Part of the AI Regulation News hub.
The Delhi High Court has directed every GST authority in India, for the time being, to refuse registration without biometric Aadhaar authentication, displacing a risk-analytics engine that had applied the check only to applicants the system scored as risky
A universal biometric gate is only as strong as the biometric. In the same week the order was made, two other High Courts were hearing bail matters in which duplicate fingerprints and seized fingerprint scanners were alleged.
Bottom line: Binding as an interim direction from 8 September 2026, and expressly provisional. The order says the directions are issued "for the time being" and grants the authorities liberty to file objections on practical difficulty. It is listed for further consideration on 22.09.2026.
Who this affects: CGST and State GST registering officers, GSTN common portal operators, chartered accountants and GST practitioners filing registrations, indirect tax counsel, and privacy counsel advising on biometric processing.
Issue date: 8 September 2026. The signature block reads SEPTEMBER 8, 2026/PT/HP. The copy we read carries the stamp "The Order is downloaded from the DHC Server on 09/09/2026 at 22:28:11".
What changed: Under an interim direction made "for the time being", with liberty to the authorities to object, biometric Aadhaar authentication moves from a condition triggered by an automated risk score to a precondition for every GST registration, applied by all authorities across the country.
Analysis: The Court records at paragraph 5 that a minister had already told the Rajya Sabha that biometric Aadhaar authentication had been made mandatory, and at paragraph 6 that the statement had not been fully implemented more than a year later. This is an enforcement order more than a new policy.
Primary sources: Neha v. Union of India & Ors., order dated 08.09.2026
- Instrument (EN)
- Order dated 08.09.2026 in Neha v. Union of India & Ors.
- Authority
- High Court of Delhi, Division Bench: Anil Kshetarpal J and Shail Jain J
- Jurisdiction
- India. The direction is addressed to "all the authorities across the country"
- Status
- Interim. Made "for the time being", with liberty to the authorities to file objections on practical difficulty
- Bindingness
- Binding as a direction of a High Court. It is not a final judgment and decides no issue in the writ petitions
- Issue date / next deadline
- 8 September 2026. Listed for further consideration on 22.09.2026 in the supplementary list
- Number
- W.P.(C) 12210/2026, CNR No. DLHC010392522026, with W.P.(C) 6218/2026, CNR No. DLHC010202192026
- Primary source
- https://indiankanoon.org/doc/199052616/
What the order directs, and how provisional it is
The operative passage is paragraph 8, and it is in force now. It records that counsel for the respondents "have failed to draw the attention of the court to any difficulty in mandating the biometric based AADHAR authentication of the GST Registration", and then: "Hence, for the time being, directions are issued to all the authorities across the country not to allow any GST Registration without biometric based AADHAR authentication henceforth. Liberty is granted to the authorities to file objections qua any practical difficulty in its implementation."
Two qualifiers in that paragraph carry the posture. For the time being marks it as interim. The liberty to file objections means the authorities can come back and say the thing cannot be done, and the matter is listed again on 22.09.2026.
The proceedings began as individual grievances. The order of 21.08.2026, reproduced inside the order of 01.09.2026, records that the petitioner alleged fraudulent GST registration by another person using her PAN and Aadhaar numbers, and that this was the second such case before the Bench.
The automated gate this replaces
Paragraph 3 is the part worth extracting. The Court records that on the written submissions of respondents 1, 2 and 4, "biometric based AADHAR Authentication is carried out only if the system identifies the case as 'risky' on the basis of various parameters and data analytics".
That is a risk-triage design. An automated system scores an application, and only applications it scores as risky attract the stronger identity check. The interim direction removes the triage step for this control: the check applies to every registration, not to the subset the model selects.
The judges did not put it in those terms and we are not attributing that framing to them. What the order does say is that the respondents showed no difficulty in mandating the check universally, and that this is why the direction issued.
The numbers the government put on the record
Paragraphs 4 and 5 reproduce figures the respondents filed as Annexure G, from a Minister of State in the Ministry of Finance answering a question in the Rajya Sabha. For 2023-2024 the answer disclosed 2,800 fraudulent GST registrations obtained using stolen or frozen PAN or Aadhaar details, with detection of Rs. 15,085 crore of tax evasion. For 2024-2025 the figures were 1,654 registrations and Rs. 13,109 crore detected.
These are the government's own reported figures, placed before the Court by the respondents. They are not independently verified counts, and we do not offer a view on whether the fall between the two years is a trend, because the order gives no denominator of total registrations against which to read either number.
Paragraph 5 also records the minister's disclosure that biometric Aadhaar based authentication "has been made mandatory for the GST Registration". Paragraph 6 then says that despite passage of more than one year that statement "has not been fully implemented". Read together, the order is aimed at the gap between an announced control and an applied one.
The facial recognition items are suggestions, not directions
Paragraph 9 asks the authorities to examine a list of suggestions filed by Mr. Tarun Gulati, Senior Counsel, who was requested by the Court to assist. Those suggestions are reproduced in the order of 01.09.2026 and include making facial recognition of the applicant against the Aadhaar database mandatory for all registrations, a mandatory 20 to 30 second video verification in which the applicant shows their face with the original PAN and Aadhaar cards and reads a system-generated prompt, retention of IP address and device location by the common portal, and a new PAN-Aadhaar-mismatch and first-time-use risk parameter for the Directorate General of Analytics and Risk Management.
