Practical notes from the engineers who build agents, copilots and AI products.
Four rule sets shape AI in Indian healthcare: the DPDP Act 2023 for personal data, the Ayushman Bharat Digital Mission policy for consent and identifiers, HIPAA where US patients are involved, and your own clinical governance. Together they decide where data sits, who may retrieve it and what you log.
Four rule sets govern AI compliance in retail and ecommerce in India: the DPDP Act 2023 for customer personal data, PCI DSS for anything touching card numbers, TRAI's commercial messaging regime for outbound WhatsApp and SMS, and consumer protection rules for what an automated agent is allowed to promise.
There is no AI-specific logistics regulation in India. What governs an AI system in logistics is the law already governing the data it touches: the DPDP Act 2023 for consignee and driver personal data, TRAI rules for automated customer messaging, GST movement records, and contract terms from enterprise shippers.
Manufacturing AI compliance splits across three zones. On the shop floor, worker personal data under the DPDP Act and network segmentation govern what leaves the plant. In enterprise systems, customer confidentiality on drawings governs what reaches a model. Exported machinery brings the EU AI Act.
No single regulation governs AI in SaaS. You inherit obligations from your customers: India's DPDP Act, UK and EU GDPR, the EU AI Act for certain uses, sector rules that reach you through regulated clients, and contractual commitments in your DPA. Architecture, not policy documents, is what satisfies them.