AI Governance Officer India Practitioner

The 7 Sutras of Responsible AI with the Indian context behind each. The 6 Pillars across Enablement, Regulation and Oversight. Deployer, developer and data provider duties as three mutually reinforcing lines of accountability. Transparency reporting under Sutra 6 Understandable by Design. The three institutions (AIGG, TPEC, AISI) and how to track their stand-up status. The voluntary-now-mandatory-signalled posture and what that means for your 2026-27 planning.

1. 1. The 7 Sutras, one by one, with the Indian context behind each 13 min
2. 2. The 6 Pillars across Enablement, Regulation and Oversight, and the two Pillars where you actually spend time 12 min
3. 3. Developer, deployer, data provider. Three functions, three parallel sets of duties documented, signed and defended 13 min
4. 4. Transparency reporting under Sutra 6, aligned to DPDP, and what a disclosure a regulator can understand actually looks like 12 min
5. 5. AIGG, TPEC and AISI. The three institutions, the current state on 9 October 2026 and how to track 12 min

The FREE-AI Committee, the Report of 13 August 2025 and the 26 Recommendations that preceded the MeitY Guidelines. The RBI Draft Model Risk Circular of 5 August 2024 and the expanded 2026 cycle (comments closed 24 July 2026). AI in credit underwriting including borrower scoring, bias testing and challenger models. The AI kill-switch expectation and the indicative AI incident reporting form. What a bank or NBFC Board policy on AI must say.

1. 1. The FREE-AI Committee, the Report of 13 August 2025 and the 26 Recommendations that preceded MeitY 13 min
2. 2. The Model Risk Management Framework. RBI Draft of 5 August 2024 and the expanded 2026 cycle 13 min
3. 3. AI in credit underwriting. Borrower scoring, bias testing and challenger models at an NBFC gold-loan and personal-loan book 13 min
4. 4. The AI kill-switch and incident reporting. FREE-AI expectations, the Chapter 5 form and the CERT-In six-hour interface 13 min
5. 5. The Bank and NBFC Board policy on AI. The twelve-clause specimen outline 13 min

The SEBI Advisory HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 of 5 May 2026, line by line. The 10-item Annexure A with practical implementation on AI VA tools (Item 2), M-SOC onboarding (Item 6c), SBOM for all critical applications (Item 9) and the long-term plan for agentic mitigation (Item 10). The Mythos threat context. The project-cyber-suraksha.ai task force. Interaction with the SEBI CSCRF and the audit-scope expansion. Aarti Capital Markets as the running case study across the three AI use cases.

1. 1. The SEBI AI Vulnerability Advisory of 5 May 2026. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 12 min
2. 2. Annexure A, ten items. The deep walk through items 2, 6c, 9 and 10 14 min
3. 3. Market SOC onboarding. What M-SOC is, what it ingests and how an entity integrates 12 min
4. 4. How the AI Advisory expands CSCRF audit scope. project-cyber-suraksha.ai and advisor obligations 12 min
5. 5. Running the SEBI AI programme end-to-end on Aarti Capital Markets 14 min

Section 10 Significant Data Fiduciary criteria and the six-factor test. Section 10(2)(c) proviso on algorithmic due diligence as the single clearest AI-governance hook in Indian law today. Rule 13 periodic DPIA, independent audit and specified Board reporting. Rule 7 commencement 14 May 2027 and AI incident breach notification. The Indian design choice to omit a GDPR Article 22 right against solely automated decisions, and what Section 10(2)(c) proviso does instead.

1. 1. Section 10 Significant Data Fiduciary. The six-factor test and why nobody has been notified yet 12 min
2. 2. Section 10(2)(c) proviso. Algorithmic due diligence, verbatim text and operational meaning 13 min
3. 3. Rule 13. Twelve-month DPIA, independent audit and the Board reporting cadence 13 min
4. 4. Rule 7 breach notification. AI incidents, the DPB clock, the MeitY expectation and the CERT-In six-hour window 13 min
5. 5. Why DPDP has no Article 22. India chose a de facto automated decision regime through Section 10(2)(c) 13 min

The role itself. The appointment Board resolution with the five authorities. The AI inventory and model register, row structure and sourcing. The twelve-clause internal AI governance policy. The Board reporting cadence and the five KPIs that matter (model inventory coverage, DPIA completion, incident count, bias-test outcomes, training-data provenance). Personal liability and the due-diligence defence available under Indian law.

1. 1. The appointment Board resolution in detail. Five authorities, eleven paragraphs, one specimen 13 min
2. 2. The AI inventory and model register. Columns, worked rows, and the "one-page in thirty minutes" test 13 min
3. 3. The twelve-clause AI governance policy. Scope to third-party management, one clause at a time 14 min
4. 4. The Board reporting cadence and the five KPIs that matter 13 min
5. 5. Personal liability and the due-diligence defence. DPDP Schedule, sectoral penalties, Section 79 safe harbour 14 min

Risk classification by use case including the practical test for a "high-impact decision" where MeitY has not notified a numerical threshold. The AI-specific DPIA format aligned to Section 10(2)(c) proviso. Pre-deployment testing covering bias, robustness and security. Post-deployment monitoring covering drift, concept shift and feedback loops. Change control, retraining triggers and the end-to-end incident response.

