The AramGRC blog
Analysis from the front line of AI governance.
ISO/IEC 42001, the EU AI Act, NIST AI RMF and the operating practice of running a credible governance program.
ISO/IEC 42001: The Complete Guide to the AI Management System Standard
The world's first certifiable AI management system standard — requirements, Annex A controls, certification, cost, training and India relevance.
What Is ISO/IEC 42001? The AI Management System Standard Explained
The standard explained in plain language.
ISO 42001 Annex A Controls: All 38 Controls Across 9 Objectives
The 38 AI controls across 9 objectives (A.2–A.10), and how you select which apply.
ISO 42001 Documentation & Toolkit: Mandatory Policies, Templates & Records
The mandatory policies, procedures and records — and what a good ISO 42001 toolkit includes.
ISO 42001 Lead Implementer: Role, Training & Certification
The role that builds and runs the AIMS — course, exam and how it differs from Lead Auditor.
ISO 42001 Certification in India: One AIMS for DPDP, MeitY and RBI FREE-AI
DPDP Act, MeitY guidelines and RBI FREE-AI, mapped to one AIMS.
ISO 42001 vs NIST AI RMF vs the EU AI Act: How They Map
A standard, a voluntary framework and a law — how they fit together.
ISO 42001 for Startups & SMEs: A Right-Sized Path to AI Governance
How smaller AI companies scope, cost and pursue certification proportionately.
ISO 42001 Certified Companies: Who's Certified & Why It Matters
Who is certifying, why the list is growing, and how to verify a certificate.
AI Governance in Healthcare
Why AI governance matters in healthcare, the rules (WHO, FDA, ONC, ICMR, DPDP), a framework, examples and how to establish it.
DPDP Act PDF (Download)
Official PDF links for the DPDP Act 2023 and the notified Rules 2025 — plus the 2025-vs-2026 confusion cleared up.
AI Risk Assessment Tool (Free)
A free AI risk assessment tool to download (Excel), the best free toolkits, and how to choose.
Garak vs PyRIT vs promptfoo: A Hands-On Comparison
I red-teamed the same LLM with Garak, PyRIT and promptfoo — what broke, and which I'd pick.
EU AI Act
What the EU AI Act is, the risk categories, obligations, timeline and penalties.
EU AI Act Compliance
A step-by-step guide and checklist to comply with the EU AI Act.
EU AI Act Risk Categories
The four risk tiers, prohibited practices and high-risk AI systems.
EU AI Act Requirements for High-Risk AI
What providers and deployers of high-risk AI must do.
EU AI Act Timeline & Deadlines
The phased dates — and what the 2026 Digital Omnibus changed.
EU AI Act Penalties
Fines up to €35M or 7% of global turnover — the full structure.
AI Compliance
AI compliance across the EU AI Act, ISO 42001, NIST AI RMF and India's DPDP.
AI Audit
What an AI audit is, the types, the process, and what a good report contains.
How to Audit an AI System
The step-by-step process for auditing an AI system.
AI Audit Checklist
A practical checklist for auditing an AI system.
AI Audit Framework
How an AI audit framework maps to ISO 42001, the EU AI Act and NIST.
AI Auditor: Role, Skills & Certification
What an AI auditor does, the skills, and how to become one.
AI Audit Tools
The tools and software used to audit AI systems, and how to choose.
Third-Party AI Audit
Why independent, third-party AI audits matter and when you need one.
AI Risk Assessment
What an AI risk assessment is, the risks to evaluate, the process, template and framework.
How to Conduct an AI Risk Assessment
The step-by-step process for running an AI risk assessment.
AI Risk Assessment Template
What an AI risk assessment template should contain, and how to use it.
AI Risk Assessment Framework
How an AI risk assessment framework maps to the NIST AI RMF, ISO 42001 and the EU AI Act.
AI Risk Management
Managing AI risk across the lifecycle — beyond a one-time assessment.
AI Vendor Risk Assessment
How to assess the risk of AI you buy or embed from third parties.
Types of AI Risk
The main categories of AI risk, with examples — bias, security, privacy, drift and more.
AI Testing & Red-Teaming
The types of AI testing — evaluation, red-teaming, security, bias and drift — and how to use them.
AI Model Evaluation
How to evaluate an AI model's performance, quality and metrics.
AI Bias & Fairness Testing
How to test an AI system for bias and unfair outcomes.
AI Security & Adversarial Testing
Adversarial testing, prompt injection and jailbreak defence for AI.
AI Model Monitoring: Drift & Performance
Monitoring AI models in production for drift, performance and bias.
AI Red Teaming Tools
The tools used to red-team and adversarially test AI systems.
How to Test AI Models
A step-by-step process for testing AI models before and after release.
Responsible AI
What responsible AI means, the core principles, and how to put it into practice.
