AI governance
Use AI with clear rules, not guesswork.
Your teams are already using AI tools, often with customer or patient data in them. We help you put simple rules, records and checks in place, so AI use stays within the DPDP Act and does not surprise you later.
Why it matters now
What applies to AI in India today
DPDP Act and Rules
Personal data typed into, uploaded to or produced by an AI tool is still personal data. Notice, consent or a legitimate use, security, retention and breach reporting all apply, with core duties from 13 May 2027.
India AI Governance Guidelines
Released by MeitY in November 2025. They are advisory, but ask organisations to follow existing laws, adopt risk frameworks, be transparent and offer a way to raise complaints.
IT Rules on AI-generated content
Since 20 February 2026, platforms that let users create or share AI-generated content must label it and act on takedown orders within three hours.
Sector rules and overseas clients
RBI and SEBI have issued AI guidance for regulated entities. If you sell into Europe, parts of the EU AI Act may apply, with high-risk duties from 2 December 2027.
What we do
Practical AI governance, sized for you
AI use policy and register
Clear rules for staff and a record of every AI tool in use.
- Inventory of AI tools across teams
- What data can and cannot go into each tool
- Short AI use policy staff will actually read
- Approval process for new AI tools
AI risk and DPDP review
A review of one or more AI use cases, products or features.
- What personal data the AI uses and why
- Notice, consent and purpose checks under DPDP
- Risks such as bias, errors, leakage and misuse
- Human oversight and complaint handling
- Written report with fixes, ranked by risk
AI vendor checks
For AI tools and models you buy or build on.
- Where data is stored and whether it trains the vendor's model
- Security and breach terms
- Contract clauses for AI suppliers
ISO/IEC 42001 readiness
For companies building AI products whose clients ask for proof.
- Gap assessment against ISO/IEC 42001
- AI management system documents
- Internal audit before certification
We also run training on safe AI use for leadership and staff, and we can add AI governance to a DPDP programme so the two are done together.
Who it is for
Two kinds of organisations
Organisations using AI
Hospitals using AI for notes or reports, colleges using AI in teaching and admissions, lenders using AI for credit or collections, and any team using chatbots with customer data.
Companies building AI
Start-ups and software firms building AI agents, chatbots or AI features, who need to answer client questions on data, safety and accountability.
Questions
AI governance FAQs
Is there an AI law in India?
Not a single AI law yet. The India AI Governance Guidelines released by MeitY in November 2025 are advisory. Binding duties today come from existing laws, mainly the DPDP Act for personal data and the IT Rules, which since 20 February 2026 require platforms to label AI-generated content. Sector regulators can add their own rules.
Does the DPDP Act apply to AI tools?
Yes, whenever personal data goes in or comes out. Customer details pasted into a chatbot, patient notes sent to an AI transcription tool, or staff data used to train a model are all processing of personal data. Notice, consent or a legitimate use, security safeguards, retention and breach reporting apply, with core duties from 13 May 2027.
Do we need ISO/IEC 42001 certification?
Most organisations do not need it yet. It helps if you build AI products and your customers, investors or overseas clients ask for proof of AI governance. We can prepare you for it; certification itself is done by an accredited certification body.
Can this be combined with our DPDP work?
Yes, and that is how we recommend it. Most of the work overlaps: the same data map, vendor review, policies and training. Adding AI governance to a DPDP programme costs far less than doing it separately.
Does the EU AI Act affect Indian companies?
Only if you place AI systems on the EU market or their output is used in the EU. Some transparency duties already apply, and the main high-risk obligations now start from 2 December 2027. If you sell to European clients, it is worth a short review.
Not sure what your AI risk is?
Book a free 30-minute call. Tell us which AI tools you use or build, and we will tell you what needs attention first.