AIBOM for Indian enterprises: CERT-In, MeitY, RBI and DPDP

India has no single AI law, but several sources of guidance point in the same direction: know what your AI systems are made of, where their data came from, and who is accountable. An AIBOM brings those answers together.

The Indian landscape in brief

CERT-In

CERT-In's guidelines define the AIBOM as "a comprehensive list of components used in building, training, and deploying AI models" and list minimum elements including model name, version, type, developer, licensing information, software dependencies, ML models and algorithms, performance metrics, data source and data-set information ^[1]. They are aimed at government, public-sector and essential-services organisations and at software exporters and service providers. Private companies supplying government projects should expect BOM disclosure requirements across software, hardware and AI ^[2]. Detail is in CERT-In AIBOM requirements.

MeitY

The India AI Governance Guidelines, released on 5 November 2025 under the IndiaAI Mission, are explicitly not new legislation. They rely on existing law where possible and set out seven guiding principles ^[3]. Summaries describe six governance pillars, proposed bodies including an AI Governance Group and an AI Safety Institute, industry transparency reports, a national AI incidents database, and graded accountability across the AI value chain ^[4]. Graded accountability depends on knowing who supplied which component, which an AIBOM records.

RBI and the financial sector

The RBI's FREE-AI committee report recommends board-approved AI policies covering lifecycle management and third-party vendor liabilities, and AI inventories and sector-wide repositories covering models, use cases, dependencies and risks ^[5]. See AIBOM for banks.

Personal data in training sets

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 with an 18-month phased compliance timeline ^[6]. Where personal data is used to train or fine-tune models, organisations need to know which datasets contain it and which models were trained on them. SPDX 3.0 dataset properties such as hasSensitivePersonalInformation and anonymizationMethodUsed give a structured place to record this ^[7].

Exporters and global customers

Indian IT services firms and product companies selling into Europe should also note that EU AI Act high-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) following the AI Omnibus ^[8]. EU providers must document third-party pre-trained components they integrate, so they are likely to ask Indian suppliers for AIBOM-style information. See EU AI Act and AIBOM.

A 90-day starting plan

1. Weeks 1 to 3: list AI systems in production, including hosted AI APIs and AI features in SaaS tools.
2. Weeks 4 to 6: generate AIBOMs for the highest-impact systems, covering the CERT-In Table 10 elements.
3. Weeks 7 to 9: identify datasets containing personal data and link them to models.
4. Weeks 10 to 12: add AIBOM clauses to supplier contracts and set up validation at intake.

Securities-market entities

Entities regulated by SEBI already work under the Cybersecurity and Cyber Resilience Framework of August 2024, which brought SBOM expectations into the securities sector ^[9]. AI systems used in trading, surveillance or client servicing sit on the same software stack, so extending the existing SBOM process to cover models and datasets is usually the quickest route to an AIBOM.

How IntelliXBOM helps

IntelliXBOM validates AIBOMs against the CERT-In AIBOM elements and other required-field policies, keeps version history, and correlates models, datasets and frameworks with vulnerabilities, licences and business services. It maps the inventory to Indian and global framework controls with timestamped evidence, and can be self-hosted, including air-gapped.

This article summarises public guidance and is not legal advice.