None of that is directed. The order says the authorities "are also expected to examine the suggestions". Reporting facial recognition at GST registration as mandated would misstate the order, and we do not.
One of the suggestions is itself a comment on automated triage: it proposes mandatory physical verification of the principal place of business rather than confining verification to the cases the existing risk-analytics engine flags as high risk, or in the alternative random bi-annual inspections based on a risk evaluation system.
Two other High Courts, in the same week, on cloned biometrics
This is the counter-evidence and it belongs in the piece. On 7 September 2026 the Gauhati High Court refused pre-arrest bail in Ayub Ali v. The State of Assam, AB/2030/2026. The order records the Additional Public Prosecutor's submission that the petitioner "is stated to have prepared duplicate artificial biometric fingerprints for the purpose of issuing sim cards, which are subsequently used for commission of cyber crime activities", and elsewhere that he used duplicate biometrics of a point-of-sale proprietor to access the activation portal.
On 8 September 2026, the same day as the Delhi order, the Patna High Court granted bail in Prafull Niranjan Priyadarshi v. The State of Bihar, Cr. Misc. No. 55297 of 2026. The prosecution case as recorded is that a raid on a cyber cafe recovered "several electronic articles, forged seals, biometric devices, fingerprint scanners and forged Aadhaar-related documents".
Both are untested allegations recorded in bail orders, and neither court made any finding that a biometric authentication system was defeated. We are not saying the Delhi direction will fail. We are saying that a control which the Delhi High Court treated as the answer to identity fraud was, in the same week, the subject of prosecution allegations about spoofed fingerprints and seized scanners in two other High Courts, and that a reader deciding what this order is worth should have both facts.
What we did not verify
What we opened: the full text of the order dated 08.09.2026, including the order of 01.09.2026 and the order of 21.08.2026 reproduced within it and the ten suggestions of Senior Counsel, read on Indian Kanoon, which reproduces the Delhi High Court Order Portal text including the DHC server download stamp. We also opened and read in full the Gauhati High Court order of 07.09.2026 in AB/2030/2026 and the Patna High Court order of 08.09.2026 in Cr. Misc. No. 55297 of 2026.
A sourcing note we are disclosing rather than hiding. A direct request to the Indian Kanoon page returned HTTP 403 to our first client; the text quoted here was retrieved through a second client that returned HTTP 200 and the full document. We did not scan the QR code the order references, and we did not independently re-verify the text on the Delhi High Court Order Portal.
What we did not open: the writ petitions and the respondents' written submissions themselves, the Delhi Police status report, Annexure G and the underlying Rajya Sabha answer, the CGST registration rules and any instruction or notification issued by CBIC in response to this order, and the order sheet for 22.09.2026. We therefore describe the risk-analytics gate only as the order describes it, and we say nothing about how any authority has implemented the direction since 8 September 2026.
What we refuse to claim: we do not say facial recognition, video verification or IP retention has been ordered, because paragraph 9 asks the authorities to examine those suggestions. We do not say the direction is final, because it is made for the time being with liberty to object and is listed again. We do not say the two bail matters show the biometric gate has been defeated, because both are untested prosecution allegations and neither concerns GST registration. We do not say the fraudulent registration figures are accurate, only that the government filed them.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
If you file GST registrations in India, the operative change from 8 September 2026 is that the biometric Aadhaar step is no longer conditional on an automated risk score, and applies to every application. The design lesson travels further than tax. When a control is applied only to the cases a model flags, the model becomes the control, and removing the triage is a different decision from strengthening the check. Watch 22.09.2026, because the authorities have express liberty to come back on practical difficulty.
Source File
https://indiankanoon.org/doc/199052616/
Open the order and confirm four things: the risk-analytics sentence at paragraph 3, the direction and its "for the time being" qualifier at paragraph 8, the request to examine Senior Counsel's suggestions at paragraph 9, and the next listing at paragraph 10.
Hence, for the time being, directions are issued to all the authorities across the country not to allow any GST Registration without biometric based AADHAR authentication henceforth. Liberty is granted to the authorities to file objections qua any practical difficulty in its implementation. ยท High Court of Delhi, Neha v. Union of India & Ors., paragraph 8, 8 September 2026
FAQ
Is this a final ruling?
No. It is an interim direction made "for the time being", with express liberty to the authorities to file objections on any practical difficulty in implementation. The matter is listed for further consideration on 22.09.2026.
What was the position before the order?
Paragraph 3 records the respondents' written submission that biometric Aadhaar authentication was carried out only where the system identified the case as risky on the basis of various parameters and data analytics. For the time being, and subject to the authorities' express liberty to file objections on practical difficulty, the interim direction removes that triage step for this check.
Has facial recognition been made mandatory for GST registration?
No. Facial recognition against the Aadhaar database is one of ten suggestions filed by Senior Counsel assisting the Court. Paragraph 9 says the authorities are expected to examine the suggestions. It does not direct any of them.
Why do the Gauhati and Patna matters belong here?
Both are in-window bail orders from the same week recording allegations about artificial duplicate fingerprints and seized fingerprint scanners and forged Aadhaar documents. They are untested allegations and neither concerns GST, but they are the reason to treat a universal biometric gate as a control with its own attack surface rather than a settled fix.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.