What Is This Module For?
The AI Governance module helps you build a responsible AI programme — inventorying AI systems, assessing their risks, and demonstrating accountability for AI-driven decisions that affect personal data.
Why Is This Important?
The DPDP Act 2023 requires Data Fiduciaries to ensure accountability for all automated processing that affects Data Principals. SEBI's Significant Data Fiduciary provisions additionally require that algorithmic processing does not harm data principals. Global AI regulations (EU AI Act) are also beginning to apply to Indian companies serving EU markets.
Step-by-Step Guide
- Go to AI Governance in the sidebar.
- Create an AI inventory — list every AI/ML system you use or are building, including third-party AI tools.
- For each system, assess: purpose, input data (does it use personal data?), output type (decision / recommendation / prediction), and risk level (Low / Medium / High).
- For high-risk AI systems, complete an AI Impact Assessment — similar to a DPIA but specific to algorithmic risks.
- Document human oversight mechanisms — who reviews AI decisions and how often.
- Track AI model versioning and retraining schedules.
Common Mistakes to Avoid
- Not inventorying third-party AI tools — ChatGPT, Copilot, and AI-powered CRM tools all count as AI systems in your governance framework.
- No human oversight for high-risk AI decisions — Automated decisions on credit, employment, or medical treatment require human review under emerging AI regulations.
Frequently Asked Questions
Q: Does India have an AI law?
A: As of May 2026, India does not have a dedicated AI law. However, the DPDP Act, IT Act, and sectoral regulations (RBI, IRDAI) contain provisions applicable to AI systems. An AI governance framework is strongly recommended as a proactive measure.