"Sovereign AI" has become one of the loosest phrases in Indian technology policy. It is used to mean national foundation models, government-owned compute, data that never leaves the country, and sometimes simply any AI system a vendor would like to sell to a ministry. For a bank, an exchange member, an insurer or a hospital group, the phrase is less important than the obligations underneath it. Sovereign AI in India, for a regulated enterprise, is whatever architecture satisfies the Reserve Bank of India, SEBI, the Digital Personal Data Protection Rules and sector supervisors at the same time, and can still be built and operated by a real team.
Those obligations are now specific enough to design against. The RBI's April 2018 circular on payment data requires that "the entire payment data shall be stored in systems located only in India". SEBI's March 2023 framework confines regulated entities' data storage and processing to data centres of cloud providers empanelled by MeitY. The RBI's Master Direction on outsourcing of IT services, effective 1 October 2023, writes audit rights, India-only storage and exit clauses into every material contract. The DPDP Rules notified on 14 November 2025 add, over an 18-month window, impact assessments, audits and localisation of notified data categories for significant data fiduciaries. And the RBI's FREE-AI committee report of August 2025 sets out 26 recommendations, not yet binding, that describe what a supervisor will expect AI governance to look like.
This article lays those instruments against a five-layer stack, data, compute, model, application and governance, and shows which requirement bites at which layer. The result is a map a CIO or chief risk officer can use to decide what must be on-premise, what may be in Indian cloud, what may be a hosted API, and what has to be written down regardless.
What sovereign AI in India means in practice
Three readings of the phrase circulate, and they call for different investments.
The first is national capability: Indian foundation models, trained on Indian data, on Indian compute. This is the IndiaAI Mission reading. The Mission's outlay is ₹10,371.92 crore; it reports 38,000+ GPUs at about ₹65 per hour, 7,541 datasets and 273 models on AIKosh, and 12 selected foundation-model startups including BharatGen and Sarvam. This matters to an enterprise as supply, not as obligation. No regulator requires a bank to use an Indian model.
The second reading is data residency: personal, financial and payment data stays in India and is processed under Indian jurisdiction. This is the reading the RBI, SEBI and DPDP instruments actually enforce, and it is the one with teeth.
The third is operational control: the enterprise, not its vendor, holds the keys, the logs, the model weights and the exit path. SEBI's framework is explicit that the regulated entity retains complete ownership of its data, logs and encryption keys, with the cloud provider acting only in a fiduciary capacity, and that "joint or shared ownership of any function, task, or activity between the RE and CSP is strictly prohibited". The RBI's outsourcing direction requires that encryption keys and hardware security modules stay under the regulated entity's control.
For a regulated enterprise, sovereign AI is the second and third readings. The first is context.
The five layers of a sovereign AI stack
An enterprise AI system can be decomposed into five layers, each of which can be sourced, hosted and governed independently. The decomposition is the analytical contribution of this piece; the requirements mapped onto it are sourced.
The data layer holds the records the model will read or be trained on: customer files, transactions, documents, telemetry. The compute layer is the hardware and cloud that stores and processes them. The model layer is the weights and the inference service, whether a self-hosted open-weight model, a fine-tuned domain model or a third- party API. The application layer is the retrieval, agents, workflow integration and user interface that turn a model into a working system. The governance layer is the policy, audit, incident and liability apparatus that makes the whole thing defensible to a board and a supervisor.
The common mistake is to treat "sovereign" as a property of the compute layer alone, and to assume that an Indian data centre settles the matter. The instruments below show that each layer carries its own obligations.
Mapping the stack against RBI, SEBI, DPDP and FREEAI
Several observations follow from the table.
The data layer is the most heavily regulated and the least ambiguous. For payment data the RBI rule is categorical, and the FAQ confirms it applies to "all banks operating in India" and to third parties they engage. The DPDP localisation obligation is narrower: it applies to significant data fiduciaries and to categories the government notifies, which it has not yet done comprehensively. Enterprises designing now should assume the notified list will grow.
