Before we get into this month's edition, a quick announcement.

Over the past few months, we've been experimenting with a different way of thinking about AI risk that’s not just based on the news. What do you really do when something goes wrong? We built an AI crisis-management workshop around that question, and after running it successfully in New Delhi and Bengaluru, we're now bringing it to Mumbai on 6 October for in-house law, policy, and compliance professionals.

You'll work through a live simulation involving rogue AI agents, patient data, investors, the media and an imminent fundraise (maybe deadlines are the true crisis). If you'd like to join us for this small, closed-door workshop in Mumbai, please reach out to Meghana from our team at meghanasantosh@ikigailaw.com or register here.

In this month’s deep dive, we look at the BRICS’ ambition to move the Global South towards shaping technology rules. Elsewhere, we look at India's new e-commerce rules and the growing regulatory interest in the systems that shape what consumers see and choose online. We also write about Australia’s new proposed digital duty of care law which could push online-safety regulation further into how platforms and other digital services are designed and operated.

If you are an in-house lawyer, compliance or a policy professional in Mumbai, don’t miss our workshop! Limited seats left!

I. I. Deep Dive

BRICS sets a tech agenda

India hosted the 18th BRICS Summit in New Delhi this month, bringing together leaders from the grouping's 11 member countries. The Summit ended with the unanimous adoption of the New Delhi Declaration, covering everything from trade and investment to security, institutional reform and technology.

Technology featured prominently. The Declaration covers artificial intelligence (AI), digital public infrastructure (DPI), quantum technologies, future communication networks, cybersecurity, digital fraud and intellectual property. It also calls for BRICS countries to work towards a “sovereign and self-reliant digital ecosystem.”

This fits into India's broader pitch for the Global South to move from being a “rule-taker to a rule-shaper.” But the Declaration also points to what that requires in practice. Having a greater say in writing global technology rules only gets you so far if the models, compute, infrastructure, skills and expertise needed to build those technologies remain concentrated elsewhere.

Building the capacity to shape the rules

Some of the ideas announced in Delhi give us a sense of where BRICS wants to start. The countries agreed to create a repository for DPI, along with pilot projects and capacity-building programmes through which members can share digital infrastructure and expertise. They also agreed to work more closely on research and emerging technologies, including quantum technologies and future communication networks.

Individual countries had their own proposals. Chinese President Xi Jinping proposed a BRICS open-source AI community, with cooperation on large language models, AI training and an open AI ecosystem. He also proposed a BRICS digital-ecosystem cloud platform. China wasn't only arguing that developing countries need better access to AI; it was offering some of the technology, infrastructure and expertise that could help provide it.

South African President Cyril Ramaphosa proposed an independent BRICS mechanism to evaluate advanced AI systems, along with reporting of serious AI incidents and stronger safeguards as AI systems become more capable. At the same time, he called for investment in sovereign AI capacity in developing countries.

Developing countries need a voice in technology governance, but they also need the technical capacity to exercise it—infrastructure to build and use these systems, people who understand them, and institutions capable of scrutinising them.

It is relevant to highlight that members from BRICS are not starting from the same place. China is the largest trading partner of every BRICS nation, and is a leading player in AI innovation, while several other BRICS countries continue to depend on foreign companies for cloud infrastructure, semiconductors and advanced AI models. Absolute AI self-reliance is difficult to achieve in practice precisely because countries remain embedded in international supply chains for hardware, cloud infrastructure, models, capital and expertise.

For India, technological autonomy needn't mean choosing between an American technology ecosystem and a Chinese one. India has generally approached BRICS as a forum for reforming the international order rather than replacing it, while maintaining technology relationships across different countries and companies. Greater autonomy can therefore also mean building more domestic capability and having greater choice over where critical technologies and infrastructure come from.

