India AI Governance Guidelines (MeitY) vs ISO 42001: What Businesses Must Do Now
The India AI governance guidelines, released by MeitY on 5 November 2025, are non-binding guidance, not a statute. They set seven sutras and six pillars for the whole economy. ISO 42001 is the management system a firm uses to make that guidance operational, with an owner, a record and a tested control.
A COO who prints the India AI governance guidelines and stops there has a PDF, not a system. The board date does not care that the document is thoughtful. It cares whether a live model has an owner. An AI system that is already in production needs an owner, a purpose, and a record of how it was tested.
The India AI governance guidelines were released on 5 November 2025 under the IndiaAI Mission. Read the MeitY AI guidelines as a brief from that mission, not as a new Act of Parliament. The MeitY AI guidelines are non-binding. They do not create an offense, a penalty section or a certification duty.
What the India AI governance guidelines ask a board to show
On a working file, the India AI governance guidelines turn into owners, purposes and test records. If a model has no owner, the India AI governance guidelines have not been applied, whatever the policy says. A Stage 2 sample will look for the person, the purpose and the test note. A poster of sutras will not substitute for that row.
Treat the AI governance framework India now has as guidance with a date, not as a fresh statute. The AI governance framework India published on 5 November 2025 adapts seven sutras from the RBI FREE-AI report of 13 August 2025. That report, “Framework for Responsible and Ethical Enablement of Artificial Intelligence”, is a committee framework for banks, NBFCs and other regulated entities. It is not a clause that makes ISO/IEC 42001 mandatory. The official PDF is on rbi.org.in.
The MeitY AI guidelines reuse the same seven sutras, adapted for the whole economy, and they speak of six pillars across enablement, regulation and oversight. The MeitY AI guidelines do not make ISO 42001 mandatory. The MeitY AI guidelines are practical guidance for industry. ISO 42001 is the management system firms use to operationalize that guidance. Do not cite the MeitY AI guidelines as if they were a section of the DPDP Act.
For a bank or an NBFC, the AI governance framework India conversation started with FREE-AI. Twenty-six recommendations sit in that report. For everyone else, the AI governance framework India conversation became a public brief on 5 November 2025. Same sutras. Wider audience. Still not a law.
Seven sutras, and what you file against each one
FREE-AI names six pillars for regulated entities: Infrastructure, Policy, Capacity (innovation), Governance, Protection, and Assurance (risk). Capacity in that list is about skill, not about buying a tool. Assurance is about testing the control, not about a logo on the website. MeitY does not hand you those six titles as a statute schedule. It points at enablement, regulation and oversight. Your job is the sutra you can evidence.
| Sutra | What the board can show | Where it sits in the AIMS |
|---|---|---|
| Trust is the Foundation | Named owner, purpose, test record | Inventory and the AI policy |
| People First | Effect on a person or a group | AI impact assessment |
| Innovation over Restraint | Experiments listed, not banned in a slogan | Scope, plus a watch list |
| Fairness and Equity | Notes where a decision affects people | AI risk assessment |
| Accountability | A role with a name, not a committee with no chair | Roles and responsibilities |
| Understandable by Design | Information a user can actually read | System documentation for users |
| Safety, Resilience and Sustainability | A stop path, monitoring, an incident note | Operation and monitoring |
Use the table as a filing plan. Do not paste the sutra into a policy and call the control done. Annex A of ISO/IEC 42001:2023 has 38 controls, from A.2 through A.10. The Statement of Applicability records which apply and why. A one-line “not applicable”, with no reason, fails the sutra and the auditor.
How the India AI governance guidelines sit inside an ISO 42001 system
ISO/IEC 42001:2023 is the AI management system, the AIMS. Clauses 4 to 10 are the management cycle. Certification is voluntary. A certification body issues the certificate after Stage 1, the documentation review, and Stage 2, the implementation audit. Then a surveillance audit, then recertification around year three. Seven Step Consulting is a consultancy in Gurugram. It does not issue ISO certificates.
The India AI governance guidelines do not replace clause work. Map the India AI governance guidelines to the inventory before you map them to a slide. A Statement of Applicability is how you show the India AI governance guidelines were turned into controls, not slogans. Pair the AI governance framework India expects with Annex A controls you can sample.
ISO/IEC 23894:2023 guides the AI risk assessment. ISO/IEC 42005 guides the AI impact assessment. Those are guidance documents, as the November brief is guidance. The AIMS is where the guidance becomes a record with an owner. Do not wait for the AI governance framework India to become a law before you name that owner.
