AI governance · India · template updated October 2026
AI Governance Framework for Companies in India: a 10-Part Template
The framework at a glance
Ten parts of a company AI governance framework
India has no single AI law that tells a company how to govern its AI. What it has is a set of expectations: MeitY’s guidelines, the DPDP Act, sector regulators and client contracts. A framework turns those expectations into decisions someone actually makes each week. The ten parts below follow the life of an AI use case, from the principles that frame it to the board report that reviews it.
- Principles: what the company stands for when it uses AI
- Roles and the AI council: who decides, who owns, who checks
- AI use-case inventory: one list of every AI system in use
- Risk tiers: how much control each use case needs
- Intake and approval: how a new idea becomes an approved use
- Data and DPDP controls: personal and confidential data
- Vendor and model controls: buying and changing AI tools
- Human oversight and monitoring: checks before and after launch
- Incidents and grievances: when something goes wrong
- Training and board reporting: skills and accountability at the top
Who does what
A RACI table for AI governance
R = responsible for doing the work, A = accountable for the decision, C = consulted, I = informed. Adjust names to your structure; the point is that every part has exactly one A.
| Part | Board | AI council | Business owner | IT and security | Legal and DPO | HR and L&D |
|---|---|---|---|---|---|---|
| 1. Principles | A | R | C | C | C | I |
| 2. Roles and council | A | R | I | C | C | C |
| 3. Inventory | I | A | R | R | I | I |
| 4. Risk tiers | I | A | C | R | R | I |
| 5. Intake and approval | I | A | R | C | C | I |
| 6. Data and DPDP | I | C | R | R | A | I |
| 7. Vendors and models | I | C | C | A | R | I |
| 8. Oversight and monitoring | I | C | A | R | C | I |
| 9. Incidents | I | C | R | A | R | C |
| 10. Training and reporting | A | R | C | C | C | R |
In companies under about 200 people, the “AI council” is often the COO plus the heads of IT and legal meeting monthly. That is enough if decisions are written down.
The template
The ten parts, with what to set up
Each part explains why it matters, what to put in place, what tends to work, and which outside reference it maps to. Replace anything in [square brackets] with your own details.
Part 1. Principles
Principles settle arguments before they start. When a team asks whether it can use AI to screen CVs or draft client advice, the principles give the council a consistent way to answer. Rather than inventing your own, adapt the seven guiding principles, or sutras, in MeitY’s India AI Governance Guidelines.
[Company] uses AI to help people do better work. We commit to:
- Trust: we use AI in ways customers, employees and regulators can rely on.
- People first: a person stays in charge of decisions that matter.
- Responsible innovation: we try new uses quickly, inside clear limits.
- Fairness: we check high-impact uses for unfair outcomes.
- Accountability: every AI system has a named owner.
- Understandable by design: we can explain what AI does in our processes.
- Safety and resilience: we test, monitor and can switch AI off.
- Keep to one screen
- Tie each principle to a later part of the framework
- Have the board approve them
- Copying a long ethics charter nobody reads
- Principles with no owner or process behind them
- Words that differ from your code of conduct
- Owner
- Board, drafted by the AI council
- Artefact
- One-page principles statement
- Review
- Yearly
- Maps to
- India AI Governance Guidelines: seven sutras; NIST AI RMF: Govern
Part 2. Roles and the AI council
“Who owns AI risk?” is the question most frameworks fail to answer. The workable answer is layered: the board owns the appetite, a small council owns decisions, and a named business owner owns each use case day to day.
The AI council is chaired by [COO/CIO/Chief Risk Officer] and includes IT and security, legal and the data protection officer, HR, and two rotating business heads. It meets [monthly], approves Tier 3 use cases, keeps the inventory, and reports to the [board/risk committee] every quarter.
Every AI use case has a business owner who is accountable for its results and its risks, and a technical owner who runs it.
