Ethics Committees for Departmental AI

A department constituted an AI ethics committee after a workshop. The order named seven people, including a retired professor of philosophy and the vendor's customer-success lead as a special invitee. The committee met once, approved the logo of the pilot, and asked to be copied on 'any ethical issues'. Six months later the agent was drafting grievance rejections and nobody could remember whether the committee still existed. A file reconstruction found the minutes. They contained the word responsible eleven times and not one denied go-live.

This is a guide to standing up a departmental ethics or review committee that does actual work for Indian ministries, state departments, PSUs and campuses. The opinion inside the guide is that most such committees fail in one of two ways. They become seminars. Or they become a second technical committee that cannot read a packet capture. You need a third thing: a mandate to halt specified go-lives, a calendar, and the humility to leave SoD and CERT-In to the people who already own them.

It is not legal advice. The India AI Governance Guidelines of 5 November 2025 are guidelines. They do not create a statutory ethics board inside your department. UGC, ICMR or institutional human-ethics rules, where they already apply to research on people, are not automatically the right instrument for a production grievance agent. Do not copy a hospital IEC letterhead and call the job done.

What the committee is for

It exists to force a written answer to four questions before a workflow that affects citizens, students, employees or vendors goes live. Is the purpose legitimate and narrow. Is the data class appropriate. Is a human still on the irreversible step. Is there a residual harm — bias, exclusion, opacity, shadow use — that leadership is accepting in writing.

It does not exist to choose a GPU SKU, to negotiate GeM terms, to replace the DPO, or to bless a vendor's model card as a safe harbour. If you load those jobs onto it, the people who can actually do those jobs will stop attending.

Call it a review board if the word ethics produces theatre in your building. The name matters less than the veto and the minutes.

Who sits — and who does not

A workable core is small. Business owner of the workflow. DPO or the officer acting as one. CISO or nominee. A legal or administration officer who can read DFPR and conduct rules. One domain person who knows the citizen or student journey. For a campus, add a teacher who is not the project's champion and a student-affairs officer. For a PSU, add internal audit as a standing invitee, not as chair.

The vendor does not vote. The SI does not draft the minutes as if they were the committee. An external academic can be useful on a specific paper — say, language exclusion — and should not become a permanent ornament.

Chair should be senior enough to halt a launch and not so senior that the meeting never happens. Additional secretary or equivalent in a department; registrar or a dean nominated by the vice-chancellor on a campus; an independent director or the chief risk officer in a PSU if the board has already named an AI owner.

Mandate rows you can paste into the constitution order. If a row has no owner, delete the row.

Decision	Committee role	Not their job
New workflow that writes or sends	Go / conditional go / no-go	Designing the prompt
Use of children's or student-special-category data	Must see the lawful-basis and notice pack	Rewriting DPDP
Auto-decision on eligibility, marks, pay	Default no-go unless a human gate is proven	Choosing the model family
Public model / unofficial tool request	Recommend allow or refuse to the CIO	Running the proxy
After an S1/S2 incident	Review residual harm and whether the workflow resumes	Owning CERT-In filing

Guidelines are not a charter

MeitY released the India AI Governance Guidelines on 5 November 2025 as a framework for safe and trusted AI. They are useful briefing material. They are not your constitution order. If you quote them, quote them as guidance the department has chosen to operationalise, not as a Gazette that created your committee.

DPDP does not require an ethics committee by that name. It requires a fiduciary who can defend purpose, notice, processor control and security. A committee can help the fiduciary think. It cannot become the fiduciary by sitting once a quarter.

Research-ethics machinery on a campus — where it already exists for human-subject research — may be the wrong door for a production admissions FAQ agent and the right door if you start experimenting on students. Do not blur the two. Check live UGC and institutional notices rather than inventing a current circular that 'requires an AI ethics board for all campus tools'.

Operating rhythm that does not rot

Meet on a calendar, not only when a vendor wants a quote for the brochure. Monthly is enough in the first year of a programme; quarterly if you only have one live workflow and a stable register. Extraordinary meetings exist for S1 incidents and for any request to remove a human gate.

Every item comes with a one-page memo: purpose, data classes, write/send paths, human gate, residual harm, dissent. If the champion cannot write the page, the item is not ready. Minutes record the decision and the conditions. Conditions have dates. A condition without a date is a no-go that nobody wanted to say.

Publish an internal register of decisions. A committee that cannot remember what it approved will approve the same harm twice.

• No vendor vote, no vendor-drafted minutes issued as the official record.
• No-go is a success if the harm was real. Count halted launches as work, not as failure.
• Dissent is recorded. Unanimous theatre is a smell.
• The quarterly governance review reads the committee's register; it does not re-do every item.

Theatre to refuse

A logo review. A request to 'align with global principles' without naming a workflow. A standing agenda item called emerging technologies that never names a data class. A membership so large the meeting is a seminar. A secretariate run entirely by the SI.

Also refuse the opposite theatre: a committee that insists on reading every system prompt as if it were a statute. Prompts change weekly. The committee owns purpose, gates and residual harm. The CISO owns the packet capture. The platform owner owns the prompt hash. Keep the lines.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We are too small for a committee.

Then do not create a seven-member seminar. Create a three-person review — owner, DPO, CISO — that can write go / no-go on one page. Small is not a licence for an unreviewed write path.

Ethics will slow innovation.

A no-go on an un-gated eligibility writer is innovation you cannot defend. Time-box the review. A ready one-page memo should be decidable in one sitting.

The guidelines say we should have oversight, so we are compliant if we meet.

Guidelines are not a statute, and a meeting is not oversight. Oversight is a recorded decision that can halt a launch. If you cannot point to a no-go or a dated condition, you have a seminar.

Let the vendor chair a technical-ethics working group.

The vendor may present. They do not chair. They do not vote. They do not hold the minutes. That is not hostility. It is SoD.

A 30-day constitution you can sign

If a committee already exists and has never issued a no-go or a dated condition, treat this as a reconstitution, not as a refresh of the logo.

1. Week 1: draft a two-page constitution with the mandate table, membership, voting, and the list of workflows that cannot go live without a decision.
2. Week 2: name the chair and the core. Brief them with one past near-miss, not with a principles deck.
3. Week 3: run the first real item — preferably a workflow that writes or sends. Practise a conditional go with a dated condition.
4. Week 4: competent authority signs the order. Publish the register path. Put the committee on the quarterly governance agenda.

How this shows up in the file

The constitution order, the membership, the register of decisions, and the first set of minutes with a real go / conditional / no-go belong in the AI file. A workshop photo does not.

When CAG or an internal auditor asks who approved the workflow, the answer should be a minute, not a vendor email that says the ethics committee was kept in the loop.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, academic-regulation or engineering advice. Confirm against the current Gazette, DPDP text and Rules, CERT-In direction, India AI Governance Guidelines, UGC/AICTE/NAAC notices, NEP documents, GFR, departmental manual and your counsel before you file it. Guidelines are not statute. Circulars move.