ISO 42001 GCC India work starts from the parent policy and the models the centre actually runs. A captive has to show head office the inventory, the owners, and the tests, not a forwarded slide. The certificate, if you pursue one, still comes from a certification body. The centre’s job is the evidence.

What ISO 42001 GCC India shows the parent

Head office often holds a global AI policy, a tool list, and a risk appetite written for another country. The floor in India holds the Copilot tenant, the internal chatbot, the proof of concept a client can already touch, and a spreadsheet still named Final_v7. ISO 42001 GCC India work is how a centre shows the parent the systems that actually run, not the systems named on a global slide.

Start ISO 42001 GCC India from the legal entity in India and the sites where people sit. “The group” is not a sample. A parent policy is an input to ISO 42001 GCC India, not a finished file. Read it, mark what applies to this entity, and write the exception where the work does not fit.

The Copilot tenant, the internal chatbot, and a model a delivery team wrapped for a client all sit in ISO 42001 GCC India scope when people use them. ISO 42001 GCC India evidence is an owner, a purpose, and a test, kept where the centre can open them without calling a colleague abroad.

Head office questionnaires get easier when ISO 42001 GCC India records already exist. Do not wait for the parent to invent ISO 42001 GCC India language before you list the tools. The questions will arrive anyway.

GCC AI governance is the local operating file under a global policy. GCC AI governance names the India owner even when the global policy names a chief abroad. GCC AI governance includes client-delivery models, not only internal productivity tools. GCC AI governance records which parent rules you follow and which ones do not fit the work. GCC AI governance is what you show a parent reviewer who has never been on the floor. GCC AI governance fails when the inventory is the global tool list and the local tools are missing.

Captive centre compliance starts with the entity that employs the people and the systems they run. Captive centre compliance is not a logo slide sent back to head office. A parent that asks for captive centre compliance wants the inventory, the risks, and the exceptions. Captive centre compliance covers the Gurugram floor and any other India site inside the same system. Write the exceptions in the open. Captive centre compliance that hides a client model will fail the first serious question. Captive centre compliance still leaves the certificate, if you want one, with a certification body.

Seven Step Consulting works from 1006, 10th Floor, EMAAR Capital Tower 1, MG Road, Sikanderpur, Sector 26, Gurugram, Haryana 122002. It is a consultancy. It does not issue ISO certificates. Many capability centers sit in the same city, on Golf Course Road and nearby. Those are kinds of address, not a client list. The AIMS you build is yours. The certification body decides the certificate. Check the body’s current scope for ISO/IEC 42001:2023 on the NABCB or IAF directory. NABCB, under QCI, accredits management-system certification bodies in India.

How ISO 42001 GCC India uses the parent policy

Keep the parent policy as a controlled input. Map each rule you adopt to a local record: the inventory row, the AI risk assessment, the AI impact assessment, or a line on the Statement of Applicability. Annex A still has 38 controls. A global “not applicable” is not a reason. Write the reason for this centre, in a sentence a skeptical reader can test.

An internal audit for ISO 42001 GCC India has to sample a live system on the floor, not the global PDF. If the named owner is in another country and cannot open the screen, the owner on the row is wrong.

ISO 42001 GCC India and an existing ISO 27001 program can share management clauses and still split the AI controls. Information security does not name the model, the purpose, or how the output was tested.

Multi-city sampling changes the plan for ISO 42001 GCC India when two India sites both operate systems. Bought assistants are inside ISO 42001 GCC India the day an employee can use them for client work.

ISO 42001 GCC India does not replace the parent’s legal review of a sensitive use. It gives the parent a file they can open. Leadership at the centre has to sign the ISO 42001 GCC India review. A forwarded mail from abroad is not that signature.

ISO 42001 GCC India file linking a parent AI policy to models the centre runs
Parent artifact What the centre adds Weak substitute
Global AI policy Local owner and the systems this floor runs The same PDF with a new cover
Global tool list Pilots, client wrappers, bought assistants “Only approved tools”
Group risk appetite Harm on this work, with a treatment A copied score and no name
Head-office questionnaire Evidence from the inventory A slide forwarded the night before

Stage 1 is the documentation review. Stage 2 is the implementation audit, on the sites you named. A surveillance audit later asks what changed: a new client model, a new tenant, a parent policy revision you have not mapped. A focused scope can be audit-ready for Stage 1 in about 90 days when the inventory is small and leadership shows up. That is readiness, not a certificate. A multi-site build often takes three to six months.

The DPDP Act, 2023, and the DPDP Rules, 2025, sit on this file when prompts or outputs hold personal data. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force. The EU AI Act does not make ISO/IEC 42001 a presumption of conformity. Most Annex III high-risk obligations have applied since 2 August 2026.

In 2026 India market ranges, not a Seven Step rate card, consulting for a bank, insurer, GCC or multi-site firm often sits between ₹15 lakh and ₹30 lakh, and sometimes more. The certification body invoices Stage 1 and Stage 2 separately, often about ₹2 lakh to ₹8 lakh. Staff time on the floor is the cost people forget.

Enterprise discovery call

Enterprise discovery call. Tell us the legal entity in India, the sites, and whether head office has already sent a policy or a questionnaire. We will say what the centre must show, and what can stay with the parent. Use https://www.sevenstepconsulting.com/contact-us/.