What it means
- Publish a clear statement about how your company uses AI: main use areas, governance, how customers are protected, how to complain.
- Keep user-facing terms and notices current, including what is prohibited, what happens on misuse, and which laws apply.
- Send periodic reminders to users where rules require them.
- ISO 27001 reuse: None. New for AI, not covered by ISO 27001. Existing privacy notice ownership and review cycles (SOC 2 P1.1) can host it.
Why it matters
- RBI FREE-AI asks regulated entities to publish AI disclosures in the annual report and website, and to run awareness campaigns on safe AI use and customer rights.
- The 2026 IT Rules require intermediaries to remind users at least once every three months about consequences of breaches, and SGI tool providers to warn about misuse penalties.
- MeitY advisories expect terms of service to spell out prohibited content, consequences and applicable penal provisions.
- The India AI Governance Guidelines encourage voluntary transparency reports.
Checklist
- Draft a public "How we use AI" page: use areas, governance owner, human oversight, data use, complaint route, last updated date.
- BFSI: add an AI section to the annual report (governance, use areas, consumer protection, complaints handled) and get board sign-off (SC-AI-040 Board reporting and AI risk metrics).
- Update terms of service to list prohibited content, consequences (removal, suspension, legal liability, reporting to authorities) and relevant laws.
- If you offer generative tools: add a specific misuse warning naming penalties.
- Platforms: schedule user reminders at least every three months, in English or a Schedule VIII language the user chose; keep send logs.
- Show prohibited-content reminders at registration, login and upload where advisories expect it.
- Run a customer awareness item (FAQ, email, branch poster) on safe AI use and how to complain.
- Review the statement at least yearly and when a new AI use goes live.
Evidence examples
- Published AI transparency page with version history.
- Annual report extract with the AI disclosure section.
- Terms of service with dated change log.
- Quarterly reminder campaign records (content, languages, send dates, delivery counts).
- Awareness campaign material and distribution records.
Common pitfalls
- A glossy "responsible AI" page with principles but no facts on actual use or complaint routes.
- Statement goes stale after new AI products launch.
- Reminder sent once, not every three months.
- Legal terms only in English for a user base that chose a regional language.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- VoluntaryNIST AI RMF and GenAI Profile
- BindingNYC Local Law 144 (AEDT)
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryMeitY AI and Deepfake Advisories
- VoluntaryRBI FREE-AI
Also relevant to
- India AI Governance Guidelinesguidance mapping (transparency reports; no obligation IDs)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 7.4 communication
- A.8.2 system documentation and information for users
- A.8.5 information for interested parties
ISO/IEC 27001
No direct equivalent
SOC 2
- CC2.3
- P1.1
Key takeaways
- Publish facts, not slogans: where AI is used, who owns it, how to complain.
- Platforms in India must remind users about rules every three months.
- Review the statement when new AI goes live, not just once a year.