Discuss the institutional architecture proposed under the India AI Governance Guidelines and the challenges in operationalising it.

MeitY released the India AI Governance Guidelines in November 2025 under the IndiaAI Mission. They rest on seven sutras and six pillars, and "Institutions" is one of those pillars [1]. India has not created a new AI regulator. Instead, the guidelines place a light, coordinating architecture on top of existing law. This design is flexible, but enforcement is its weak point.

Proposed institutional architecture

• AI Governance Group (AIGG): a high-level, whole-of-government body that coordinates policy [1].
• Technology & Policy Expert Committee (TPEC): gives the AIGG technical and policy advice [1].
• AI Safety Institute (AISI): the technical arm for safety testing, standards and risk research. It works with CERT-In, and MeitY is the nodal ministry [1].
• Sectoral regulators: they enforce through the IT Rules, 2021 and the DPDP Act, 2023. There is no standalone AI Act [2].
• Enabling tools: graded liability based on a firm's role and level of risk, a national AI incident-reporting mechanism [1], and IndiaAI compute capacity [3].
• AI Governance and Economic Group: MeitY set it up later to coordinate across ministries and regulators [5].

Challenges in operationalising it

• No statutory teeth: most of these bodies only advise or coordinate. The guidelines rely on voluntary frameworks and avoid licensing "unless necessary", so a firm that does not comply faces no penalty [3].
• Gaps in the law: the IT Rules cover online content and the DPDP Act covers personal data. A model that helps someone plan a mass-casualty attack may breach neither law [2].
• Unclear liability: graded liability is still a recommendation and has not been written into law [1].
• No evidence base: the incident database proposed in the Principal Scientific Adviser's (PSA) techno-legal white paper does not exist yet [6]. Without it, regulators cannot spot patterns of harm.
• Coordination overload: the AIGG, the new Economic Group, the AISI, CERT-In and sectoral regulators may have overlapping mandates. When a risk cuts across sectors, no single body clearly leads [5].
• Capacity deficit: the AISI needs skilled testers and compute. Only about 38,000 GPUs have been onboarded against a target of 1,00,000 [3].

The architecture balances "Innovation over Restraint" with oversight, and the government says it will not allow unrestricted deployment of high-risk AI [4]. Four steps would make it work in practice:

• give the AISI a clear mandate to test frontier models;
• write graded liability into an amendment of the IT Rules;
• set up the PSA's incident database;
• lay down a lead-regulator protocol through the Economic Group.

Together these would deliver trusted, people-first AI in line with SDG 9.