Indian boards have spent two decades learning to oversee cyber risk, data privacy and outsourcing. AI arrives as a fourth category that is none of these and touches all three. A model that scores loan applicants is a data protection matter, an outsourcing matter if it runs on a vendor's cloud, a cyber matter if it can be manipulated, and a conduct matter if it is unfair. The question for directors is not whether AI governance in India needs a new committee. It is which existing obligations now bite on AI systems, and what a board must be able to answer about them.
This piece sets out that obligation map and turns it into a board question set. It draws on four instruments: the Digital Personal Data Protection Rules notified on 14 November 2025, the RBI's FREE-AI committee report of August 2025, SEBI's cloud services framework of March 2023 and its Cybersecurity and Cyber Resilience Framework of August 2024, and the general board duties under the Companies Act 2013 and the SEBI Listing Regulations. It is written for directors, company secretaries and chief risk officers, not for lawyers, and it is not legal advice. Where an instrument is a recommendation rather than a binding rule, the text says so.
The underlying argument is simple. Almost nothing in Indian law today says "AI". But a great deal says "personal data", "risk management policy", "cloud", "outsourcing" and "internal controls", and every one of those terms now has an AI system inside it. Boards that wait for an AI statute will find they were already accountable.
What AI governance in India rests on today
Four instruments matter, and they differ in force.
DPDP Act and Rules, binding with a phased window. The Government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, with what the Press Information Bureau describes as an eighteen- month period for phased compliance. The Rules require each data fiduciary to issue a separate, plain-language consent notice stating the specific purpose of collection, to display contact information for personal data queries, and to answer requests for access, correction, updating or erasure within ninety days. Breaches must be reported to affected individuals without delay, in plain language, with the steps taken. Significant data fiduciaries must conduct independent audits and impact assessments, face stricter checks when using new or sensitive technologies, and may be directed by the Government to keep specified data within India. Consent managers must be companies based in India. The Data Protection Board is a fully digital body of four members with appeals to the TDSAT. Penalties sit in the Act of 2023: the highest, up to ₹250 crore, applies to failing to maintain reasonable security safeguards. For a board, the operative point is that an AI system trained on or inferring from customer data is a processing activity under this regime, and if the company is designated a significant data fiduciary, its AI systems fall within the audit and impact assessment duties.
RBI FREE-AI, recommendations not yet binding. The RBI's Committee on the Framework for Responsible and Ethical Enablement of AI released its report on 13 August 2025. It sets out seven guiding "sutras", in the report's own wording: Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; and Safety, Resilience and Sustainability. It makes 26 recommendations under six pillars, three for innovation enablement (Infrastructure, Policy, Capacity) and three for risk mitigation (Governance, Protection, Assurance). Recommendation 14 is the one directors should read first: regulated entities "should establish a board-approved AI policy" covering governance structure, accountability, risk appetite, operational safeguards, auditability, consumer protection measures, AI disclosures, a model life cycle framework and a liability framework. Recommendation 10 asks regulated entities to "develop AI-related capacity and governance competencies for the Board and C suite". Recommendation 8 keeps liability where it is: regulated entities "must continue to remain liable for any loss suffered by customers", with any tolerant supervisory stance "limited to first time / one-off aberrations". The report identifies as high-risk "autonomous AI systems that handle customer interactions, make financial decisions, or move customer funds", and places responsibility for identifying, assessing and mitigating AI risk with the Risk Management Committee or a similar body. These are committee recommendations. They are not binding regulation as of this writing, and a board should verify the status before treating them otherwise. A separate PanScience Research piece covers building under FREE-AI in BFSI compliance.
SEBI frameworks, binding on regulated entities. SEBI's Framework for Adoption of Cloud Services by Regulated Entities, issued on 6 March 2023, requires that data be processed and stored within India, that regulated entities select cloud providers empanelled by MeitY, and that the regulated entity, not the cloud provider, remain solely responsible for data security, logs, compliance and privacy. Existing arrangements had to comply within twelve months, by 6 March 2024. SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 applies a graded approach across five categories of regulated entity, from market infrastructure institutions down to self-certifying entities, requires a dedicated cyber security committee including senior management and IT experts, an incident response team with a protocol for reporting to SEBI, third-party vendor cyber readiness assessments, and periodic assessments, biannual by third parties for market infrastructure institutions and annual self-assessment for qualified regulated entities. Any AI system that runs in a cloud, calls an external model API or is supplied by a vendor is inside both frameworks for a SEBI-regulated entity.
