AINOTEQDetermine · Discover · Assess · Govern
AI Obligation RegisterAll jurisdictionsCoverage
Jurisdiction

IndiaIN

6 instrument(s) held in this jurisdiction, each cited to its official text. What an instrument says — not whether it reaches you.

Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure

Indian Computer Emergency Response Team (CERT-In), MeitY · guidance · in_force · v1 · official text

CERT-In's advisory blueprint of 25 May 2026. Section 12, Secure Adoption and Governance of Artificial Intelligence Systems, asks organisations to establish governance and accountability for AI adoption, keep visibility of AI systems, integrations, APIs and third-party AI dependencies, identify shadow or unauthorised AI usage, and set operational boundaries, monitoring, audit logging and emergency shutdown for agentic AI. Section 10 restates the duty to report cyber incidents to CERT-In within six hours under CERT-In's binding directions of 2022. The blueprint itself is advisory — 'organisations are encouraged', 'should implement'.

  1. Section 12 — secure adoption and governance of AI systems Secure Adoption and Governance of Artificial Intelligence System — Governance and accountability for AI adoption; an inventory of AI systems, integrations, APIs and third-party AI dependencies; detection of shadow or unauthorised AI; boundaries, monitoring, audit logging and emergency shutdown for agentic AI.
  2. Section 10 — incident response and cyber resilience Incident Response and Cyber Resilience — Timely reporting to CERT-In, within six hours, under CERT-In's standing directions.

Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, Version 2.0

Indian Computer Emergency Response Team (CERT-In), MeitY · guidance · in_force · v1 · official text

CERT-In's guidelines on bills of materials, including an AI Bill of Materials: a list of the components used to build, train and deploy an AI model — model name, version, type, developer, licence, software dependencies, algorithms, performance metrics, data sources and datasets. Issued for government, public sector, essential-services organisations and the software export and services industry, which are encouraged to make BOMs a mandatory procurement and development practice. Guidance, not a direction.

  1. Scope — applicability Entities the guidelines are issued for — Issued for government, public sector, essential-services organisations and the software export and services industry, which are encouraged to make BOMs a mandatory standard practice in procurement and development.
  2. AIBOM — definition and minimum elements Artificial Intelligence Bill of Materials — An AIBOM lists every component used to build, train and deploy a model — at minimum model name, version, type, developer, licence, software dependencies, algorithms, performance metrics, data sources and datasets.

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)

Parliament of India; administered by the Ministry of Electronics and Information Technology · binding · in_force · v1 · official text

India's binding law on digital personal data. It reaches any data fiduciary processing personal data in India, and its duties bite on AI systems that process personal data: consent and notice (ss. 5–6), accuracy where data is used to make a decision about a person (s. 8(3)), security safeguards and breach intimation (s. 8(5)–(6)), erasure when the purpose is served (s. 8(7)), children (s. 9), Significant Data Fiduciary duties including a periodic Data Protection Impact Assessment (s. 10), data principal rights (ss. 11–14) and Government-notified transfer restrictions (s. 16). Commencement is phased by the notification of 13 November 2025: administrative provisions from 14 November 2025; the substantive duties, rights and consent provisions from 14 May 2027.

  1. Section 4(1) Grounds for processing personal data — Processing needs consent or a listed legitimate use, and a lawful purpose.
  2. Section 5-6 — notice and consent Notice; consent — Every consent request is preceded by a notice of the data, the purpose, how to exercise rights and how to complain; consent must be free, specific, informed, unconditional and unambiguous, in plain language, and as easy to withdraw as to give.
  3. Section 8(1) — responsibility General obligations of Data Fiduciary — responsibility — The fiduciary is responsible for compliance for all processing, including by its processors, whatever the contract says.
  4. Section 8(3)-(4) — accuracy and measures Completeness, accuracy and consistency; technical and organisational measures — Where personal data is likely to be used to make a decision affecting the person — which is what an AI model does — its completeness, accuracy and consistency must be ensured.
  5. Section 8(5) — security safeguards Reasonable security safeguards — Personal data, including in the hands of processors, must be protected by reasonable security safeguards.
  6. Section 8(6) — breach notification Intimation of personal data breach — A breach must be intimated to the Board and to each affected person, in the prescribed form.
  7. Section 8(7)-(8) — retention and erasure Erasure when consent is withdrawn or the purpose is served — Erase when consent is withdrawn or the purpose is no longer served, and make processors erase too; the purpose is deemed served after a prescribed period of no contact.
  8. Section 8(9)-(10) — contact and grievances Published contact; grievance redressal mechanism — Publish who answers questions about processing; run an effective grievance mechanism.
  9. Section 9 — children and persons with disability Processing of personal data of children — Verifiable parental or guardian consent before processing; no processing detrimental to a child; no tracking, behavioural monitoring or targeted advertising directed at children.
  10. Section 10 — Significant Data Fiduciary Additional obligations of Significant Data Fiduciary — A notified Significant Data Fiduciary must appoint an India-based Data Protection Officer answerable to the board, an independent data auditor, and run periodic Data Protection Impact Assessments and audits.
  11. Section 11-14 — data principal rights Rights to information, correction and erasure, grievance redressal, nomination — The person may obtain a summary of the data and processing and the identities of everyone it was shared with; have it corrected, completed, updated or erased; have readily available grievance redressal; and nominate someone to exercise the rights after death or incapacity.
  12. Section 16 — cross-border transfer Processing of personal data outside India — The Government may restrict transfers to notified countries; stricter sectoral laws are preserved.
  13. Section 33(1) — penalties Monetary penalty — The Board may impose the penalties in the Schedule for a significant breach, after a hearing (up to INR 250 crore for a failure of security safeguards).

