MeitY AI Governance Guidelines: India's 7 Sutras

What Are India's AI Governance Guidelines?

The document has four parts:

• PART 1
  Principles. The seven sutras that ground India's governance philosophy.
• PART 2
  Recommendations. Guidelines across six pillars for responsible AI development.
• PART 3
  Action Plan. Short, medium, and long-term implementation timelines.
• PART 4
  Practical Guidelines. What organizations and regulators should actually do.

This is not binding law. MeitY has stated repeatedly that these guidelines carry no legal enforceability on their own. ^{PIB 2025} The legal teeth come from existing statutes: the IT Act, the DPDPA, consumer protection law, and sector-specific regulations that are already binding. The guidelines sit on top of that foundation, providing direction without adding statutory obligations.

That distinction matters. If you are building a compliance program around MeitY's framework, your enforcement exposure comes from the underlying laws, not the guidelines themselves. The guidelines tell you what good looks like. The laws tell you what happens when you fall short.

What Are the 7 Sutras of India AI Governance?

Each sutra is a named principle with a formal definition in the MeitY document. ^{MeitY 2025} Here is what each one says, what it means for practitioners, and how it maps to frameworks you may already be working with.

Governance Bodies: AIGG, TPEC, and AISI

MeitY's guidelines propose three new institutional structures. None of these existed before November 2025. ^{MeitY 2025}

AIGG Composition

The AIGG coordinates policy across a broad set of government bodies. It does not itself regulate. It ensures that sector regulators are aligned with the seven sutras and that regulatory approaches do not conflict across ministries. ^{MeitY 2025}

6 Risk Categories: How India Classifies AI Threats

MeitY defines six categories of AI risk. This differs from the EU AI Act's four-tier system (unacceptable, high, limited, minimal) by focusing on the nature of harm rather than a hierarchy of risk levels. ^{MeitY 2025 EU AI Act}

The India-specific additions are significant. Caste bias is a risk category that no other national framework addresses. Gendered deepfakes targeting women and children are called out as a priority harm. Language discrimination, where AI systems perform worse for non-English or non-Hindi speakers among India's 22 official languages, is treated as a fairness failure. ^{MeitY 2025}

The EU's four-tier system classifies AI applications by risk level (a social scoring system is "unacceptable," a hiring tool is "high-risk"). India's six-category system classifies risks by type, meaning a single AI application could touch multiple categories simultaneously. A hiring tool could present bias risk, transparency risk, and accountability gaps all at once.

For organizations building compliance programs, this means you cannot simply classify your AI system into one risk tier and move on. You need to assess each system against all six categories.

Action Plan: Short, Medium, and Long-Term

MeitY's Part 3 lays out a phased implementation timeline. Here is what to expect. ^{MeitY 2025}

The timeline is deliberately open-ended on the long-term items. MeitY is signaling that new AI-specific legislation is possible but not imminent. The current approach is to use existing laws and voluntary guidelines first, then legislate only where gaps persist.

What Organizations Must Do

Part 4 of the guidelines is the most actionable section. It provides separate guidance for AI organizations and for regulators. ^{MeitY 2025}

For AI Organizations

• LAW
  Comply with Indian laws. DPDPA, IT Act, Consumer Protection Act, sector-specific regulations. These are binding, not voluntary.
• VOLUNTARY
  Adopt voluntary measures. Internal AI governance policies aligned with the seven sutras.
• LAW
  Grievance redressal. Establish mechanisms for individuals harmed by AI decisions. Mandatory under the Consumer Protection Act for products and services.
• VOLUNTARY
  Transparency reports. Publish information about AI systems, their capabilities, and limitations.
• TECHNICAL
  Techno-legal solutions. Implement technical safeguards: watermarking, content authentication, audit trails.

These are voluntary under the guidelines, but several map to binding requirements under existing law. Grievance redressal is mandatory under the Consumer Protection Act. Transparency about automated decision-making is required under the DPDPA, and organizations managing AI data governance lifecycles need to map these requirements to their data pipelines. ^{DPDP Rules 2025} The guidelines extend these existing obligations to AI-specific contexts. India-specific compliance checklists and assessment templates are available in the templates hub.

For Regulators

MeitY gives sector regulators three directives:

• DIRECTIVE 1
  Pro-innovation posture. Regulators should enable AI adoption, not block it.
• DIRECTIVE 2
  Harm-based prioritization. Focus enforcement on demonstrated harms, not theoretical risks.
• DIRECTIVE 3
  Least burdensome instruments. Use the lightest regulatory tool that achieves the objective (guidance before codes, codes before rules, rules before legislation).

This is remarkable language in a government document. MeitY is explicitly telling regulators to go easy. That signal shapes the enforcement environment for every organization operating in India. For professionals building governance careers around this framework, the AI governance career path and salary benchmarks reflect the growing demand these guidelines are creating.

International Standards Alignment

MeitY did not build this framework in isolation. Annexures 2 and 6 of the guidelines explicitly reference international standards and frameworks. ^{MeitY 2025}

ISO 42001 (Annexure 6)

Adopted by BIS as IS/ISO/IEC 42001:2023. ^BIS MeitY cites it as the recommended management system for AI governance. Organizations that certify to ISO 42001 can demonstrate alignment with the seven sutras through a single, internationally recognized certification. ^ISO The ISO 42001 Resource Center covers the clause-by-clause implementation details. Professionals pursuing governance credentials should also consider the IAPP AIGP certification, and a full list of relevant credentials is in the IT Certifications Hub.

NIST AI Risk Management Framework (Annexure 2)

MeitY references the NIST AI RMF as an example of a risk-based approach. The NIST framework's four functions (Govern, Map, Measure, Manage) complement MeitY's six risk categories by providing a process for identifying and treating AI risks. ^NIST

EU AI Act (Annexure 2)

The guidelines include a comparative analysis with the EU AI Act. MeitY acknowledges the EU approach as the most comprehensive binding regulation while explicitly choosing a different path: voluntary guidelines with sector-specific enforcement rather than a single horizontal regulation. ^{EU AI Act}

OECD AI Incident Definition

India adopted the OECD's definition of AI incidents for its planned incidents database. This ensures international comparability and allows India to participate in cross-border incident sharing arrangements. ^OECD

For GCC compliance teams managing multi-jurisdiction requirements, the alignment signals are clear. ISO 42001 certification satisfies the MeitY reference, demonstrates a structured approach for EU AI Act compliance, and aligns with the NIST AI RMF. One management system, three frameworks addressed. ^{Zinnov/NASSCOM}