- Write a one-page council charter
- Give the council a decision log
- Rotate business members yearly
- A council of twenty people
- Owners who are “the IT team” rather than a person
- Councils that only discuss and never decide
- Owner
- Board appoints; council chair runs it
- Artefact
- Council charter and decision log
- Cadence
- Monthly meetings; quarterly board report
- Maps to
- India guidelines: Institutions and Accountability pillars; ISO/IEC 42001: Leadership
Part 3. AI use-case inventory
You cannot govern what you cannot see. An inventory is a living list of every AI system the company builds, buys or switches on inside other software, including the AI features in tools you already pay for.
Record each AI use case in the AI inventory with these fields: name and purpose; business owner and technical owner; tool, vendor and plan; data used (and whether it includes personal data); people affected; risk tier; approval date; next review date; and status (pilot, live, retired).
Business owners must add new use cases before go-live and update the record when the tool, data or purpose changes.
- Start with a spreadsheet; move to a system later
- Include AI features inside existing software
- Link each entry to its approval record
- An inventory only IT can edit
- Missing shadow AI found in browser logs
- No review dates
- Owner
- AI council, with business owners filling entries
- Artefact
- AI inventory (register)
- Review
- Quarterly sweep
- Maps to
- NIST AI RMF: Map; ISO/IEC 42001: Operation
Part 4. Risk tiers
Most AI use is low risk and should be quick to approve. A few uses can harm people or the business and need much more care. Risk tiers let you spend governance effort where it matters, which is also the spirit of MeitY’s call for an India-specific, evidence-based approach to risk.
Classify every use case into one tier:
- Tier 1, Low: internal drafting, summarising and research on Open or Internal data. Business-owner approval.
- Tier 2, Medium: confidential data, customer-facing drafts reviewed by a person, or workflow automation. IT and legal review.
- Tier 3, High: decisions about individuals (hiring, credit, pricing, health), autonomous actions in core systems, or anything a regulator oversees. AI council approval, testing and monitoring plan.
- Not permitted: uses the company will not undertake, such as deceptive impersonation or covert surveillance of employees.
- Give two examples per tier from your business
- Let low-risk uses go live in days
- Re-tier when data or purpose changes
- Treating every chatbot as high risk
- Tiers with no different controls
- Ignoring who is affected, not only what data is used
- Owner
- AI council; IT and legal apply it
- Artefact
- Tiering guide with examples
- Review
- Every six months
- Maps to
- India guidelines: Risk Mitigation pillar; NIST AI RMF: Map and Measure
Part 5. Intake and approval
A clear front door stops two failure modes: teams waiting months for an answer, and teams not asking at all. Approval effort should rise with the risk tier.
New AI use cases are submitted through the [AI intake form], stating the purpose, data, people affected, tool and expected benefit. The business owner proposes a tier. Tier 1 uses are approved by the business owner within [3] working days and recorded in the inventory. Tier 2 uses are reviewed by IT and legal within [10] working days. Tier 3 uses go to the AI council with a test plan, a human-oversight plan and an exit plan.
- One short form for every request
- Published turnaround times
- Approvals recorded in the inventory
- Separate processes for each department
- Approvals by email that nobody can find
- Tier 3 uses launched as “just a pilot”
- Owner
- AI council
- Artefact
- Intake form and approval log
- Turnaround
- [3] / [10] working days / next council
- Maps to
- NIST AI RMF: Govern and Map; ISO/IEC 42001: Planning
Part 6. Data and DPDP controls
Personal data used with AI is still personal data. The DPDP Rules were notified on 14 November 2025 with an 18-month phased compliance timeline, and the Act’s core principles include purpose limitation, data minimisation, security safeguards and accountability. Significant Data Fiduciaries also face periodic audits and impact assessments.
Before a Tier 2 or Tier 3 use case goes live, the business owner confirms with the [data protection officer] that: the purpose is covered by notice or another lawful basis; only necessary personal data is used, masked where possible; the vendor contract covers processing, security, retention and deletion; and individuals can still exercise their rights. Confidential client data is used only where contracts allow it.
