[Answered] How can India formulate a risk-proportional AI governance architecture that prevents regulatory overreach while fostering ethical technological innovation? Analyze.

Introduction

India’s AI transition demands neither regulatory paralysis nor laissez-faire. The Economic Survey 2025–26 urges “measured and swift” governance, making risk-proportional regulation essential for innovation, rights and technological sovereignty.

Why India needs a risk-proportional architecture

1. AI applications range from low-risk productivity tools to systems affecting health, credit, employment, policing and critical infrastructure. A uniform compliance regime would impose identical costs on fundamentally different risks.
2. The Economic Survey 2025–26 explicitly recommends risk-based, proportionate regulation, graduated obligations according to firm scale and sector of use, and reliance on existing sectoral regulators rather than a single omnibus AI law.
3. This is consistent with NITI Aayog’s Responsible AI for All, which identifies safety, equality, inclusivity, privacy, transparency and accountability, while stressing that implementation should be calibrated to specific risks.

Proposed Risk-Proportional Architecture Four-Tier Risk Classification

1. Minimal risk: spam filters, productivity assistants → voluntary codes. Example: AI writing tools.
2. Limited risk: chatbots, synthetic media → transparency and labelling. Example: Deepfake labels.
3. High risk: healthcare diagnosis, recruitment, lending, education → impact assessment, human oversight, audit and explainability. Example: AI credit scoring.
4. Unacceptable risk: manipulative or discriminatory applications causing serious rights violations → prohibition/restriction. Example: Social scoring.

Preventing Regulatory Overreach

1. Graduated compliance: Obligations should rise with risk, scale, autonomy and potential harm, rather than merely the sophistication of the underlying model.
2. SME-sensitive regulation: Excessive audit and certification costs can favour Big Tech by creating entry barriers. The EU’s 2026 AI Omnibus itself extended simplifications to small and mid-cap firms and expanded sandbox access, an important regulatory-learning lesson for India.
3. Regulatory sandboxes: High-risk innovations should be tested under controlled supervision before full-scale deployment. Example: EU AI sandbox.
4. Sunset/review clauses: AI rules should undergo mandatory periodic review because technological capabilities and risk profiles evolve rapidly.

Institutional architecture

Rather than creating an all-powerful central regulator:

1. RBI → algorithmic lending and financial AI.
2. SEBI → AI in securities markets.
3. IRDAI → insurance algorithms.
4. NMC/health authorities → clinical AI.
5. Election authorities → political deepfakes and synthetic campaigning.
6. MeitY/AIGEG → horizontal standards, coordination and systemic-risk oversight. MeitY has already constituted an AI Governance and Economic Group (AIGEG) in 2026, creating an institutional base for such coordination.

India’s AI Dilemma Innovation vs. Regulation

1. Risk-Proportional Classification: Heavy upfront compliance costs risk crippling early-stage startups; regulations must categorize AI tools based on actual harm tiers rather than broad systemic definitions. Example: Risk-Based Framework.
2. Preventing Innovation Flight: Strict ex-ante liability frameworks force indigenous tech talent and capital to migrate to friendlier regulatory jurisdictions. Example: Startup Capital Flight.
3. Addressing Asymmetric Market Power: Broad, rigid mandates disproportionately harm smaller developers, consolidating AI dominance among capital-rich Big Tech conglomerates. Example: Market Concentration Burden.
4. Leveraging Existing Statutory Frameworks: Re-using existing laws, such as the Digital Personal Data Protection Act (DPDPA), 2023 and BNS provisions, avoids duplicating compliance burdens across agencies. Example: DPDPA Statutory Synergy.

Way Forward

1. Adopt Regulatory Sandboxes: Establish time-bound testing environments under MeitY to evaluate high-risk AI models before full market deployment. Example: MeitY AI Sandboxes.
2. Empower Sectoral Authorities: Allow domain-specific bodies (RBI, SEBI, NMC) to issue tailored AI guidelines rather than enforcing a centralized, rigid mandate. Example: Sectoral Regulator Audits.
3. Mandate Watermarking & Water-level Transparency: Focus statutory enforcement on high-harm areas like deepfakes and algorithmic bias using machine-readable provenance tags. Example: Synthetic Content Tagging.

Conclusion

As Dr. A.P.J. Abdul Kalam’s vision of technology for societal transformation reminds us, India must make AI regulation a trust enabler, protecting citizens while keeping innovation accessible and inclusive.