AI Governance Checklist for Companies in India: 90-Day Plan

An AI governance checklist for companies in India comes down to six things: a named owner, an inventory of every AI tool, a risk rating for each use, real human oversight of decisions about people, vendor contracts that bar training on your data and require fast breach notice, and an incident plan built around the legal clocks (CERT-In within 6 hours today; the Data Protection Board within 72 hours from 13 May 2027). India has no AI Act, so these records are how a company shows regulators, clients and courts that it used AI with due care.

Step 1: ownership and the AI inventory

Every AI governance checklist for companies starts with people and visibility.

• Board or top management approves the AI policy and risk appetite and receives reports.
• An AI governance lead or committee: in a startup, a founder plus whoever handles legal; in a larger firm, legal, compliance, IT security, data protection, HR and business heads.
• A business owner for each AI system, accountable for its use, monitoring and incidents.

Then build the inventory. For each tool record: name and vendor; owner and department; purpose in one sentence; personal, children’s or confidential data used; who is affected; whether it makes or supports decisions about people; whether it publishes content in the company’s name; contract status; risk tier and last review date.

Find “shadow AI” with a short survey of every team, a check of software expense claims and a review of SaaS sign-ups and browser extensions. Do not forget AI features switched on inside existing email, HR or CRM software by an update.

Step 2: AI risk assessment by use case

Rate the use, not the brand. One question drives the rating: if this output is wrong, who is harmed, how badly, and would we notice? For high and medium uses, assess legal basis for data, accuracy, bias, security, IP, transparency and failure modes.

Step 3: AI vendor due diligence

Vendor terms usually disclaim accuracy and cap liability at fees paid, so the contract is where risk is really allocated. Check:

1. Your data: used only to provide the service; no training on it without written consent.
2. Processor terms: DPDP-style obligations, Rule 6 security safeguards, help with rights requests, deletion at the end.
3. Breach notice: within a few hours, so you can meet the 6-hour CERT-In clock.
4. Sub-processors and data location.
5. Security evidence: certifications or audit reports, access controls, logging, defences against prompt injection.
6. Testing: accuracy and bias results, ideally on Indian users and languages; notice of material model changes.
7. IP: who owns outputs; indemnity against third-party IP claims.
8. Liability: carve-outs from the cap for data breach, confidentiality, IP and wilful misconduct.
9. Regulatory access: essential for RBI and SEBI regulated entities.
10. Exit: data return, deletion and a certificate of deletion.

Record what you asked and what you got. Under s.85 of the IT Act, that record can be the difference for officers in charge.

Step 4: oversight, transparency, incidents and training

• Human oversight that is real: reviewers with authority to override, the information to judge, manageable volumes, and recorded reasons.
• Transparency: chatbot interaction notices, decision notices with main reasons and a review route, labels on realistic synthetic content, updated privacy notices.
• Incident response: contain, preserve logs and outputs, assess, report within the clocks, remedy, learn. Keep a log of near misses too.
• Role-based training with attendance records: what never to paste, checking outputs, labelling, reporting.
• Board reporting each quarter or half-year: inventory by tier, incidents, complaints, test results, vendor gaps, law changes, training completion.

A 90-day AI governance plan

A small startup can compress this into a month. Either way, the AI governance checklist for companies becomes a living record.

Frequently asked questions

What should an AI governance checklist for companies include?

A named owner, an inventory of every AI tool and use, a risk tier for each use, human oversight for decisions about people, vendor contracts with data and breach terms, notices and labels, an incident plan with the legal clocks, staff training and regular board reports.

Is AI governance mandatory for Indian companies?

No single law requires an AI governance programme. But the DPDP Act, IT Act, consumer law, copyright law and sector rules all apply to AI use, and governance records are the main evidence that a company acted with due care when something goes wrong.

Who is liable if a vendor’s AI tool causes harm?

Usually the deploying company first, because the affected person dealt with it. Under DPDP s.8(1) the company remains responsible for its processors, so the contract should shift costs back through indemnities and carve-outs.

How often should the AI inventory be reviewed?

At least once a year, and whenever the law changes, a major incident occurs or a vendor makes a material model update. High-risk tools should be re-tested after major updates.

Quick quiz

Get the full toolkit in AI Law and Governance in India, ₹599, and train staff with AI at Work: Using ChatGPT and AI Tools Safely, Smartly and Legally, ₹299.

Sources

• MeitY, India AI Governance Guidelines, 5 November 2025
• Digital Personal Data Protection Act, 2023, s.8; DPDP Rules, 2025, Rules 6 and 7
• Information Technology Act, 2000, s.85; CERT-In Directions of 28 April 2022; IT Rules, 2021 as amended in February 2026
• SEBI amendments of 6 February 2025; RBI FREE-AI committee report, 13 August 2025
• Indian Contract Act, 1872, ss.73 and 124

This page is for education and general information, not legal advice for a specific case. Law as on 31 October 2026.