India's AI Governance Guidelines (2025), read for hospitals and health-tech teams

The short answer

Picture a hospital board asking whether India’s new AI guidelines apply to the AI tools on its wards. The 2025 guidelines are voluntary, but they single out health as a sensitive sector and ask for audit trails and human oversight. Those two are worth building first.

The India AI Governance Guidelines, drafted by a MeitY committee and published in November 2025, set out seven guiding principles (“sutras”), recommendations across six pillars, and an action plan. They are not legally binding. They favour existing laws and voluntary measures over a new AI law, but they say governance frameworks need audit trails and human-in-the-loop mechanisms at critical decision points¹, and that high-risk applications in sensitive sectors such as health may need extra safeguards.¹

For a hospital or health-tech company, that reads as: the safeguards are voluntary today, and they are the ones you’ll be asked about tomorrow.

The seven sutras

The committee adapted seven principles from the RBI’s FREE-AI Committee report:¹

The examples in the right-hand column are ours, not the committee’s.

The six pillars

The recommendations sit under six pillars: infrastructure, capacity building, policy and regulation, risk mitigation, accountability, and institutions.¹ Three matter most to health teams.

Risk mitigation. The committee wants an India-specific risk framework built on real evidence of harm, with voluntary measures supported by techno-legal tools, and additional obligations in sensitive contexts.¹

Accountability. It proposes a graded liability system that depends on the function performed, the level of risk, and whether due diligence was observed.¹ “Did you take reasonable care?” is a question you answer with records: who approved the deployment, what was tested, what the tool did.

Institutions. It proposes an AI Governance Group, supported by a Technology and Policy Expert Committee, with the AI Safety Institute providing technical expertise and sector regulators keeping their enforcement powers.¹ For health, that points to the health ministry, NHA and other existing health bodies rather than a new AI regulator.

What it says about health

The guidelines say low-risk applications may need only basic commitments, such as transparency reporting and a grievance mechanism, while high-risk applications in sensitive sectors such as health or finance may need additional safeguards.¹ On risks from advanced AI, they say governance frameworks “must therefore have clear monitoring standards, audit trails, and ensure that human-in-the-loop mechanisms are in place at critical decision points”.¹

Nothing there is specific to a modality or a clinical use. The design consequence is general: in health, assume your AI system will be treated as higher risk, and build oversight and records accordingly.

Incident reporting

The committee suggests a national database of AI incidents, federated so sector regulators can run their own, with organisations encouraged to report without the threat of penalties.¹ It also suggests using existing mechanisms such as CERT-In’s to monitor vulnerabilities in AI systems in critical sectors.¹

For a hospital, the useful step now is internal: keep your own register of AI incidents, such as a wrong record written, a misrouted message, an approval that should have been refused. If a national scheme arrives, you’ll already have the data, and in the meantime you learn from it. CERT-In’s list of reportable incidents already includes attacks on AI and machine learning systems; see CERT-In’s directions for hospitals.

The health-specific layer: SAHI, BODH and ICMR

Two health-specific documents sit beside the general guidelines.

• In February 2026, the health ministry launched SAHI, the Strategy for Artificial Intelligence in Healthcare for India, described as a governance framework and roadmap for responsible AI in healthcare, and BODH, a benchmarking platform built by IIT Kanpur with NHA to evaluate AI models on anonymised real-world data for performance, robustness, bias and generalisability before deployment at population scale.²
• ICMR’s 2023 ethical guidelines for AI in biomedical research and healthcare already say human oversight and manual override must be compulsory for AI that could cause severe or bodily injury, and that AI technologies must undergo regular internal and external audits.³

Read together, the message is consistent: test before scale, keep a person in charge of consequential steps, and be able to show what happened.

A practical reading for hospitals

A short list you can act on without waiting for any new rule:

1. Inventory every AI system in use, including the ones bundled in vendor software, and name an owner for each.
2. Classify by consequence. A tool that drafts text a clinician edits is different from one that writes orders or codes claims.
3. Put a named person on consequential writes, and record the approval. Our post on automation bias explains why a fast click isn’t oversight.
4. Keep an audit trail outside the AI tool, so the record of what it did doesn’t depend on the tool.
5. Start an internal AI incident register with a simple schema: what, when, impact, cause, fix.
6. Ask vendors how they tested, on what data, and how they report incidents to you.

For what an audit trail of AI actions should hold, see the glossary entry on audit trails for AI in healthcare. For what Deedglass does around AI agent writes in hospitals, see /healthcare; the FHIR write benchmark shows where its checks miss.

To try the checks on synthetic data, open the playground in your browser. To see what an AI agent on your machine can change, run npx deedglass scan (what the grade means) or paste its MCP config into /check; neither uploads your data. Our AI agent permissions report shows what public agent setups commonly leave open.

Written with AI assistance and checked against our claims register.