AI and automation · Guide
AI governance in India: what to build before an agent acts.
India has no AI statute: existing law applies1, and CERT-In’s guidance now recommends an AI inventory, usage monitoring and audit logs2. Before an agent writes to a system of record, put five things in place: an inventory entry, its own scoped identity, a human approval step, logs and outbound controls.
- Written by
- NetScale IT Services
- Published
- Sources checked
- Read
- 10 minutes
- Sources
- 16, listed below
On this page
The facts
Is there an AI law in India, and what applies instead?
Two kinds of AI use land on IT’s desk: the public assistants staff open in a browser, and the pilot someone wants to connect to the ERP. India has no AI statute for either.
MeitY released its India AI Governance Guidelines on 5 November 202513. They say “at this stage, a separate law to regulate AI is not needed given the current assessment of risks”1. Existing laws on information technology, data protection, consumer protection and the civil and criminal codes “can be used to govern AI applications”1.
The guidelines give an example: using personal data without consent to train AI models falls under the DPDP Act and the IT Act1. Anyone developing or deploying AI in India should comply with Indian law, and “demonstrate compliance” when an agency or sector regulator calls for it1.
| Text | Date | Status and scope | What it asks of IT |
|---|---|---|---|
| MeitY, India AI Governance Guidelines | 5 November 2025 | Guidance for industry, developers and regulators3 | Comply with existing law and show it on request; “human-in-the-loop mechanisms” at “critical decision points”1 |
| IT Rules amendment on synthetically generated information | Notified 10 February 2026, in force 20 February 2026 | Binding on intermediaries4 | A prominent label on AI-generated content their tools create, and embedded provenance metadata where technically feasible4 |
| RBI, FREE-AI committee report | 13 August 2025 | Committee report, with recommendations for regulated entities and regulators56 | 26 recommendations, among them a board-approved AI policy and an internal AI inventory56 |
| CERT-In, advisory CIAD-2026-0020 | 26 April 2026 | Advisory, severity High7 | “Monitor and restrict outbound network traffic to known AI service endpoints”7 |
| CERT-In, blueprint CISG-2026-02 | 25 May 2026 | Guidance, applied “in a risk-informed manner”2 | An AI system inventory, AI usage monitoring, audit logs and limits on autonomous actions2 |
| DPDP Rules, 2025 | Gazette of 13 November 2025; Rule 6 applies from 13 May 2027 | Binding on Data Fiduciaries, covering processing by their Data Processors8 | Access control, logs with monitoring and review, and one year of log retention8 |
We read the IT Rules amendment in a law firm’s summary4. The Gazette copy would not load when we checked on 8 October 2026.
The facts
What does CERT-In now expect of AI systems?
CERT-In’s advisory of 26 April 2026 recommends that organisations “monitor and restrict outbound network traffic to known AI service endpoints”7. The stated aim is to curb staff use of unsanctioned AI tools and the risk of sensitive data reaching them7.
The blueprint of 25 May 2026 goes further. Its section 12 sets out 16 areas for adopting AI securely2. The measures that apply to an agent before it goes live, in CERT-In’s words:
- Inventory: “Maintain AI asset inventories” and “Identify shadow or unauthorised AI usage”2
- Integrations: “Monitor AI APIs, plugins, and automation workflows”2
- Logging: “Monitor AI usage and maintain audit logs”2
- Permissions: “Restrict AI permissions and execution capability”2
- Oversight: “Restrict fully autonomous critical actions” and “Maintain auditability and approval mechanisms”2
- Agentic systems: “Define operational boundaries and permissions” and “Establish override and emergency shutdown mechanisms”2
The blueprint’s 60-day roadmap puts “establish AI governance and AI system inventory” in days 8 to 302. It is guidance. The binding text is still the CERT-In Directions of 28 April 2022. Under them, a listed incident must be reported “within 6 hours of noticing” it, AI or not9.
The facts
How much AI use is already outside IT’s view?
Verizon’s 2026 Data Breach Investigations Report puts frequent use of AI tools at 45% of employees, up from 15% a year earlier10. It ranks unapproved “shadow AI” as the third most common non-malicious data leakage activity10.
In IBM’s 2025 study of organisations that had a breach, only 37% in India reported AI access controls11. Nearly 60% had no AI governance policy or were still developing one11.
In the 2026 study, where shadow AI was present, it added an average of ₹1.79 crore to the cost of a breach in India12. That put it among India’s top three cost-increasing factors12. Ponemon Institute ran the study for IBM on breaches at 602 organisations worldwide, from March 2025 to February 202612.
The facts
What changes when the AI can act?
A chatbot that gets an answer wrong produces a bad paragraph. An agent with write access can post a journal entry or change a customer record.
