Turning AI regulation into controls you can actually test.
Global AI Compliance Guild is an independent group of compliance practitioners, risk experts and technologists. We map AI obligations across jurisdictions, translate them into practical controls, and publish guidance that organisations can check against their own work.
Read our publications · Browse the regulatory register · Get involved
Why Global AI Compliance Guild exists
AI is being adopted quickly across financial services, healthcare and other regulated sectors. Governance requirements are arriving from many directions at once, and implementation guidance is fragmented. Organisations are left to translate regulatory intent into technical controls on their own.
Global AI Compliance Guild exists to close that gap, slowly and carefully, with work that can be checked.
Independent
No single organisation's product or commercial interest shapes our output.
Sourced
Every regulatory statement cites its primary source and version date.
Versioned
Every publication carries a version number, an effective date and a change log.
Corrected in public
Errors are fixed and recorded in the change log, not quietly replaced.
What we do, and how we work
Draft v0.1
Purpose
To help organisations understand and implement AI compliance requirements through sourced, practical and independently produced guidance.
Scope
- Geographies: India, United Kingdom, European Union, United States, and the Middle East (first named jurisdictions to be confirmed).
- Sectors: financial services first; healthcare to follow.
- Reference frameworks: NIST AI Risk Management Framework and ISO/IEC 42001, treated as voluntary standards.
Workstreams
- Regulatory register: a versioned record of AI obligations, their status, applicability and sources.
- Control framework: controls mapped to the register, linking regulation, obligation, control, evidence and test.
- Assurance model: test procedures, evidence expectations and a maturity scale.
- Publications: one whitepaper per quarter, with shorter guidance notes in between.
Working model
- The group meets fortnightly.
- Decisions are made by consensus. Where consensus fails, the convenor decides and records the reasoning.
- Roles rotate, and written processes cover publishing, review and correction.
- Members participate in a personal capacity. Members must not discuss pricing, customers or competitive strategy of their employers.
Review
The charter is reviewed annually. If a quarter passes without a publication or register update, the group meets to decide whether to continue, change scope or pause.
Who is involved
Global AI Compliance Guild is run by practitioners who volunteer their time. Members are listed here with their agreement.
| Member | Role |
|---|---|
| Kalyan Chandrapu | Founding member and convenor |
| Sudha Kiran Pentela | Founding member and convenor |
| Vivek Aggarwal | Founding member and convenor |
| Suresh Chandra | Founding member and convenor |
Join us. We are looking for practitioners in each jurisdiction, and for people who can test our guidance against real work. Get in touch.
Live register of AI obligations
Version 0.1 · In preparation
The register records each AI obligation by jurisdiction, with its status, applicability, effective date and primary source. Entries are added only after they have been checked against the source. Version 0.1 will be published once the first jurisdiction has been reviewed.
Open the AI regulatory tracker (working log of recent regulatory activity; not yet reviewed against the sources)
Latest regulatory items
Items are added only when linked to an official source. Entries marked as unverified have not yet been reviewed by a member.
Loading latest items…
Entry 1: Digital Personal Data Protection Act, 2023 (India)
| Instrument | Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), and Digital Personal Data Protection Rules, 2025 |
| Regulator | Data Protection Board of India |
| Status | Enacted. The Rules were notified in November 2025 and the Act's obligations take effect in phases over about 18 months. The final compliance date is around May 2027; sources differ by a day, so confirm against the notification. |
| Applicability | Processing of digital personal data in India, and processing outside India connected with offering goods or services to people in India (S.3). Applies to Data Fiduciaries, Significant Data Fiduciaries, Data Processors and Consent Managers. |
| Primary source | Act No. 22 of 2023, Gazette of India. Link to be added. |
| Last checked | 5 November 2026, against the Act text as recorded in the group's working register. Gazette check outstanding. |
Key obligations (Data Fiduciary)
| Section | Obligation | Type |
|---|---|---|
| S.4 | Process personal data only for a lawful purpose, on consent or on a legitimate use under S.7 | Mandatory |
| S.5 | Give a notice with, or before, each consent request, in the prescribed form | Mandatory |
| S.6 | Obtain consent that is free, specific, informed, unconditional and unambiguous. Allow withdrawal as easily as consent was given. Stop processing after withdrawal. | Mandatory |
| S.6(10) | Be able to prove that valid notice and consent were given | Mandatory |
| S.7 | Legitimate uses without consent (voluntary provision, State functions, legal obligations, medical emergencies, employment). These are alternative bases, not additional duties. Determine which basis applies before assessing obligations. | Non-mandatory (basis) |
| S.8(1) | Remain responsible for compliance, including for processing done by a Data Processor | Mandatory |
| S.8(5) | Protect personal data with reasonable security safeguards | Mandatory |
| S.8(6) | Notify the Board and each affected Data Principal of a personal data breach, in the prescribed manner. Timing and content are set by the Rules and are not yet recorded in this entry. | Mandatory |
| S.8(7) | Erase personal data when its purpose is served or consent is withdrawn, unless retention is required by law | Mandatory |
| S.9 | For children, obtain verifiable parental consent. Do not carry out tracking, behavioural monitoring or targeted advertising directed at children. | Mandatory |
| S.10 | For Significant Data Fiduciaries only: appoint a DPO based in India, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments | Mandatory (if notified) |
| S.11 to S.14 | Honour Data Principal rights: access, correction and erasure, grievance redressal and nomination | Mandatory |
| S.16 | Do not transfer personal data to countries the Central Government restricts | Mandatory |
| S.17 | Exemptions. Each exemption applies only where its stated conditions are met. Read the clause in full; conditions are not summarised here. | Non-mandatory |
| S.33 and Schedule | Penalties. Amounts to be verified against the Schedule text before publication. | n/a |
Gaps in this entry: the Rules prescribe breach-reporting detail, notice content, and the Significant Data Fiduciary classification process. These are not yet extracted and are the next priority for this entry.
