MeitY released India's National AI Governance Guidelines in November 2025 under the IndiaAI Mission — a national policy baseline covering accountability, safety, transparency, fairness, and inclusion, applying to every entity deploying AI in India, banks included. For a bank, the practical question isn't whether MeitY's guidelines apply — they do — it's how they relate to the RBI and SEBI obligations that actually carry examination weight.

Short version: MeitY sets the national principle; RBI and SEBI set the operational requirement an examiner will test. Get the sector-specific work right and the national layer mostly takes care of itself.

India's four-layer AI governance stack for banking

  • National — MeitY's National AI Governance Guidelines (Nov 2025): accountability, safety, transparency, fairness, inclusion as national policy principles, setting context for sector regulators.
  • Sector — RBI — RBI's supervisory expectations on AI plus the FREE-AI committee report: examination-relevant obligations for RBI-regulated entities, including evidence trails, independent validation themes, and the committee's 26 recommendations.
  • Sector — SEBI — SEBI's AI/ML consultation (June 2025) plus existing algo-trading oversight: governance principles for SEBI intermediaries using AI, generally summarized as fairness, accountability, transparency, robustness, privacy, explainability.
  • Cross-cutting — DPDP Act 2023 plus IndiaAI Mission's compute/data standards: data protection obligations that apply at the inference pipeline level, not just at the point data is stored.

MeitY's five principles, and what they actually mean for a bank

  • Accountability — the organization deploying AI is accountable for its outcomes, including AI sourced from a vendor. This mirrors RBI's outsourcing expectation directly: buying an AI system from a vendor does not transfer accountability for what it decides.
  • Safety and security — AI systems must be designed to avoid harm, and security vulnerabilities in AI — prompt injection, adversarial manipulation — sit inside this principle alongside conventional cybersecurity. This lines up with the reliability and robustness themes in both RBI's FREE-AI work and SEBI's consultation.
  • Transparency and explainability — material AI decisions affecting individuals must be explainable. MeitY doesn't define "material" nationally; RBI and SEBI do, in practice, through examination behavior — credit decisions and KYC determinations for banks, advisory recommendations and trading decisions for SEBI intermediaries. If you're waiting for a national definition before building explainability tooling, you're waiting for the wrong document.
  • Fairness and non-discrimination — AI must not produce systematically discriminatory outcomes, with protected attributes explicitly in scope. For BFSI this is credit scoring, pricing algorithms, underwriting AI, and customer segmentation — the same territory FREE-AI's fairness-related recommendations cover.
  • Inclusion and societal benefit — AI deployment shouldn't deepen existing inequalities in financial access. This one reads as aspirational at the national level, but it has a real operational edge for banks: a credit or customer-service AI that systematically underserves a demographic segment is both a fairness problem and an inclusion problem, and regulators increasingly ask about both in the same breath.

MeitY vs. sector obligations: what actually governs banking AI

Requirement area MeitY national framework RBI sector obligation SEBI sector obligation What a bank actually has to implement
Accountability for AI decisions Named accountability, including for third-party AI Board-approved governance framework, outsourcing controls Clear human accountability per AI system Governance framework plus named owners plus outsourcing evidence, in RBI's and SEBI's expected format
Model safety and security Harm avoidance, security by design FREE-AI reliability-related recommendations, runtime controls Robustness across market conditions Adversarial testing, drift detection, runtime guardrails with evidence for examination
Fairness and bias prevention Non-discrimination, protected attributes FREE-AI fairness-related recommendations Fairness principle (no discriminatory outcomes) Pre-deployment bias assessment plus ongoing monitoring, evidenced for both regulators at once
Transparency and disclosure Material AI decisions must be explainable FREE-AI explainability-related recommendations Investor disclosure for AI-influenced decisions Explainability tooling for credit/advisory AI plus investor disclosure templates
Data protection Alignment to DPDP Act Outsourcing controls, audit trail, DPDP at the inference layer Privacy principle (DPDP at inference) PII detection in AI pipelines, consent workflows
Model validation and oversight Not specified at national level Independent validation themes for AI models, including third-party Robustness testing, stress scenarios Independent validation workflow — the single most demanding item in this table

The practical read for a governance team

Build to satisfy RBI's and SEBI's sector-specific obligations first — the evidence trail, the validation discipline, the fairness and explainability tooling — and the MeitY national layer is satisfied as a side effect, because MeitY's five principles are a looser version of the same requirements. I have never seen a bank that passed an RBI examination on AI governance and then separately failed a MeitY-alignment review; the inverse — a bank with a tidy national-principles slide deck and no actual evidence trail — is much more common, and it's the one examiners actually catch.

IndiaAI Mission: the parts that rarely touch a bank's AI estate

The National AI Governance Guidelines are one pillar of the broader IndiaAI Mission, which also covers sovereign compute infrastructure (IndiaAI Compute), curated training datasets with provenance standards (IndiaAI Datasets), and sector-specific application development. For most private-sector banks running commercial cloud infrastructure, the compute and dataset pillars rarely apply directly — they matter most for public-sector and research-oriented deployments. The governance guidelines are the piece that actually reaches a bank's AI estate; RBI, SEBI, and DPDP carry the rest.

What to do with this

  1. Treat MeitY's five principles as a checklist to confirm, not a separate program to build — your RBI and SEBI evidence should already satisfy most of it.
  2. Define "material AI decision" for your own institution now, in writing, rather than waiting for a national threshold that may never arrive with bank-specific precision.
  3. Verify your FREE-AI mapping against the committee's primary report before using pillar-letter citations (F-1, R-3, etc.) in any examiner-facing document.
  4. Confirm whether your AI vendors fall inside MeitY's third-party accountability principle and RBI's outsourcing controls simultaneously — most do, and most contracts haven't caught up.
  5. If you're building on IndiaAI Compute or Datasets for any public-facing pilot, check the infrastructure-layer governance obligations separately — they're not covered by your standard RBI/SEBI evidence chain.

All four layers. One platform. One evidence chain.

MeitY, RBI, SEBI, DPDP — Zytra maps all four simultaneously with a single control library and a single evidence chain for all examinations.