OWASP published its Top 10 for Agentic Applications on 9 December 202513. The ten risks, in its order:
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI04 Agentic Supply Chain Vulnerabilities
- ASI05 Unexpected Code Execution (RCE)
- ASI06 Memory & Context Poisoning
- ASI07 Insecure Inter-Agent Communication
- ASI08 Cascading Failures
- ASI09 Human-Agent Trust Exploitation
- ASI10 Rogue Agents13
OWASP adds the idea of “Least-Agency”, which it explains as advice “to avoid unnecessary autonomy”13. It advises “per-agent identities and short-lived credentials”, and human approval “for high-privilege or irreversible actions”13. Its tool examples include read-only database queries and “no send/delete rights for email summarizers”13.
The RBI committee says regulated entities “must clearly define the tasks AI can perform autonomously and instances when human oversight is required”6. They “must remain liable for the actions and outcomes of the autonomous AI systems they deploy”6.
In June 2025, Gartner predicted that over 40% of agentic AI projects will be cancelled by the end of 202714. The reasons it gave: “escalating costs, unclear business value or inadequate risk controls”14. In May 2026 it said 40% of enterprises will demote or decommission autonomous agents by 2027, over governance gaps found “only after production incidents occur”15. Its answer is to govern by level of autonomy:
| Level | What the agent may do | Governance Gartner lists |
|---|---|---|
| 1. Observe | Read-only access to defined data; output seen only by the user who asked | Scoped data access, user authentication, usage logging, basic functional and security testing |
| 2. Advise | Suggest drafts or actions that a person reviews and carries out | Level 1 controls, plus accuracy and hallucination testing, domain quality checks and user training |
| 3. Act with approval | Write data, send communications or change configurations, with explicit human approval for each action | Strong security testing, approval workflows with audit trails, agent-specific incident response |
| 4. Act autonomously | Act within guardrails; people review exceptions, logs and outcomes | Continuous monitoring, enforced guardrails, rapid rollback, circuit breakers, clear ownership of agent behaviour |
What it means
What will you be asked to show?
An AI incident is judged by the rules you already answer to1. A prompt carrying customer records, a retrieval index built from HR files and the logs of both all hold personal data. From 13 May 2027, Rule 6 of the DPDP Rules sets safeguards for personal data a Data Fiduciary holds, including what its Data Processors handle8. Applicability is for your counsel.
Rule 6 asks for “visibility on the accessing of such personal data, through appropriate logs, monitoring and review”, with logs kept for a year8. For an agent, that means recording who asked what, which documents it retrieved and what it changed. Rule 6 also names masking as a safeguard, which suits prompt logs that would otherwise hold personal data in plain text8.
For RBI-regulated entities, the committee’s recommendations are the questions to prepare for: a board-approved AI policy, and an AI inventory “updated at least half yearly” for “supervisory inspections and audits”6. In any sector, the MeitY guidelines expect you to show compliance when asked1. A customer’s security review can ask the same.
Two gaps make that hard. Without a list of which tools see which data, CERT-In’s inventory stays empty2. And an agent acting on a person’s credentials muddies the logs: every action it takes looks like the person’s.
What it means
What should you check on Monday?
Each step leaves a record you can show a regulator, an auditor or a customer.
- List every AI system in use: assistants staff open in a browser, AI features switched on in software you already license, API keys in code and every agent in a pilot. Record the owner, what each reads and what each can write. RBI’s committee adds use cases, target groups, dependencies, risks and grievances6.
- Pull a week of proxy, DNS or firewall logs and count requests to known AI service domains, by department. That count is your shadow AI baseline, and the starting point for CERT-In’s outbound control7.
- Decide which tools are sanctioned for which class of data. Restrict the rest at the proxy, with a block page that names the sanctioned tool.
- Check how each pilot agent signs in. Replace a person’s login or a shared API key with the agent’s own identity and short-lived, narrowly scoped credentials13.
- Place each agent at one of Gartner’s four levels15. Anything that writes to a system of record stays at level 3, act with approval, until you have measured its accuracy on your own data.
- Send prompts, retrieved sources, tool calls, approvals and outputs to your central log store. CERT-In’s Directions require 180 days of logs, kept in India9. Where the logs hold personal data, Rule 6 sets one year from 13 May 20278.
- Write the stop procedure and test it: who can revoke an agent’s credentials, how quickly and what happens to work in flight. The blueprint lists “override and emergency shutdown mechanisms”2.
- Add AI to the incident runbook. Name who decides whether an AI-related event is reportable, because the 6-hour clock runs from noticing9.
Our view
Where should the gate sit before an agent writes?
We treat AI governance as an engineering gate. We would put it at the write: the point where an agent can change a system of record such as the ERP, core banking, CRM, HR or payments.