1. 1. High-impact decision classification. The method MeitY left to you 13 min
2. 2. The AI-specific DPIA. Ten sections that satisfy DPDP Section 10(2)(c) and Rule 13 13 min
3. 3. Pre-deployment testing. Bias, robustness and security batteries that satisfy a regulator 13 min
4. 4. Post-deployment monitoring. Drift, feedback loops, shadow mode and the thresholds that trigger review 13 min
5. 5. Change control, retraining and incident response. Closing the lifecycle loop 13 min

User-facing transparency notices under MeitY Sutra 6 Understandable by Design. Model documentation using model cards, system cards and datasheets for datasets. Explainability techniques for high-impact decisions (post-hoc explanations, counterfactuals, feature importance). Human-in-the-loop design patterns across pre-decision, decision and post-decision stages. Audit trail and immutable logging for AI decisions that must be explained three years after they were made.

1. 1. User-facing transparency notices. Operationalising Sutra 6 for Aarti Capital's three AI use cases 12 min
2. 2. Model cards and datasheets for datasets. The two documents a regulator will ask for first 13 min
3. 3. Explainability for high-impact decisions. What SHAP, LIME and counterfactuals buy you, and where they fail 13 min
4. 4. Human-in-the-loop oversight. Three stages, one SOP, and how to document that a human actually reviewed 12 min
5. 5. Audit trail and immutable logging. Reconstructing a specific AI decision three years later 13 min

The IT Rules 2026 amendment notified 10 February 2026 and in force 20 February 2026. The new "Synthetically Generated Information" category and what counts. Mandatory labelling and permanent provenance metadata requirements. The three-hour takedown window under Rule 3(1)(d) for court or government-flagged unlawful content and the separate two-hour window for non-consensual sexual imagery including morphed and deepfake nudity. The deepfake case law from Rashmika Mandanna (October 2023) through 2024 Lok Sabha election incidents to the Images Bazaar PIL. The MeitY 1 March 2024 advisory and the 15 March 2024 revision read together.

1. 1. The new Synthetically Generated Information category under the IT Rules 2026 amendment 12 min
2. 2. Labelling and provenance metadata. Watermarks, C2PA and metadata that survives re-encoding 13 min
3. 3. The three-hour takedown and the two-hour non-consensual sexual imagery window 13 min
4. 4. Deepfake case law. Rashmika Mandanna, Lok Sabha 2024 and Images Bazaar PIL 13 min
5. 5. The MeitY advisories of 1 March and 15 March 2024. How India iterates fast 13 min

The IRDAI AI Working Group of 19 June 2026 and the expected Q1-Q2 2027 framework circular. The IRDAI Information and Cyber Security Guidelines of 6 April 2026 and AI as a threat vector in insurance. The Telecom Cyber Security Rules 2024 and the AI silence inside the generic defend obligation. The TRAI AIDAI proposal of 20 July 2023 and why MeitY went a different way with AIGG, TPEC and AISI. Healthcare, education and public-services AI governance.

1. 1. IRDAI AI Working Group and the framework insurers should pre-build 12 min
2. 2. The IRDAI 2026 Cyber Security Guidelines and AI as a threat vector 12 min
3. 3. The Telecom Cyber Security Rules 2024 and where AI sits in a silent framework 12 min
4. 4. TRAI's AIDAI proposal and why MeitY picked AIGG, TPEC and AISI instead 12 min
5. 5. Healthcare, education and public-services AI: the gaps and the practitioner playbook 13 min

EU AI Act Regulation 2024/1689 and the four risk tiers, with phased application through 2 December 2027 and 2 August 2028. NIST AI RMF 1.0 (AI 100-1) and the Generative AI Profile (AI 600-1) with its 12 risk categories. OECD AI Principles update of 3 May 2024. ISO/IEC 42001:2023 crosswalk to the MeitY 7 Sutras. The GCC compliance architecture question of when an Indian subsidiary of a multinational must meet EU + India + US expectations simultaneously.

1. 1. EU AI Act. The four risk tiers and the phased timeline that quietly binds Indian GCCs 13 min
2. 2. NIST AI RMF 1.0 and the GenAI Profile. Four functions and twelve generative risks 13 min
3. 3. OECD AI Principles. The common vocabulary that lets a Mumbai team talk to a Munich team 12 min
4. 4. ISO/IEC 42001. The voluntary conformity path and the clause-by-clause map to the MeitY 7 Sutras 13 min
5. 5. The GCC compliance architecture. One baseline plus two overlays, when EU plus India plus US arrives at once 13 min

The capstone walks you through a complete ten-week AI governance programme on Aarti Capital Markets Pvt Ltd, a fictional Mumbai SEBI-registered mid-size broker and AMC combo with Rs 8,400 crore AUM across 180 employees, deploying AI for client-onboarding risk scoring, real-time trade surveillance and portfolio recommendations. You produce every artifact from Modules 1-11 on this one entity and submit a complete programme file. The final exam is 45 questions drawn from a 70-item pool, covering every module, with each question anchored to a specific Section, Rule, Guideline, Advisory, Circular or international standard clause cited in the course.

1. 1. Build your ten-week AI governance programme. The scope document and the stakeholder map 11 min
2. 2. Weeks 1-10 Gantt and the twelve artifacts of the capstone workbook 11 min
3. 3. The Board briefing deck and the year-1 operating calendar 11 min
4. 4. The 25-anchor exam reference card 10 min
5. 5. The final exam. 45 questions from a 70-item pool, 90 minutes, 75 percent pass 10 min