The compute layer has a clear Indian answer for SEBI entities: MeitY-empanelled providers. The RBI instruments do not name an empanelment list but impose audit, key-control and shared-responsibility conditions that most global hyperscalers' Indian regions can meet contractually. The difference matters when a model vendor runs its own infrastructure outside those regions.
The model layer is where the instruments are silent on AI specifically and loud on outsourcing generally. A frontier API is, in regulatory terms, a material IT outsourcing if the workflow it serves is material, and that brings the full apparatus of due diligence, audit rights, concentration risk and exit planning. Few API terms of service were written with an RBI right-to-audit clause in mind. This is the practical origin of the on-premise and private-cloud market for regulated AI in India, and a separate PanScience Research piece in this series sets out the fit test for small and domain-specific models that make it possible.
The governance layer is where FREE-AI will matter most, even before anything becomes binding. Its seven sutras (Trust is the Foundation, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, Safety Resilience and Sustainability) and six pillars (Infrastructure, Policy and Capacity for enablement; Governance, Protection and Assurance for risk) read as a draft of future supervisory expectations. The committee's position that "accountability cannot be delegated to the model and underlying algorithm", and its graded liability recommendation under which leniency applies only to one-off failures where safeguards such as incident reporting, audits and red teaming were in place, tell a board exactly what evidence it will need to show.
Timelines that determine the build order
The instruments are not all live at once, and the sequence shapes what to build first.
The RBI payment data rule has applied since 2018 and the IT outsourcing direction since 1 October 2023, with existing agreements required to comply at renewal or within 36 months, whichever is earlier. These are the baseline; any AI system touching payment or customer data in a bank or NBFC is already inside them.
SEBI's framework applied immediately to new cloud projects from 6 March 2023 and gave existing deployments a 12-month glide path with monthly, quarterly and annual reporting milestones. It is fully in force.
The DPDP Rules are staged. Rules 1, 2 and 17 to 21, covering definitions and the Data Protection Board, took effect on notification. Rule 4, on consent managers, applies 12 months from publication, in November 2026. Rules 3, 5 to 16, 22 and 23, which carry the substantive obligations including significant data fiduciary duties, cross-border transfer conditions and breach notification, come into force 18 months from publication, in May 2027. An enterprise building an AI system in late 2026 is building for a regime that becomes enforceable within the typical procurement- to-production cycle.
FREE-AI is a committee report. The RBI has published it and its 26 recommendations are addressed variously to the RBI, other regulators, self-regulatory bodies and regulated entities on short and medium-term horizons. None is yet a direction. The prudent reading is that board-approved AI policies, inventories of deployed AI systems, periodic audits and incident reporting will be expected before they are required, because supervisors read the same report.
What a sovereign stack looks like in practice
Three PanScience Innovations ventures illustrate how the layers are being filled in practice. All descriptions are company-reported from panscience.xyz, and no client is named.
Eigen is described as on-premise AI for regulated industries: the model and application layers deployed inside the enterprise's own compute, so that the data layer never crosses a perimeter and the outsourcing question collapses to hardware and software licensing. Insituate AI is described as an on-premise enterprise retrieval and agent platform, which is the application layer built to sit on whichever model the enterprise can lawfully run. Proteus is described as an LLM gateway that routes, secures and monitors model calls, which is the governance layer's enforcement point: it is where a policy that says "payment data may only reach model X in region Y" becomes a technical control rather than a document.
The pattern across the three is instructive. None of them is a foundation model. Sovereignty in the regulated enterprise is being built mostly at the application and governance layers, using open-weight or domain-tuned models at the model layer, on compute the enterprise already controls or an empanelled Indian provider supplies. The national foundation-model programme is upstream of this, and welcome, but it is not where the compliance work is.
What sovereignty does not solve
A sovereign stack answers the question of where. It does not answer whether the system works, whether it is fair, or whether anyone is accountable when it fails.