The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))

Ministry of Electronics and Information Technology, Government of India · binding · in_force · v1 · official text

The rules that operationalise the DPDP Act. For an AI estate the operative ones are Rule 3 (what a notice must contain), Rule 6 (reasonable security safeguards, including logs retained for one year), Rule 7 (breach intimation to affected persons without delay and to the Board within 72 hours), Rule 8 (erasure time periods), Rule 10 (verifiable parental consent), Rule 13 (Significant Data Fiduciaries: annual DPIA and audit, and due diligence that algorithmic software does not pose a risk to data principals' rights) and Rule 15 (transfers outside India subject to Government orders). Phased: Rules 1, 2 and 17–21 from publication; Rule 4 after twelve months; Rules 3, 5–16, 22 and 23 after eighteen months (14 May 2027).

  1. Rule 1 — commencement Short title and commencement — Rules 1, 2 and 17–21 from publication (14 Nov 2025); Rule 4 after twelve months; Rules 3, 5–16, 22 and 23 after eighteen months (14 May 2027).
  2. Rule 3 — notice Notice given by Data Fiduciary to Data Principal — The notice must stand on its own, in plain language, itemise the data and state the purpose and the goods or services, and link to consent withdrawal, rights and the Board.
  3. Rule 6 — reasonable security safeguards Reasonable security safeguards — Encryption, obfuscation, masking or tokens; access control; logs, monitoring and review; continuity measures; logs and data retained one year; processor contracts; technical and organisational measures.
  4. Rule 7 — intimation of personal data breach Intimation of personal data breach — Tell each affected person without delay, in plain terms, what happened, the likely consequences, what is being done and what they can do; tell the Board without delay and give the full account within 72 hours.
  5. Rule 8 — erasure time period Time period for the specified purpose to be deemed no longer served — Classes of fiduciaries in the Schedule must erase after the prescribed period of no contact, with 48 hours' notice; logs and data are retained at least one year.
  6. Rule 10 — verifiable consent of parent Verifiable consent for processing of personal data of child — Appropriate technical and organisational measures to obtain verifiable parental consent, with due diligence that the person is an identifiable adult, using reliable identity details, voluntarily provided details or an authorised entity's virtual token.
  7. Rule 13 — Significant Data Fiduciary Additional obligations of Significant Data Fiduciary — An annual DPIA and audit with significant observations reported to the Board; due diligence that algorithmic software is not likely to pose a risk to data principals' rights; localisation of Government-specified data.
  8. Rule 14 — rights of Data Principals Rights of Data Principals — Publish how rights requests are made and what identifiers are needed; answer grievances within a published period not exceeding ninety days; allow nomination.
  9. Rule 15 — processing outside India Processing of personal data outside India — Transfers are allowed subject to any general or special order of the Central Government about making data available to a foreign State or its agencies.

Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) — Report of the Committee

Reserve Bank of India (Committee constituted 26 December 2024) · guidance · in_force · v1 · official text

The RBI committee's framework for AI in the financial sector: seven Sutras (Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; Safety, Resilience and Sustainability) and 26 recommendations under six pillars — Infrastructure, Policy and Capacity for innovation; Governance, Protection and Assurance for risk. It is a committee report accepted and published by the RBI, not a direction: it sets the supervisory expectation for RBI-regulated entities and names action owners and timelines, but carries no penalty of its own.

  1. The Seven Sutras Foundational principles for AI adoption in the financial sector — Seven principles the RBI expects regulated entities to build AI on: trust as the foundation; people first; innovation over restraint; fairness and equity; accountability; understandable by design; safety, resilience and sustainability.
  2. Six pillars and 26 recommendations Strategic pillars — Governance, Protection, Assurance (risk mitigation); Infrastructure, Policy, Capacity (innovation enablement) — The 26 recommendations sit under six pillars. For a regulated entity's programme the risk-mitigation pillars are the operative ones: board-approved AI policy and governance, an AI inventory, risk-based assessment, consumer protection and grievance handling, and assurance through audit, testing and incident reporting.

Consultation Paper on Guidelines for Responsible Usage of AI/ML in Indian Securities Markets

Securities and Exchange Board of India · proposed · consultation · v1 · official text

SEBI's June 2025 consultation on guidelines for market participants using AI and ML — model governance, investor protection and disclosure, testing, fairness and bias, data privacy and cyber security, and a lighter regime for AI used only for internal operations. It is a consultation: it obliges nobody. No final circular had been published on the SEBI portal at the retrieval date. Held on the watchlist so a securities-market client sees what is coming.

  1. Proposed guidelines — scope Consultation proposal — Proposed principles for market participants' AI/ML use: model governance, investor protection and disclosure, testing, fairness and bias, data privacy and cyber security, with lighter treatment for internal-only use. A consultation obliges nobody.

← All jurisdictions