Forward-deployed AI consulting in India
India has no AI-specific statute yet. The government's guidelines are voluntary, and the binding duties for an agent come mainly from the data protection law and from the rules of sector regulators. That shapes how I work here. The questions a team must answer are usually about personal data, about who owns the system once it is built, and, for a financial firm, about governance, customer rights and explainability.
I am Mayur Patil, based in Nashik, India. I work with Indian enterprises and global capability centres on forward-deployed AI consulting, and the India pillar sets out the rules with their sources.
What is changing in India
India's global capability centres are the largest group of buyers for this work. The NASSCOM and Zinnov report of 2024 counted more than 1,700 GCCs in India in FY2024, with 2,975 GCC units and more than 1.9 million professionals. Six cities host 92 per cent of them: Bengaluru, Hyderabad, Pune, Mumbai, the National Capital Region and Chennai. The centres are moving from delivery work toward owned outcomes, which is the point where an agent has to be designed, tested and handed over.
Banking is the largest single group within that picture. Zinnov counts 333 BFSI GCC units across India. Bengaluru holds 80 of them, Mumbai 56, Hyderabad 51 and Pune 36, and the six cities hold 289 in total. The Bengaluru, Hyderabad, Pune and Mumbai pages each cover the local facts I can source.
The data protection law
The Digital Personal Data Protection Act was enacted on 11 August 2023. Its Rules were notified on 13 November 2025 under G.S.R. 846(E), and they phase in over time. Rule 4, on consent managers, applies one year after publication, from 13 November 2026. Most of the other obligations apply eighteen months after publication, around 13 May 2027.
For an agent, the duties attach to what it reads, writes and logs. The processing needs a lawful basis. People must be given notice of what is collected and why. People must be able to exercise their rights, including correction and erasure, through a route that works. The data must be protected with security safeguards, and a breach must be handled under the Act. A centre that builds an agent before these dates should have the data map, the basis and the rights route in place already, because retrofitting them costs more than designing them in.
The governance guidelines
MeitY released the India AI Governance Guidelines on 5 November 2025 under the IndiaAI Mission. They set seven principles, called sutras, and six pillars, and they say that a separate AI law is not needed at this stage. Risk and procurement teams will use them to ask questions. The guidelines' concerns are accountability for outcomes, transparency about the system's behaviour and safety. An agent designed to answer them in advance is easier to defend than one that answers them after an incident.
The financial sector
The Reserve Bank of India's FREE-AI Committee published its report on 13 August 2025. The report is recommendations, and it may be turned into formal directions. A financial firm should read the report's wording for each recommendation before it relies on one, and it should watch for directions that apply to its regulated activities. For a bank or insurer, the first design questions are governance, customer explanation and the record of decisions.
Public support for AI
The Union Cabinet approved the IndiaAI Mission on 7 March 2024, for a five-year programme. Its compute pillar envisions more than 10,000 GPUs. For a team, the mission is context rather than a rule. It explains why national compute and skills are available, and it is a reason to expect buyers to ask about capability building.
One example use case
The example below is an illustration of the work, not a client engagement.
Example: a KYC-document agent for a bank's operations centre. The centre processes onboarding documents for new retail customers. The proposed agent checks each pack against the checklist, flags missing or expired items and drafts the request to the customer. It does not approve an account. The readiness review settled three points first. The documents contain personal data, so the agent sees only the fields the checklist needs. An operations officer approves every request sent to a customer. And the evaluation set is built from past packs whose outcomes the team has already reviewed.
How an engagement runs
An engagement starts with the two-week AI Delivery Readiness Review on one workflow, with the people who run the work in the room. The review lists the personal data each step reads, the sector rules that apply, and the actions that need an approver. It ends with a written recommendation to proceed, reframe or pause. If the work proceeds, an architecture sprint or a forward-deployed delivery engagement follows, with a named owner at handover.
Three ways to start
AI Delivery Readiness Review. Two weeks on one workflow, with a written readout.
Architecture Sprint. Two to four weeks on one use case, with the architecture, recorded decisions and a backlog.
Forward-deployed AI delivery. One bounded use case, built with your engineers, with a runbook and a named owner.
Each is quoted on its scope. The engagements page describes what each includes. I do not publish prices.
Relevant work
The organisations I have worked with and can name are listed on the about page. They include Tredence, Persistent Systems and Walmart, and I have worked with Wipro and Infosys on capability programmes. I do not describe the detail of that work beyond what the clients have agreed to share.
Where to go next
The FDE consulting hub covers the three ways to engage. For the cohort and team programmes, see the India training page. For the rules, the India pillar is the reference.
Common questions
When do the DPDP obligations start for an AI system we build now?
The DPDP Rules were notified on 13 November 2025. Rule 4, on consent managers, applies one year after notification. Most of the other obligations apply eighteen months after notification, around 13 May 2027. The notified Rules are the reference for the exact dates.
Are the India AI Governance Guidelines binding?
No. MeitY released them on 5 November 2025 as non-legislative guidance. They shape what risk and procurement teams ask for, and a vendor that can answer those questions in writing is easier to hire. The binding duties for an agent come mainly from the data protection law and sector regulators.
Can a global capability centre run forward-deployed work for its parent company?
Yes. The operating model decides who owns each system. Three models are common: a central pod, an embedded team with a shared platform, and a partner-led build. The centre names the owner in the business and keeps the runbook.
Which cities do you work in?
I work with teams in Bengaluru, Hyderabad, Pune and Mumbai, and I am in Bengaluru, Hyderabad and Pune often for engagements. Each city has its own page with the local facts I can source.
Sources
- Official: PIB, India AI Governance Guidelines (5 November 2025)
- Official: PIB, Digital Personal Data Protection Rules notified (November 2025)
- Official: MeitY, Digital Personal Data Protection Rules 2025
- Official: RBI, FREE-AI Committee report (13 August 2025)
- Official: PIB, IndiaAI Mission cabinet approval (7 March 2024)
- Zinnov with NASSCOM, India GCC landscape, five-year report (2024)
- Zinnov, the role of six cities in India GCC growth
- Zinnov, five steps for BFSI GCCs to lead the AI shift in India (BFSI units by city)