AI Taxonomy – From Labels to Levers: A Functional Approach

Governments around the world are considering how existing and emerging regulatory frameworks should apply to AI. Some jurisdictions have introduced standalone horizontal legislation, while others are addressing AI risks through existing digital services, consumer protection, data protection and sectoral frameworks. In India, the AI Governance Guidelines (2025) have endorsed a risk-based and sectorally informed approach, even as the possibility of standalone AI legislation continues to be considered. 

Across these approaches, applying regulatory obligations to AI raises two related questions. First, how should an actor be classified under the law? Second, does that actor have the information and control required to fulfil a particular obligation? Broad labels such as “intermediary”, “provider”, “deployer” or “platform” provide a useful starting point, but may not always capture the specific function an actor performs or the degree of control available to it. 

AI Taxonomy – From Labels to Levers: A Functional Approach, developed by The Quantum Hub (TQH) with inputs from the Indian Governance and Policy Project (IGAP), seeks to bridge this gap by proposing a functional taxonomy of AI actors. The taxonomy categorises actors according to the functions they perform in relation to a specific AI output and examines how visibility and control over the generation, use and distribution of AI outputs – whether text, images, audio or video – are distributed across different actors and technical layers. The scope of this work is limited to the Generative AI output lifecycle. Agentic systems are also considered to illustrate how control over AI outputs and intermediate steps may be distributed across different technical layers and actors. However, the allocation of responsibility for autonomous actions taken by such systems remains outside the scope of the report.

The taxonomy is further developed into a ‘functional attributes matrix’, which compares eight actor categories across five attributes relating to their ability to influence, observe and control AI outputs. The matrix provides a common analytical framework for identifying which actors are best placed to prevent, mitigate or respond to specific output-related risks. 

Even where a single entity performs several functions, the control available to it may vary at each stage. Identifying where these points of control lie can support more proportionate and effective regulation by directing obligations towards actors capable of fulfilling them and calibrating those obligations to the extent of their influence. The analysis also accounts for the broader deployment context, recognising that both risk exposure and the technical and operational controls available to actors may vary across use cases and environments. 

The taxonomy draws on secondary research, analysis of regulatory approaches across jurisdictions and consultations with industry and civil society experts. 

The intent of this work is not to recommend more or fewer obligations, but to provide policymakers with a practical toolkit for determining where responsibility can most effectively sit. As AI systems evolve, the actors and architectures around them will evolve as well. Durable AI governance therefore depends on assigning responsibility where information and control actually lie, rather than assuming that legal categories will always map neatly onto technical capabilities.