The Algorithm and the State: Inside India's Proposed AI Act That Could Ban Deepfakes, Mandate Watermarking, and Create a New Regulator—And Why Hollywood and Bollywood Are Both Watching

NEW DELHI — May 30, 2026 — On the morning of May 28, two days ago, the Ministry of Electronics and Information Technology released a 217‑page draft of legislation that will, if enacted, fundamentally reshape the relationship between artificial intelligence and the Indian state. The Artificial Intelligence (Regulation and Governance) Act, 2026—the "AI Act," as it is already being called—is the most ambitious regulatory intervention in the technology sector that any democratic government has attempted. It proposes to ban certain categories of AI‑generated content, including non‑consensual deepfake pornography and AI‑generated child sexual abuse material. It mandates that all AI‑generated or AI‑assisted content—images, videos, audio, text—that is published or distributed in India be watermarked or labelled in a way that identifies its synthetic origin. It creates a new statutory authority, the Artificial Intelligence Regulatory Authority of India, with the power to license, audit, and sanction the developers and deployers of high‑risk AI systems. And it imposes criminal penalties—including imprisonment—for the most serious violations of its provisions.

The draft legislation arrives at a moment when the debate over AI regulation has become the most contentious policy conversation in the world. The European Union's AI Act, which was adopted in 2024 and will be fully implemented by 2026, has established the global template—a risk‑based framework that imposes progressively stricter obligations on AI systems as their potential for harm increases. The United States has, by contrast, relied primarily on voluntary commitments from the major technology companies, enforced through a series of executive orders and the Federal Trade Commission's existing consumer‑protection authority. China has imposed a comprehensive regime of AI content regulation. India's draft legislation is designed to be a third way—a framework that is more interventionist than the American model, more innovation‑friendly than the Chinese model, and more tailored to the specific conditions of the Indian market than the European model.

The Deepfake Emergency

The single most powerful force driving the AI Act's creation was the deepfake emergency that engulfed the Indian public sphere in late 2025 and early 2026. A series of incidents—a Bollywood star's face superimposed onto pornographic videos, a politician's voice cloned to make inflammatory statements that were never uttered, a business leader's likeness used to endorse a fraudulent investment scheme—demonstrated, with a force that no policy paper could match, that the technology for creating convincing synthetic media had advanced faster than the legal and regulatory infrastructure required to govern it. The victims of deepfakes had no clear legal remedy. The platforms that hosted deepfakes had no clear legal obligation to remove them. The creators of deepfakes operated in a space that was, effectively, lawless—a gap in the regulatory framework that the existing laws, designed for an era before generative AI, could not close.

The deepfake emergency was not unique to India. Similar incidents—the Taylor Swift deepfake pornography that circulated on X in January 2024, the AI‑generated images of Pope Francis in a Balenciaga puffer jacket that went viral in 2023, the political deepfakes that have been deployed in elections in Slovakia, Indonesia, and the United States—have made the regulation of synthetic media a global priority. The Indian government's response, however, has been more aggressive than that of most other democracies. The AI Act's deepfake provisions do not merely require the platforms to remove non‑consensual synthetic content upon notification. They make the creation and distribution of such content a criminal offence, punishable by up to three years in prison, and they impose a duty on the platforms to proactively detect and block such content, using the same AI tools that the creators use to generate it. The deepfake provisions are the sharpest edge of the AI Act—the provisions that will be tested first, in the courts and in the public square, and that will determine whether the Act is seen as a legitimate exercise of state authority or as an overreach that threatens free expression.

The deepfake emergency has also had a commercial dimension that extends well beyond the criminal law. The endorsement industry—the ₹10,000‑crore‑a‑year business in which celebrities license their names, their likenesses, and their voices to brands—has been thrown into chaos by the proliferation of AI‑generated deepfakes. The celebrity who has not endorsed a particular product can be made to appear as if they have, by a deepfake creator who has trained an AI model on publicly available images and videos. The brand that commissions a deepfake endorsement may not even be aware that the endorsement is fake—it may have been sold the rights to a "virtual influencer" by an agency that represents the deepfake as an original creation. The AI Act's watermarking and labelling provisions are designed, in part, to address this commercial chaos—to give brands, celebrities, and consumers the tools to distinguish between authentic endorsements and synthetic ones, and to give the victims of unauthorised synthetic endorsements a legal basis for challenging them. The watermarking mandate is, in this sense, not merely a consumer‑protection measure. It is a commercial‑infrastructure measure—a way of preserving the value of authentic human identity in a market that is being flooded with synthetic alternatives.

