Board Approval Memo for PSU AI Buys

A director (technical) circulated twelve slides and a vendor film. The company secretary asked for the memo. The slides said transformation. The memo, when it arrived, still said transformation, plus a number that looked like a capex. There was no vigilance paragraph. There was no data-class paragraph. There was a sentence that necessary approvals would be obtained. The board deferred.

PSU boards are allowed to buy tools. They are not allowed to buy fog. A usable memo has three spines — commercial, vigilance, data — and a request that a director can vote on without becoming a prompt engineer.

This template is for the CIO who has to write that memo, and for the CS who has to refuse the film. It is not a substitute for your articles, your DPE guidelines, or your instrument of delegation. Check those. Then fill the spines.

The three spines, on six pages

Commercial: what is being bought, from whom by what route, for which workflows, at what cost across years, against which head, with what exit. Not a TAM slide.

Vigilance: how competition was or will be ensured, why any restriction exists, how POCs and gifts were handled, how application of mind remains human. Not a badge.

Data: fiduciary, classes, perimeter, Aadhaar (usually: none), traces, training ban, DPDP map. Not we take security seriously.

Six pages is a target, not a virtue. Annex the architecture and the use-case papers. Do not hide the human gate in an annex the board will not open.

Headings to paste into the note

1. Purpose and workflows. Identifiers from the register. What will not be automated.
2. Why now. A file reason — charter breach, incident, audit para — not a conference.
3. Options considered. Do nothing; extend current IT; hosted; on-prem or [air-gapped. Real costs, not insults.
4. Route and competence. GeM, open tender, rate contract; DFPR, board or CMD as per your live delegation. Do not invent rupee thresholds here; cite the current instrument.
5. Commercials. Capex, opex, power, people, AMC, and what happens if FY renewal slips.
6. Vigilance paragraph. Competition, specification fairness, POC terms, no leftover access, no invented CVC AI circular.
7. Data paragraph. Fiduciary, classes, residency, no Aadhaar in logs, no training on company cases, packet export.
8. OT paragraph if a plant is in scope. Agent stays off OT. One-way copy only.
9. Human gate. Named posts. System of record.
10. Risks and residual risk the board is being asked to accept.
11. Request. A voteable sentence. Not guidance of the board is sought unless you truly want guidance.
12. Annex list. Use-case papers, data-flow, legal or DPO note, CVO comments if any.

Sentences that survive the minutes

This purchase does not authorise automated award, automated discipline, or write-back to operational technology.

The company is the data fiduciary for the listed classes. Processors are named in annex.

We have not relied on an unsourced national spend statistic or on an unsourced CVC AI circular.

If the vendor ends, the company will retain corpus, prompts, traces and a loadable adapter as specified in the contract draft at annex.

Autonomy as a Maharatna, Navratna or Miniratna, if claimed, does not reduce DPDP, vigilance or the need for this board process where the delegation so requires.

What not to attach

• A vendor film in lieu of the data paragraph.
• A title-bank statistic such as an unsourced 22% national fall.
• A model card as the whole risk annex.
• An integrity-pact scan with no specification behind it.
• A list of fifty future use cases you cannot staff.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

The board does not read six pages

Then they should not approve a system that drafts plant or commercial language. Give them six pages or do not ask for the vote. A film is not shorter. It is only prettier.

Legal will add the data bit later

Later is how you buy a tenant you cannot map. The data spine is a condition of the request, not a cleanup.

CVO clearance will delay the foundation day

Foundation day is not a competence. Put the date after the spines, or drop the date.

Our autonomy means CMD can approve

Then cite the live delegation and still write the spines for the file. Autonomy is not silence. Check DPE and your own instrument; do not quote a blog for the rupee limit.

Four weeks to a memo that can be voted

1. Week 1: freeze the workflow list to what you can staff. Open a draft with the twelve headings.
2. Week 2: fill commercial and route with finance. Attach the current delegation extract, not a remembered number.
3. Week 3: fill vigilance and data with CVO and DPO. Record disagreements. Do not smooth them into noted.
4. Week 4: write the voteable sentence. Circulate. If a director only received the film, you are not ready.

How this shows up in the file

Subject: Standard spines for board notes on agent purchases.

Any note seeking approval to buy or materially expand an agent system shall contain commercial, vigilance and data spines, a human-gate sentence, and a voteable request. Unsourced national statistics and unsourced CVC AI badges shall not appear.

Where plant networks are in scope, the note shall state that agents will not write to OT. This template is an internal aid. It is not legal advice.

After the vote

The minutes should repeat the prohibitions: no automated award, no OT write-back, no Aadhaar in traces. If the minutes only say approved as proposed, attach the memo. A later officer will need those sentences.

Prcept AI will not draft your board note as if it were ours. We will give you the technical annex and refuse to be the fiduciary. If the CS wants a film, we will offer a staging walk instead.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, engineering or board advice. Confirm against the live Gazette, GFR, GeM term, CVC instruction, CERT-In direction, UIDAI regulation, DPE guideline, DPDP text, departmental charter, plant safety manual and your counsel before you file it.

How this clears vigilance and the board

A P1 CIO/CTO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “Board Approval Memo for PSU AI Buys” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

If the board memo is only a capability story, it is a brochure. Write commercial, vigilance and data on the same six pages. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “Board Approval Memo for PSU AI Buys” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “PSU board approval AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “Board Approval Memo for PSU AI Buys” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “PSU board approval AI”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “PSU board approval AI” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“Board Approval Memo for PSU AI Buys” earns a line in the noting only if a P1 CIO/CTO can attach proof of “PSU board approval AI.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “PSU board approval AI.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.