training in AI, in infrastructure and in systems of the internal governance of the corporation so as to enable compliance with the new
rules and laws. Despite the many difficulties that would accompany the introduction of any such AI system, it could not be gainsaid that a properly promulgated AI law could be of assistance to India in its plans to introduce development along all fronts but especially in the area of its industries while expecting a better standard of respect for the rights of consumers thereof, improvement in corporate governance and law and enhancement to the competitive efficiency of its companies in the growing global markets. In order also to accomplish this, India should set up dedicated AI regulations which conform specifically to its own social and economic environment. Also, companies should appoint Chief Technology Officers to their boards to oversee the proper use and commercial exploitation of AI.
Directors should also have qualified courses in both AI technology and the best techniques for its commercial exploitation, with particular attention to its use in corporate governance. A national even, body should be established to define what is within the ambit of AI and what is outside its realm. Also policies should be elaborated to indicate what ought to be done as to risks and liability. If India learns the lessons from the EU and introduces a modicum of its model of AI regulation after adjusting it to the needs of the Indian milieu, it will not only serve the development of corporations within the country, but ultimately will result in a system such as will facilitate future governance, transparent, ethical and effective in its corporate usage of AI systems.
REFERENCES
1. The Companies Act, 2013, No. 18, Acts of Parliament, Section 149 (India). 2. Information Technology Act 2000 3. Companies Act, No. 18 of 2013, section 2(34) (India). 4. NITI Aayog, National Strategy for Artificial Intelligence (June 2018), available at https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for- ArtificialIntelligence.pdf 5. NITI Aayog, Responsible AI #AIFORALL: Approach Document for India: Part 1 - Principles for Responsible AI (Feb. 2021), available at https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf 6. Regulation
(EU)
2024/1689, Art. 2(1)(c), available at https://eurlex. europa. eu/legalcontent/EN/TXT/PDF/? uri=OJ:L_202401689 7. Digital Personal Data Protection Act, No. 22 of 2023, Section 4 (India). 8. Tanvir Kaur, Regulating AI in India: A Comparative Analysis with International Standards, Econ. Sci. , vol. 21, 1, (2025). , at 598-599 available at https://doi. org/10. 69889/ksaa2139. 9. Rahul Kailas Bharati, Navigating the Legal Landscape of Artificial Intelligence: Emerging Challenges and Regulatory Framework in India, YMER, vol. 23, no. 7, July 2024, at 701- 702, available at SSRN: https://ssrn. com/abstract=4898536 10. Lucky & Vinit Kumar Sharma, Artificial Intelligence in Company Law and Corporate Governance: A Legal and Ethical Study, Int’l J. Res. Pub. & Revs. , vol. 6, no. 1, Jan. 2025, at 5330-533, available at https://ijrpr. com/uploads/V6ISSUE1/IJRPR38219. pdf 11.
Tanmay Mukund Pethkar, Artificial Intelligence (AI) in Corporate Governance: Transformative Trends and Legal Pathways in India, Chartered Secretary, Aug. 2024, at 94-95, available at https://www. icsi. edu/media/webmodules/CSJ/August2024/16. pdf
12. Martin Ebers, Truly Risk-Based Regulation of Artificial Intelligence: How to Implement the EU’s AI Act, 16 Eur. J. Risk Reg. at 684, 686-687 (2025), available http://dx. doi. org/10. 2139/ssrn. 4870387 13. Yavuz Selim Balcioglu et al. , A Turning Point in AI: Europe’s Human-Centric Approach to Technology Regulation, 23 J. Resp. Tech. 100128, at 2-3 (2025), available at DOI:10. 1016/j. jrt. 2025. 100128 14. Maria de Lourdes Haynes, Governing at a Distance: The EU AI Act and GDPR as Pillars of Global Privacy and Corporate Governance, SSRN Preprint, at 6-7 (2024), available at SSRN: https://ssrn. com/abstract=5501087 15. Celso Cancela-Outeda, The EU’s AI Act: A Framework for Collaborative Governance, Internet of Things 101291, at 2-3 (2024), available at https://doi. org/10. 1016/j. iot. 2024. 101291 16.
Saksham Tontar & Saloni Dutt, Artificial Intelligence and Law: Technological Approach, Opportunities and Future Scope, 4 Indian J. L. & Legal Rsch. 1 (2022), available at https://heinonline-org-christuniversity. knimbus. com/HOL/Licens 17. Nripendra P. Rana et al. , Understanding the Dark Side of Artificial Intelligence (AI)Integrated Business Analytics: Assessing Firms’ Operational Inefficiency and Competitiveness, Eur. J.
