The EU AI Act was presented as a landmark effort to regulate AI through a risk-based framework. But The EU’s AI Omnibus, which entered into force on July 27, changes parts of the AI Act. It extends some deadlines and simplifies some compliance requirements. It also gives regulators and companies more time to prepare for high-risk AI rules. This is not a retreat from regulation. It is an admission that AI is changing faster than laws can normally change.

For India, this offers an important lesson. The question is how to regulate AI without slowing innovation. The original EU AI Act was based on a risk-based approach. Some AI practices were prohibited. High-risk systems faced strict obligations. General-purpose AI models also came under specific rules. But implementation has proved difficult. The EU’s response shows that even carefully designed regulation must be capable of adjustment.

The first lesson for India is that good regulation must be capable of learning. Technology changes. Risks change. Regulators must have the ability to review and adjust rules. Regulation should be a continuing process.

India has so far followed a different path. It has focused on responsible AI, innovation and sector-specific governance rather than creating a comprehensive AI law. This flexibility can be useful but it should not become uncertainty. Businesses need clarity. Citizens need protection. Regulators need clear responsibilities. The regulatory burden should depend on potential harm. The greater the risk to people and society, the stronger the safeguards should be.

The second lesson is that regulation needs an escape valve. Rules work only when regulators and companies have the capacity to implement them. India should consider regulatory sandboxes and regular reviews of AI rules. Sunset mechanisms could make regulation more responsive.

The third lesson concerns smaller companies. Compliance can be expensive. Large technology companies can hire lawyers, engineers and auditors. Start-ups cannot always do so. Excessive compliance costs could unintentionally favour large companies and reduce competition.

The fourth lesson is that simplification must not mean deregulation. Reducing paperwork is different from reducing safeguards. AI can create serious risks involving privacy, discrimination, manipulation and opaque decision-making. India must ensure that simpler regulation does not mean weaker protection.

The fifth lesson is institutional. The EU has shown that even a major regulatory framework can be revised. Regulatory maturity means recognising when rules are not working and changing them.

India has its own strengths. It has a large digital population; experience with digital public infrastructure. It has a growing technology sector and experience in deploying digital services at scale. These can support an adaptive Indian model of AI governance.

The IndiaAI Mission can play an important role. So can regulatory sandboxes, sectoral regulators, research institutions and industry bodies. India should create a framework that protects citizens while allowing experimentation. Above all, it should be capable of changing as technology changes.

The debate over AI is often presented as a choice between regulation and innovation. That is a false choice. The challenge is to design regulation that makes innovation safer and more trusted.

The writer is assistant professor, School of International Studies, JNU