Responsible AI Principles
The core principles of responsible AI, explained.
Responsible AI Framework
How to build a responsible AI framework and map it to standards.
How to Implement Responsible AI
A step-by-step guide to putting responsible AI into practice.
Responsible AI Examples
Real-world examples of responsible AI in practice.
Responsible AI Tools & Toolkits
The tools and toolkits that support responsible AI, and how to choose.
Responsible AI Maturity
How to assess and improve your organisation's responsible AI maturity.
What Is AI Governance?
Start here — what AI governance is, the principles, and how to build a program.
AI Governance in India
India's AI governance guidelines, DPDP and the regulatory landscape.
ISO 42001 Certification
Start here — what ISO 42001 is, what it requires, costs, and how to get certified.
ISO 42001 Requirements
The clauses and Annex A controls ISO 42001 asks for.
ISO 42001 Certification Cost
What ISO 42001 certification costs, including in India.
ISO 42001 Checklist
A step-by-step readiness checklist for certification.
ISO 42001 vs ISO 27001
How the AI and information-security standards differ.
How to Get ISO 42001 Certified
The certification process, step by step.
ISO 42001 Lead Auditor
Courses and credentials for individuals.
DPDP Act
What India's Digital Personal Data Protection Act is, what it requires, and how to comply.
DPDP Rules 2025
What the notified DPDP Rules 2025 require and the phased timeline.
DPDP Compliance Checklist
A step-by-step checklist to become DPDP-compliant.
DPDP Act Penalties
Fines up to ₹250 crore — the full penalty schedule and enforcement.
Who Does the DPDP Act Apply To?
Scope, who's covered, exemptions, and key roles.
DPDP Act Enforcement Date & Timeline
Is the DPDP Act in force? The phased dates to 2027.
AI Regulation in India
How India regulates AI: DPDP, MeitY guidelines, RBI FREE-AI and sector rules.
AI Governance Framework
The components of an AI governance framework, with examples.
AI Governance Platforms & Tools
What AI governance platforms do and how to choose one.
AI Governance Certification
Courses, costs and credentials for AI governance professionals.
AI Governance vs Data Governance
How the two differ and why you need both.
AI Governance Roles & Careers
The roles, skills and team structure for AI governance.
Building Trust in AI: A Third-Party Assurance Framework for Enterprises (US & India)
How do you build trust in AI at enterprise scale? AramGRC co-founder Anand shares a practical third-party AI assurance framework — inventory, governance, conformance, red teaming and independent reporting — built for the US and India.
What Is an AI Audit? Types, Scope, and What a Good Audit Report Looks Like
What is an AI audit — and why does "AI audit" mean five different things to five different people? AramGRC co-founder Anand breaks down the types of AI audit, what a good one covers, and exactly what a strong audit report should include.
AI Assurance for Indian AI Companies: DPDP, MeitY & What Global Buyers Expect
How do Indian AI companies win global trust? AramGRC co-founder Anand explains AI assurance for India — the DPDP Act, MeitY's AI guidelines, and what US and EU buyers actually expect from Indian AI vendors.
ISO/IEC 42001 Assurance: How Independent Audits Prove Your AI Is Trustworthy
What is ISO/IEC 42001, and why does an independent audit matter more than "alignment"? AramGRC co-founder Anand explains ISO 42001 certification — the audit process, what auditors check, and how it proves your AI is trustworthy.
EU AI Act Conformity Assessment: When You Need a Third-Party Assessor
Does the EU AI Act require a third-party assessor? AramGRC co-founder Anand explains conformity assessment in plain English — self-assessment vs a notified body, and exactly when high-risk AI providers need an independent assessor.
LLM Red Teaming: How to Test Large Language Models for Safety & Security
How do you red team a large language model? AramGRC co-founder Sakthi explains LLM red teaming step by step — the OWASP LLM Top 10 threats, the tools like Garak and PyRIT, the attack categories, and how to test LLMs for safety and security.
AI Penetration Testing vs AI Red Teaming vs AI Audit: What's the Difference?
AI penetration testing, AI red teaming and AI audit are not the same thing — and buying the wrong one is expensive. AramGRC co-founder Anand explains the difference, how they overlap, and which one your AI product team actually needs.
How to Choose an AI Red Teaming Partner: A Checklist for AI Product Teams
How do you choose an AI red teaming partner? AramGRC co-founder Sakthi shares a practical checklist for AI product teams — what to ask, what a good report looks like, and the red flags to walk away from.
AI Red Teaming: The Complete Guide (How It Works + What a Report Includes)
What is AI red teaming, how does it work, and what belongs in a good report? AramGRC co-founder Sakthi shares a hands-on guide — the process, the tools (Garak, PyRIT, promptfoo), and exactly what an AI red teaming report should include.
