AI use policy
What staff may and may not do with AI tools, which tools are approved, and what data may never go into them. Written in plain English, short enough to read.
Discover
Use AI. Show your board and your regulator how you control it.
We write the AI policies, run the risk assessments and put in the controls your organisation needs under the Digital Personal Data Protection Act and your sector regulator. Practical controls your engineers can follow, not a binder nobody opens.
- Typical length
- 3 to 6 weeks
- Indicative price
- ₹3 lakh to ₹15 lakh, excluding GST
- Engagement path
- Discover→Prove→Build→Run
Sound familiar?
Typical situations, not quotes from clients.
- Half our staff paste customer data into free AI tools. We have no policy.
- The audit committee asked how we govern AI. We did not have an answer.
- We want to deploy an AI agent, but legal will not sign off until someone explains the DPDP position.
AI governance is no longer optional. The DPDP Act sets duties for anyone processing personal data of people in India. RBI, IRDAI and SEBI expect regulated entities to manage the risks of the technology they use. Customers and enterprise buyers now ask for evidence in their vendor questionnaires.
The DPDP timeline
The Digital Personal Data Protection Act, 2023 receives assent.
The DPDP Rules, 2025 are notified. The Data Protection Board and definitions come into force.
Consent manager provisions come into force.
The remaining obligations apply, including the core duties of data fiduciaries: notice, consent, security safeguards, breach notification, retention and erasure.
Dates are from the published notifications as we understand them. Please confirm them with your counsel. This page is guidance, not legal advice.
What we do
AI inventory and risk assessment
Every AI system and tool in use, including the ones nobody approved. Each one assessed for data, accuracy, fairness, security and regulatory risk.
DPDP mapping for AI systems
Personal data flows through each AI system: what is collected, on what basis, where it goes, how long it stays, and how a data principal’s rights are met.
Technical controls
Data masking before model calls, India-region hosting, access control, logging with retention limits, prompt injection defences and human approval steps. We specify them and help your engineers implement them.
Sector overlays
RBI guidance on outsourcing, IT and the responsible use of AI for regulated entities. IRDAI information and cyber security guidelines. SEBI cloud and cyber resilience frameworks. Clinical responsibility rules in healthcare.
Evidence pack
Documents your auditors, board and enterprise customers can read: policy, register, assessments, controls and an incident process.
How it fits together
How the engagement runs
Typical length: 3 to 6 weeks.
Discover
week 1Interviews with leadership, IT, legal, compliance and the teams using AI. A survey of AI tools in use.
Assess
weeks 2 to 3AI inventory, risk assessments and DPDP data-flow mapping for each system.
Design
weeks 3 to 5Policies, controls and the incident process, reviewed with your legal and compliance teams.
Hand over
week 6Board-level read-out, training for system owners, and a 90-day action plan.
If you are building an AI system with us, governance runs alongside the Prove and Build steps, so controls are ready before go-live. Afterwards, Managed AI keeps the register and assessments current.
How we measure it
We agree with you at the start what “ready” means. Typically:
Every AI system and tool in use is on the register, with an owner.
Every system that handles personal data has a completed data-flow map and risk assessment.
Each identified gap has an owner, a control and a date.
The policy is approved by leadership and communicated to staff.
An incident and breach-response process exists and has been walked through once.
What you get
- AI use policy and acceptable-use guidelines
- AI system register with owners
- Risk assessment for each in-scope system
- DPDP data-flow maps and gap analysis
- Control specifications for engineering teams
- Vendor assessment checklist for AI tools
- AI incident and breach-response process
- Board read-out and 90-day action plan
- Training for system owners
What we need from you
- A sponsor from leadership, legal or compliance
- Interviews with IT, security, legal and the teams using AI
- Your existing privacy policy, information security policy and vendor contracts
- Access to anyone who has deployed AI tools
- Your legal counsel’s time to review the final policy
For small businesses: DPDP Readiness Lite, from ₹1.5 lakh. A fixed-scope pack: a data map, privacy notice and consent wording, consent capture on your website and WhatsApp, a retention schedule, a breach response plan and a staff briefing. We implement the controls in your systems; a lawyer must confirm the legal wording. Ask for it on the discovery call.
Indicative price
₹3 lakh to ₹15 lakh
excluding GST.
The range depends on the size of the organisation, the number of AI systems and the sector rules that apply. You get a fixed price in writing before we start. 40% advance, the rest on milestones.
Frequently asked questions
Are you lawyers?
No. We are engineers and consultants. We do the technical and operational work and write the policies. Your legal counsel should review them, and we work with them directly.
We do not build AI. Do we still need this?
If your staff use AI tools with business or customer data, yes. Most of the risk sits in tools already in use.
Does the DPDP Act ban sending data to foreign AI providers?
The Act permits cross-border transfer except to countries the government restricts. Your sector regulator may have stricter rules, for example on storing payment or insurance data in India. We map what applies to you; your counsel confirms it.
Is this aligned with ISO/IEC 42001?
We can structure the work to fit ISO/IEC 42001 if you plan to certify. We do not certify you ourselves.
What happens after the six weeks?
You own the policies and register. You can keep them current through Managed AI, or assign an internal owner we train.
Be ready before May 2027.
A 30-minute call with a founder. We will tell you where you likely stand and what a readiness review would cover.