What it means
- A register of the AI laws, rules, advisories and frameworks that apply (or may soon apply) to the company, with a note on why each one applies and which controls meet it.
- Covers binding rules (IT Rules 2026 amendment, DPDP Act), sector guidance (RBI, SEBI, IRDAI, TRAI), voluntary frameworks, and foreign laws that reach Indian firms through customers (EU AI Act for SaaS exporters).
- Horizon scanning: someone watches for new drafts and consultations and flags them before they bite.
Why it matters
- RBI FREE-AI expects the AI policy to stay aligned with national frameworks; you cannot do that without tracking them.
- The 2026 IT Rules amendment starts with a scoping question: which of your features create synthetic content?
- Indian AI regulation moved fast in 2025 and 2026; a register avoids "we did not know".
Checklist
- Create the register: regulation, regulator, status (binding, draft, voluntary), applies yes or no with reason, owner, mapped controls, next review date.
- Use the AI Regulation Library as the source list and mark which entries apply.
- Assign an owner (usually compliance or legal) to scan regulator sites, gazette notifications and consultations monthly.
- Record each new item with an impact note and decision (act now, watch, not applicable).
- Report material changes to the AI committee and trigger an AI policy review when needed.
- Review the whole register at least annually.
Evidence examples
- Regulatory applicability register showing, for example, the IT Rules 2026 amendment as applicable with mapped controls.
- Monthly horizon-scanning log or newsletter with decisions.
- AI committee minutes noting a new regulation and actions agreed.
- Annual register review sign-off.
Common pitfalls
- Listing laws without saying why they apply or which controls meet them.
- Tracking only binding laws and missing drafts that become binding months later.
- No owner, so scanning stops when one person leaves.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Also relevant to
- India AI Governance Guidelinesno numbered obligations; mapped in its practical notes (comply with all Indian laws and be able to show it)
- AI (Ethics and Accountability) Bill 2025no numbered obligations; mapped in its practical notes (track in a horizon register)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 4.1 Understanding the organisation and its context
- 4.2 Understanding the needs and expectations of interested parties
ISO/IEC 27001
- A.5.31 Legal, statutory, regulatory and contractual requirements
SOC 2
- CC3.4
Key takeaways
- Know which AI rules apply, why, and which controls meet them.
- Strong reuse from ISO 27001: extend the legal and regulatory register you keep for A.5.31 with AI entries.
- Watch drafts and consultations, not just final laws.