Info. Sys. (2022), https://doi.org/10.1080/0960085X.2021.1955628 18. Meredith Broadbent, What’s Ahead for a Cooperative Regulatory Agenda on Artificial Intelligence? Ctr. for
Strategic & Int’l Studs. (2021), available at https://www.jstor.org/stable/resrep30085 19. Yoshija Walter, Managing the Race to the Moon: Global Policy and Governance in Artificial Intelligence Regulation-A Contemporary Overview and an Analysis of Socioeconomic Consequences, 4 Discover Artificial Intelligence 14 (2024), available at https://doi.org/10.1007/s44163-024-00109-4
20. Harshit Bidhuri, Regulating Artificial Intelligence in India: Bridging the Legal Vacuum, Int’l
J.
L.
112, (2025), available at https://www. lawjournals. org/assets/archives/2025/vol11issue4/11086. pdf 21. Robert Kilian et al. , European AI Standards - Technical Standardisation and Implementation Challenges under the EU AI Act, 1 Eur. J. Risk Reg. 1, 2-3 (2025), available at http://dx. doi. org/10. 2139/ssrn. 5155591 22. Keval Govardhan Ukey & Tanavi Prasad Naik, Legislative Gaps in India’s AI Regulation: Need for a Dedicated AI Law, 27 Afr. J. Biomed. Res. 634-635 (2024), available at https://doi. org/10. 53555/AJBR. v27i2. 8260 23. Vidushi Marda, Artificial Intelligence Policy in India: A Framework for Engaging the Limits of Data-Driven Decision-Making, 376 Phil. Trans. R. Soc. A 20180087, 6-7 (2018), available at https://doi. org/10. 1098/rsta. 2018. 0087 24. Mustafa Kenan Ustahaliloglu, Artificial Intelligence in Corporate Governance, 7 Corp. L. & Governance Rev.
123, 125- 126 (2025), available at https://doi. org/10. 22495/clgrv7i1p11
25. Ashish Makhija, Corporate Directors-Roles, Responsibility, Powers and Duties of Directors 112, 1st edn., (LexisNexis 2016). 26. Simran Karkhur, Metamorphosis in Corporate Governance Due to Artificial Intelligence, 4 Jus Corpus L.J. 19, 24-25 (2024), available at https://heinonline-org christuniversity.knimbus.com/HOL/License 27. Amarendar Reddy, Legal Implications in Artificial Intelligence, 5 Int’l J.L. Mgmt. & Human. 1766, 1768-69 (2022), available at https://heinonlineorgchristuniversity.knimbus.com/HOL/Licens 28. Sudha Hegde dhati, Regulate to Safeguard: A Critical Analysis of the European Union’s First-of-Its-Kind AI Act and the Indian Scenario, CMR Univ. J. Contemp. Legal Aff. 23-24 (2024), available at https://www.researchgate.net/publication/396290614_Regulate_To_Safeguard_A_Cr itical_Analysis_of_the_European_Union's_First_of_Its_Kind_AI_Act_and_the_Indi an_Scenario
29. Betsy Anne Williams et al., How Algorithms Discriminate Based on Data They Lack: Challenges, Solutions, and Policy Implications, 8 J. Info. Pol’y 78, 85-86 (2018), available at DOI:10.5325/jinfopoli.8.2018.0078 30. Shrisha Rao & Deya Chatterjee, Artificial Intelligence Policy, 115 Current Sci. 1015,
1016 (2018), available at https://www.jstor.org/stable/10.2307/26978340
31. Regulation 2024/1689, of the European Parliament and of the Council of 13 June 2024, on Artificial Intelligence and amending certain Union Legislative Acts, arts. 9-14, 2024 O.J. (L 1689) 1, available at https://eurlex.europa.eu/legalcontent/EN/TXT/PDF/?uri=OJ:L_202401689 32. Riddhi Rastogi & Aniket Dwivedi, Bridging the AI Governance Gap: Lessons for India’s DPDP Act from the EU AI Act and Other Global Standards, 7 Int’l J. Multidisciplinary Res. 1, 4-5 (2025), available at https://doi.org/10.36948/ijfmr.2025.v07i04.50792