GIGW Compliance for AI-Powered Interfaces

The department passed a security review for on-prem inference and then pasted a vendor's chat widget onto the homepage. The widget loaded from a commercial CDN, ignored the Hindi toggle, trapped keyboard users inside a dialog, and had no publisher identity beyond a purple sparkle. The page had been moving toward GIGW evidence. The widget undid the front door.

GIGW means Guidelines for Indian Government Websites — now commonly framed as websites and apps. NIC publishes the guidelines at guidelines.india.gov.in. Manuals have moved (teams will mention 2.0 and 3.0; download the current manual, do not cite a version from memory). STQC and empanelled auditors are how many departments evidence conformance. This article will not pretend to be that audit.

An AI-powered interface is still an interface. Domain, branding, language, accessibility, content ownership, security headers, and the citizen's ability to reach a human desk do not become optional because a model sits behind the box. This guide is for web leads, SIs and departmental CIOs. It is written on 17 August 2026. It is not legal advice and not an STQC certificate.

What GIGW is and is not

It is a quality and conformance framework for government websites and apps: how a citizen can tell this is government, read it, navigate it, and trust that content has an owner. Accessibility language in current manuals aligns to widely used WCAG-shaped expectations — read the live manual for the exact bar (teams often talk in terms of WCAG 2.1-class requirements; do not hard-code a level in your RFP without opening the PDF).

It is not a model-governance statute. It will not tell you whether a mutation tool is lawful. It will tell you if the button that launches the agent is invisible to a screen reader. It is not optional for a ministry site because the widget is just a pilot. Pilots on the public homepage are public interfaces. If you must pilot, put the widget on an internal URL or a clearly marked experimental page that still meets the accessibility bar.

GIGW-shaped questions an AI widget must still survive.

Question	Fail pattern	Fix
Is this clearly a government page?	Widget served from a random domain with no .gov.in / .nic.in parent identity	Host on the government property; show department publisher
Does language toggle still work?	Widget English-only; breaks the Hindi / state-language switch	Honour the site language; do not ship a parallel unofficial translation
Can a keyboard / screen-reader user use it?	Focus trap, no labels, contrast fail, mouse-only send	Treat the widget as a first-class component in the accessibility test
Who owns the words?	Model output looks like a government order	Label as assistance; link the signed page; no unofficial PDF
Where do scripts load from?	Foreign CDN, extra trackers	Self-host on the approved infrastructure; inventory scripts
How does a citizen escalate?	Chat dead-ends; no CPGRAMS or desk link	Always offer the human / official grievance path

Content ownership and the model

GIGW expects content to have an owner and a review habit. Model output is content the moment it appears on a government page. Either it quotes a signed page, or it is a new content class with a reviewer and a retention rule. Do not let the widget generate downloadable PDFs on department letterhead. That is how unofficial orders are born. Link the official PDF. When the model is wrong, the correction is a content incident, not only an ML incident. The same officer who owns the page should be able to take the widget down.

Security and the script inventory

A third-party chat script is a third-party processor and a supply-chain object. It belongs in the security audit and in the DPA. It is only JavaScript is how sessions leak. If inference is on-prem but the widget phones a vendor analytics host, you failed isolation at the browser. Packet-capture the page, not only the GPU node. CERT-In logging still applies to the new endpoint. So do session timeouts already on the parent site. The widget must not keep a citizen session alive longer than the portal allows.

Evidence STQC-shaped auditors will recognise

They will look at the page, not at your model card. Screenshots of contrast, keyboard path, language toggle, publisher identity, and the script inventory matter more than a temperature graph. If you already have a GIGW certificate on the parent site, adding a widget is a change. Ask whether it is in scope of the last certificate. Do not assume a 2024 certificate covers a 2026 sparkle. Pair this article with the earlier cluster piece on GIGW and STQC together. This page is the AI-interface overlay, not a reprint of that audit path.

• Self-host the widget assets on the approved domain.
• Preserve skip links, focus order and captions.
• Honour the site's language and text-size controls.
• Expose a human path on every conversation end-state.
• Document the reviewer who can disable the widget.

Two rooms you can walk into

The model was isolated. The page was not.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

GIGW is for static websites, not AI.

GIGW is for government websites and apps. If the citizen uses it in a browser or an app, it is in scope. Intelligence of the backend is irrelevant to contrast.

We will comply after the pilot.

A public homepage pilot is a production interface. Pilot on an internal URL or meet the bar now.

Accessibility will slow the model team.

The model team should not own the widget. The web team should, to the same standard as the navigation bar.

Our app is on the Play Store, so GIGW websites rules do not apply.

Current guidelines speak to apps as well. Open the live manual. Do not invent an exemption from a 2018 memory.

A four-week GIGW pass for the widget

Start this when the parent site already has an owner. A widget cannot redeem an unowned portal.

1. Week 1: download the current GIGW manual from guidelines.india.gov.in. List the components you will add. Decide internal URL versus homepage.
2. Week 2: self-host assets, language hook, keyboard path, publisher label, human escalation link. Script inventory.
3. Week 3: accessibility test with the same method you use for the parent site. Packet-capture the page for unexpected egress.
4. Week 4: change note for the existing GIGW/STQC file. Name the officer who can disable the widget. Do not ship if the parent certificate would be misleading.

How this shows up in the file

Subject: GIGW and the AI interface. GIGW means Guidelines for Indian Government Websites (and apps), live manual downloaded on a dated day. The agent widget is a page component: self-hosted, language-aware, accessible, labelled as assistance, with a human/CPGRAMS path. Scripts listed. No vendor CDN. No letterhead PDFs from the model. Change notified to the GIGW evidence owner. This note is not a certificate.

What we will and will not claim

Prcept AI will not ask you to load our widget from a foreign CDN. We will sit behind your page, on your domain, and lose the argument if we break your Hindi toggle. Isolation at the GPU is not isolation at the browser.

This article is informational field guidance for Indian universities and public institutions, not legal, procurement, audit or engineering advice. Confirm against the live Gazette, GFR, state financial rules, GeM terms, UGC text, GIGW, DPDP commencement, departmental manual and your counsel before you file it.

How to sequence this in a state, not a slide

“GIGW Compliance for AI-Powered Interfaces” is a department problem. A P4 System Integrator should name the legacy system, the officer who owns the file, and the citizen charter clock before buying “GIGW compliance AI”.

GIGW is the Guidelines for Indian Government Websites (and apps). An AI widget on a .gov.in page inherits those duties. A fluent overlay that breaks contrast, language or publisher identity fails GIGW even if the model is on-prem. Do not invent league tables of states. Read tenders and policies. Election Model Code of Conduct can freeze a rollout. NIC is a partner, not a villain. SDC readiness is GPU, power, ops and egress — not a logo.

• Audit the legacy store first.
• Keep mutation and money as officer actions.
• Map SLAs to the citizen charter.
• Budget change requests after go-live.

Close this loop before the next CAB

Put “GIGW Compliance for AI-Powered Interfaces” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 System Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “GIGW compliance AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.