Building a State-Level AI Governance Body

By the time a state notices it needs governance, it usually has three pilots, two public APIs, and a vendor who sits in the weekly meeting as if they were a joint secretary. The question is no longer whether to 'look at ethics'. The question is who may stop a go-live on a Friday.

MeitY released India AI Governance Guidelines on 5 November 2025. They are worth reading. They are not a substitute for a state G.O. that names seven people, a register, and a veto. Principles do not refuse a discharge-note API. A dated terms of reference might.

This playbook is dated 17 August 2026. It is not legal advice and it does not create a regulator. If your state already has a digital-governance council, do not create a twin. Add an AI register and a high-line veto to the body that already has a minute book.

Small on purpose

A body of twenty-four will meet twice and then become a photo. A body of seven can meet monthly and read three files. Give it a secretariat of one officer who actually maintains the agent register. Without that person, you have a seminar.

Do not staff it only with enthusiasts. Enthusiasts are how every pilot is 'transformational'. You need a finance person who asks about change-request envelopes, a lawyer who has read Section 7, and an NIC host who will say when the egress test failed.

• A G.O. or office order with a sunset and a review date.
• An agent register: workflow, owner, model hash, data class, human gate, egress status.
• A high-line list: police records, clinical text, land writes, Aadhaar stores, automated penalties.
• A no-objection for go-live on citizen-facing or money-facing workflows.
• Vendors in attendance, never in the quorum.

What the body should decide, and what it should send elsewhere.

Question	Body	Elsewhere
May this workflow go live?	Yes, if register row is complete	Not a vendor steering group
May we send this class to a public API?	Default no for personal data	Not a 'temporary' exception in a WhatsApp
Is Section 7 the basis?	Demand the limb in writing	Counsel, not the SI
Do we buy more GPUs?	Only after SDC numbers	Finance concurrence
Is this an FIR automation?	Refuse unless an instrument exists	Home department + counsel, not a hackathon

National guidelines are inputs, not your G.O.

Cite the November 2025 guidelines as context. Do not claim they appointed your committee. Do not invent a duty they did not write. Accountability, safety and inclusion as principles are useful in the preamble. The operative part is your register and your veto.

DPDP still applies to the department as Data Fiduciary. The body does not become the Board. CVC and state vigilance still care about procurement integrity. The body does not replace a tender committee. Clear those sentences so the committee does not swell with borrowed majesty.

Two G.O.s after the same workshop

Objections you will hear — and what to do with them

Governance will slow innovation

A writ will slow it more. A monthly hour on seven files is cheaper than a year of freeze.

We should wait for a state AI law

You already have pilots. An executive register does not prevent a later law. Waiting is how the public API becomes the baseline.

The CIO can do this alone

The CIO will be transferred. A body with a G.O. survives one transfer. A heroic CIO does not.

Departments will hide pilots

Then tie the no-objection to hosting, to GeM payment, or to the SDC VLAN. Hidden pilots that need a rack become visible. Hidden pilots that need a public API are a conduct problem — write that.

A four-week playbook to stand the body up

1. Week 1: draft a two-page terms of reference. High-line list. Register fields. Veto. Sunset.
2. Week 2: name seven people who will actually attend. Ask them before the G.O. is issued.
3. Week 3: inventory live pilots. Put them on the register whether they like it or not.
4. Week 4: issue the G.O., hold the first meeting, refuse one thing that should be refused. A body that has never refused is not yet a body.

File note you can paste

Subject: Proposal for a state agentic-systems review committee.

It is proposed to constitute a seven-member committee by office order, with a one-officer secretariat, to maintain a register of agentic workflows and to grant or withhold a no-objection for citizen-facing or money-facing go-live. MeitY's November 2025 guidelines are noted as context; they are not cited as a binding order to create this committee. High-line domains — police records, clinical text leaving the perimeter, land-register writes, casual Aadhaar stores, automated penalties — require an instrument before go-live. Vendors will not form part of the quorum. This committee is not the Data Protection Board and not a tender committee.

This note is an internal aid. It is not legal advice.

Prcept AI will appear when asked and will leave before the vote. If a competitor needs a seat in the quorum, that is your first refusal.

The register fields that make the body real

Workflow name. Owner post and deputy. Model or runtime hash. Data classes. Lawful-basis sentence. Human-gate yes or no. Egress test date. Connector list with purpose tags. High-line flag. Go-live no-objection date. Sunset. If a row cannot be filled, the workflow is not live, whatever the dashboard says.

Publish the register inside the secretariat monthly. You need not publish model prompts to the world. You do need a room in which hidden public-API pilots become visible because they need a VLAN, a payment, or a GIGW surface. Hidden pilots that need none of those are a conduct problem. Write the conduct sentence once.

Review the G.O. at the sunset. If the body has never refused a file, shrink it or kill it. A committee that only blesses is a photo. The state already has photos.

This article is informational field guidance for Indian public institutions, not legal, organisational-design or procurement advice. Confirm against your state's rules of business, DPDP, the live text of MeitY guidelines, and counsel before you file it.

How to sequence this in a state, not a slide

“Building a State-Level AI Governance Body” is a department problem. A P1 CIO/CTO should name the legacy system, the officer who owns the file, and the citizen charter clock before buying “state AI governance structure”.

A state does not need a replica of every national committee. It needs a small body that can refuse a public API, demand a human gate, and keep a register of live agents. Write the terms of reference before the third pilot. Do not invent league tables of states. Read tenders and policies. Election Model Code of Conduct can freeze a rollout. NIC is a partner, not a villain. SDC readiness is GPU, power, ops and egress — not a logo.

• Audit the legacy store first.
• Keep mutation and money as officer actions.
• Map SLAs to the citizen charter.
• Budget change requests after go-live.

Close this loop before the next CAB

Put “Building a State-Level AI Governance Body” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “state AI governance structure” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “Building a State-Level AI Governance Body” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “state AI governance structure”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “state AI governance structure” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“Building a State-Level AI Governance Body” earns a line in the noting only if a P1 CIO/CTO can attach proof of “state AI governance structure.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “state AI governance structure.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.