- A short DPDP checklist inside the intake form
- Masking or anonymising by default
- Vendor contracts reviewed before go-live
- Uploading full customer exports to test a tool
- Treating a vendor’s marketing page as a contract
- Forgetting candidate and employee data
- Owner
- Data protection officer or legal
- Law
- DPDP Act, 2023 and DPDP Rules, 2025
- Timeline
- 18-month phased compliance from November 2025
- Note
- General summary, not legal advice
Part 7. Vendor and model controls
Most companies buy AI rather than build it, and vendors change models, terms and features often. Governance has to cover the purchase and every material change after it.
Before an AI tool is approved, IT and legal review: data use and training terms; data location and retention; security certifications; how the vendor notifies model or terms changes; audit and exit rights. Approved tools are recorded with the highest risk tier they may be used for. When a vendor makes a material change, the technical owner re-checks the affected use cases within [30] days.
- A standard AI vendor questionnaire
- A record of which plan has which data terms
- An exit plan for each critical tool
- Approving a consumer plan for business data
- No trigger to re-review after vendor changes
- Building on a single tool with no exit route
- Owner
- CIO or head of IT
- Artefact
- Vendor questionnaire and approved-tools list
- Review
- On renewal and on material change
- Maps to
- ISO/IEC 42001: Operation; NIST AI RMF: Govern (third parties)
Part 8. Human oversight and monitoring
AI systems drift: data changes, models are updated, people stop checking. Oversight means deciding in advance what a person reviews, what gets tested, and what is watched after launch.
Each Tier 2 and Tier 3 use case has a written oversight plan: which outputs a person must review before use; what is tested before launch (accuracy on real examples, unfair outcomes where people are affected, security); what is monitored after launch; and who can switch it off. AI agents that take actions in [Company] systems run with least-privilege access, activity logs and human approval for external actions.
- Test on your own examples, not vendor demos
- Name who can switch a system off
- Sample outputs regularly after launch
- “Human in the loop” with no time to review
- Testing once and never again
- Agents with broad, permanent access
- Owner
- Business owner, with the technical owner
- Artefact
- Oversight plan and monitoring log
- Cadence
- Monthly sampling for Tier 3
- Maps to
- NIST AI RMF: Measure and Manage; India sutra: People First
Part 9. Incidents and grievances
Something will go wrong: a wrong answer sent to a customer, confidential data pasted into the wrong tool, an agent that acts on bad data. Fast, blame-free reporting limits the damage and supports breach-notification duties under the DPDP framework.
Anyone who suspects an AI incident reports it to [security/incident contact] within [24] hours. The technical owner can pause the system immediately. Incidents are logged with cause, impact and fix, and reviewed by the AI council. Customers, employees or others affected by an AI-assisted decision can raise a concern through [grievance channel] and receive a human review.
- One reporting route for all AI incidents
- A pause switch owned by a named person
- A short lessons-learned note each time
- Punishing honest reports
- No route for affected people to complain
- Treating AI incidents separately from security incidents
- Owner
- Security lead, with legal
- Artefact
- AI incident log; grievance route
- Report within
- [24] hours
- Maps to
- India guidelines: Accountability; NIST AI RMF: Manage
Part 10. Training and board reporting
A framework run by people who do not understand AI becomes paperwork. MeitY’s guidelines list capacity building as one of six pillars for good reason. The board also needs a regular, plain view of how AI is used and what could go wrong.
All employees complete AI essentials training on approved tools within [30] days of joining, with a yearly refresher. Business owners, council members and technical owners complete role-specific governance training. The AI council reports to the [board/risk committee] each quarter on: the number of live use cases by tier, new approvals, incidents, training completion, and the value delivered by key use cases.
- Practical training on your own tiers and tools
- A one-page quarterly board report
- Board members trained too
- A one-off awareness video as the only training
- Board reports full of jargon
- No measure of value, only of risk
- Owner
- Board (A); council and HR (R)
- Artefact
- Training plan; quarterly board report
- Cadence
- Quarterly
- Maps to
- India guidelines: Capacity Building pillar; ISO/IEC 42001: Support and Performance evaluation
Map to recognised frameworks
How the ten parts line up with MeitY, NIST and ISO
Mapping your framework to recognised references makes it easier to explain to auditors, clients and regulators. The table shows the closest match for each part; it is a guide, not a compliance claim.
