How the India AI Governance Guidelines sit on top of ISO 42001

The India AI Governance Guidelines released by MeitY in November 2025 are non-binding but they shape the direction of Indian AI regulation. This lesson walks the seven sutras and six pillars, shows how they map onto the ISO 42001 clause structure, and explains why designing your AIMS with the sutras in mind is what turns a foreign standard into an Indian operating system.

Free preview 12 min read Under review

Legal basis

ISO/IEC 42001 primary-source stack current to 19 September 2026. Core: ISO/IEC 42001:2023 first edition December 2023 (ten clauses 0-10 plus Annex A with 38 controls across groups A.2 Policies related to AI, A.3 Internal organisation, A.4 Resources for AI systems, A.5 Assessing impacts of AI systems on individuals or groups and societies, A.6 AI system lifecycle, A.7 Data for AI systems, A.8 Information for interested parties of AI systems, A.9 Use of AI systems, A.10 Third-party and customer relationships, plus Annex B implementation guidance, Annex C AI-related organisational objectives, Annex D use of AIMS across domains). Companion standards: ISO/IEC 23894:2023 (guidance on AI risk management), ISO/IEC 23053:2022 (framework for AI systems using machine learning), ISO/IEC 42005:2025 (AI system impact assessment), ISO/IEC 22989:2022 (AI concepts and terminology), ISO/IEC TR 24028:2020 (trustworthiness in AI). Integration standards: ISO/IEC 27001:2022 for the AIMS-on-top-of-ISMS pattern, ISO/IEC 27701:2025 for the PIMS integration. India-specific stack: India AI Governance Guidelines released by MeitY in November 2025 (seven sutras Trust / People-first / Innovation over restraint / Fairness and equity / Accountability / Understandability by design / Safety resilience sustainability, across six pillars Infrastructure / Capacity building / Policy and regulation / Risk mitigation / Accountability / Institutions, with Annexure 6 recommending ISO/IEC 42001), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 notified 10 February 2026 effective 20 February 2026 introducing Synthetically Generated Information as a due-diligence category with visual labelling audio disclosure metadata embedding and 2 to 3 hour takedown for deepfake harm, MeitY AI Advisory dated March 2024 on labelling AI-generated content operative until superseded on labelling by the 2026 Rules, SEBI Circular No. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 5 May 2026 (Advisory on emerging advanced AI tools for vulnerability detection, Cyber-suraksha.ai task force, applies to every regulated entity in the Indian securities market), Report of the RBI Committee on FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence) chaired by Professor Pushpak Bhattacharyya of IIT Bombay released 13 August 2025 (seven sutras 26 recommendations six pillars Infrastructure Policy Capacity Governance Protection Assurance), DPDP Act 2023 and DPDP Rules 2025 notified November 2025 with phased commencement (no equivalent to GDPR Article 22, no right to explanation), BIS adoption as IS/ISO/IEC 42001:2023 identical to ISO text, IndiaAI Mission approved March 2024 with ₹10,371 crore outlay over five years across seven pillars including Safe & Trusted AI (13 projects funded as of July 2026 on deepfake and bias), IndiaAI Safety Institute announced January 2025. Global adjacent regulation for extraterritorial reach and crosswalk: EU AI Act Regulation (EU) 2024/1689 phased application 2 February 2025 prohibited practices and AI literacy live, 2 August 2025 GPAI transparency for new models, 2 August 2026 general application and Article 50 transparency, 2 December 2026 new prohibited practices on synthetic intimate content and CSAM, 2 December 2027 Annex III high-risk (pushed back from August 2026 by Digital Omnibus), 2 August 2028 Annex I product-embedded high-risk. NIST AI Risk Management Framework 1.0 (January 2023) four functions Govern Map Measure Manage with official crosswalk to ISO/IEC 42001 published by NIST AIRC. OECD AI Principles (2019 updated 2024). UNESCO Recommendation on the Ethics of AI (2021). Council of Europe AI Framework Convention (opened for signature September 2024). Certification body landscape referenced: A-LIGN, BSI India, Bureau Veritas India, DNV Business Assurance India, Schellman, SGS India, TÜV SÜD South Asia, TÜV Nord India, Intertek India (accredited under ANAB, UKAS, RvA pending NABCB scheme extension). Personal certification schemes referenced (not primary): PECB Lead Implementer and Lead Auditor for ISO 42001, BSI ISO 42001 Lead Implementer, operating under ISO/IEC 17024. India first-mover organisational certifications referenced: Mphasis (first Indian IT services company to certify, 2025) and KPMG India (certified by SGS December 2025). Items requiring ongoing verification and flagged inside the relevant lessons: NABCB scheme extension timeline for ISO 42001; any ISO/IEC 42001 amendment beyond first edition; Digital India Act draft status and eventual enactment; RBI conversion of FREE-AI Report recommendations into binding master directions; DPDP Board of India Chairperson appointment status; new India AI-specific legislation.

Let me close Module 1 by walking the Indian regulatory reality that sits on top of the ISO baseline. Because if you build an ISO 42001 AIMS in Indian conditions without paying attention to what MeitY is saying, what SEBI is saying and what RBI is saying, you are going to build a technically correct AIMS that misses the political and regulatory context of the country you are operating in. That is a real risk. Auditors will still give you the certificate. Regulators may still ask a different question. The…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

MeitY AI Governance Guidelines, India AI Governance Guidelines Nov 2025 (Seven sutras and six pillars) L5-C3

MeitY released the Guidelines on 5 November 2025. Seven sutras: Trust, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, Safety Resilience and Sustainability. Six pillars. Voluntary; no separate AI law proposed now.

