AI governance sets the rules for how an organisation builds and runs AI: which decisions may be automated, what human oversight is required, how models are tested for bias, what is logged for audit, how personal data is handled under the DPDP Act 2023, and who is accountable when something goes wrong.
Governance is what survives the first bad outcome
Every AI deployment eventually produces an outcome someone disputes — a rejected application, a misrouted complaint, an unfair-looking pattern. The organisations that handle it well are the ones that can show what the system decided, on what basis, who reviewed it, and what recourse exists. The ones that cannot are the ones that end up in the news.
For public-sector and citizen-facing work this is not optional. Decisions affecting people need documented logic, human review on consequential outcomes, and a grievance path. We build governance as part of delivery rather than as a document written afterwards.
Process
How we deliver it
Process flow for AI governance & responsible AI
01
Inventory AI use
Every system, what it decides and who it affects.
02
Classify risk
Tiered by consequence, from low-stakes to individual-affecting.
03
Set the rules
Human oversight, approval thresholds and prohibited uses.
04
Test for bias
Outcome disparity testing where decisions affect people.
05
Instrument and review
Audit logging, grievance path and periodic review cadence.
Deliverables
What you receive
An AI use inventory with risk classification
Written governance policy with clear accountability
Bias testing methodology and baseline results
Audit logging specification and grievance handling process
DPDP Act alignment review of data flows and consent
Engagement shape
Four to eight weeks for a framework. Ongoing review is usually a light quarterly retainer.
Stack decisions follow the problem. This is where we usually start, not a fixed menu.
Frequently asked
Questions we get about this
Is AI regulated in India yet?
There is no comprehensive AI-specific statute at present, but the DPDP Act 2023 governs the personal data flowing through AI systems, and sectoral regulators issue their own guidance. Building to a defensible standard now is considerably cheaper than retrofitting when rules arrive.
How do we test for bias practically?
By measuring outcome disparities across relevant groups on real historical cases, and investigating gaps. It requires data you may not currently collect, which is itself a finding. The method matters less than doing it consistently and documenting what you found.
Talk it through before you commit
A discovery call is a working session on your constraint, not a sales pitch.
