India Opens Nuclear Sector to Private and Foreign Operators Under New Framework

India has released draft SHANTI Rules and Regulations for public consultation, establishing separate frameworks for licensing and safety authorisation in the nuclear sector. The rules permit private and foreign operators to participate in nuclear energy development, supporting the government's target of 100 GW of nuclear capacity by 2047, up from the current 8.8 GW.

Prospective operators may seek in-principle approval before selecting a site or technology, enabling early engagement with reactor vendors and infrastructure acquisition. A single composite licence covers building, owning, operating and decommissioning nuclear plants for electricity generation, captive power, hydrogen production and research applications.

Applicants must demonstrate financial, managerial and technical capabilities, including assured fuel supplies and spent fuel management arrangements
Operators must maintain insurance or financial security for nuclear damage, with security remaining in place until spent fuel removal
Foreign reactor designs require approval from the country of origin's regulatory authority and operational precedent in that country or another nation
The Atomic Energy Regulatory Board conducts design approval and safety authorisation for siting, construction, commissioning, operation and decommissioning stages
A Nuclear Liability Fund, funded through operator levies, provides additional protection for nuclear damage claims

Regulatory Requirements

Detailed safety checks encompass plant design, accident analysis, safety systems, site characteristics, radiological impact, emergency preparedness and waste management. Before operating authorisation, facilities must submit commissioning results, safety reports, technical specifications and radiation protection plans.

Uranium and thorium mining above government thresholds remains restricted to state-nominated entities
Civil liability limits will be reviewed every five years by an expert group
Foreign designs must originate from countries with self-reliant reactor design and supply-chain ecosystems and globally trusted regulatory approvals

India's Power Sector Faces New Cybersecurity Requirements

India's power sector will operate under new cybersecurity mandates following notification of the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026. The framework applies to entities owning, operating or managing operational technology infrastructure linked to the interconnected power system, with thresholds of 50 MW and above for generating companies and energy storage facilities.

Organisations must encrypt sensitive data, including cloud-hosted information, and ensure vendors handling such data meet security standards. The regulations require segregation of IT and OT systems, with operational technology equipment and services procured exclusively from trusted sources. Remote OT operations must use dedicated channels isolated from the internet and operate within India.

Report cybersecurity incidents to CSIRT-Power and CERT-In within six hours; cyber sabotage involving critical systems within 24 hours
Conduct vulnerability assessments and penetration testing before commissioning new critical systems; address critical vulnerabilities within one month
Appoint a chief information security officer and alternate, maintain 24-hour security functions, and conduct annual self-audits
Implement mandatory cybersecurity training for personnel operating critical systems and periodic security exercises

India's SHANTI Act Draft Rules Establish Single Licence Regime and Technology Criteria

Draft rules under India's SHANTI Act establish a single composite licence regime covering construction, ownership, operation, and decommissioning of nuclear power plants. The framework opens the sector to private developers and foreign technology, subject to specified conditions. Private applicants must maintain mandatory insurance coverage and financial security extending through decommissioning and waste management phases.

Foreign reactor designs are permitted only if operational and certified by regulatory authorities in their country of origin or other recognized nations. Eligibility is restricted to countries demonstrating self-reliance in nuclear reactor design and supply chain ecosystems with globally trusted regulatory approvals. Imported or domestically acquired technology must not adversely affect national interests. The Department of Atomic Energy opened the draft rules for public comment through September 4.

Single composite licence for all plant lifecycle stages
Mandatory insurance and financial security requirements for private operators
Foreign technology restricted to self-reliant nations with certified designs
Public consultation period extended through early September