Entry 2: Model Risk Management guidance (RBI, draft 2026)
| Instrument | Guidance on Regulatory Principles for Model Risk Management, 2026 (draft). Press Release 2026-2027/528, 24 June 2026. The circular number is not yet assigned in the draft. |
| Regulator | Reserve Bank of India |
| Status | Draft for consultation The comment period closed on 24 July 2026. This entry does not confirm whether a final version has been issued. Check the RBI website before relying on it. |
| Applicability | Paragraph 4 lists commercial banks (including foreign banks), small finance banks, payments banks, local area banks, regional rural banks, urban and rural co-operative banks, NBFCs (base, middle, upper and top layers), all-India financial institutions, asset reconstruction companies and credit information companies. Some press coverage describes a narrower scope. Paragraph 4 governs. |
| Effective date | Not stated in the draft |
| Relationship to other rules | Read with RBI Directions. Where they conflict, the Directions prevail (para 5). Applies to all models, whether built internally or bought from third parties (para 6). On final issue, supersedes Chapter 3 of the 2002 Guidance Note on Credit Risk Management (para 64). |
| Primary source | RBI draft text, 16 pages. Link to the RBI press release to be added. |
| Last checked | 5 November 2026, against the draft text. The draft says further AI requirements may follow (para 2), so this entry will need a further review. |
Key AI provisions (Chapter V.B) and related paragraphs
| Paragraph | Requirement |
|---|---|
| 9 | A Board-approved MRMF must cover AI and ML models, whatever their source |
| 17 to 20 | Risk-tier all models, review tiers at least annually. A low-complexity score must not reduce the tier of a material model. |
| 29 to 33 | Independent validation by the RE before and after deployment, after changes, and periodically |
| 45 to 48 | Third-party models: the RE stays accountable, validates independently regardless of the provider's assurance, and has due diligence, documentation and audit rights in contracts |
| 49 to 51 | Define the scope of AI and ML models, including foundation and frontier models. Deploy only where the risk can be managed. |
| 52 | Consider reliance on model outputs and the level of autonomy when tiering AI models |
| 54 | Set explainability thresholds and apply higher ones to material decisions. Control hallucinations. Test for bias and fairness. Monitor for overfitting and data or concept drift. |
| 55 and 56 | Red-teaming for customer-facing and generative models. Strict controls over automatic model updates. |
| 57 | Enhanced documentation for traceability, reproducibility and auditability |
| 58 and 59 | Deployment safeguards, including controls against prompt injection. Disclose to customers that they are interacting with AI. Offer a route to a human. |
| 60 to 63 | Human oversight, including override and kill-switch mechanisms, and guarding against automation bias |
| 25 | Do not use any model that harms consumers. Grievance redressal must cover consumer-facing models. |
Note on sources: this entry is based only on the published draft. No consultation submission has been used. Paragraph references are to the draft and may change in the final text.
Fields in each entry
| Field | What it records |
|---|---|
| Jurisdiction and regulator | Where the obligation applies and who enforces it |
| Instrument | The law, regulation, guidance or standard, with its version |
| Status | Enacted, draft, guidance or voluntary standard |
| Applicability | Entity type, sector, use case and risk class where specified |
| Effective date | When the obligation takes effect |
| Primary source | Link to the official text, and the date accessed |
| Last checked | Date of the most recent review against the source |
Published work
Our first whitepaper is in preparation. Each publication will carry a version number, sources, stated limitations and a change log.
From regulation to control
How to move from an AI obligation to a control, its evidence and a test.
Change log
| Date | Version | Change |
|---|---|---|
| [Date] | 0.1 | Website and charter draft published |
Get in touch
For membership, corrections to our publications, or to suggest a regulatory change we should track, write to us at [group-email].
Corrections are published in the change log for the relevant document.