For a startup, the India AI governance guidelines still mean one inventory, even if the product is a single model. For a bank or NBFC, the India AI governance guidelines sit beside FREE-AI. They do not cancel it. A model used in credit, collections or customer service needs the same owner column a product firm needs, plus the fairness and override notes a regulated board will ask for.
Check the certification body’s current scope on the NABCB or IAF directory if you decide to certify. This article names no bodies. NABCB, under QCI, accredits management-system certification bodies in India. An accredited ISO 27001 mark is not an AIMS mark. The India AI governance guidelines are not an accreditation scheme.
ISO 27001 still matters. It governs information security: access, logging, suppliers. It does not inventory AI systems or record how a model was tested. If your only file is an ISO 27001 manual, you have not operationalized the November guidance.
What to do in the next board cycle
A founder can brief the team on the MeitY AI guidelines in one sitting. The records take longer. Implementation of an AI management system often takes 3 to 6 months, depending on size, AI maturity and how many systems are in scope. A focused firm with a small inventory can be audit-ready for Stage 1 in about 90 days if leadership shows up. That is readiness. It is not a certificate, and the guidelines do not require one.
A practical AI governance framework India can defend in a board pack is the inventory plus the sutra table, not a second policy that repeats the PDF. List what you build, what you buy and what staff paste into a browser. A vendor copilot on customer text is in scope. A spreadsheet named Final_v7 that scores applicants is a system. Shadow AI breaks the India AI governance guidelines in practice. Add the row or accept the finding.
The DPDP Act, 2023, and the DPDP Rules, 2025, are a separate clock. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force. Personal data in training sets, prompts and outputs still needs a purpose. The EU AI Act is a different clock again for exporters. Most Annex III high-risk obligations have applied since 2 August 2026. Neither clock turns the November guidance into a statute.
A board that wants a number should see a market range, not a slogan. In 2026 India market ranges for one legal entity, a gap review often sits between ₹1.5 lakh and ₹4 lakh, and consulting for a startup or single-product firm often sits between ₹4 lakh and ₹8 lakh. Those figures are not a Seven Step fee. Staff time is the cost people forget when they budget the India AI governance guidelines as a reading exercise. A certification body invoices Stage 1 and Stage 2 separately, about ₹2 lakh to ₹8 lakh in the same market ranges, driven by headcount and sites.
A quote PDF that promises “alignment with national guidance” in one line is not a system. Ask which systems, which sutra and which record are inside the fee.
Ask for the health check while the file is still thin
Free AI governance health check is the right first step if the board has the PDF and not the inventory. We will look at the systems you run, the sutras you can evidence, and the gaps a Stage 1 visit would find. Write through the contact page: https://www.sevenstepconsulting.com/contact-us/
Questions people ask before they buy
Are the November guidelines a law?
No. The MeitY AI guidelines are not a statute, and they do not order you to certify. They are non-binding guidance under the IndiaAI Mission, released on 5 November 2025. A management system is how you operationalize them. A certificate, if you want one, comes from a certification body, not from MeitY and not from a consultant.
Do the guidelines make ISO 42001 mandatory?
No. FREE-AI does not make it mandatory for banks. The November guidance does not make it mandatory for everyone else. Use the AI governance framework India has been given as the brief. Use the AIMS as the file. Certification stays voluntary.
If you already follow FREE-AI, do you ignore MeitY?
Keep FREE-AI if you are a bank, NBFC or other regulated entity. The seven sutras in the India pack are adapted from that report for the whole economy. The India AI governance guidelines do not, by themselves, require a certificate. They do ask you to show the same habits: trust, people, accountability, understandable design, and a stop path.
Where should a non-bank start?
Start with the systems that affect people. That is where the India AI governance guidelines become visible. One hiring model, one customer bot, one scoring sheet. Name the owner. Write the purpose. Keep the test record. Then decide which Annex A controls apply.
Does ISO 27001 already cover this?
It covers a large part of information security. It does not cover the model. You still need an AI system inventory, an AI risk assessment, an AI impact assessment and a Statement of Applicability. A surveillance audit on an ISO 27001 certificate does not sample those AI records unless the scope says so.
Put an owner on the row before the next board pack
If the guidelines are already in the board folder, do not add another summary slide. Book a free AI governance health check. We will show where the India AI governance guidelines are already evidenced and where the inventory is still a blank owner column.
