A Managing Director called me one Sunday evening in May. That afternoon, he had read the SEBI Advisory from 5 May 2026. He realized his broker needed a Software Bill of Materials for every critical AI application. He also saw that his trade-surveillance model would now fall within the audit perimeter, and his client-onboarding risk-scoring model was triggering DPDP Section 10(2)(c) proviso obligations. Most importantly, he noticed that no one in his organization was responsible for any of these areas.
He had just one question: "Who do I appoint on Monday?" This article explains the answer.
India’s AI governance framework took shape in two key documents released between August and November 2025. Sectoral regulators began putting these rules into practice in 2026.
Now, every bank, NBFC, broker, insurer, VDA service provider, GCC, and mid-market company falls under one or more compliance requirements. If your organization does not appoint an AI Governance Officer by the end of 2026, the first inspection or incident will expose this gap.
This role bridges four existing positions.
The AI Governance Officer is not the DPO renamed. It is not the CISO extended. It is a new seat that draws authority from four existing roles, each of which hands off a specific obligation.
The Data Protection Officer gives the authority to apply the DPDP Act 2023 Section 10(2)(c) proviso. This rule requires a Significant Data Fiduciary to make sure that any algorithmic software it uses does not risk Data Principal rights. This proviso is currently the clearest AI governance requirement in Indian law. The AI Governance Officer handles the due diligence, while the DPO signs off under Section 10.
The Chief Information Security Officer provides the authority to implement the SEBI AI Vulnerability Detection Advisory from 5 May 2026(HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026). This Advisory requires a Software Bill of Materials for every critical AI application, including open-source components, Market SOC onboarding, and a long-term plan for managing agentic risks. The CISO defines the overall scope, while the AI Governance Officer is responsible for the model-specific tasks.
The Chief Risk Officer passes on responsibility for model risk. For banks or NBFCs in the eleven categories listed in the RBI Draft on Model Risk Management(comments closed 24 July 2026, with the final Master Direction expected in FY 2026-27), the Board’s policy on model risk will name the AI Governance Officer as the person in charge of AI and ML models.
The Compliance Head has the authority to handle regulatory questions. When MeitY, SEBI, RBI, IRDAI, the DPDP Board, or the Ministry of Information and Broadcasting asks about an AI system, the AI Governance Officer is the first person to respond.
Why the stack moved in 2025 and 2026
Two key documents created the stack, in this sequence.
The first was the Reserve Bank of India's FREE-AI Committee Report, released on 13 August 2025, titled"Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector." This report introduced 7 Sutras, 6 Pillars, and 26 actionable recommendations. The 7 Sutras, which form the core of India's approach, started here rather than at MeitY.
The second document was the MeitY India AI Governance Guidelines, published on 5 November 2025(PIB PRID 2186639), called "Enabling Safe and Trusted AI Innovation." MeitY used the 7 Sutras from FREE-AI without changes, added the 6 Pillars across three areas, Enablement, Regulation, and Oversight; outlined three institutions (AIGG, TPEC, AISI), and established a voluntary approach.
All three institutions are now in place. The AI Governance Group (AIGG) was officially formed on 16 April 2026, followed by the Technology and Policy Expert Committee (TPEC) on 18 April 2026. Recruitment for the AI Safety Institute (AISI) Director ended on 2 June 2026, with the appointment awaiting public confirmation as of October 2026. Over the next year, we can expect AIGG to release implementation guidelines based on the November 2025 Guidelines, TPEC to publish technical notes, and sectoral regulators to align with these changes.
Accountability is based on function, not on contract terms.
For an AI Governance Officer, Sutra 5, Accountability, is the most important. It sets out a function-based accountability model that India chose on purpose, differing from the EU AI Act.
According to Sutra 5, the developer is responsible for the system's architecture, training data choices, evaluation, and documentation. The deployer is responsible for choosing use cases, the deployment context, input flows, output handling, and monitoring. The data provider is responsible for data provenance, collection, preparation, and release terms. Each party is accountable for their own role at the same time.
This has a key practical effect. If a vendor's EULA claims to transfer "all AI accountability" to the deployer, it might shift civil-law risk through indemnity, but it does not change regulatory accountability. The developer is still answerable to Indian regulators for their own role. If your organization buys AI tools from a vendor and uses them in production, you are responsible as the deployer and often as the data provider (for your own RAG or fine-tuning data). The vendor keeps developer accountability, no matter what the contract says.
What the Board resolution must say
The Board resolution that appoints the AI Governance Officer is the first thing a MeitY reviewer, SEBI inspector, or DPDP Board officer will request. A simple one-line resolution will not pass inspection. Instead, the resolution should clearly list five specific authorities.
Access authority means the officer can review all records, data pipelines, and model artifacts for AI governance, without needing extra approval.
Interview authority allows the officer to speak with any employee as needed for AI governance.
DPIA authority gives the officer the power to require an AI DPIA before any system goes live and to stop the launch until the DPIA is approved.
Kill-switch authority lets the officer remove a model from production if there is a confirmed incident. The RBI FREE-AI Report says this is expected for banks, but you should include it even if your organization is not a bank. This is the most important operational power for the role.
Independence protections. The AI Governance Officer cannot be removed or his authority diluted except by a Board resolution recorded in minutes. His compensation is not linked to the deployment velocity of any business line. He has a direct right of access to the Chairman and to the Audit Committee at any time.
If a Managing Director is reluctant to grant any of these five authorities, it shows the organization is not prepared for its first SEBI, RBI, or DPDP Board inspection.
Key regulatory changes you need to watch in 2026-27
In the coming year, three sets of regulations will take effect at once. The AI Governance Officer should keep track of each one.
