Governance Debt: The Cost of Skipping This

A CIO told the finance committee that governance could wait until after the pilot 'proved value'. The pilot proved a fluent draft. It also proved a shared password, a write tool nobody had listed, a prompt the SI edited from a hotel wifi, and a clerk who kept a public chatbot as the real desk because the official one was only up on Tuesdays. Six months later the department had three unofficial workflows, one official workflow nobody trusted, and a PAC question about a rejected file that could not be replayed. Nobody had budgeted that month. That month was the bill.

This is an opinion about governance debt in Indian public AI. The opinion is that skipping the unglamorous pieces — register, SoD, AUP, bindings, a quarterly that can say no — is not speed. It is a high-interest loan against the reconstructability of the file. You can take the loan. You should know the rate.

It is not a survey and not a pricing sheet. It will not invent a percentage of GMV or a national average cost of an incident. Those numbers, when they appear in decks, are usually advertisements. The costs below are types you can recognise in your own building.

What the debt is

Governance debt is every decision you defer that makes the next decision more expensive. No register means the next tool arrives uncompared. No SoD means the first write is unowned. No AUP means unofficial paste becomes culture. No bindings mean the first RTI is a reconstruction project. No quarterly means expansions happen in hallway conversations.

It is cousin to technical debt, but the interest is paid in institutional trust, not only in engineering hours. A brittle index you can rebuild. An unlogged rejection of a citizen you may not.

The people who take the debt are rarely the people who repay it. Pilots are signed by enthusiasts. Inquiries are sat by whoever is still in the chair.

How the interest compounds

Week one: a single unofficial paste. Week twelve: a section habit. Week twenty-six: the official agent is the shadow system and the public chatbot is production. At that point an AUP feels like an accusation, not a policy. You are no longer writing a control. You are negotiating a ceasefire.

A combined-duty account is the same shape. The first helpful weekend fix becomes the standing operating procedure. By the time CISO asks for a split, twenty automations depend on the god-mode. The split is now a project. It was a morning in week one.

Bindings skipped 'until we scale' cannot be backfilled for the cases already closed. Those cases are gone. Debt that deletes history is not like debt that delays a feature. It is a hole.

Interest you can describe without inventing a statistic. Use it in a finance note as types, not as fake rupees.

Skipped now	What compounds	How the bill usually arrives
No register	Duplicate tools, unofficial production, no owner	A newspaper question or a PAC: what systems do you even run
No SoD / one process account	Silent writes, SI weekend culture	A payment, mark or notice you cannot unwind cleanly
No staff AUP	Shadow AI as the real desk	A leak you cannot scope; an inquiry with no offence on paper
No case bindings	Unreplayable decisions	RTI, CAG, a student, a bidder — and a shrug
No quarterly veto	Hallway expansions, removed gates	An incident whose first question is who allowed this

The costs that are not licence fees

Re-exam or re-tender costs when integrity is plausibly stained. You do not need a proven leak. You need a process that looks like it could have leaked.

Officer time in reconstruction. Senior people spending a fortnight rebuilding what a hash would have held.

Vendor lock-in that arrived as a pilot favour. The unpaid invoice is the exit you never wrote.

Shadow-AI data you cannot erase on a host you never contracted.

The freeze. After a public incident, even good workflows stop. The opportunity cost of a year of caution is real, and it was purchased by the skipped control, not by the model.

Why smart people skip

Because the pilot is scored on a demo. Because the political calendar wants a launch. Because governance sounds like a Delhi workshop. Because the vendor offered to 'handle compliance'. Because DPDP's remaining operational duties apply from 13 May 2027 and someone misread that as a permission to wait. Because guidelines are not statute, and someone misread that as a permission to do nothing.

None of those reasons are stupid. All of them spend the same account: reconstructability.

The cheapest repayment is still early and boring. A two-page AUP. A three-identity split. A register that admits unofficial tools. A quarterly that can say no. Those are days, not schemes.

What not to put in the finance note

Do not invent a return on governance. Do not quote a global average cost of a breach as if it were your file. Do not claim that buying a branded platform liquidates the debt — platforms can add debt if they hide bindings.

Do write the types of bill, the skipped controls, and the days it would take to install the minimum. Finance committees understand options better than adjectives.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We are only piloting.

Pilots create traces, habits and embeddings. If production-like data is in, production-like debt is in. Synthetic data is how you pilot without the loan.

Governance is what we buy from the vendor.

You can buy logs and gates. You cannot buy a register of unofficial tools or an officer's signature. Those are yours. A vendor who offers to be your fiduciary is selling a confusion.

We cannot afford a programme management office.

You can afford a register spreadsheet, an AUP, and a 75-minute quarterly. A PMO is optional. Reconstructability is not.

After the launch we will regularise.

That sentence is how debt is issued. Put a dated condition in the go-live note. If the condition slips, the write path freezes. Without that, 'after' never comes.

A 15-day debt inventory

Name the loans before you take another one. This is not a maturity model with fake scores. It is a list.

1. Days 1–5: list live, staging and unofficial tools. Mark write/send, bindings, SoD, AUP, owner. Red is missing, not 'immature'.
2. Days 6–10: pick the two reddest rows that touch citizens, students or money. Install the minimum control — split, AUP, or freeze.
3. Days 11–15: one-page note to the competent authority. What was skipped, what you froze, what you will not launch until the register is true.

How this shows up in the file

The inventory is the file. Update it in the quarterly. Debt you refuse to name is the most expensive kind, because everyone can pretend it is strategy.

If a vendor slide offers to erase your governance debt with a certificate, file the slide under theatre.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, academic-regulation or engineering advice. Confirm against the current Gazette, DPDP text and Rules, CERT-In direction, India AI Governance Guidelines, UGC/AICTE/NAAC notices, NEP documents, GFR, departmental manual and your counsel before you file it. Guidelines are not statute. Circulars move.

How this survives CAG, RTI or the Board

“Governance Debt: The Cost of Skipping This” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

Governance debt is the compounding cost of unofficial tools, one god-mode account, and no register. You do not pay it in a licence line. You pay it when the file cannot be reconstructed. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI governance debt” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Governance Debt: The Cost of Skipping This” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI governance debt” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.