India's New AI Governance and Security Guidelines: What IT Companies Should Know
Artificial Intelligence is transforming the way businesses develop software, manage operations, process information, and interact with customers. From AI-powered applications and chatbots to automated business workflows, companies across India are increasingly integrating AI into their digital products.
However, as AI adoption grows, concerns around data privacy, cybersecurity, transparency, misinformation, and responsible technology use are becoming more important.
To address these challenges, the Government of India has introduced an AI governance framework through the Ministry of Electronics and Information Technology (MeitY). In addition, security-focused guidance from CERT-In and India's Digital Personal Data Protection (DPDP) framework are helping shape how organisations approach AI development and deployment.
For IT companies, software developers, startups, and technology service providers, understanding these developments is becoming an important part of building reliable and responsible AI-powered solutions.
What Are India's New AI Governance Guidelines?
India's AI Governance Guidelines provide a principle-based framework for developing and deploying Artificial Intelligence responsibly.
The framework was introduced under the IndiaAI Mission by MeitY to encourage AI innovation while addressing risks to individuals, businesses, and society.
The guidelines were officially released on 15 February 2026 and focus on creating an AI ecosystem that supports innovation, accountability, fairness, safety, and public trust.
Rather than focusing only on restrictions, the framework aims to encourage responsible AI adoption through existing laws, institutional coordination, technical safeguards, and risk management.
The framework includes four major components:
- Seven guiding principles, also known as Sutras.
- Recommendations across six pillars of AI governance.
- An action plan covering short-, medium-, and long-term priorities.
- Practical guidance for industry participants, developers, and regulators.
The Seven Key Principles of India's AI Governance Framework
India's AI governance approach is built around seven guiding principles that help organisations understand how AI systems should be designed, developed, and deployed.
1. Trust Is the Foundation
Trust is essential for successful AI adoption.
Businesses should develop AI systems that users can rely on. This includes maintaining system reliability, protecting information, and establishing responsible processes for AI development and deployment.
2. People First
AI systems should support human decision-making rather than remove meaningful human control.
Organisations should consider user safety, human oversight, and the impact of automated decisions, especially in sensitive applications.
3. Innovation Over Restraint
The framework encourages technological innovation and responsible AI adoption.
Businesses should have opportunities to experiment with new AI technologies while taking appropriate steps to identify and reduce potential risks.
4. Fairness and Equity
AI systems should be designed to avoid unfair discrimination and biased outcomes.
Developers should evaluate training data, model outputs, and system performance to identify potential bias.
5. Accountability
Companies involved in developing or deploying AI systems should have clear responsibilities.
Organisations should establish ownership, documentation, monitoring, and appropriate review processes for their AI products.
6. Understandable by Design
AI systems should provide appropriate transparency and explanations about their functionality and outcomes.
Users should receive relevant information about how AI systems operate and how their outputs may affect them, wherever technically feasible.
7. Safety, Resilience and Sustainability
AI systems should be designed with safeguards against unexpected behaviour, misuse, and security threats.
The framework also encourages resource-efficient AI development and environmentally responsible technology practices.
What Are the Six Pillars of India's AI Governance Framework?
Alongside the seven principles, the framework identifies six important areas for developing India's responsible AI ecosystem.
1. AI Infrastructure
AI development requires access to computing resources, datasets, digital infrastructure, and reliable technology platforms.
The framework encourages investment in scalable infrastructure, improved access to computing resources, and the development of relevant datasets.
For IT companies, this highlights the importance of building reliable infrastructure that can support growing AI workloads.
2. AI Skills and Capacity Building
As AI adoption increases, businesses need professionals with the right technical and practical skills.
Developers, software engineers, cybersecurity professionals, and business teams need to understand AI technologies and their associated risks.
Continuous training and AI education can help organisations build stronger technical capabilities.
3. Policy and Regulation
The framework encourages a balanced approach to AI governance using existing laws and identifying areas where additional guidance or regulatory clarity may be needed.
Important areas include data protection, intellectual property, cybersecurity, content authenticity, and accountability across the AI development lifecycle.
4. Risk Mitigation
AI systems can introduce risks such as inaccurate outputs, biased decisions, privacy violations, misinformation, and cybersecurity vulnerabilities.
Businesses should identify potential risks before deploying AI applications and establish appropriate safeguards.
5. Accountability and Governance
Organisations should clearly define who is responsible for AI systems, how they are monitored, and how potential issues are addressed.
Documentation, internal policies, human oversight, and review mechanisms can support responsible AI operations.
6. International Cooperation
AI technologies operate across geographical boundaries.
India's framework recognises the importance of international collaboration, common standards, knowledge sharing, and participation in global AI governance discussions.
CERT-In's AI Security Auditing Guidelines: What Businesses Need to Know
One important development for Indian technology companies is CERT-In's Artificial Intelligence Security Auditing Guidelines.
CERT-In, the Indian Computer Emergency Response Team, provides cybersecurity guidance and coordinates responses to cybersecurity incidents.
Its AI security auditing framework provides a structured approach to assessing AI systems developed, purchased, deployed, or operated by organisations in India.
The framework also covers relevant AI systems processing Indian data or providing AI-enabled services to Indian users.
1. Risk-Based AI Classification
The guidelines classify AI systems into four risk categories:
- Low Risk
- Moderate Risk
- High Risk
- Critical Risk
The risk classification considers factors such as the sensitivity of data, potential impact, level of automation, system complexity, transparency, and operational importance.
The risk level helps determine the appropriate depth of security assessment, documentation, human oversight, and ongoing monitoring.
