Service 03

AI Governance and Compliance in India

In India, a model in production is a liability until someone owns the law, the failure modes, and the people who will use it. We put that operating layer in place—AI governance and compliance under the DPDP Act.

Typical duration

4–6 weeks

Typical investment

Starting at ₹6.5L

Led by

Founder, hands-on

Output

Compliance audit + trained internal owners

When this is the right engagement

  • Legal is asking what the model can see and where the answers go.
  • Nobody has tested for leaks, hallucinations, or biased outcomes.
  • Staff are prompting production tools with no shared rules.
  • You need GDPR, HIPAA, or DPDP alignment—not a policy PDF.

The work

What we actually do

01

Compliance Management

Align AI systems with data laws like GDPR or HIPAA.

02

Risk & Bias Audits

Test models for data leaks, hallucinations, and bias.

03

Staff Upskilling

Train employees on prompt engineering and safe AI usage.

Cadence

How the weeks go

  1. Week 1

    Law, data flows, and owners

    We map what the system ingests, who can see the output, and which regulation actually applies. Decision rights get names, not committees.

  2. Weeks 2–4

    Audit the model in the wild

    Leak tests, hallucination suites, and bias checks against the cases that already hurt. Findings come with a fix or a kill, not a score.

  3. Weeks 5–6

    Train the people who will run it

    Prompting, review, and when to stop. The operating rules live with the team, not in a slide they never open again.

What you leave with

  • A compliance map: data flows, lawful basis, and named owners
  • An audit report covering leaks, hallucinations, and bias
  • Remediation or kill criteria for every finding
  • A training session and a one-page safe-use guide for staff

What we will not do

This is how you tell a builder from a firm selling AI as a mood. If you need one of these, we are the wrong partner—and we will say so.

  • Policy decks with no test against the live system
  • “Trust the model” in place of an audit
  • Training that is only a prompt-engineering webinar
  • Rubber-stamping a system we would not put our name on

Also

01AI Strategy & AuditingOpen02Custom AI ImplementationOpen

Questions operators actually ask

Questions about this engagement.

What does AI governance cover under the DPDP Act?

For companies in India: what the model can see, where answers go, named owners, and tests for leaks, hallucinations, and bias. DPDP is the default when the data is personal. GDPR or HIPAA apply when those regimes actually bind you—not as decoration.

How long does a governance engagement take?

Typically 4–6 weeks, starting at ₹6.5L. We map data flows and owners, audit the live system, then train the people who will run it. Policy decks with no test against production are not the work.

Will you train our team in India?

Yes. Prompting, review, and when to stop. The operating rules live with your staff, not in a slide they never open again. Training is part of the engagement, not an optional webinar.

Do you stay after the audit?

No. You leave with a compliance map, an audit report, remediation or kill criteria, and a one-page safe-use guide. We do not sell a retainer to babysit a DPDP policy.

Tell us the job that already hurts.

We’ll tell you honestly if we can help and what it would take.

Write to us