| Part | India AI Governance Guidelines | NIST AI RMF | ISO/IEC 42001 |
|---|---|---|---|
| 1. Principles | Seven sutras | Govern | Leadership (AI policy) |
| 2. Roles and council | Institutions; Accountability | Govern | Leadership |
| 3. Inventory | Accountability (transparency) | Map | Operation |
| 4. Risk tiers | Risk Mitigation | Map; Measure | Planning (risk assessment) |
| 5. Intake and approval | Risk Mitigation | Govern; Map | Planning; Operation |
| 6. Data and DPDP | Policy & Regulation | Map; Manage | Operation |
| 7. Vendors and models | Accountability (value chain) | Govern | Operation |
| 8. Oversight and monitoring | People First; Safety | Measure; Manage | Performance evaluation |
| 9. Incidents and grievances | Accountability | Manage | Improvement |
| 10. Training and reporting | Capacity Building | Govern | Support; Performance evaluation |
Where Skillopedia fits
Governance works when the people running it understand AI
Skillopedia does not provide legal advice, audits or certification. We are a corporate AI training firm (Skillopedia LLP, Mumbai, est. 2017) that has worked with 335+ organisations across 13 sectors, and we train the people a governance framework depends on.
That usually means three groups: board members and leaders who set the risk appetite, through our AI for CXOs and business leaders programme; council members and business owners who approve and run use cases, through role-specific sessions on tiering, oversight and incident handling; and employees who need practical AI literacy training on your approved tools. Every engagement follows our FLUENT framework. Participants rate our programmes 4.8/5 on average (300+ surveyed).
A rollout plan
Ninety days from blank page to a working framework
Start small and make it real. A framework that approves its first use cases within a quarter earns trust; one that spends a year on documents does not.
India context
What Indian rules and guidelines say today
India AI Governance Guidelines (MeitY, 5 November 2025). A non-binding framework with seven sutras (Trust is the Foundation; People First; Innovation over Restraint; Fairness & Equity; Accountability; Understandable by Design; Safety, Resilience & Sustainability) and recommendations across six pillars: Infrastructure, Capacity Building, Policy & Regulation, Risk Mitigation, Accountability and Institutions. MeitY has said it will use existing laws wherever possible.
DPDP Act, 2023 and DPDP Rules, 2025. Notified on 14 November 2025 with an 18-month phased timeline; covers consent notices, breach notification, data principal rights and extra duties for Significant Data Fiduciaries.
IT Rules amendment on synthetic content (February 2026). Requires intermediaries to label synthetically generated content. Even if you are not a platform, it signals that labelling realistic AI media is becoming the norm.
Sector regulators and client contracts. Banking, insurance, securities and healthcare regulators, and many client contracts, add rules on outsourcing, data location, model risk and disclosure. Your framework should reference the ones that apply to you.
Right-sizing
How much governance does your company need?
Small companies and start-ups. Keep all ten parts but make each one short. One owner, usually the founder or COO, runs a monthly review with a lawyer on call for parts 6 and 7. The inventory can be a shared spreadsheet.
Mid-size companies. Form a proper council, publish the intake form and turnaround times, and link the framework to onboarding and the risk register. Most effort goes into parts 3, 4 and 10.
Regulated and listed companies. Connect the framework to model risk, outsourcing and board risk committees, and consider whether an ISO/IEC 42001 management system is worth building towards. Banks, insurers and healthcare providers should map sector rules into parts 4, 6 and 8. If you want help building the skills behind it, talk to us.
Questions to settle first
- Where is AI already used, officially or not?
- Which decisions about people involve AI?
- Who chairs the council?
- Which regulators and contracts apply?
Red flags in a framework
- No named owner per use case
- Every use treated as high risk
- No inventory, or one nobody updates
- Nothing on agents or vendors
For the board
- What AI risk are we unwilling to take?
- Which uses affect customers or staff?
- How do we know controls work?
- What value is AI delivering?