General board duties, binding on all companies. Under Section 134(3) of the Companies Act 2013 the board's report must include a statement indicating the development and implementation of a risk management policy, including identification of elements of risk that may threaten the company's existence. The audit committee's role includes evaluating risk management systems, and independent directors are expected to satisfy themselves that the systems of risk management are robust and defensible. For the top 1,000 listed entities by market capitalisation, SEBI's Listing Regulations, as amended in May 2021, require a Risk Management Committee of at least three members, a majority of them directors and at least one independent, meeting at least twice a year with no more than 180 days between meetings, whose role includes formulating the risk management policy, overseeing its implementation, monitoring and evaluating risks, and the appointment and removal of the chief risk officer. Nothing in these provisions names AI. All of them apply to it.
The gap the board must close
The instruments above were written for data, cloud and cyber. AI introduces three properties they did not fully anticipate, and the board's questions must probe each.
The first is that an AI system's behaviour changes without a code change. A model retrained on new data, or a prompt adjusted by an operator, can alter decisions for thousands of customers overnight. Conventional change control, built for software releases, does not catch this. FREE-AI's call for a "model life cycle framework" is the regulatory recognition of the point.
The second is that errors are statistical, not binary. A payments system either settles or fails. A model is right 94% of the time, and the 6% is distributed across customers in ways that may correlate with protected characteristics. McKinsey's 2025 global survey found 51% of AI-using organisations had experienced at least one negative consequence, with inaccuracy the most common; organisations now mitigate an average of four AI risks, up from two in 2022, and high performers are more likely to have defined processes for human validation of model outputs. Explainability, the survey notes, is the second most experienced risk but not among the most mitigated. That gap between experiencing and mitigating is exactly where board attention belongs.
The third is that the supply chain is opaque. An enterprise AI feature may rest on a foundation model from a global vendor, served through a cloud in another jurisdiction, fine-tuned by an Indian services firm, and wrapped by an internal team. SEBI's rule that the regulated entity remains solely responsible for cloud arrangements, and FREE-AI's rule that liability stays with the regulated entity, mean the board cannot pass accountability down that chain.
Two international standards give boards a vocabulary for closing the gap. The NIST AI Risk Management Framework 1.0 of January 2023 organises AI risk work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001:2023 defines an AI management system that can be certified, in the way ISO 27001 does for information security. Neither is law in India, but both are the structures that FREE-AI's board-approved policy and DPDP's impact assessments will in practice be built on. A separate PanScience Research piece covers evaluation harnesses aligned to NIST's Measure function.
The board question set
The table maps the questions a board should be able to answer to the obligation each one serves. It is an original framework drawn from the instruments above, and the mapping is the authors' reading, not a regulator's.
Three features of the set deserve comment. First, the inventory question comes before every other, because none of the rest can be answered for systems the board does not know exist. Vendor-embedded AI, the fraud model inside the core banking package or the recommendation engine inside the CRM, is where inventories most often fail. Second, the location question is where the three regulators converge: DPDP, SEBI and RBI all care where data and compute sit, which is why on-premise and India-hosted deployment has become a governance decision rather than only an engineering one. PanScience's Eigen, described by the company as on-premise AI for regulated industries, is one example of the category of product that exists because of this convergence; the company reports it as its own offering and this piece makes no claim about its adoption. Third, the competence question is the one boards most often skip. FREE-AI's Recommendation 10 is explicit that this is a board matter, not a CTO matter.
How to organise the oversight
The instruments point to an answer on committee structure, and it is not a new committee. FREE-AI places AI risk with the Risk Management Committee or an equivalent body. The Listing Regulations already give the top 1,000 listed companies such a committee with a defined remit, a chief risk officer and a meeting cadence. The Companies Act gives the audit committee the duty to evaluate risk management systems. The practical structure is therefore for the Risk Management Committee to own the AI inventory, the policy and the risk tiering; for the audit committee to own the assurance that monitoring and controls work; and for the full board to approve the policy and receive an annual report against the question set. Companies outside the top 1,000, and unlisted companies, have the same substantive duties under Section 134 and can adopt the same structure at smaller scale.
