AI governance Who decides which AI the office uses, who answers for it, and how anyone would know.
Short answer. AI governance is the set of decisions, roles, policies and records an organisation uses to control how AI is chosen, used and checked. It answers who may use which AI tool for what, who is accountable when something goes wrong, and how the organisation would know. India’s AI Governance Guidelines, unveiled by MeitY on 5 November 2025, rely on existing laws plus voluntary measures: they say a separate AI law is not needed at this stage, and ask industry to comply with Indian laws, adopt voluntary frameworks, publish transparency reports and provide grievance redressal. The NIST AI Risk Management Framework and ISO/IEC 42001 give structures for doing this. In a small office, governance can be one accountable person, a written policy, a register of tools and a monthly look at the logs.
01
Three reference frameworks
Framework
Issued by and when
Status
Core idea
India AI Governance Guidelines
MeitY under the IndiaAI Mission, 5 November 2025
Guidance resting on existing laws and voluntary measures
Seven sutras, including accountability and understandable by design
NIST AI RMF 1.0
US National Institute of Standards and Technology, 26 January 2023
Voluntary
Four functions: Govern, Map, Measure, Manage
ISO/IEC 42001:2023
ISO and IEC, 18 December 2023; adopted in India as IS/ISO/IEC 42001:2023
Management system standard
Requirements for establishing, running and improving an AI management system
02
What governance looks like in a 20-person office
An owner: one partner or manager accountable for AI decisions. NIST’s GOVERN 2.3 places responsibility for AI risk decisions on executive leadership.
A policy: which tools are approved, what data may go into each, and what a person must check.
A register: every AI tool in use, who uses it, what data it sees and where it runs. NIST’s GOVERN 1.6 asks for an inventory of AI systems.
Training: staff know the policy and how to check outputs (GOVERN 2.2).
Records: logs of who used AI for what, kept long enough to answer a complaint or an audit.
An incident route: how a wrong answer or a data leak is reported and fixed.
A review date: look again whenever a model, vendor or use changes.
03
Indian signals to build on
CERT-In’s advisory of 26 March 2025 on generative AI tells organisations to use only AI tools approved and verified by the organisation, to avoid online generative AI tools for professional work involving sensitive information, to review tools’ access to business data periodically, and to fact-check outputs instead of relying on AI alone for business decisions.
The India AI Governance Guidelines add industry duties of transparency reports and grievance redressal, and propose an AI incidents mechanism. Sector regulators can go further: in January 2019 SEBI asked stock brokers and depository participants using AI or machine learning systems to report them every quarter.
04
Where ANVE fits
On ANVE, cloud models, connectors and the tools an agent can use each need an administrator’s approval; every model call is logged on the box with the user, the app and the model, and every tool call is logged too, as the /security page sets out. That gives an office a record to govern with. The decisions, and the legal duties, remain the office’s.
05
Questions people ask
Is there an AI law in India?
Not a dedicated one, as of October 2026. The India AI Governance Guidelines say existing laws on information technology, data protection, consumer protection and criminal law can govern AI, and that a separate AI law is not needed at this stage.
Do we need ISO/IEC 42001 to govern AI?
No. It is a voluntary standard suited to organisations that want an auditable system. A small office can start with an owner, a policy, a register and logs.
How is AI governance different from responsible AI?
Responsible AI is the set of principles, such as fairness and accountability. AI governance is the machinery that puts them into practice: roles, policies, records and reviews.
Who should own AI governance in a small firm?
One named partner or manager with authority to approve tools and stop uses. NIST’s GOVERN 2.3 puts responsibility for AI risk decisions on executive leadership.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
