India AI Governance Guidelines: What Changes

A vendor compliance matrix arrived the week after MeitY put the India AI Governance Guidelines in the public domain. The matrix had a green tick: compliant with India AI Governance Guidelines, 2025. There was no mapping to a sutra, no note that the document is a guideline, and a second green tick that said DPDP covered because Guidelines followed. The DPO asked for the section of law. The salesperson sent the PIB link. That is not how instruments work.

On 5 November 2025 the Ministry of Electronics and Information Technology released the India AI Governance Guidelines. PIB and the published PDF describe a four-part framework anchored in seven sutras: Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; and Safety, Resilience and Sustainability. They are a principle-based, techno-legal approach aimed at departments, sector bodies and industry. They are not a gazette that repeals anything, and they are not a substitute for the Digital Personal Data Protection Act, 2023.

This explainer is what we tell government buyers who ask 'what changed on 5 November?'. The honest answer: your briefing language changed, your design tests got official adjectives, and your vendors gained a new tick to abuse. Your DPDP map, your CERT-In clock, your GFR and your delegations did not go away.

Not legal advice. Read the PDF on the PIB document server and the Act on India Code. Do not read a vendor matrix as either.

What the document is

It is a committee-backed set of guidelines published by MeitY, presented in four parts, beginning with the sutras. Subsequent parts discuss pillars of implementation and recommendations for government, regulators and industry. PIB notes from 2025 and early 2026 describe the same spine. If a later edition appears, read that. This article is not a substitute PDF.

It is principle-based. That means it tells you how to think, not which form to file. Officers who look for a licence number will be disappointed. Officers who look for a way to argue with a vendor deck will be fed.

Sutras as design tests for an agent file, not as green ticks.

Sutra (as publicly described)	What to put in the file	Vendor abuse to reject
Trust is the Foundation	Named owner, reconstructable trail, no silent hops	'Trust us, we are aligned'
People First	Named human gates on material acts; citizen correction path	A rubber-stamp HITL toggle
Innovation over Restraint	A scoped pilot, a short year-one language list, no fake 22	Skip the DPA because innovation
Fairness and Equity	Held-out Indic and district evals, not a Delhi-English demo	A single urban benchmark
Accountability	Four seats: fiduciary, competent authority, vendor, bypasser	'The model is accountable'
Understandable by Design	Seven-field trail, not an essay	An explainability word-cloud
Safety, Resilience and Sustainability	Isolation drill, patch-on-media, 180-day logs	A certificate with no pcap

What did not change on 5 November

DPDP still regulates digital personal data. Its commencement remains phased. Processor contracts, purposes, and rights did not move into a sutra. CERT-In still wants logs and incident clocks. GFR and GeM still govern how you buy. CAG still audits expenditure and systems. DFPRs still say who may sanction.

A vendor who says 'we follow the Guidelines, so DPDP is covered' has failed a reading test. Fail the row.

What should change in your next note

You can now cite an official MeitY vocabulary when you argue for a human gate (People First) without pretending DPDP invented HITL. You can cite Innovation over Restraint when a political office wants a year-one list of two languages rather than a fake twenty-two. You can cite Understandable by Design when a vendor offers an essay instead of a trail.

You should add a one-pager to the charter: which sutras you are operationalising, and which artefacts count as evidence. That is the only 'compliance' with a guideline that means anything.

You should not rewrite your MSA to say 'vendor shall comply with the India AI Governance Guidelines' as a single clause. That clause is not markable. Point at artefacts.

• Cite the Guidelines as guidelines, dated 5 Nov 2025, with a PDF pin.
• Map sutras to artefacts, not to ticks.
• Keep DPDP, CERT-In, GFR and DFPRs as separate headings.
• Reject 'Guidelines = DPDP' matrices.

Sector regulators still exist

The Guidelines invite sector bodies to use the sutras. They do not pre-empt RBI localisation, health-data practice, or a university regulator. If you are in a regulated sector, you now have one more document to read, not one less.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

If they are only guidelines, we can ignore them.

You can ignore them the way you ignore every other MeitY design document: at the cost of arguing without the official vocabulary, and at the cost of looking unprepared when a secretary asks. Ignoring is not illegal. It is usually unwise.

We should wait for the Guidelines to become an Act.

Maybe they will influence future instruments. Your live duties are already in DPDP, CERT-In, GFR and delegations. Waiting is how a year of agents run on vendor ticks.

Innovation over Restraint means we should not write heavy annexures.

It means do not ban a useful agent because a theoretical harm has no evidence. It does not mean skip the training ban or the trail. Restraint of evidence-free panic is the point. Restraint of basic controls is not.

Our vendor is already 'aligned to OECD / UNESCO / EU AIA'.

Nice posters. Map the Indian sutras to artefacts on this buy. Foreign alignments are colour.

A week to operationalise 5 November

Read the PDF. Do not operationalise a news story about the PDF.

1. Day 1: DPO and counsel read the official PDF and this file's 'what did not change' list.
2. Day 2–3: map each sutra to an artefact you already demand (trail, gate, eval, isolation, seats).
3. Day 4: add the one-pager to the charter. Delete any MSA clause that says 'comply with the Guidelines' without a list.
4. Day 5: brief the evaluation committee on how to fail a green-tick matrix.

How this shows up in the file

Pin the PDF, date it, and attach the sutra-to-artefact table. Write one sentence: these Guidelines do not replace DPDP or our procurement rules. Write one sentence: we will not accept a vendor tick against a sutra without the artefact.

That is what 5 November changed in a well-run file.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How this survives CAG, RTI or the Board

“India AI Governance Guidelines: What Changes” is not a workshop slide. A P6 Compliance/DPO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

Released 5 November 2025, the Guidelines give seven sutras and a principle-based approach. They are not DPDP, not a licence, and not a reason to skip a processor clause. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “India AI governance guidelines” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “India AI Governance Guidelines: What Changes” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “India AI governance guidelines” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“India AI Governance Guidelines: What Changes” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “India AI governance guidelines”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Released 5 November 2025, the Guidelines give seven sutras and a principle-based approach. They are not DPDP, not a licence, and not a reason to skip a processor clause. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C6 Governance & Audit: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “India AI governance guidelines”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.