Deploying Legal AI in India: What the Law Requires, What the Government Wants, and What the Data Actually Looks Like

India has one of the world's largest litigation caseloads: more than 56 million cases are pending across its courts. The government has committed about $1.2 billion to a national AI mission. And yet, deploying a legal AI system in India in 2026 means navigating a framework that is simultaneously permissive, fragmented, and shifting fast.Sources: National Judicial Data Grid

This article covers the four questions that matter most for any provider entering this market: what the law currently requires, what the government is building toward, what the corpus of Indian legal text actually contains, and where computation must physically sit.

1. THE LEGAL FRAMEWORK: A MOSAIC, NOT A LAW

India has no dedicated AI legislation. What exists is a layered set of frameworks that apply to AI systems indirectly.

The foundational instrument is the Digital Personal Data Protection Act (DPDPA), which received assent in August 2023; its implementing DPDP Rules were notified on 14 November 2025, and substantive compliance obligations take effect after an 18-month transition, by 14 May 2027. The Act establishes the concept of the "data fiduciary": any entity that determines the purpose and means of processing personal data. A legal AI system that ingests client documents, court filings, or case instructions is almost certainly a data fiduciary under this definition.Sources: DPDP Act

The obligations that follow are not trivial. Processing must be lawful and for a specified purpose. Data must be minimised. The client, as data principal, has rights of access, correction, and erasure. If the system uses subprocessors (cloud infrastructure, model providers), those relationships require Data Processing Agreements with contractual standards for purpose limitation and security.

Critically, the DPDPA uses a negative-list approach to cross-border transfers: personal data may flow outside India to any destination unless the Central Government explicitly restricts it. As of June 2026, no countries have been added to the restricted list — though stricter sector-specific localisation rules continue to apply, and Section 16 becomes fully operative at the May 2027 milestone. This means cross-border inference is currently legal for general personal data, but the government retains the power to change this at any time.Sources: DPDPA Section 16

For regulated sectors, the picture is stricter. The Reserve Bank of India requires payment system data to be stored only in India, with a limited carve-out that lets the foreign leg of a cross-border transaction be processed abroad provided the data is purged from offshore systems and returned to India within 24 hours. Sector-specific localisation is not merely anticipated: IRDAI already requires insurers to keep Indian policy and claims records within India (Maintenance of Insurance Records Regulations, 2015), and SEBI's cloud and cyber-resilience frameworks impose localisation conditions on regulated entities — though SEBI's data-localisation element remains on hold pending further notification. Any legal AI system serving the fintech or banking sector, or processing documents that contain payment or financial data, must plan for India-resident storage from day one.Sources: RBI directive

On professional conduct: the Bar Council of India has issued no formal AI guidance; the only national-level instrument is the government's India AI Governance Guidelines (MeitY, November 2025). No Indian bar association has published an equivalent voluntary AI advisory. The prudent practices that international guidance converges on are consistent across bodies: verify AI output against primary sources before filing, be transparent with clients about AI use, and protect client confidentiality when uploading material to third-party tools. In India, the clearest professional-conduct signals have come from the courts themselves.

In February 2026 the Supreme Court addressed AI-fabricated citations in two matters. On 17 February, a bench led by Chief Justice Surya Kant called the trend of lawyers using AI to cite non-existent judgments "alarming" — Justice Nagarathna pointing to a fictitious "Mercy vs Mankind." On 27 February, in Gummadi Usha Rani v. Sure Mallikarjuna Rao (2026 SCC OnLine SC 341), Justices Narasimha and Aradhe held that relying on non-existent, AI-generated judgments "would be a misconduct," not a mere error in decision-making. The line the courts are drawing runs through verification: AI-assisted drafting is not the problem; filing fabricated citations without checking them is.Sources: Gummadi Usha Rani (SCC Online) · CJI bench, 17 Feb

2. WHAT THE GOVERNMENT IS BUILDING

The IndiaAI Mission, approved by the Union Cabinet on 7 March 2024 with an outlay of about Rs 10,371.92 crore (roughly Rs 103.7 billion) over five years, is the most significant government AI initiative currently active. It operates across seven pillars: compute capacity, the Innovation Centre, the Datasets Platform (AIKosh), the Application Development Initiative, FutureSkills, startup financing, and Safe & Trusted AI.Sources: IndiaAI Mission

On compute: by mid-2025, the mission had empanelled 34,333 GPUs (18,417 already available plus 15,916 added), far exceeding its original 10,000 target, offered at subsidised rates. This is relevant for any provider considering India-hosted fine-tuning or embedding generation.Sources: IndiaAI compute milestone

On datasets: AIKosh, launched in March 2025, is the IndiaAI Datasets Platform, aggregating non-personal government and public datasets for AI training; legal data is an obvious candidate, given the volume of public court records, though the specific scope and access terms are still being defined.Sources: AIKosh

On governance: India's AI Governance Guidelines, published in November 2025, establish seven foundational principles (called sutras in the document): Trust is the Foundation, People First, Innovation over Restraint, Fairness & Equity, Accountability, Understandable by Design, and Safety, Resilience & Sustainability. The guidelines are voluntary. There is no enforcement mechanism and no regulator with a specific AI mandate. The philosophy is explicitly techno-legal: compliance is meant to be embedded into system architecture rather than enforced through inspections.Sources: India AI Governance Guidelines

The government's position is that it wants India to be an AI-producing country, not merely an AI-consuming one. The concern about paying for intelligence generated from Indian data has moved from academic to policy-level. Any vendor that can demonstrate a model trained on Indian legal text, hosted in Indian infrastructure, positions itself well in that conversation.

