Indian law and your own regulator's directions bind you. The best-known AI frameworks guide you, and the European Union's act applies only if you sell into that market. A governance plan starts by sorting the two lists. It then builds the same six controls whichever list an item came from.
What binds and what guides
Risk teams usually bring the frameworks. Compliance teams bring the directions. Put them in one table before any design work starts.
| Instrument | Status for an Indian company | What it gives you |
|---|---|---|
| DPDP Act and Rules | Law; most Rules apply from mid-May 2027 | Duties on consent, accuracy, safeguards and erasure |
| RBI Master Direction on IT outsourcing | Covers banks, NBFCs in the Top, Upper and Middle layers, credit information companies and all-India financial institutions, for material arrangements | Duties on responsibility, audit rights, data location and incident reporting |
| RBI payment data circular | Binds payment system operators and the banks and vendors in their chain | Payment data held only in India |
| EU AI Act | Applies when your system is sold or used in the EU | Risk tiers, logging and human oversight duties |
| ISO/IEC 42001 | Voluntary standard | A management-system structure for AI |
| NIST AI RMF | Voluntary, per NIST | A cycle for finding and tracking AI risk |
Sector regulators other than the RBI, such as SEBI and IRDAI, issue their own outsourcing and cyber rules for the firms they supervise. Read the one that supervises you.
The three frameworks, in a line each
ISO/IEC 42001. It was published on 18 December 2023, according to the IEC webstore, and sets requirements for an AI management system. It follows the pattern of ISO 27001 but for AI: named roles, risk assessment, written controls and regular reviews. Design against it early. Certify only when a tender or customer contract asks for the certificate.
NIST AI RMF 1.0. NIST released it on 26 January 2023 and describes it as "intended for voluntary use" (NIST). Its four functions are govern, map, measure and manage. Each maps onto plain engineering questions. Which failures are possible? How would the team spot one? What then?
EU AI Act. Recital 58 of the Regulation says systems that evaluate the credit score or creditworthiness of natural persons "should be classified as high-risk", and Annex III, point 5(b), lists them with an exception for fraud detection (Regulation (EU) 2024/1689). Article 12 requires high-risk systems to record events automatically. Article 14 requires design for oversight by people. Application dates for the high-risk rules have moved under later EU amendments, so check the current dates before you plan around them.
What the Indian instruments ask of an AI system
DPDP Act. Consent must be limited to the specified purpose (section 6(1)). A person can withdraw it at any time (section 6(4)). Where personal data is likely to be used to make a decision that affects the person, the company must ensure its completeness, accuracy and consistency (section 8(3)). Safeguards are required (section 8(5)), and data is erased once consent is withdrawn or the purpose is no longer served, unless a law requires retention (section 8(7)). Under the Rules, Rule 1(4) brings most remaining rules, including Rules 3 and 5 to 16, into force eighteen months after Gazette publication. The Gazette is dated 13 November 2025. A companion article, how the DPDP Act applies to AI pipelines, follows each duty through a model pipeline.
RBI IT outsourcing direction. The Master Direction says outsourcing does not reduce the regulated entity's obligations (paragraph 4.1). It gives the entity audit rights over the provider and its sub-contractors (paragraph 16.13), expects the agreement to require storage of data only in India, as applicable to the entity (paragraph 16.7) and sets a six-hour window for reporting cyber incidents to the RBI (paragraph 17.8). The Direction's definition of IT outsourcing lists cloud computing services, so a hosted model API is likely to count as an outsourced service where the arrangement is material. Confirm that reading with your compliance team.
RBI payment data circular. RBI's FAQ on the circular says payment system data must sit only in systems located in India. Processing abroad is allowed if the data is deleted there and brought back within one business day or 24 hours, whichever is earlier. For a workflow that touches payment data, this settles the hosted-model question before any technical comparison.
Six controls that satisfy all of them
Frameworks describe outcomes. These artefacts produce them.
- A written data boundary. List what may leave your network, what must stay, and what is masked or tokenised in between. Settle it before you pick a model.
- An action allowlist. Name each operation the system may call, the parameters it may use and the identity it runs as. A broad credential plus a polite prompt does not count as a control.
- A scored test set, run whenever the model, the prompt or the retrieval index changes. See how to build an AI evaluation set.
- An event log designed for reconstruction rather than debugging. See the fields an AI audit trail must hold.
- A human review lane whose threshold is a business setting with an owner. See human-in-the-loop design.
- One named owner. Each framework wants to know who answers for the system. Naming a person costs nothing and closes the most common gap.
The order that avoids rework
Adding governance to a working pilot costs more than building it in. Work in this sequence:
- Draw the data boundary and test it against the RBI and DPDP texts above.
- Collect test questions from real users while discovery is still running.
- Design the log and the allowlist. Then take the architecture to security review while a change is still cheap.
- Tune accuracy last. Everyone wants to start there, and it moves fastest once the first three exist.
Questions teams ask
Do we need ISO/IEC 42001 certification?
Not by default. The standard is worth reading as a checklist for roles and reviews. A certificate pays off once a buyer or a tender demands one, so treat it as a procurement item and not a legal duty.
Does the EU AI Act apply to an Indian bank that lends only in India?
Its scope turns on whether the system is offered in the EU or its output is used there. A lender serving only Indian customers should read the Regulation's scope articles with counsel before assuming either way.
Which is the first document to write?
The data boundary. It decides which models you can use, where the log lives and what a vendor may keep. The other five controls build on it.
Why it decides whether a pilot ships
In June 2025 Gartner forecast that over 40 per cent of agentic AI projects would be dropped by the end of 2027. Reuters reported the reasons given as escalating costs, unclear business value and inadequate risk controls. A governance plan removes the third. The other two are covered in the causes behind cancelled agent projects.
Where Brihat fits
Brihat Infotech's AI strategy and roadmap service produces a governance and risk framework, using ISO/IEC 42001, NIST's framework and the EU's risk tiers as reference points. Start a conversation.
Sources and primary texts
- Digital Personal Data Protection Act, 2023 (MeitY, PDF)
- Digital Personal Data Protection Rules, 2025, Gazette of India (MeitY, PDF)
- RBI Master Direction on Outsourcing of Information Technology Services, 10 April 2023
- RBI FAQ on Storage of Payment System Data (circular of 6 April 2018)
- Regulation (EU) 2024/1689, Artificial Intelligence Act (EUR-Lex)
- NIST AI Risk Management Framework
- ISO/IEC 42001:2023 (IEC webstore)
- Gartner forecast on agentic AI projects, reported by Reuters (The Star, 25 June 2025)