Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 01 AUGUST 2025

CERT-In's New BOM Guidelines: What India's Software, AI, And Hardware Ecosystem Needs To Know

AZB & Partners
AZB & Partners
Contributor
AZB & Partners

AZB & Partners

AZB & Partners, one of India’s premier law firms was founded in 2004 with a clear purpose to...

View firm profile
Explore more from AZB & Partners

The Indian Computer Emergency Response Team ("CERT-In") has issued the updated version of the "Technical Guidelines on | SBOM | QBOM & CBOM | AIBOM | HBOM" on July 09, 2025..

IndiaTechnology
Aprajita Rana
Aprajita Rana
Shruti Agrawal
Shruti Agrawal
Amulya Bhatia
Amulya Bhatia
Author LinkedIn connections

The Indian Computer Emergency Response Team (“CERT-In”) has issued the updated version of the “Technical Guidelines on | SBOM | QBOM & CBOM | AIBOM | HBOM” on July 09, 2025 (“Guidelines”) for maintenance of Bill of Materials (“BOM”).

A BOM is a comprehensive, structured list of all the components, materials, and instructions required to manufacture a product. These Guidelines introduce a voluntary but detailed framework for improving software supply chain transparency through the maintenance of BOM across software and now artificial intelligence (“AI”), and hardware systems.

Even though not legally binding, these Guidelines represent the intent of the Indian Government to establish a structured best practice model and ‘good to have' measures that are likely to influence contractual standards, procurement procedures, and regulatory expectations in India and become market practice.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Use Of Artificial Intelligence (AI) In Courts

On June 3, 2026, the Supreme Court of India’s AI Committee released preliminary draft of the Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 (“The Draft”). This marks a shift from scattered experiments with AI tools for translation, transcription, research and case management. With over 93,000 pending matters as of March 2026, the guidelines aim to ease processes for officials and citizens. AI could help reduce backlogs through automated cause-list preparation, transcription, research, and defect scrutiny, but its use also raises serious concerns.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Fintech In India: An Overview Of The Current Regulatory Landscape

India's fintech market is one of the fastest growing in the world, and it shows no sign of slowing down. Estimates put the market at about USD 145 billion at the end of 2025, growing at a compound annual rate of 30.55% to reach roughly USD 550 billion by 2030. India's fintech adoption rate is around 87%, reportedly the highest anywhere and well above the global average of roughly 64% to 67%. Add the world's second-largest digital population and the runway looks long.
IndiaTechnology
Legitpro Law
Legitpro Law
Article

CERT-In’s New AI-Vulnerability Guidelines: A Quick-Reference For OEMs, Tech Vendors And In-House Counsel

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Cybersecurity Is Now A Contract Risk: What India's New Power-Sector Regulations Mean For Technology Vendors

For most technology vendors, cybersecurity has been a promise made to a customer, set out in a statement of work and enforced, if at all, through the contract. For vendors supplying India's power sector, that is changing. The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, notified on 31 July 2026 under the Electricity Act, 2003, impose obligations directly on vendors, alongside a far more demanding set of requirements for the power-sector entities they serve. Most of these provisions come into force on 1 April 2027.
IndiaTechnology
Legitpro Law
Legitpro Law
Article

Enhancement Of PF Wage Ceiling To INR 25,000

The Ministry of Labour & Employment has issued a notification dated September 17, 2026, notifying INR 25,000 per month as the new wage ceiling for the purposes of the provident fund provisions (“PF“) of the Code on Social Security, 2020 (“SS Code”). The notification is effective from September 17, 2026. The wage ceiling was last revised 12 years ago in September 2014, when it was increased from INR 6,500 per month to INR 15,000 per month.
IndiaEmployment and HR
AZB & Partners
AZB & Partners
Article

Rethinking E-Commerce Compliance: Key Changes Under The Consumer Protection (E-Commerce) (Amendment) Rules, 2026

On September 9, 2026, the Ministry of Consumer Affairs, Food and Public Distribution (Department of Consumer Affairs) notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 (“Amendment Rules”), amending the Consumer Protection (E-Commerce) Rules, 2020 (“E-Commerce Rules”). The Amendment Rules will come into force on January 1, 2027.
IndiaConsumer Protection
AZB & Partners
AZB & Partners
Article

FCRA Amendment Rules, 2026: Key Changes And Practical Implications

AZB & Partners provides important disclaimers regarding the nature and purpose of their website, clarifying that no solicitation or advertising has occurred and that the information is provided solely at the user's request. The firm outlines the limitations of the website content and emphasizes that accessing it does not create a lawyer-client relationship. Users are informed about their responsibilities when using the site and the firm's intellectual property rights over the content.
IndiaCorporate/Commercial Law
AZB & Partners
AZB & Partners
Article

Arbitral Award Signed, Not Stamped: The Delhi High Court In URC Construction v. Airports Authority Of India Closes The Door On Deferred Stamp Duty At The Enforcement Stage

The Delhi High Court has ruled that arbitral awards must be stamped when signed, not when enforcement is sought, closing a decades-old practice of deferred stamp duty payment. Once the one-month statutory window expires, award holders cannot cure the deficiency through unilateral deposit and must pay both deficit duty and penalty at a fixed rate, fundamentally reshaping enforcement practice for arbitration practitioners across India.
IndiaLitigation, Mediation & Arbitration
AZB & Partners
AZB & Partners
Article

New Social Security Schemes For Employees In India

India has introduced three new social security schemes under the Code on Social Security, 2020, effective July 1, 2026, fundamentally restructuring the country's provident fund, pension, and insurance frameworks. These schemes replace decades-old regulations and introduce special provisions including enrollment campaigns, damage relief programs, and retrospective exemptions for establishments. The new framework maintains contribution structures while introducing significant operational changes and transitio
IndiaEmployment and HR
AZB & Partners
AZB & Partners