FREE-AI's Fairness and Equity sutra and its call for consumer disclosure are not satisfied by a data centre location. The DPDP requirement that significant fiduciaries ensure algorithmic measures do not harm user rights is a question about model behaviour, not hosting. The RBI's concentration-risk test applies just as much to a single on-premise vendor as to a single cloud.
Nor does sovereignty mean isolation. The RBI FAQ itself permits processing abroad for cross-border transactions and sharing with overseas regulators with RBI approval. SEBI permits cloud, provided the cloud is empanelled and the entity keeps the keys. DPDP Rule 15 permits transfers subject to restrictions. The instruments describe a controlled perimeter, not a wall, and a stack designed as a wall will be more expensive and no more compliant.
Finally, sovereignty does not remove the operating burden. Every layer the enterprise brings in-house is a layer it must run, patch, evaluate and audit. The FREE-AI committee's capacity-building recommendations for boards, executives and staff exist because the committee saw the gap. An on-premise model with no evaluation harness and no named owner is a liability with a good address.
Conclusion
Sovereign AI in India, for regulated enterprises, is a set of layer-specific obligations rather than a slogan. The data layer is governed hardest and most clearly, by the RBI's 2018 payment rule, the 2023 outsourcing direction and the DPDP Rules' localisation and transfer provisions. The compute layer has a named answer for SEBI entities in MeitY empanelment and a contractual one for RBI entities. The model layer is regulated by implication, as material outsourcing, which is why hosted APIs are hard to use for core regulated workflows and why open-weight and domain-tuned models on controlled compute have become the practical default. The application layer carries exit, breach and disclosure duties. The governance layer is where FREE-AI's recommendations will become expectations first.
The build order follows the timeline: baseline on the RBI and SEBI rules already in force, design for the DPDP obligations that become enforceable in May 2027, and adopt FREE-AI's board policy, inventory, audit and incident- reporting practices before they are mandated. Enterprises that do this will find that most of the work is at the top of the stack, in applications and governance, and that the national models and compute arriving from the IndiaAI Mission are an input to that work rather than a substitute for it.
Methodology and sources
The five-layer decomposition and the mapping of regulatory instruments to layers are the authors' analytical contribution; the requirements placed in each cell are drawn from the sources below and the table should be read as an interpretation for design purposes, not legal advice. Where an instrument is silent on AI specifically, the article says so and applies the general outsourcing or cloud rule by analogy.
Regulatory sources opened on 25 October 2026: RBI, FAQ on storage of payment system data, referring to circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 (rbi.org.in/Scripts/FAQView.aspx?Id=130); RBI, Master Direction on Outsourcing of Information Technology Services, 10 April 2023, effective 1 October 2023 (rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12486); SEBI, Framework for adoption of cloud services by SEBI regulated entities, 6 March 2023, read via Taxmann's summary because the SEBI page did not load (taxmann.com/post/blog/sebi-introduces-framework-for-adoption-of-cloud-services-by-regulated-entities/) and Tata Communications' summary (tatacommunications.com/blog/sebi-cloud-adoption-framework-key-takeaways); PIB backgrounder on the DPDP Rules 2025, 17 November 2025 (static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf); AZB and Partners on the DPDP phased rollout (azbpartners.com/bank/indias-digital-personal-data-protection-act-phased-rollout-and-key- compliance-milestones/); Storyboard18 on the DPDP Rules (storyboard18.com/digital/breaking-govt-notifies-final- dpdp-rules-sets-staggered-rollout-with-key-obligations-for-data-fiduciaries-84201.htm); RBI press release on the FREE-AI committee report, 13 August 2025 (rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=61018) and the report itself (rbi.org.in/scripts/PublicationReportDetails.aspx?ID=1306), chaired by Dr Pushpak Bhattacharyya of IIT Bombay. The FREE-AI recommendations are quoted as recommendations; none had become binding regulation at the time of writing. IndiaAI Mission figures are from the PIB backgrounder of February 2026 as verified by the editor. Descriptions of Eigen, Insituate AI and Proteus are company-reported from panscience.xyz; no client, deployment count or revenue is stated.