A UK-based software firm supplying analytics to mid-size Indian banks hit a compliance problem that stopped their renewal cold. One of their clients’ compliance officers sent a detailed questionnaire: AI model documentation, data residency, what happened to Indian personal data inside the platform. The firm had good answers on some of it. On the rest, they were working from assumptions. That gap, between what a UK business assumes and what an Indian regulator already expects, is where compliance exposure concentrates.
India’s AI governance landscape has moved quickly. The rules span data protection law, sector regulation, and government guidelines published in late 2025. For UK owner-operators with Indian clients, outsourcing partners, or data flows touching India, knowing the structure matters now.
What is India’s approach to AI governance?
India governs AI through sector regulators rather than a single binding Act. The 2025 India AI Governance Guidelines assign enforcement responsibility to existing bodies: the Reserve Bank of India for banking and payments, SEBI for capital markets, and relevant ministries for healthcare. The framework targets applications of AI rather than the underlying technology, with coordination handled by a proposed AI Governance Group.
The horizontal data law is the Digital Personal Data Protection Act 2023, administered by the Ministry of Electronics and Information Technology. The DPDP Act introduces consent requirements, purpose limitation, and security obligations for data fiduciaries, with penalties up to INR 250 crore per incident. A 2024 advisory from MeitY separately directs platforms and intermediaries using AI to implement due diligence measures under the IT Act 2000, covering transparency obligations and controls on unlawful content. India’s preference for innovation-enabling governance means the regulatory picture is fragmented by design. For a UK business, the working question is not which Act applies but which regulator touches your sector.
Why does this matter for UK owner-operators?
The DPDP Act sets penalties up to INR 250 crore (roughly USD 30 million) per incident for data fiduciaries who fall short on consent or security. Any UK business processing Indian personal data through a partner, platform, or cross-border service qualifies as a data fiduciary under that law. A light-touch policy stance does not reduce the potential penalties.
The pace of AI adoption inside India adds a second risk layer. Survey data from Pinac Law’s 2025 workplace governance guide indicates that nearly 60% of Indian organisations either lack an AI governance policy or are still developing one, even as 80% have declared AI a core strategic priority. That mismatch produces shadow AI exposure: staff uploading customer data or proprietary code to public AI tools without authorisation. Over 40% of documented shadow AI incidents have involved intellectual property compromise. If your Indian outsourcing partner carries that gap, and your data sits in their environment, the risk belongs to your business as much as theirs. Explicitly covering AI governance and data handling in vendor assessments is a reasonable precaution before extending or renewing any outsourcing arrangement.
Where will you actually meet these rules?
The rules surface most visibly in financial services. RBI outsourcing directions require Indian banks to retain ultimate accountability for any vendor function, meaning UK firms supplying AI-driven credit scoring or fraud detection face model documentation and audit trail requirements through their clients’ internal governance. SEBI’s algorithmic trading framework adds pre-deployment testing, kill switches, and audit logs for capital markets tools.
Beyond financial services, the IT and outsourcing sector brings questionnaire-based exposure. India’s major technology services firms, including Infosys, TCS, and Wipro, have built internal AI governance frameworks that frequently exceed current regulatory requirements because global client demands push them there. A UK SME working with these firms, or with their tier-two peers, should expect formal due diligence queries about AI model documentation, data handling, and DPDP compliance. The same logic runs in the other direction: when you are the client purchasing AI-enabled services from an Indian firm, you should run equivalent due diligence to satisfy your UK GDPR obligations.
Healthcare introduces a further layer. India’s National Digital Health Mission and its telemedicine guidelines require clear consent mechanisms and strict privacy controls. UK healthtech firms selling AI tools into Indian hospital systems face growing pressure to explain algorithmic behaviour and evidence absence of bias. There is no dedicated healthcare AI statute yet, but the combination of DPDP obligations and procurement-driven contractual standards creates practical requirements that operate like one.
When do you need to act, and when can you wait?
Act now if any of these describe your situation: you process Indian personal data directly or through a vendor; you supply AI-enabled tools into Indian banking, capital markets, or healthcare; your outsourcing partner in India has access to UK client or employee data. In any of those situations, DPDP obligations and sector-level expectations are already live, not prospective rules on a future timeline.
Three practical starting points fit a realistic working week. First, map your data flows involving India. Confirm whether DPDP data-fiduciary obligations apply. The test is straightforward: if your systems receive, store, or process data about Indian residents, they apply. Second, update your vendor questionnaire to cover AI governance explicitly. The due diligence you would run on a UK AI tool applies equally to Indian vendors, covering where data goes, who trains on it, what access controls are in place, and what happens at contract end. Third, run a Data Protection Impact Assessment that explicitly covers the India leg of any AI deployment touching personal data. The ICO’s DPIA guidance covers your UK obligations; DPDP requirements cover the Indian portion. They are broadly compatible, and a single documented exercise can address both.
One assumption worth correcting before you decide to wait: the absence of a single AI Act does not mean low liability. DPDP penalties are already in force. RBI and SEBI enforcement on model governance is active. Firms that defer compliance work on the grounds that India’s regime is “still developing” are miscalibrating the actual enforcement risk.
How does this connect to your UK and EU compliance picture?
India’s rules do not sit in isolation. ICO guidance on AI and data protection applies whenever UK residents’ data passes through an Indian system, regardless of where the processing takes place. EU AI Act obligations can reach UK-based suppliers of high-risk AI into EU member states, with fines up to €35 million or 7% of global turnover. FCA-regulated firms must evidence appropriate governance over any AI-enabled function outsourced to India.
This creates a layered compliance picture for businesses operating across both environments. An AI system touching Indian personal data, processed in part by an Indian vendor, and delivering outputs to EU-based clients can sit under DPDP, the EU AI Act, ICO guidance, and RBI or SEBI expectations simultaneously. The practical answer is to map the data flows, identify which personal data belongs to which jurisdiction, and design your governance work to address all applicable regimes in a single documented exercise rather than as separate projects.
India’s stated preference for techno-legal mechanisms, combining technical safeguards such as audit logs and watermarking with legal controls, aligns closely with the approach recommended by the NCSC for secure AI development. Firms that have completed solid governance work for their UK compliance will find much of the documented framework reusable in India-specific conversations with clients or regulators. The difference is the sectoral distribution of enforcement: in the UK and EU you are dealing with one or two primary regulators; in India you may face three or four, depending on your sector and the functions your AI performs.
If you would like to talk through what this means for your specific business and the AI arrangements you operate, a conversation is the right place to start. Book a conversation.