Before an agent crosses it, we would want five things in place:
- An inventory entry that records what the agent reads and what it writes
- Its own service identity with the minimum scopes, never a person’s login
- A human approval step on every write until accuracy on your own data is measured
- Logs of prompts, tool calls and outputs, kept like any other access log
- Outbound controls that steer staff to sanctioned tools instead of banning AI outright
Take the approval step out only when the measured error rate supports it, and review a sample from then on. The RBI committee suggests “periodic human validation checks on a sample of AI decisions (e.g., 1%)” to catch a model that degrades quietly6.
The gate is lighter for read-only agents. Gartner’s baseline for its observe level is scoped data access, user authentication, usage logging and basic testing15. With no write, there is nothing to approve.
The counter-view is fair. Gartner warns that approvals can degrade under “time pressure or approval fatigue”, and that over-restricting simple agents “drives shadow development”15. So match the gate to the level. An unmeasured agent still needs approval to write to the ledger.
Limits
What does this article not cover?
Whether RBI’s recommendations, a SEBI circular, the IT Rules or the DPDP Rules apply to you is for your compliance team and counsel. Model accuracy, bias and fairness testing need their own method on your own data. This piece covers the controls IT runs.
Where we fit
Who can build the gate with you?
Our AI and automation practice works this way: one process, tested on your own documents and data, with a governance step before anything reaches a system of record. The assessment is in writing and yours to keep. A bounded proof comes first, then a production build in phases, each signed off separately. Where the gap is staff use of public AI tools, that is identity and access work, and we will say so.
Questions readers ask
Does India have a law that regulates AI?
Is RBI’s FREE-AI framework mandatory for banks?
It is a committee report, not an RBI direction: RBI placed it on its website on 13 August 20255. Its 26 recommendations include a board-approved AI policy and an AI inventory updated at least half-yearly56. In June 2026 RBI released draft guidance on model risk management that covers AI and ML models16. Whether any of this binds your entity is for your compliance team and counsel.
Should we block public AI tools at the firewall?
Restrict them, and name a sanctioned alternative for each class of data. CERT-In recommends monitoring and restricting outbound traffic to known AI service endpoints, to curb unsanctioned use7.
Can an AI agent run on an employee’s login?
It should not. OWASP advises per-agent identities with short-lived credentials13. That way each agent’s access can be scoped, logged and revoked without touching the employee’s account.
References
- 1Ministry of Electronics and Information Technology, IndiaAI Mission. India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation. 5 November 2025. static.pib.gov.in (opens in a new tab)
- 2Indian Computer Emergency Response Team (CERT-In). Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (CISG-2026-02, Version 1.0). 25 May 2026. cert-in.org.in (opens in a new tab)
- 3Press Information Bureau, Ministry of Electronics and IT. MeitY Unveils India AI Governance Guidelines under IndiaAI Mission to Ensure Safe, Inclusive, and Responsible Adoption of Artificial Intelligence across Sectors. 5 November 2025. pib.gov.in (opens in a new tab)
- 4Shardul Amarchand Mangaldas & Co. Legislative Update: The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026. February 2026. amsshardul.com (opens in a new tab)
- 5Reserve Bank of India. Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector (Press Release 2025-2026/902). 13 August 2025. rbi.org.in (opens in a new tab)
- 6Reserve Bank of India. FREE-AI Committee Report - Framework for Responsible and Ethical Enablement of Artificial Intelligence. 13 August 2025. rbi.org.in (opens in a new tab)
- 7Indian Computer Emergency Response Team (CERT-In). Defending Against Frontier AI Driven Cyber Risks (CERT-In Advisory CIAD-2026-0020). 26 April 2026. cert-in.org.in (opens in a new tab)
- 8Ministry of Electronics and Information Technology, Gazette of India. Digital Personal Data Protection Rules, 2025 (notification G.S.R. 846(E)). 13 November 2025. meity.gov.in (opens in a new tab)
- 9CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. 28 April 2022. cert-in.org.in (opens in a new tab)
- 10Verizon (news release). Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds. 19 May 2026. verizon.com (opens in a new tab)
- 11IBM India newsroom. India Records Highest Average Cost of a Data Breach at INR 220 million in 2025: IBM Report. 7 August 2025. in.newsroom.ibm.com (opens in a new tab)
- 12IBM India newsroom. India Records Its Highest Average Cost of a Data Breach at INR 255 Million (INR 25.5 Crore) in 2026: IBM Report. 3 August 2026. in.newsroom.ibm.com (opens in a new tab)
- 13OWASP Gen AI Security Project. OWASP Top 10 for Agentic Applications for 2026. 9 December 2025. genai.owasp.org (opens in a new tab)
- 14Gartner (press release). Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. 25 June 2025. gartner.com (opens in a new tab)
- 15Gartner (press release). Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure. 26 May 2026. gartner.com (opens in a new tab)
- 16Reserve Bank of India. RBI issues draft ‘Guidance on Regulatory Principles for Model Risk Management’ (Press Release 2026-2027/528). 24 June 2026. rbi.org.in (opens in a new tab)
Changes
- First published.
Written by NetScale IT Services. How these guides are written