The same questions were coming up at the UN

BRICS wasn't the only forum asking these questions this month. Less than two weeks later, world leaders gathered in New York for the UN General Assembly, where access to AI capacity emerged alongside the now-familiar debates around AI safety and governance. On 10 September, the President of the UN General Assembly pointed out that 118 countries had yet to meaningfully participate in major international AI-governance initiatives. His priorities included not only safety, accountability and human oversight, but access to AI infrastructure, data and skills.

A day later, UN Secretary-General António Guterres called for work towards a Global Fund for AI Capacity-Building. He called for an initial $3 billion over two to four years to begin addressing gaps in compute, connectivity, data and skills in developing economies.

The conversations in Delhi and New York are useful to read together. The UN is trying to bring more countries into global AI governance while helping close some of the capacity gaps that prevent meaningful participation. BRICS is exploring what emerging economies might be able to do with each other—share DPI, develop skills and research programmes, and potentially cooperate on AI infrastructure.

There are obvious limits. AI infrastructure and frontier capabilities remain highly concentrated, BRICS itself contains enormous differences in technological capacity, and many of the initiatives announced in Delhi remain proposals, repositories and working groups whose impact will depend on implementation.

The larger shift is that the Global South's place in AI governance is now being discussed as a question of capacity, not just representation.

II. II. Connecting the Dots

E-commerce rules look under the hood of platforms

On 9 September, the Department of Consumer Affairs notified amendments to the Consumer Protection (E-Commerce) Rules, 2020. The changes kick in from 1 January 2027 and cover quite a bit - search results and rankings, sponsored listings, discounts, dark patterns, seller disclosures, complaints and even how marketplaces use information about their customers.

These rules are the latest step in an emerging trend of technology policy in India – regulation that is increasingly looking at how digital platforms are designed, and the effects of the design on the choices that people make.

A couple of changes highlight this – dark patterns being a clear example (you can read our earlier deep dive here). In 2023, the CCPA introduced guidelines identifying 13 kinds of deceptive design practices. In 2025, it asked e-commerce platforms to conduct self-audits, and 26 platforms subsequently submitted declarations of compliance. This year, we also saw the CCPA take enforcement action against companies. The new rules now make annual dark-pattern audits an obligation, with platforms required to prominently display a certificate saying they are dark-pattern free.

And the same thinking is spreading beyond dark patterns. Platforms cannot mislead users by manipulating search results based on their queries. Sponsored products must be clearly identified. Marketplaces must explain the main parameters used to rank products and sellers, so a consumer understands what they’re seeing. Discounts must be compared against the lowest price charged during the preceding 30 days.

This indicates a shift. Regulators are no longer looking only at what platforms tell consumers or what happens when a transaction goes wrong. They are increasingly looking at the systems that shape consumer choice in the first place—how products are ranked, prices presented, ads distinguished and user interfaces are designed.

II III. From the Courtroom to your inbox

· Children, contracts, and curfews: PILs on social media regulation are having a moment: Much like what’s playing out in the US, where multiple trials against social media platforms over their addictive design are ongoing, Indian courts are seeing something similar. A cluster of Public Interest Litigations (PILs) seeking regulation of children’s social media use is flooding the court rooms. These cases have focussed both, on the harmful content spewed across these platforms, and their addictive design features.

The Supreme Court is hearing a case instituted by Just Rights for Children Alliance, demanding safeguards for minors’ use of social media platforms. Just Rights argues that minors can’t enter into a legal contract with such platforms, since the age of majority in India is 18. And that the lack of an age-verification mechanism, in turn, exposes children to serious harms online. It has asked the Court to direct the government to declare such contracts invalid and introduce a requirement for parental or guardian consent, either through the Information Technology Rules, 2021, or other guidelines. The government has assured that it will take some action, and potentially address the minimum threshold of 18.

At the Delhi High Court, a law professor filed a PIL against addictive design features like autoplay, infinite scroll, and engagement-driven notifications, seeking an expert committee on design standards and a possible harm-compensation fund. The Court hasn’t dismissed the case yet, and will hear it next on 28 October 2026.

