Risk-based regulation
Also called: Risk-based framework · Topic: Statutory, Regulatory and Quasi-judicial Bodies · NCERT: Beyond NCERT
Meaning
Risk-based regulation is a way of making rules where the strictness of control depends on how much harm an activity can cause. Activities that can do serious damage face tight checks. Low-risk activities face light rules or none. The aim is to protect people without choking new ideas, an approach often called "innovation with safeguards". The regulator also chooses a proportionate response, which means its action is sized to the harm and not heavier than needed.
Example
India's AI Governance Guidelines (5 November 2025) set out a risk-based, proportionate framework for artificial intelligence that builds on existing laws. Matching this approach, the IT Rules, 2021 were amended on 10 February 2026 to deal with deepfakes and other AI-made content. Platforms must block the worst harms, such as child sexual exploitation material, non-consensual intimate imagery and impersonation. Lawful synthetic content only needs a label.
Don't confuse with
- Uniform (one-size-fits-all) regulation: this applies the same rules to every actor and activity, whatever the risk. Risk-based regulation grades its rules by the level of harm.
- A standalone AI Act: India's risk-based AI framework is a set of guidelines plus rules made under the IT Act. Parliament has not passed a separate law on AI.