What the board should resist is the delegation of AI governance to the technology function alone. The DPDP Rules, SEBI and FREE-AI all locate accountability with the entity and its board. A CTO can answer how a model works. Only the board can answer whether the company should be running it.
Timing
Boards have a window, and it is shorter than it looks. The DPDP Rules' eighteen-month phased period, from November 2025, runs into 2027. SEBI's cloud framework has been in force for existing arrangements since March 2024 and its cyber framework since 2024 with phased compliance. FREE-AI is a recommendation today; the RBI has in the past turned committee recommendations into supervisory expectations, and a bank or NBFC that adopts the board-approved policy now will be ready whether or not the recommendation becomes a direction. The sensible sequence for most boards is an AI inventory within one quarter, a risk-tiered policy within two, and the first annual report against the question set within the year.
Conclusion
AI governance in India does not yet have its own statute, and boards should not wait for one. The DPDP Rules make every AI system that touches personal data a compliance object with a notified deadline. SEBI's cloud and cyber frameworks place any AI system on a cloud or from a vendor inside existing, binding obligations with the regulated entity solely responsible. FREE-AI, though still a recommendation, tells boards in the financial sector precisely what a board-approved AI policy should contain and places AI risk with the Risk Management Committee. The Companies Act already asks every board to identify the risks that could threaten the company and to show it has a policy for them. The eleven questions above are the practical form of those duties applied to AI. A board that can answer them is governing AI. One that cannot is carrying the liability without the oversight.
This article is a research piece for directors and executives. It is not legal advice, and companies should take counsel on how these instruments apply to their specific circumstances.
Methodology and sources
The board question set and its mapping to obligations are an original framework; the mapping is the authors' reading of the instruments and not a regulator's guidance. Observed provisions and figures come from the following sources, each opened and read for this piece unless marked editor-verified. Press Information Bureau backgrounder on the Digital Personal Data Protection Rules, 2025, dated 17 November 2025 (https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf): notification on 14 November 2025, eighteen-month phased compliance, consent notices, ninety-day response, breach notice without delay, significant data fiduciary audits and impact assessments, consent managers, Data Protection Board, penalties under the Act. Rule 15 on cross-border transfers and the RBI payment data localisation circular of 6 April 2018 are editor-verified. RBI, Report of the Committee on Framework for Responsible and Ethical Enablement of AI, released 13 August 2025 (https://rbi.org.in/scripts/PublicationReportDetails.aspx?ID=1306): seven sutras, six pillars, Recommendations 8, 10 and 14, paragraphs 4.4.44 and 4.4.45; status as recommendations. SEBI cloud framework of 6 March 2023 as summarised by Thales (https://cpl.thalesgroup.com/blog/compliance/sebi-framework-for-cloud- services-india): data in India, MeitY-empanelled providers, regulated entity solely responsible, compliance by 6 March 2024; the SEBI circular itself could not be opened for this piece and readers should consult it directly. SEBI Cybersecurity and Cyber Resilience Framework of 20 August 2024 as summarised by Saga Legal in Bar and Bench (https://www.barandbench.com/view-point/cybersecurity-cyber-resilience-framework-sebi-digital-safety): graded five-category approach, cyber security committee, incident response team, third-party assessments. SEBI Listing Regulations May 2021 amendments on the Risk Management Committee as summarised by Vinod Kothari Consultants (https://vinodkothari.com/2021/05/sebi-notifies-substantial-amendments-in-listing-regulations/): top 1,000 entities, composition, two meetings, 180-day gap, role. Companies Act 2013 Section 134(3) risk management statement, audit committee and independent director roles as summarised by Taxguru (https://taxguru.in/company- law/risk-assessment-management-policy.html). McKinsey, The state of AI in 2025 (https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/the-state-of-ai-2025): 51% negative consequence, four risks mitigated on average, explainability gap, human validation. NIST AI RMF 1.0 and ISO/IEC 42001:2023 are editor-verified. PanScience Innovations' description of Eigen is company-reported from panscience.xyz, read 24 October 2026.