ICMR's guidelines for AI in healthcare, explained for hospitals

In 2023 the Indian Council of Medical Research published Ethical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare. It is the main Indian reference for how AI in health should be built, tested and used, and ethics committees reviewing AI research turn to it.

Most hospitals have heard of it and few have read it. This article explains what it says, in plain terms, and turns it into a checklist a hospital can act on. It is a summary, not legal advice.

The ten principles

The guidelines set out ten principles, in this order. The one-line glosses are our reading, not the guidelines’ own wording:

1. Autonomy. People stay in control of decisions about their care, and AI supports rather than replaces clinical judgement.
2. Safety and risk minimisation. Harm is anticipated and reduced before and after deployment.
3. Trustworthiness. Systems behave reliably and can be understood well enough to be trusted.
4. Data privacy. Personal data is protected throughout.
5. Accountability and liability. It is clear who is responsible for an AI system and its outcomes.
6. Optimisation of data quality. The data a system learns from and works on is good enough, and representative.
7. Accessibility, equity and inclusiveness. The benefits reach people fairly.
8. Collaboration. Clinicians, technologists, patients and others work together.
9. Non-discrimination and fairness. Systems do not disadvantage groups of people.
10. Validity. Systems are shown to work, in the setting where they are used.

Three parts hospitals should read closely

Data quality. The guidelines say training data “must not have any sampling bias”, and that datasets “should adequately represent the population in which the technologies are intended to be used.” They recommend a “pre-deployment testing” process at every new site, and say that if bias is alleged, the system’s operation must be temporarily discontinued.

For a hospital, the practical meaning is that a tool built on other patients has to be tested on yours before you rely on it, and there has to be a way to pause it.

Validation. AI “must undergo rigorous clinical and field validation before application on patients/participants”, and validation should use “independently collected datasets other than the training dataset.” A vendor’s accuracy figures, measured on its own data, are not validation in this sense.

Ethics committees. The guidelines ask ethics committees to check AI proposals for their data source, quality, safety, anonymisation and data selection biases. Committees that often review AI projects should consider adding legal experts, data scientists and computer scientists. Review categories (exempt, expedited or full) follow ICMR’s 2017 national ethical guidelines, under which a researcher cannot decide the category for themselves: every proposal goes to the committee.

How it fits with other rules and guidance

• ICMR’s 2017 National Ethical Guidelines for biomedical and health research govern any study involving patients or their records, AI or not.
• The Digital Personal Data Protection Act, 2023, with Rules notified in November 2025, governs the personal data any AI system processes. Most of its obligations take effect around May 2027.
• WHO’s 2021 guidance on the ethics and governance of AI for health sets out six principles that overlap heavily with ICMR’s, and WHO added guidance on large multi-modal models in 2024.
• NITI Aayog’s Responsible AI papers (2021) set out seven principles for AI in India across sectors.
• ISO/IEC 42001:2023 is an international standard for an AI management system, for organisations that want a formal, certifiable process.

A checklist for hospitals

1. Name an owner. One person or a small committee approves AI tools and is accountable for them.
2. Write down the purpose. For each tool: what it is for, who uses it, and what it must never do.
3. Ask for the data. What was the tool trained and tested on? Does it represent your patients?
4. Test it on your own patients before relying on it, using data it was not trained on.
5. Keep a person in the loop. Anything clinical is reviewed by a clinician before it reaches a patient or their record.
6. Tell patients. Explain where AI is used in their care, and record consent where it is needed, such as recording a consultation.
7. Protect the data. Know where it goes, whether it leaves India, and whether a vendor uses it to train models.
8. Monitor after go-live. Measure performance on a schedule, and look for differences between groups of patients.
9. Make it easy to report a wrong answer, and record what was done about it.
10. Be able to stop. Know how to pause a tool quickly if something goes wrong.
11. For research, go to the ethics committee before you start, with the data source, quality and anonymisation described.

Where 92health fits

92health is an EMR and AI platform used by clinics, hospitals, pharmacies, labs and optical shops in India. Its AI features are built around several of these principles:

• AI drafts and reads, and a person checks the result: notes, summaries and certificates arrive as drafts a clinician edits and signs;
• the AI agent that answers questions about a clinic’s numbers can read freely, but anything it would change waits for a person’s approval;
• consultations are recorded with the patient’s consent;
• access is by role, changes are logged, and patient data stays in India.

None of this makes a hospital compliant on its own. Governance is something a hospital does, not something it buys. But software can make the right practice the default, and we help hospitals put the rest in place as part of our AI readiness work.

Sources

• ICMR. Ethical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare, 2023.
• ICMR. National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017.
• WHO. Ethics and governance of artificial intelligence for health, 2021, and guidance on large multi-modal models, 2024.
• NITI Aayog. Responsible AI #AIforAll, Part 1: Principles for Responsible AI, 2021.
• MeitY. DPDP Rules, 2025.
• ISO/IEC 42001:2023. IEC webstore.