IT Amendment Rules 2026, IT Rules Amendment 2026 SGI (SGI due-diligence obligations) L5-C4

G.S.R. 120(E) of 10 February 2026 amended the IT Rules 2021 (effective 20 February 2026). Rule 2(1)(wa) defines SGI (audio, visual, audio-visual). Rule 3(3): technical measures, labels, metadata. Rule 3(1)(d): 3-hour takedown. Rule 3(2)(b): 2 hours. Source: MeitY consolidated rules.

SEBI Circular 5-May-2026, SEBI Advisory 5-May-2026 Mythos (AI vulnerability detection advisory) L5-C5

SEBI circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 of 5 May 2026 to regulated entities on AI tools for vulnerability detection. Covers vulnerability management, patching, API security, SOC and Market SOC onboarding; sets up the Cyber-suraksha.ai task force. It does not refer to ISO/IEC 42001.

RBI FREE-AI Report, RBI FREE-AI Report 13-Aug-2025 (RBI committee framework) L5-C6

Report of the RBI Committee on FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence), released 13 August 2025. It makes 26 recommendations across six pillars. It is a committee report and not a binding direction; no timeline for directions is committed.

ISO/IEC 42001:2023, Clause 4.2 Interested parties (Interested parties for AIMS) L5-C7

Clause 4.2 requires the organisation to determine interested parties relevant to the AIMS, their requirements, and which of those requirements will be addressed. For AI, interested parties expressly include affected individuals and groups who are not customers — a broader stakeholder map than ISO 27001, and one that maps directly to the India AI Governance Guidelines People-first sutra.

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: What ISO/IEC 42001 actually is, and why it turned into a procurement gate in 2026

Module 2: Reading Clauses 4, 5 and 6: Context, Leadership and Planning

Clauses 4.1 and 4.2: understanding your context and identifying interested parties
Clause 4.3: writing an AIMS Scope Statement that a certification body will accept
Clause 5: Leadership, AI Policy and Roles — where an AIMS becomes real
Clause 6.1: the AI risk assessment methodology — the beating heart of the AIMS
Clauses 6.2 and 6.3: AI objectives and planning of changes

Module 3: Reading Clauses 7, 8, 9 and 10: Support, Operation, Performance evaluation, Improvement

Clauses 7.1 to 7.4: Resources, Competence, Awareness, Communication
Clause 7.5: Documented information — what must be in writing, and how it is controlled
Clause 8: Operation — executing the risk methodology and running the AIIA
Clause 9: Performance evaluation — monitoring, internal audit, management review
Clause 10: Continual improvement, nonconformity and the CAPA process

Module 4: Annex A controls Part 1: A.2 Policies, A.3 Internal organisation, A.4 Resources, A.5 Impact assessment

Annex A.2 — Policies related to AI: three controls that anchor the AIMS
Annex A.3 — Internal organisation: AI roles and the concerns-reporting channel
Annex A.4 Part 1 — Resource documentation, data and tooling resources (A.4.2 to A.4.4)
Annex A.4 Part 2 — System and computing, and human resources (A.4.5 and A.4.6)
Annex A.5 — AI Impact Assessment: the four controls that decide whether an AIMS is real

Module 5: Annex A controls Part 2: A.6 AI lifecycle, A.7 Data, A.8 Information, A.9 Use, A.10 Third-party

Annex A.6 Part 1 — AI lifecycle: requirements, design and development
Annex A.6 Part 2 — Verification, deployment, operation, monitoring and event logs
Annex A.7 — Data for AI systems: five controls with the DPDP overlay
Annex A.8 — Information for interested parties: where the IT Rules 2026 SGI obligations land
Annex A.9 and A.10 — Responsible use of AI systems and third-party relationships

Module 6: Building the AIMS end-to-end: inventory, impact assessment, risk assessment, Statement of Applicability, tooling

Building the AI system inventory — the foundation everything else hangs on
Running an AI Impact Assessment per ISO/IEC 42005:2025 — the operational template
Running the AI risk assessment methodology per ISO/IEC 23894:2023
Building the Statement of Applicability — the single most-audited document
GRC tooling landscape — buy versus build for an AIMS

Module 7: Certification body selection, Stage 1 audit, Stage 2 audit, certificate issuance

The accreditation chain — why the certificate means anything, and where NABCB stands on ISO 42001
CB selection — the RFP process, scoring criteria and negotiation
Stage 1 — the documentation review: what the auditor tests and how to pass first time
Stage 2 — the operating-effectiveness audit: sampling, interviews, evidence
The three-year sustain cycle — surveillance, recertification and living with the certificate

Module 8: The India overlay + the next five years: AI Governance Guidelines, IT Rules 2026, SEBI, RBI FREE-AI, DPDP, EU AI Act, NIST AI RMF

The India AI Governance Guidelines in operational depth — the seven sutras and six pillars, clause by clause
IT Amendment Rules 2026 SGI obligations in operational depth — the first binding AI law in India
Sector-specific overlays — SEBI 5-May-2026, RBI FREE-AI, and the wider sectoral picture
DPDP intersection with AI, and EU AI Act extraterritorial reach on Indian exporters
NIST AI RMF crosswalk and the next five years — closing the course