ISO 42001: AI Governance for Indian Tech Companies (2026 Guide)

Short answer: ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). It gives Indian tech companies a certifiable way to show clients, investors and regulators that the AI they build or use is governed: risks are assessed, impacts on people are considered, data is controlled and humans stay accountable. A typical mid-sized IT or SaaS company can get audit-ready in about 8 to 16 weeks after a 1 to 2 week gap assessment.

Why ISO 42001 matters for Indian tech companies now

Enterprise buyers in the US, UK and EU now send AI questionnaires alongside security questionnaires. They want to know where your models come from, what data trained them, how you test for bias and errors, and who can switch a system off. At home, the rules are also tightening:

• India AI Governance Guidelines (MeitY, 5 November 2025): seven principles including trust, people first, fairness, accountability, “understandable by design” and safety. They favour existing laws and voluntary frameworks over a new AI statute, which makes a recognised standard like ISO 42001 the natural way to show you follow them.
• IT Rules amendments on synthetically generated information (notified 10 February 2026, in force 20 February 2026): labelling and provenance markers for AI-generated content, and takedown within three hours of a government or court order. Platforms and companies offering generative tools need documented controls.
• DPDP Act, 2023 and the DPDP Rules, 2025: personal data used to train or run AI still needs a lawful basis, notice, security safeguards and breach reporting.

What the standard contains

ISO/IEC 42001 follows the same high-level structure as ISO 9001 and ISO 27001 (clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement), so it slots into an existing management system. Its Annex A sets out 38 controls under 9 objectives:

Annex A objective	What it covers	Controls
A.2 Policies related to AI	AI policy and how it aligns with other policies	3
A.3 Internal organisation	Roles, responsibilities, reporting concerns	2
A.4 Resources for AI systems	Data, tools, compute and people	5
A.5 Assessing impacts	AI system impact assessments on individuals and society	4
A.6 AI system life cycle	Design, development, verification, deployment, monitoring	9
A.7 Data for AI systems	Data quality, provenance and preparation	5
A.8 Information for interested parties	User documentation, incident communication	4
A.9 Use of AI systems	Responsible use and intended-use limits	3
A.10 Third-party and customer relationships	Suppliers, model providers and customers	3

Companion standards help with the detail: ISO/IEC 23894 for AI risk management, ISO/IEC 42005:2025 for AI system impact assessments, and ISO/IEC 42006:2025, which sets the requirements for bodies that audit and certify AI management systems.

Step-by-step path to certification

1. Inventory your AI. List every AI system you develop, fine-tune, resell or use internally, including third-party APIs and copilots. Mark your role for each: developer, provider, deployer or user.
2. Set the scope. Decide which products, teams and locations the AIMS covers. A focused scope (for example, one SaaS product and its ML team) is faster to certify.
3. Gap assessment (1 to 2 weeks). Compare current practice against clauses 4 to 10 and Annex A, and produce a prioritised action plan.
4. AI policy and roles. Board-approved AI policy, a named owner for the AIMS, and a channel for staff to raise AI concerns.
5. Risk and impact assessments. Assess risks to the business and impacts on individuals (bias, privacy, safety, explainability), then select controls and write the Statement of Applicability.
6. Life-cycle and data controls. Documented requirements, training-data provenance, testing and validation criteria, human oversight, release approval, monitoring for drift and an AI incident process.
7. Supplier controls. Contract clauses and due diligence for model and data providers.
8. Run it for a cycle. Train staff, operate the controls, collect evidence, then carry out an internal audit and management review.
9. Certification audit. Stage 1 (documentation readiness) and Stage 2 (effectiveness), followed by annual surveillance audits.

Worked example

A 120-person Chennai SaaS company sells an HR screening product that ranks applicants using a third-party large language model. A US customer asks for evidence of AI governance before renewal. The company already holds ISO 27001. Its gap assessment shows no AI inventory, no impact assessment on applicants, and no contract terms with the model provider on data use. Over about 12 weeks it adopts an AI policy, runs an impact assessment on bias and explainability, adds a human-review step before any rejection, tightens the supplier contract and links the AIMS to its existing ISMS so internal audit and management review cover both. It then goes for a combined audit.

Documents you will usually need

• AIMS scope, AI policy and AI objectives
• AI system inventory with roles and intended use
• AI risk assessment, risk treatment plan and Statement of Applicability
• AI system impact assessments
• Data provenance and quality records; model testing and validation reports
• Supplier and customer contract clauses on AI
• Competence and training records
• Internal audit report, management review minutes and corrective actions

Typical timeline

For a mid-sized company the usual sequence is a gap assessment in 1 to 2 weeks, implementation in 8 to 16 weeks depending on how many AI systems are in scope and whether an ISO 27001 or ISO 9001 system already exists, at least one cycle of internal audit and management review, and then the Stage 1 and Stage 2 audits. Plan for annual surveillance audits after certification, and update your AI inventory and impact assessments whenever you launch or materially change an AI feature.

Common mistakes and red flags

• Treating ISO 42001 as an IT security project. It also needs product, legal, HR and leadership involvement.
• Leaving out “shadow AI”: staff using public chatbots with client data.
• Copying a template AI policy that does not match what your systems actually do.
• No impact assessment for systems that affect people’s jobs, credit, health or access to services.
• Ignoring the DPDP Act when training or fine-tuning on personal data.
• Choosing an auditor before checking it can certify AI management systems under the current accreditation requirements.

FAQ

Is ISO 42001 mandatory in India?

No. It is voluntary, but it is increasingly asked for by enterprise customers and is a practical way to show you follow the MeitY guidelines and existing laws.

We only use AI tools from other vendors. Does ISO 42001 apply to us?

Yes. The standard covers organisations that use AI, not only those that build it. Your controls will focus more on supplier selection, intended use, data shared with the tool and human oversight.

Can we combine ISO 42001 with ISO 27001?

Yes. Both use the same clause structure, so policies, internal audit, management review and document control can be shared. Many companies run an integrated audit.

Who issues the certificate?

An independent certification body. Vakil Labs prepares you and coordinates the audit; certification audits are arranged through our tie-up with Veritas International (a JAS Global Certifications brand). Vakil Labs does not issue certificates.

How Vakil Labs can help

We run the gap assessment, draft the AI policy, impact assessments and supplier clauses, carry out the internal audit and coordinate the certification audit. See our ISO 42001 certification consulting, our wider ISO certification consulting and our data privacy and DPDP compliance services. If you already hold or plan ISO 27001, read our ISO 27001:2022 checklist for IT and SaaS companies.

For companies that want AI governance, privacy, contracts and labour compliance handled by one accountable team, our Legal Retainer for Companies covers it under a single monthly plan. Call +91 99416 26224, contact us, or Book a call with an advocate.

This article is for general information only and isn’t legal advice.