2. Nine Core AI Security Audit Areas
The guidelines identify nine important areas for assessing AI security and governance.
| Audit Area | Main Focus |
|---|---|
| AI Governance and Accountability | Ownership and responsibility |
| Data Lifecycle, Quality and Privacy | Data protection and quality |
| Model Risk Management | Model reliability and risk |
| AI Ethics, Bias and Fairness | Fair and responsible outputs |
| Explainability and Transparency | Understanding AI decisions |
| Security and Adversarial Resilience | Protection against AI attacks |
| Continuous Monitoring | Performance and model changes |
| Human Oversight | Human control and accountability |
| Third-Party Assurance | External tools and dependencies |
These areas cover different stages of the AI lifecycle, from development and testing to deployment, monitoring, and retirement.
3. Security Risks in Generative AI and Agentic AI
Modern AI applications introduce security considerations beyond traditional software systems.
The CERT-In guidelines also address newer AI architectures, including:
- Generative AI
- Retrieval-Augmented Generation (RAG)
- Agentic AI
- Multimodal AI
- Multi-Agent AI
- Autonomous and Cyber-Physical AI
Potential risks include prompt injection, sensitive information disclosure, data poisoning, unsafe tool usage, and weaknesses in third-party integrations.
For companies developing AI-powered products, security testing should consider these risks alongside conventional application security practices.
Digital Personal Data Protection Rules: Why They Matter for AI Companies
AI systems often process large amounts of information, including personal data.
India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 provide an important legal framework for processing digital personal data.
The DPDP Rules were notified on 14 November 2025.
For IT companies, this framework is relevant when their applications collect, store, process, or use personal data.
1. Responsible Data Collection
Businesses should understand what personal information their applications collect and why it is required.
Data collection should be handled according to applicable legal requirements and the purpose of processing.
2. Consent and Transparency
Organisations should provide appropriate information about personal data processing and obtain consent where required by the applicable framework.
Users should be able to understand how their information is being used.
3. Data Security
Companies should establish reasonable security safeguards to protect personal data against unauthorised access, disclosure, and other security incidents.
4. Data Retention and Deletion
Organisations should review how long personal data needs to be retained and establish appropriate deletion processes according to applicable requirements.
For AI developers, this is especially important when working with training datasets, user conversations, analytics, and application logs.
How These Guidelines Affect IT Companies and Software Developers
India's AI governance and security developments have practical implications for companies building digital products.
1. AI Application Development
Developers should consider security, fairness, transparency, and human oversight during the application development process.
Responsible AI practices should be included from the planning stage rather than added only after deployment.
2. SaaS Product Development
SaaS platforms increasingly integrate AI features such as recommendation engines, automated customer support, document analysis, and intelligent dashboards.
Companies should evaluate how these features process customer data and how their outputs affect users.
3. AI Chatbots and Virtual Assistants
AI chatbots may process customer conversations and personal information.
Developers should consider privacy controls, access restrictions, output validation, and appropriate user disclosures.
4. Enterprise Automation
AI-powered automation can perform tasks involving business records, internal systems, and third-party services.
Companies should define permissions, monitor automated actions, and maintain appropriate human review for sensitive operations.
5. Cybersecurity and Software Maintenance
AI integration creates additional components that need ongoing security assessment.
Development teams should review APIs, model dependencies, data flows, access permissions, and potential vulnerabilities regularly.
What Should IT Companies Do to Prepare?
Understanding AI governance is only the first step. Organisations should also establish practical processes for responsible AI development.
Here are some important areas companies can focus on.
1. Create an AI Usage Policy
Define how employees and development teams can use AI tools.
The policy should cover approved applications, sensitive information, access permissions, and responsibilities.
2. Maintain an AI System Inventory
Maintain a record of AI models, APIs, third-party platforms, plugins, and automated workflows used within the organisation.
This improves visibility into the company's AI ecosystem.
3. Conduct Regular Security Assessments
Evaluate AI applications for security vulnerabilities, data exposure, model risks, and unexpected behaviour.
Testing should be appropriate to the system's purpose and risk level.
4. Protect Customer and Business Data
Apply appropriate access controls, encryption, data handling policies, and security safeguards.
Review how information is shared with external AI providers.
5. Maintain Human Oversight
Important business decisions should have appropriate review mechanisms, particularly when AI systems influence sensitive or high-impact outcomes.
6. Document AI Development and Deployment
Maintain relevant documentation about system purpose, data sources, model versions, testing, security assessments, and operational responsibilities.
Documentation can support internal reviews and accountability.
The Future of AI Governance in India
AI governance in India is expected to evolve alongside advances in generative AI, autonomous systems, and intelligent automation.
The government's approach combines innovation, institutional coordination, existing legal frameworks, and risk-based safeguards.
The establishment of institutions such as the AI Governance Group, Technology & Policy Expert Committee, and AI Safety Institute reflects the growing importance of coordinated AI governance.
For technology companies, this means responsible AI development will increasingly involve more than building accurate models or adding new AI features.
Businesses will also need to consider security, transparency, data protection, accountability, and long-term system reliability.
Final Thoughts
India's AI governance and security developments represent an important step toward building a more responsible and trustworthy AI ecosystem.
The MeitY AI Governance Guidelines provide principles for responsible AI innovation, CERT-In's security auditing framework introduces a structured approach to AI risk assessment, and the DPDP framework establishes important requirements for digital personal data protection.
For IT companies, software developers, startups, and SaaS businesses, understanding these developments can help create safer, more transparent, and more reliable digital products.
As AI continues to transform the technology industry, companies that consider security, privacy, and accountability throughout the development process will be better positioned to build trust with their customers.
The future of AI is not just about building smarter technology. It is about building technology that people can trust.