Measuring it
How to tell whether your AI governance is working
Good governance makes safe AI use faster, not slower. Track a few signals and put them in the quarterly board report.
| Signal | How to measure | Good direction |
|---|---|---|
| Coverage | Live AI uses recorded in the inventory, compared with a sweep of tools in use | Rising to near-complete |
| Speed | Days from intake to decision, by tier | Short for Tier 1; steady for Tier 3 |
| Control | Tier 3 uses with a current oversight plan and test record | All of them |
| Incidents | Reported AI incidents and time to report | Reported quickly; repeat causes falling |
| Capability | Owners and council members who completed role training | All of them before approvals |
For CXOs, risk and governance leads
Building a framework? Train the people who will run it.
Tell us your sector, headcount and how far your AI governance has got. We reply within one working day, and after a short call you receive a written proposal that can cover:
- a board and leadership session on AI risk and value
- role training for council members and business owners
- hands-on AI literacy for employees on approved tools
- a quarter-end review of what is working
Ask for an AI governance training proposal
We reply within one working day. No obligation.
FAQ
AI governance framework: common questions
What is AI governance?
AI governance is how an organisation directs and controls its use of AI: who decides which AI is used, how risks are assessed and managed, who is accountable for outcomes, and how leaders are kept informed.
Why is AI governance important?
It lets a company use AI faster with fewer surprises. Without it, tools spread without data checks, nobody owns mistakes, and the company struggles to answer clients, auditors or regulators who ask how AI is used.
What is an AI governance framework?
It is the documented structure for AI governance: principles, roles, an inventory of AI uses, risk tiers, an approval process, data and vendor controls, oversight, incident handling, training and reporting. The ten parts above are one template.
How do you create an effective AI governance framework?
Appoint an owner and a small council, list the AI already in use, agree risk tiers with examples, publish a simple intake process, run real use cases through it, train the people involved, and report to the board every quarter.
Who owns AI risk?
The board owns the overall risk appetite. A senior executive, often the COO, CIO or chief risk officer, chairs the AI council that makes decisions. Each AI use case has a named business owner accountable for its results and risks.
What are the three pillars of AI governance?
There is no single official list. Many organisations group governance into people (roles and skills), process (approval, oversight and incidents) and technology (data, tools and monitoring). The ten parts here cover all three.
What are the six pillars of AI governance?
In India, MeitY’s AI Governance Guidelines make recommendations across six pillars: Infrastructure, Capacity Building, Policy & Regulation, Risk Mitigation, Accountability and Institutions.
What are the five principles of AI governance?
Lists vary. The OECD AI Principles, adopted in 2019 and updated in 2024, set out five values-based principles: inclusive growth and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. India’s guidelines use seven sutras.
What is the national AI governance framework in India?
The India AI Governance Guidelines, released by MeitY under the IndiaAI Mission on 5 November 2025. They set out seven sutras, recommendations across six pillars, an action plan and practical guidance for industry, and favour existing laws over a new AI law for now.
Is there an AI governance framework companies must follow in India?
There is no single mandatory AI governance framework for companies. The MeitY guidelines are non-binding, but laws such as the DPDP Act, sector regulations and contracts still apply to AI use, so most companies benefit from a framework of their own.
What is the difference between an AI policy and an AI governance framework?
A policy is the set of rules employees follow. A framework is the wider system that approves uses, judges risk, assigns owners and reports to the board. See our AI policy template for the employee rules.
Do we need ISO/IEC 42001 certification?
Not by law in India. ISO/IEC 42001:2023 is a voluntary, certifiable standard for an AI management system. It can help when clients ask for assurance, but many companies start with a lighter framework and build towards it.
How often should an AI governance framework be reviewed?
Review the whole framework yearly, the risk tiers and vendor list every six months, and the inventory every quarter. Also review after any serious incident, a change in law or a major new AI tool.
Next step
Make your AI governance framework work in practice
Tell us about your framework, your sector and the people who will run it. We reply within one working day with a few questions, then send a written proposal with a fixed fee.
- Board and leadership sessions on AI risk and value
- Role training for council members and owners
- Hands-on AI literacy on your approved tools
Ask for an AI governance training proposal
Reply within one working day.