3. THE CORPUS: WHAT INDIAN LEGAL TEXT ACTUALLY CONTAINS

This is where the practical difficulty lives, and where most legal AI deployments underestimate the challenge.

The formal Indian legal corpus spans the Supreme Court, 25 High Courts, and a network of specialised tribunals — the NCLAT, NCLT, ITAT, CESTAT, NGT and SAT — alongside sectoral regulators such as SEBI, RBI, CBDT, CCI and IRDAI that issue binding orders and circulars. The Indian High Court Judgments open dataset, published on the AWS Registry of Open Data, spans all 25 High Courts from 1950 to 2025, totals roughly 1TB and is updated quarterly; Supreme Court judgments are released as a separate, smaller dataset. (The broader Open Justice India initiative is working to release Indian court judgments as open data.) The district judiciary adds tens of millions of additional structured records via the eCourts/NJDG platform — official figures cite more than 70 million pending and disposed district-court cases — as case metadata rather than full-text judgments.Sources: AWS High Court Judgments dataset · Open Justice India

Three structural facts make this corpus harder to use than its volume suggests.

First, fragmentation by source format. The Supreme Court, each of the 25 High Courts, and every specialised tribunal publishes documents in different formats, different citation conventions, and different degrees of digital availability. A judgment from the Madras High Court and a judgment from the Rajasthan High Court on the same point of law will look nothing alike structurally.

Second, linguistic heterogeneity. A meaningful portion of High Court judgments, particularly from courts in states with strong regional language traditions, mix English with vernacular terms, statutory quotations, and procedural language in ways that general-purpose multilingual models handle poorly.

Third, authority hierarchy. Knowing that a Supreme Court judgment exists is not the same as knowing whether it controls on a given question, whether it has been overruled, distinguished, or affirmed by a Constitution Bench, or whether a High Court's interpretation in a specific circuit is the operative standard in practice. Retrieval systems that treat all documents as equal fail at exactly the cases where accuracy matters most.

Any serious legal AI deployment in India requires not just access to the corpus but a jurisdiction-aware indexing layer that understands which tribunal's output controls on which category of question.

4. WHERE COMPUTATION MUST SIT

Under the current DPDPA framework, there is no blanket requirement to run AI inference inside India for general legal data. The negative-list approach means cross-border processing is permissible until a country or category is restricted.

In practice, three considerations push toward India-resident infrastructure regardless of the legal minimum.

The first is sector-specific mandates. Legal work that touches RBI-regulated payment data, IRDAI-regulated insurance data, or SEBI-regulated securities data is subject to localisation requirements that already exist. A legal AI system serving the financial sector, or processing transaction documents as part of contract or compliance review, needs India-resident compute to stay compliant.

The second is the trajectory of regulation. The government has stated explicitly that it may impose additional localisation requirements for specific categories of sensitive data. Legal data involving disputes, regulatory investigations, or client confidential information is a plausible candidate. Providers who build on cloud-agnostic, geography-flexible infrastructure are better positioned than those who hard-code to a single region.

The third is client expectation. Indian enterprises in regulated sectors have already internalised data sovereignty as a procurement criterion. A legal AI provider that cannot demonstrate India-resident processing will lose competitive evaluations not because of law but because of policy-level preference that has become standard procurement language.

AWS Mumbai (ap-south-1), Azure Central India, and Google Cloud Mumbai all provide infrastructure that satisfies current DPDPA requirements and the existing sector-specific mandates. For providers with sovereign deployment capability, on-premises or private cloud options allow Indian law firms and legal departments to run the full stack within their own controlled environment, which eliminates the cross-border question entirely.

THE OPERATIONAL PICTURE

Operating a legal AI system in India in 2026 is legally permissible. There is no licence requirement, no AI-specific regulator, and no law that prohibits the activity. The framework that applies is a combination of data protection obligations under the DPDPA, sector-specific data localisation mandates for regulated clients, and professional conduct standards that require human verification of AI output before filing.

The practical barriers are not legal. They are technical: the fragmentation of the corpus, the absence of a reliable citation verification layer, and the challenge of mapping authority hierarchy across 25 High Courts and a dozen specialised tribunals. The providers who solve those problems will find a market that the government is actively trying to develop and that the legal profession is starting to use, with or without formal guidance.

The window for establishing infrastructure trust with Indian clients is open. It will not stay open indefinitely.