India’s proposed artificial intelligence governance framework is moving towards a sector-specific model, according to officials involved in a consultation paper being prepared by the Ministry of Electronics and Information Technology. The approach could give financial and other critical infrastructure regulators tighter powers over AI risks while allowing a broader, less restrictive framework for sectors where the consequences of failure are considered lower.
That distinction is important because AI is not a single policy problem. An error in a consumer-facing application, a failure in a financial system and an unreliable automated decision in a critical network can have very different consequences. The MeitY consultation paper is therefore being designed around a difficult administrative question: how can India create common principles for artificial intelligence without imposing identical rules on technologies that operate in fundamentally different environments?
Officials cited by Hindustan Times said the paper would seek to balance broad oversight with the specific needs of industries. The framework is expected to address safety, humanity, skilling, inclusivity and risk mitigation. It is also expected to raise questions about which institutions should regulate AI, who should be responsible when AI causes harm and what safeguards should be mandatory.
The proposed structure reflects a shift from treating AI regulation as a single central exercise to distributing responsibility across existing regulatory systems. A MeitY official said an overarching ministry guidance could affect sectors differently and suggested that sectoral regulators should proceed in areas where they already possess specialised authority. The official pointed to the Reserve Bank of India and the Securities and Exchange Board of India as examples of regulators that have previously acted within their respective domains.
This is more than an institutional design choice. It determines where accountability will sit when an AI system fails. A central ministry may be able to establish broad standards, but it may not have the operational knowledge to supervise every use of AI in banking, securities markets, telecommunications or other critical systems. Sector regulators, by contrast, already monitor institutions, impose compliance obligations and investigate failures within those industries. A sector-specific approach could therefore place responsibility closer to the systems where risks emerge.
The difficulty is that distributed regulation can also create gaps. If the same AI system is supplied by a technology company, integrated by a telecom operator and used to deliver services to citizens, several institutions may have a legitimate interest in its conduct. The consultation paper’s questions about who will regulate AI and how responsibility for harm will be determined point to this unresolved overlap.
The issue is particularly visible in telecommunications. The Telecom Regulatory Authority of India recently proposed that telecom companies, including Airtel, Jio and Vodafone Idea, should be directly accountable for failures involving AI used in their networks and services. The draft guidelines released on October 30 reportedly cover AI developed internally as well as systems purchased from vendors. They also propose that serious AI failures should be reported to the regulator.
That proposal establishes an important principle for digital infrastructure: outsourcing the technology does not necessarily outsource responsibility. A telecom operator may rely on an external AI vendor, but the consequences of a failure would still be experienced through the operator’s network or service. For users, the distinction between a company’s own system and a purchased system may be meaningless. The regulatory question is therefore whether the organisation controlling the service should remain accountable for the outcome.
The same question is likely to arise in other critical sectors. The MeitY official cited in the report said some sectors face much larger risks because they are critical infrastructure. The official suggested that regulation could be tighter in those areas, while warning that excessively strict rules from the central ministry could affect everyone. This proposed balance places risk classification at the centre of India’s emerging AI framework.
Risk classification, however, has an administrative consequence: regulators must decide which uses of AI deserve heightened scrutiny. The supplied report identifies banking, securities and commodities markets as areas where risks can vary significantly. It does not establish the final categories that the MeitY paper will adopt, the proposed thresholds for intervention or the penalties that may apply. Those details will be crucial in determining whether sector-specific regulation produces clarity or simply adds another layer of compliance.
The government’s position also reflects its broader preference for a techno-legal model. According to the report, MeitY believes AI cannot be regulated through legislation alone and that stakeholders should be involved from the beginning. This approach treats law as one part of a wider system that could include technical standards, institutional oversight, industry processes and reporting obligations.
Such a model may be suited to a technology that changes faster than conventional legislative cycles. It could allow regulators to respond through guidance and technical requirements without waiting for every operational detail to be written into statute. At the same time, a framework that relies heavily on voluntary norms or industry implementation must explain how compliance will be checked and what happens when companies fail to prevent harm.
The government’s expectations of industry are significant. MeitY expects companies to carry much of the implementation burden and take primary responsibility for addressing user harm, cybersecurity risks, safety issues, psychological disorders and deepfakes. This places the private sector at the centre of enforcement, even as the state considers how to supervise it.
That arrangement makes the definition of responsibility especially important. If companies are expected to identify and manage risks, they will need to know which uses are prohibited, which require impact assessments, which incidents must be reported and what evidence regulators will require after a failure. Without such clarity, responsibility could remain broad in principle but difficult to enforce in practice.
The consultation paper is also emerging after a change in the government’s public position. MeitY minister Ashwini Vaishnaw announced on October 8 that the ministry would issue a consultation paper on a new AI law within a month. The announcement signalled movement away from the earlier argument that existing laws and voluntary norms were sufficient. Critics had said that approach left gaps around risks including autonomous agents and accountability.
The move towards a formal consultation does not itself establish what the eventual law will contain. It does, however, create the first publicly described institutional process for deciding whether existing rules are adequate and where new obligations may be necessary. The paper’s value will depend on whether it converts broad concerns about AI into clearly assigned responsibilities across regulators, companies and users.
For India’s cities and infrastructure systems, that question will extend beyond consumer applications. Urban services increasingly depend on interconnected networks operated by public agencies and private companies. The supplied material does not specify how the proposed framework would apply to municipal systems, transport operations, utilities or public-sector decision-making. It does show why those questions cannot be separated from the wider regulatory debate: the risks of AI depend heavily on the system in which it is deployed and the consequences when it fails.
A central framework can provide common principles on safety, inclusivity and accountability. Sectoral regulators can add operational rules for markets and networks they already supervise. The challenge is to ensure that this division does not leave systems that cross regulatory boundaries without a clear owner. The consultation paper’s focus on who will regulate AI and who will answer for harm makes that institutional gap one of its most consequential issues.
The evidence currently establishes the direction of travel but not the final architecture. MeitY is preparing a consultation paper, the government is considering a new law, sector regulators are beginning to define responsibilities in their own domains and industry is expected to play a major role in implementation. The next milestone will be the release of the consultation paper, which should clarify the proposed division between central oversight, sectoral regulation and company-level accountability.
