ISO/IEC 42001 by region
ISO 42001 certification in India: accreditation, the DPDP Act, client-driven scope and local practice
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
What is different about ISO/IEC 42001 in India: why overseas clients ask Indian IT, SaaS and delivery centres for it, NABCB and overseas accreditation for AI management systems, DPDP Act data evidence, role-based scope and certificate checks.
Key points
- No Indian law requires ISO/IEC 42001. In India the request comes mostly from overseas clients of IT services firms, SaaS exporters and global capability centres who now run AI due diligence on their suppliers.
- Accredited ISO/IEC 42001 certification is new everywhere. Whether NABCB, India's accreditation board for certification bodies, accredits for this standard yet could not be confirmed, so ask each certification body which accreditation covers its ISO/IEC 42001 certificates.
- The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 reach the personal data your models are trained and run on. One AIMS can hold that evidence, but no certificate proves DPDP compliance.
- A delivery centre's certificate must name the AI systems, client programmes and your role for each, or a foreign client will not read it as covering their work.
Why Indian organisations pursue ISO/IEC 42001
The first request usually arrives inside a client security or vendor-risk questionnaire. A European bank asks its Pune or Bengaluru delivery partner how the AI used in claims triage is governed; a US software buyer asks a Mumbai SaaS company where its model's training data came from and who signs off a release. An ISO/IEC 27001 certificate does not answer that section.
EU clients add a second reason: the EU AI Act, Regulation (EU) 2024/1689, places obligations by role and risk class, and some of that weight reaches Indian suppliers by contract. ISO/IEC 42001 does not give conformity with the Act; the EU AI Act comparison explains the gap.
At home, the pull is weaker and mostly contractual: where an Indian buyer asks about AI governance, the question usually sits in a vendor assessment rather than in regulation. The decision guide helps you judge timing.
Accreditation for ISO/IEC 42001 in India
NABCB is a constituent board of the Quality Council of India and describes itself as an autonomous body set up by the Ministry of Commerce and Industry. It accredits management system certification bodies to ISO/IEC 17021-1; for AI management systems, ISO/IEC 42006:2025 adds requirements on top.
Two points need care in India. First, we could not confirm that NABCB accredits certification bodies for ISO/IEC 42001; check its directory of accredited bodies for this standard by name. Second, NABCB's own site states that it is an IAF, ILAC and APAC signatory, yet no Indian body appeared on the Global ACI list of recognised accreditation bodies when it was checked. Global ACI replaced the IAF and ILAC on 1 January 2026. If an overseas client will rely on your certificate, confirm NABCB's current standing first.
Certification bodies working in India may hold overseas accreditation instead. UKAS, for example, has opened an AIMS accreditation programme under ISO/IEC 17021-1 with ISO/IEC 42006. Ask to see the accreditation scope for ISO/IEC 42001, not only ISO/IEC 27001. NABCB points to IAF CertSearch for checking an issued certificate; the certification body's own register is the second check. See choosing a certification body.
What changes an ISO/IEC 42001 project in India
DPDP Act obligations on training and inference data
The DPDP Act, 2023, with the DPDP Rules, 2025 notified on 13 November 2025, applies its main duties of Data Fiduciaries from May 2027. Personal data used to train, fine-tune or prompt a model needs a lawful purpose and ground, notice in English or an Eighth Schedule language, safeguards and erasure once the purpose is served. A Significant Data Fiduciary adds a yearly DPIA and audit, including due diligence on algorithmic software. Your AIMS data records under Annex A.7 and your impact assessments can carry that evidence; the DPDP Act guide covers the law.
Client-owned models and your role
In delivery centres the model, the data and the decision often belong to the client, and your team builds, tunes or operates it. Record your role for each system and agree responsibilities under the Annex A third-party controls. A scope saying "all AI" without that split rarely survives Stage 1; see the scope guide.
Extending the ISMS you already hold
Many Indian IT and BPO firms already run an ISO/IEC 27001 system audited every year. Extending it into an AIMS, with one document set, audit programme and management review, is usually faster; see the ISO/IEC 27001 extension guide.
Multi-city delivery and audit logistics
A Mumbai head office with delivery centres in other cities is common. Agree the sites and client programmes in scope before quotations; auditor time and the availability of AIMS auditors for a newer scheme shape the timeline.
Local items to check before and after certification
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Accreditation of the certification body for ISO/IEC 42001 | Decides whether the certificate is accredited for AI management systems, not only for information security | NABCB's directory of accredited bodies, or the overseas accreditation body's directory |
| Standing of the accreditation body | Overseas clients may check international recognition | NABCB's site and the Global ACI list of recognised accreditation bodies |
| DPDP Act and DPDP Rules | Sets grounds, notice, safeguards and erasure for personal data in AI systems | The Act and Rules as notified in the Gazette of India |
| Client AI clauses and questionnaires | Decide the AI systems, programmes and roles the certificate must name | Master services agreements, statements of work and vendor-risk questionnaires |
| Issued certificate | Clients will search for it and read its scope | IAF CertSearch and the certification body's register |
How Sterling works in India
Indian ISO/IEC 42001 projects run from Sterling's Navi Mumbai office: on site in Mumbai, Thane and Pune, planned visits and remote working elsewhere. The team draws on 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits and decides,; we help you confirm its accreditation for this standard.
How Sterling supports Indian AI teams
An AIMS your delivery teams and overseas clients can both read
We build the AI system inventory with your delivery and product leads, record your role for every client programme, run the risk and impact assessments with the people who build the models and extend your existing ISMS rather than duplicate it. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 42001 certification in India: questions buyers ask
Is ISO 42001 certification mandatory in India?
No. No Indian law requires it. Demand comes from clients, mostly overseas, who ask suppliers to show how their AI is governed, and from vendor assessments that include questions on AI.
Can an NABCB-accredited body issue ISO 42001 certification in India?
Only if NABCB has accredited that body for ISO/IEC 42001, which we could not confirm. Check NABCB's directory for this standard, or accept a body with recognised overseas accreditation for AI management systems.
Does ISO 42001 help with DPDP Act compliance?
It helps, but it does not prove compliance. The AIMS records data provenance, impacts on people and controls, which supports DPDP evidence. The Act has no certificate, and the Data Protection Board of India judges compliance.
ISO 42001 certification in Mumbai: can a consultant work with our team on site?
Yes. Sterling's Navi Mumbai office supports teams in Mumbai, Thane and Pune on site, and delivery centres in other Indian cities through planned visits and remote working.
ISO/IEC 42001 by region
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 42001 certification in Australia
- ISO 42001 for healthcare
- ISO 42001 for HR and staffing
- ISO 42001 implementation plan
- ISO/IEC 42001 certification in India
- ISO 42001 internal audit
- ISO 42001 management review
- ISO/IEC 42001 certification in the Netherlands and Europe
- ISO/IEC 42001 certification in Singapore and South East Asia
- ISO/IEC 42001 certification in the Philippines
- ISO/IEC 42001 certification in the UAE and GCC
- ISO/IEC 42001 certification in the United Kingdom
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Plan your ISO/IEC 42001 certification in India with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice