India's AI rulebook is voluntary! The chips it runs on are not

India made a deliberate choice about how to govern artificial intelligence, and it is worth being precise about what the choice was.

The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology on November 5, 2025, did not impose obligations on anyone. They set out principles, proposed institutions, and expressed a preference for voluntary compliance, self-certification and regulatory sandboxes over prescriptive mandates.

That was not an oversight. It was the stated approach, and one of the seven principles says so outright: innovation over restraint.

What The Guidelines Actually Do

The framework rests on seven principles — trust as the foundation, people first, innovation over restraint, fairness and equity, accountability, understandable by design, and safety, resilience and sustainability.

It proposed three bodies to carry them: an AI Governance Group, a Technology and Policy Expert Committee, and an AI Safety Institute.

Nine months on, the AI Safety Institute has been established under the IndiaAI Mission. The other two remain proposals.

This is described as a techno-legal approach — the idea that technical standards and institutional capacity should mature before binding rules are written, so that regulation does not freeze a field still changing shape. It is a defensible position, and several jurisdictions have arrived at versions of it after watching the European Union legislate early and then spend years amending.

What It Does Not Mean

Voluntary AI guidelines are not the same as an unregulated environment, and the distinction matters.

The Digital Personal Data Protection Act binds anyone processing personal data, whatever technology they use. Sectoral regulators impose their own requirements — SEBI on securities markets, the Reserve Bank on financial services. An AI system that mishandles personal data or misprices a financial product is already exposed under existing law.

What is absent is AI-specific obligation: no registration, no pre-deployment assessment, no mandatory disclosure of training data or model capability, no independent audit requirement.

The Rules Being Written Anyway

The picture is complicated by what has been happening since.

A six-member government committee has been working on more prescriptive rules, reported in May. Separately, there is active discussion within MeitY about whether high-capacity GPU clusters above a certain threshold should be required to register or disclose end use.

Neither has been formally notified. The GPU question is expected to surface in consultations on the Digital India Act.

So the operative position is a published voluntary framework, a committee drafting something firmer, and a compute-registration proposal that exists in discussion but not in law. For a company deciding what to build in India this year, that is a difficult set of facts to plan against — not because the rules are strict, but because the ones that count have not been written down.

The Constraint Nobody Voted On

There is a harder limit on Indian AI than anything MeitY has drafted, and it is not Indian.

The IndiaAI Mission's compute programme is built on subsidised GPUs — 34,000 by the government's own count, though aggregators cite higher figures — and that hardware is overwhelmingly Nvidia. So is almost everyone else's.

Nvidia is an American company, and its most advanced chips are subject to US export control. That is the same statutory authority Washington used to cut China off in 2022, and it is currently being extended. A bill before the Senate, the Remote Access Security Act, would treat renting compute as an export event in itself — closing the gap that let Chinese laboratories reach restricted hardware through data centres in third countries.

The bill is aimed at China. The instrument is not country-specific. Any regime that treats access to American chips as a licensable export gives Washington a decision over who may use them, anywhere, regardless of where the machines physically sit.

India has open-sourced models across 22 languages, built genuine domestic capability, and has a data advantage no other democracy can match. All of it runs on silicon licensed under another government's authority.

The Question Worth Asking

Sovereignty in AI has usually been discussed in India as a question of models and data — whether the systems serving Indians are built here, trained on Indian languages, governed by Indian law.

Those are real questions and the answers have been reasonably good. But they sit downstream of a question that has attracted less attention: who decides whether the compute keeps running.

A voluntary domestic framework and a foreign licensing regime are not symmetrical instruments. One asks. The other does not have to.