An earlier PIL, filed before the Delhi High Court (now dismissed), sought to restrict social media access for users below 13, regulate what content 13-16 year-olds can access, impose an overnight curfew for that age group, mandate age-verification mechanisms, among other asks. The Court dismissed it after noting that a similar case, Zep Foundation v. Union of India, which sought prohibition on social media usage for children under 13, had already been dismissed by the Supreme Court, on the ground that these were policy questions outside the court’s remit, directing petitioners to make a representation to the government instead.

IV IV. Global Tech Stories

“My Feed, My Way” Australia leads the charge on online safety

Australia has always been one of the most aggressive governments on social media regulation. It became the first country to ban social media use for children under 16, covering platforms like YouTube, Instagram, Snapchat, X, Facebook, and Reddit, among others. Now, it’s taking things a step further with its draft “duty of care” law.

Earlier this month, Prime Minister Anthony Albanese announced an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (Bill), which amends the Online Safety Act, 2021. This Bill is touted to be Act’s biggest overhaul since the it came into force. The intent is to give Australian users more agency over their internet use, particularly since the earlier ban hasn’t delivered the results government had hoped for.

The draft introduces a proactive “digital duty of care” across nine categories of online services, going well beyond just social media. It covers social media platforms, messaging and email, websites and apps, hosting services, search engines, app stores, and AI providers, among others. Providers would have to take reasonably practicable steps to provide a safe online environment, including conducting risk assessments and addressing foreseeable harms. Importantly, assessments would also be required before making changes to a service that are likely to introduce new risks.

For social media, the Bill goes directly after how platforms are designed. Under-16s would have to be protected from specified features including recommender systems, endless feeds and engagement-feedback mechanisms. More broadly, users would get greater control over algorithmic recommendations, including the ability to opt out of personalised feeds—hence the government's pitch: “My Feed, My Way.”

The exposure-draft consultation closed on 22 September, with the US government publicly objecting to parts of the proposal and warning that obligations affecting algorithms and content recommendations could lead platforms to over-moderate lawful speech. The Australian government has defended the proposal and will now consider consultation feedback before introducing legislation.

V. V. Reading reccos

Ben Thompson writes in Stratechery about whether agents like Muse will really change the way consumers use AI.
The Acquired podcast on Google’s AI story is a brilliant listen for anyone interested in the history of modern AI.
Ezra Klein has a good summary on New York Times of where the current AI debate is going, and what we should focus on.

VI. What’s keeping us busy?

We recently helped a global brand restructure its digital business in India, where a strategic partner would run the brand's primary online channel. The challenge was to benefit from the partner's platform capabilities and local execution without losing control over the brand's IP, consumer relationships and data.

Our approach: We designed a governance framework that separated who operates the channel from who ultimately controls its key assets. Consumer data was treated as the brand's asset from the outset, while operational rights, content and data would automatically revert to the brand if the partnership ended. We also built an exit mechanism that protected the partner's genuine investment while allowing the brand to switch operators, alongside business-continuity, incident-escalation and compliance obligations. We applied the same underlying logic to third-party marketplace sales. The operator may change, but control over the IP, data and brand standards remains with the brand.

VI VI. Shoutouts

On 6 October, we're hosting a small, closed-door crisis-management workshop for in-house legal and policy professionals. Participants will work alongside the Ikigai team through a simulated crisis involving rogue AI agents, patient data, an imminent fundraise, investors and the media—making decisions as the situation unfolds. The workshop will be held under the Chatham House Rule. If you'd like to attend, you can find more details here.
Aman Taneja and Nirmal Bhansali wrote in the Hindustan Times on why India needs a new framework to protect the digital likeness of ordinary citizens.
Our partner Nehaa Chaudhari is conducting a webinar is conducting an IAPP webinar on “DPDPA Across Industries: Navigating the Road from Compliance to Implementation”, looking at the move from understanding India's data protection framework to implementing it across industries. You can find more details and register here.