FDPPI had released an AIGSI version 1.2 on 28th June 2026 and publiushed it on www.dgpsi.in.
This Version 1, released in August 2026, brought together DGPSI-AI, the RBI Guidance on Model Risk Management and the CERT-In Guidelines on AI vulnerabilities.
Since then, two additional documents have appeared in public domain. DSCI released its Discussion Paper on AI Liability for Agentic AI on 30 October, and CERT-In issued its AI Security Auditing Guidelines on 4 November.
We compared AIGSI with both, clause by clause, for IDPS 2026 and FDPPI is now releasing AIGSI Version 2.0, a consolidated draft of the AI Governance Standard of India, for public discussion. Version 2.0 now brings all of these sources into a single standard.
This will be released during IDPSO 2016 at Bangalore on November 21, 2026.
The central message of Version 2.0 is simple. AI governance in India must first be compatible with the law of the land: the DPDPA 2023 and the ITA 2000.
Key features of the consolidated version:
- Law first. Security of personal data is treated as DPDPA compliance. Security of non-personal data and of the AI system itself is treated as ITA 2000 compliance.
- Accountability forward, liability backward. The deployer is accountable to the affected person. Liability then flows backwards through a contract at every link: to the developer, to the tool and infrastructure providers, and finally to the model owner. The affected person is never asked to trace the fault through the value chain.
- Four roles. The standard now covers the Model Owner and the Infrastructure Provider alongside the Deployer and the Developer, with 12 contract clauses for the liability chain.
- A two-part audit. A common core is tested once. It supports a DPDPA-centric AI audit and an ITA 2000-centric AI audit, with branches for RBI Regulated Entities, Significant Data Fiduciaries, CERT-In risk tiers and agentic AI.
- Enforced controls. Following DSCI, limits and stop mechanisms must be built into systems and tested, not merely written into policy. An independent Kill Switch remains the final safeguard.
The standard now has 16 principles and over 100 specifications for deployers, developers, model owners and infrastructure providers.
The two AIGSI vs CERT-In and AIGSI Vs DSCI comparative analyses and AIGSI Version 1.2 are included as annexures.
The draft would be made available to the delegates of the IDPS 2026 which is set to be inaugurated by none other than the honourable Justice Srishananda, a sitting judge of Karnataka High Court.
We invite comments from DPOs, Independent Data Auditors, AI developers, legal professionals, regulators and industry bodies, including DSCI and CERT-In, before a final version is issued.
Naavi