Third-Party AI Assurance: What It Is and Why Internal Audits Aren't Enough
What is AI assurance, and why isn't an internal audit enough? An AramGRC co-founder explains third-party AI assurance, how it differs from an AI audit, why passing red-teaming tools like Garak and PyRIT isn't sufficient, and what a good assurance report looks like.
Is there a value in independent AI Red teaming?
A common objection to independent AI red teaming goes like this: "The engineers who built the system understand it better than anyone. How can an outside team find what they missed?" The question assumes that building and breaking sit on the same skill ladder, and that the breaker must stand on a higher rung. They don't, and they needn't.
AIUC-1: A New Standard for Trustworthy AI Agents
AIUC‑1 offers a new, governance‑focused way to address AI malfunctions in the age of agentic systems. Instead of only checking whether security and AI policies exist, it tests how AI agents behave under attack, whether they can be jailbroken, leak sensitive data, or misuse tools autonomously. Positioned alongside standards like ISO/IEC 27001, ISO/IEC 42001, SOC 2, and GDPR, AIUC‑1 adds what those frameworks largely lack: independent, behaviour‑based assurance and documented human oversight through human‑in‑the‑loop workflows. With 50+ technical, operational, and legal safeguards and frequent adversarial testing, it shifts the core question from “Is the AI compliant on paper?” to “Can this AI be trusted to operate safely, securely, and under human control in real‑world enterprise environments?”
IRDAI’s Approach to AI: Building Safe Insurance Systems
How IRDAI, India’s insurance regulator, is responding to the growing use of artificial intelligence in insurance by focusing on governance rather than bans. It shows how AI is improving underwriting, claims and fraud detection, but also creating risks around bias, privacy and opaque decisions. It then highlights IRDAI’s steps setting up an AI working group, urging insurers to “AI‑proof” systems before integrating with the Bima Sugam digital marketplace, and insisting that AI tools be fair, transparent, explainable and accountable, so that innovation can continue while policyholders’ data, rights and trust stay protected.
Agentic AI in Retail Brokerages: When the Model Stops Asking Permission
The leap from Generative AI to Agentic AI in India’s financial sector is happening faster than our compliance frameworks can adapt. It is one thing for a language model to suggest a market trend; it is a fundamentally different risk when an autonomous agent is given the API keys to act on it.
AI Governance Through ISO 42001: Practical Guide for Practitioners
AI is transitioning from experimental pilots to mission‑critical systems that impact customers, employees, and regulators. That evolution makes strong governance indispensable. ISO 42001 — the developing international standard for AI management systems — provides organisations with a structured, auditable framework to manage AI risk, compliance, and performance across the entire lifecycle.
Shadow AI is the BFSI governance blind spot nobody put on the risk register
Every Indian bank, NBFC and insurer now runs an AI program it never approved, never inventoried and cannot see. Shadow AI has quietly become the fastest-growing attack surface in financial services.
AI in microfinance: the inclusion promise and the over-indebtedness risk
The same alternative-data model that brings a first-time borrower into the formal system can also push a vulnerable household into a debt spiral. The governance scaffolding to tell the two apart is mostly missing.
Shadow AI in the clinic: healthcare's quiet patient-data leak
The most common AI deployment in an Indian hospital today is not the radiology triage tool the board approved. It is the resident pasting a discharge summary into a free chatbot at 2 a.m.
Agentic AI in BFSI: when the model stops asking permission
Generative AI drafts. Agentic AI acts. The shift from a model that suggests a reply to a system that opens accounts, moves money, files disputes and emails customers without a human in each loop is the defining governance challenge of 2026 — and most BFSI risk frameworks were not written for it.
Incentivizing Responsible AI Within Organizations
Most companies have a "responsible AI" page on their website. Fewer have a reason for their employees to actually act on it. That gap is not usually a values problem — it's an incentives problem. When a recent study surveyed product managers, the people who make the daily calls on what AI features actually ship, only about one in five said their organization gave them any clear incentive to use generative AI responsibly. Meanwhile, promotion cycles, OKRs, and roadmap pressure all reward one thing: shipping fast. Ask someone to optimize for speed and safety simultaneously, without rewarding the second one, and you already know which one wins.
ISO/IEC 42001 as the control layer that unifies India and the Middle East
When an enterprise faces five regulators across three jurisdictions, the instinct is to run five compliance projects. The discipline is to run one management system and map it to all five.
Synthetic identity and AI fraud at the bottom of the pyramid
The deepfake-CEO stories grab the headlines, but the highest-volume AI fraud in 2026 is happening quietly in microfinance, rural lending and first-time digital onboarding.
The boardroom number: putting a rupee figure on shadow AI
Boards approve AI governance budgets when shadow AI stops being an IT anecdote and becomes a number on a slide. Here are the four numbers that turn an invisible risk into a quantified one.