The Watermarking Mandate

The most operationally significant provision of the AI Act is the watermarking mandate. The draft requires that all AI‑generated or AI‑assisted content—images, videos, audio, and text—that is published or distributed in India be "identified by means of a persistent, tamper‑resistant label, metadata tag, or watermark" that indicates its synthetic origin and, where applicable, identifies the AI system or service that created it. The requirement applies to content that is created in India and to content that is created abroad but distributed to Indian audiences. The label or watermark must be detectable by both human readers and automated systems, and it must be designed to survive common forms of content manipulation—compression, cropping, screen capture, reformatting—that might otherwise strip it away. The technical standards for the watermark are to be developed by the AIRAI, in consultation with the industry, within twelve months of the Act's enactment.

The watermarking mandate is, in one sense, a technical intervention—an attempt to solve an information problem by embedding a persistent signal into the content itself. But it is also, in a deeper sense, a philosophical intervention—an assertion that synthetic content and authentic content are not equivalent, that the distinction between them matters, and that the state has a legitimate interest in ensuring that the distinction is visible to the people who consume the content. The mandate is modelled on the labelling requirements that have been applied to other categories of product—food, pharmaceuticals, consumer goods—that are subject to information asymmetries between producers and consumers. The consumer who buys a packaged food product has a right to know what is in it. The consumer who views a synthetic image or video, the Act argues, has a right to know that it is synthetic. The state's role is to enforce that right, by requiring the producer to label the product in a way that the consumer can understand.

The watermarking mandate has been the most controversial provision of the AI Act in the consultations that preceded its publication. The technology companies that develop generative‑AI models—the OpenAIs, the Googles, the StabilityAIs—have argued that the mandate is technically infeasible at the scale the Act requires, that the watermarking technologies that exist today can be stripped or evaded by sophisticated actors, and that the mandate will create a compliance burden that falls disproportionately on the smaller developers who can least afford it. The technology companies that operate the platforms that distribute content—the Metas, the Googles, the Xs—have argued that the mandate should be imposed on the creators of the content, not on the platforms that merely host it, and that the platforms should not be held liable for the failure of third‑party creators to comply. The government has acknowledged these objections but has not, so far, been persuaded by them. The draft Act imposes the watermarking obligation on both the developers of AI systems and the deployers who use those systems to create or distribute content, and it makes both categories of actor liable for violations. The government's view, expressed in the explanatory memorandum that accompanies the draft, is that the responsibility for ensuring the integrity of the information ecosystem must be shared by all the actors who participate in it, and that the costs of compliance must be borne by the industry that profits from the technology, not by the consumers who are exposed to its risks.

The New Regulator

The most institutionally significant dimension of the AI Act is the creation of the Artificial Intelligence Regulatory Authority of India. The AIRAI, which will be established as a statutory body with a chairperson and six full‑time members appointed by the central government, will have the power to license, audit, and sanction the developers and deployers of high‑risk AI systems. The definition of "high‑risk" is deliberately broad, encompassing AI systems that are used in critical infrastructure, in law enforcement and criminal justice, in employment and education, in healthcare and public health, in financial services, and in the production and distribution of information to the public. The AIRAI will be responsible for developing and enforcing the technical standards that the Act requires, for investigating complaints about AI systems that cause harm, and for imposing penalties—including fines, licence revocations, and, in the most serious cases, criminal referrals—on the entities that violate the Act's provisions.

