No. It is voluntary. No Indian law currently requires it, and MeitY's AI Governance Guidelines are advisory rather than binding. What has changed is commercial. Enterprise clients, global parents and tender processes are asking for it, so in practice it behaves more like a condition of doing business than a nice-to-have.

Yes. The Bureau of Indian Standards adopted it as IS/ISO/IEC 42001:2023, an identical adoption under single numbering, through the Artificial Intelligence Sectional Committee LITD 30. Certification is available in India through bodies accredited by NABCB under the Quality Council of India, or through international accreditation bodies recognised under the IAF arrangement.

Four to eight months to Stage 2 for an organisation that already holds ISO 27001. Nine to twelve months building from scratch. The limiting factor is rarely documentation. It is that the management system has to run long enough to produce records an auditor can sample.

It depends on how many distinct AI systems are in scope, whether you train or fine-tune models, how many entities and locations are included, and how much of your ISO 27001 or SOC 2 work can be reused. Our consulting fee is fixed once scope is agreed at the gap assessment. Certification body audit days are quoted separately by that body, so be careful with anyone bundling both into a single headline number.

Less than most people fear. Both standards use the same harmonised structure, so scope, leadership, internal audit and management review carry across. What you are adding is AI-specific: system inventory, role determination, AI risk and impact assessment, lifecycle controls, data provenance, transparency artefacts, and supplier controls covering your model providers. We usually run the two as one integrated programme with a single evidence base.

Yes, and it is the scoping conversation we have most often. The standard covers organisations that develop, provide or use AI systems. Ship a feature built on someone else's model and you are still accountable for how it is deployed, monitored, overseen and disclosed, even though the model itself is closed to you.

Not on its own. They are different instruments. DPDP is law, ISO 42001 is a voluntary management standard. The overlap is genuinely useful though. Data governance, consent handling, purpose limitation and record-keeping work done for DPDP produces evidence that the ISO 42001 data and lifecycle controls ask for. We scope them together where clients want both.

No, and no credible firm can. Impartiality requirements under ISO/IEC 17021-1, supplemented by ISO/IEC 42006:2025 for AI management systems, keep consulting and certification separate. We deliver readiness, implementation and audit support. An accredited certification body issues the certificate after its own audit. That independence is exactly what makes the certificate worth showing a client.

Yes. We deliver across India remotely, with on-site visits where the scope calls for them. We also work with Indian companies whose parent or client base sits in the US, UK, EU and Singapore, where we have offices of our own.