When India's Ministry of Electronics and Information Technology released its AI Governance Guidelines on 5 November 2025, it made a deliberate choice: to impose almost nothing. The framework rests on seven principles, among them trust, fairness, accountability, and, stated outright, innovation over restraint. It expresses a clear preference for voluntary compliance, self-certification and regulatory sandboxes over binding mandates. This is what officials call a techno-legal approach, the idea that technical standards and institutional capacity should mature before firm rules are written, so that regulation does not freeze a field still changing shape. It is a defensible instinct, one several governments have reached after watching the European Union legislate early and then spend years amending.
Voluntary is not the same as unregulated, and the distinction matters. The Digital Personal Data Protection Act already binds anyone handling personal data, whatever technology they use, and sectoral watchdogs like the securities regulator SEBI and the Reserve Bank impose their own requirements. What is missing is anything AI-specific: no registration, no pre-deployment assessment, no mandatory disclosure of training data, no independent audit. And even that picture is unsettled. A six-member government committee is quietly drafting firmer rules, while MeitY weighs whether high-capacity GPU clusters above some threshold should have to register or disclose their end use. For a company deciding what to build in India this year, the difficulty is not that the rules are strict. It is that the ones that will count have not been written down yet.
There is, however, a far harder limit on Indian AI than anything MeitY has drafted, and it is not Indian. The government's flagship IndiaAI Mission runs on subsidised compute, some 34,000 GPUs by its own count, and that hardware is overwhelmingly made by Nvidia. So is almost everyone else's. Nvidia is an American company, and its most advanced chips fall under US export control, the same statutory authority Washington used to cut China off from cutting-edge silicon in 2022 and is now moving to extend.
The extension is the part worth watching. A bill before the US Senate, the Remote Access Security Act, would treat renting compute as an export event in itself, closing the gap that has let Chinese laboratories reach restricted hardware through data centres in third countries. The bill is aimed squarely at China. The instrument, though, is not country-specific. Any regime that treats access to American chips as a licensable export hands Washington a decision over who may use them, anywhere, regardless of where the machines physically sit. India has open-sourced models across 22 languages, built genuine domestic capability and holds a data advantage no other democracy can match. All of it runs on silicon licensed under another government's authority.
Sovereignty in AI has usually been debated in India as a question of models and data: whether the systems serving Indians are built at home, trained on Indian languages and governed by Indian law. Those are real questions, and the answers so far have been reasonably good. But they sit downstream of a quieter one that has drawn far less attention: who decides whether the compute keeps running. A voluntary domestic framework and a foreign licensing regime are not symmetrical instruments. One asks. The other does not have to.