The AIRAI is modelled, in its structure and its powers, on the regulatory authorities that have been established to govern other complex, technically sophisticated industries—the Securities and Exchange Board of India, the Telecom Regulatory Authority, the Insurance Regulatory and Development Authority. The model is familiar, but its application to the AI industry is novel, and the success or failure of the AIRAI will depend on the same variables that have determined the success or failure of every other regulatory authority: the quality of its leadership, the depth of its technical expertise, its independence from the political pressures that will inevitably be brought to bear on it, and its ability to move at the speed of the industry it is regulating—an industry that evolves, in some dimensions, on a cycle of weeks rather than years. The AIRAI is the most ambitious institutional experiment in the AI Act, and the outcome of that experiment will be watched by every country that is considering a similar approach.

The creation of the AIRAI also reflects a structural shift in the Indian government's approach to technology regulation. For most of the past three decades, the government's instinct—shaped by the success of the IT Act 2000 and the liberalisation of the telecom sector—has been to intervene lightly, to rely on self‑regulation and industry codes of conduct, and to use the state's authority sparingly and reactively. The AI Act represents a departure from that instinct—a recognition that the technology that is being developed today is too powerful, too pervasive, and too potentially harmful to be governed by the same light‑touch approach that governed the previous generation of digital technologies. The AI Act is, in this sense, not merely a regulatory framework. It is a philosophical statement—a declaration that the era of self‑regulation is over, and that the era of state‑mandated transparency, accountability, and liability has begun.

The Global Echo

The Indian AI Act is not being written in isolation. It is being written in the context of a global conversation about AI governance that is producing a patchwork of national and regional regulatory frameworks, each with its own definitions, its own standards, and its own enforcement mechanisms. The European Union's AI Act, which has established the most comprehensive regulatory framework to date, is built on a risk‑based pyramid that imposes the strictest obligations on the most dangerous AI applications—those that pose an "unacceptable risk" to safety, rights, or democratic values—and that largely exempts the least dangerous ones. The Indian Act borrows the EU's risk‑based structure but adapts it to the Indian context—expanding the definition of high‑risk to include AI systems that affect access to essential services, that process the personal data of vulnerable populations, and that are deployed in areas where the state has a particular interest, such as national security and public order.

The American approach, which has been shaped by the political dynamics of a divided government and the lobbying power of the technology industry, has been to avoid comprehensive federal legislation in favour of a series of executive orders, agency actions, and voluntary commitments from the major technology companies. The Biden administration's AI Bill of Rights, published in 2022, established a set of principles—safety, non‑discrimination, data privacy, notice and explanation, human alternatives—that have guided the federal government's approach but that have not been enacted into law. The Trump administration, which returned to office in January 2025, has indicated a preference for an even lighter regulatory touch, emphasising the importance of maintaining American competitiveness in AI and reducing the regulatory burden on the industry. The contrast between the American and Indian approaches—the former prioritising innovation and competitiveness, the latter prioritising safety and accountability—reflects a broader divergence in how the world's democracies are thinking about the governance of technology.

The Indian Act's global significance is not primarily a function of the size of the Indian market, although the market is large enough to make the Act a de facto global standard for any company that wants to operate in India. It is a function of the Act's ambition—the breadth of its scope, the depth of its regulatory intervention, and the precedent it sets for other developing countries that are looking for a model of AI governance that is more interventionist than the American approach and more tailored to their specific conditions than the European one. The Indian AI Act, if it is enacted in something close to its current form, will be the most significant legislative intervention in the AI industry that any democratic government has attempted, and its success or failure will shape the global conversation about AI governance for the next decade.

What This Signals

The AI Act is not primarily a story about regulation. It is a story about the structural tension between the speed of technological change and the speed of democratic governance—between the ability of the technology industry to develop and deploy powerful new capabilities in a matter of months and the ability of the state to understand, deliberate, and legislate on those capabilities in a matter of years. The Act is an attempt to close that gap—to build a regulatory framework that is both comprehensive enough to address the known risks of AI and flexible enough to adapt to the unknown ones. The attempt is ambitious, and its outcome is uncertain. The deepfake provisions will be tested in the courts. The watermarking mandate will be tested by the technology. The AIRAI will be tested by the politics. The AI Act is not the end of the conversation about AI governance. It is the beginning—and the conversation will continue long after the Act is passed.