The first stream is the start of DPDP operations. The DPDP Rules 2025 were announced through G.S.R. 846(E) on 13 November 2025 and will begin in phases. Rule 4, which covers Consent Manager registration, starts on 13 November 2026. Rules 3, 5-16, 22, and 23, including Rule 7 on breach notification and Rule 13 on Significant Data Fiduciary duties, will take effect on 14 May 2027. For every SDF, the twelve-month DPIA cycle under Rule 13 also begins on 14 May 2027.
The second stream covers new rules from sector regulators. The SEBI AI Advisory from 5 May 2026 is already active, and its 10-point Annexure A serves as an ongoing checklist. The RBI's draft on Model Risk Management closed for comments on 24 July 2026, with the final Master Direction expected in the 2026-27 financial year. The IRDAI AI Working Group was set up on 19 June 2026, with its report originally due in September 2026 (but delayed to October 2026). A draft framework circular is expected in the first half of 2027.
The third stream involves rules for synthetic media and intermediaries. The IT Rules 2026 amendment, issued on 10 February 2026 and effective from 20 February 2026, introduced the "Synthetically Generated Information" category. This requires mandatory labeling, permanent provenance metadata, a three-hour takedown window for unlawful content flagged by courts or the government under Rule 3(1)(d), and a separate two-hour window for non-consensual sexual images, including morphed and deepfake nudity. These requirements now apply to any intermediary handling AI-generated content.
The ten-week engagement map
Building an effective AI governance program usually takes around ten weeks. The process is divided into four phases, each with a key action and a checkpoint for the Board or Audit Committee.
In weeks 1 and 2, start by appointing key roles. Define the project scope clearly on a single page. Get Board approval with the five required authorities. Set up the AI inventory and model register. Assign stakeholder responsibilities by role. Address three common early issues: unclear authority for the AI Governance Officer, missing AI inventory, and not being ready to launch high-risk new deployments.
During weeks 3 to 5, focus on drafting. This is the most intensive phase. Write the twelve-clause internal AI governance policy. Create the AI DPIA template to match Section 10(2)(c) proviso and Rule 13. Prepare the pre-deployment risk assessment checklist for bias, robustness, and security. Develop templates for the model card, datasheet for datasets, and the AI transparency notice for users. Write the standard operating procedure for human oversight and the AI incident response runbook. At the end of this phase, get Board approval for the policy at Checkpoint 2.
In weeks 6 to 8, move into the operational phase. Train product owners, data engineers, and legal and compliance teams. Carry out DPIAs on three actual systems from your inventory. Test at least two production models before deployment. Set up monitoring for changes after deployment. Run a trial of the AI incident response process using the runbook.
In weeks 9 and 10, focus on review. Conduct a mock review with an external advisor or your internal audit team, as if a sector regulator were involved. Address any policy gaps you find. Prepare a six-slide briefing deck for the Board. Complete the twelve-month operating calendar. Get final Board approval at Checkpoint 4.
By the end of Week 10, the organisation is no longer running an engagement. It is running a programme.
Where this fits with ISO/IEC 42001
ISO/IEC 42001:2023 sets the standard for AI management systems. Following it is voluntary, but MeitY encourages firms to adopt it. If your organisation is working toward ISO 42001 certification, its clauses align with the MeitY Pillars. For example, Clause 4 (Context) and Clause 5 (Leadership) match Pillar 6 (Institutions). Clause 6 (Planning) and Annex A controls A.2 to A.5 align with Pillar 4 (Risk Mitigation). Annex A A.6 to A.9 relate to accountability for developers and data providers. ISO 42001 provides the standards framework, while Indian regulators set the operational requirements on top.
Our new course at dcomply Academy covers every requirement from start to finish. The AI Governance Officer India Practitioner course includes 12 modules and 65 lessons, each linked to a specific Sutra, Pillar, Section, Rule, Circular, Advisory, or international standard. You can preview Module 1 for free. The capstone project follows the full ten-week program using Aarti Capital Markets, a fictional Mumbai SEBI-registered broker and AMC with Rs 8,400 crore in assets under management and three AI use cases. When you enroll, you get access to a workbook with twelve browser-fillable templates, including the Board resolution, AI inventory, 12-clause policy, DPIA template, pre-deployment checklist, model card, datasheet, transparency notice, HITL SOP, incident runbook, operating calendar, and Board deck.
Mentioned in this post
AI Governance Officer India Practitioner
Twelve modules. Sixty-five lessons. Ninety-seven primary-source anchors. The India-regulator operational layer that sits on top of ISO/IEC 42001. One ten-week engagement that gets your organisation\'s named AI Governance Officer ready for the first MeitY review cycle, SEBI AI audit, or DPDP Board inquiry.
Open the course on dcomply Academy →
Further reading
MeitY India AI Governance Guidelines (5 Nov 2025): PIB PRID 2186639
RBI FREE-AI Committee Report (13 Aug 2025): RBI Notifications
SEBI AI Vulnerability Detection Advisory (5 May 2026): SEBI Master Circulars
DPDP Act 2023 Section 10: PRS India
ISO/IEC 42001:2023 AI Management System: ISO.org
EU AI Act (Regulation 2024/1689): European Commission
This article is a practitioner guide, not legal advice. For a specific compliance decision affecting your organisation, retain a qualified advocate. All statutory and regulatory references are to the MeitY India AI Governance Guidelines of 5 November 2025, the DPDP Act 2023 and DPDP Rules 2025 as commenced in phases through 14 May 2027, the SEBI AI Advisory of 5 May 2026, the RBI FREE-AI Committee Report of 13 August 2025 and the IT Rules 2026 amendment of 10 February 2026, as in force on 9 October 2026.