PSU AI Readiness Self-Assessment

A maharatna asked us to fill a 'digital maturity' spreadsheet that scored GPU count, cloud landing zones and number of data scientists. They scored themselves green. They could not name the class of the folder they wanted to ingest, they had no cost centre, and the union had not been briefed. That spreadsheet measured a lab. It did not measure a PSU file.

This scorecard is for a CIO who has to tell a CMD whether to buy an agent this quarter. It is deliberately boring. Each row is something a CVO, a CFO, a CISO or a plant head can mark without a data-science translator. If you are red on classification or OT, stop. If you are amber on IR or vigilance, fix the paper before the indent. If you are green on artefacts and red on GPUs, you can still run a document pilot on CPU.

It is not a certified maturity model and not an ISO. It is a self-assessment. Lie to it and you will only surprise yourselves in the technical committee.

Not legal advice. Sector overlays (RBI, CERC, DGMS) still have to be mapped where they apply.

How to mark

Green: artefact exists, dated this year, owner named. Amber: draft exists or owner named but the artefact is stale. Red: slogan only, or the opposite artefact exists (a manpower slide, an OT connection, an unstamped drive). Do not average the colours into a single '67 percent ready'. A single red on OT or vigilance-class ingest is a stop.

Mark artefacts, not aspirations. A banner is not a row.

Row	Green looks like	Red looks like
Classification	Pilot corpus stamped; paste rules	'Internal, probably'
Packet	Export of who/retrieved/proposed/signed	Chat history in a vendor console
Estate connectors	Named SID/interface, retrieval role	Invented module APIs or SAP_ALL
OT boundary	Diagram initialled by plant head	Historian in the same SOW as SOPs
IR sentence	No staffing change, union briefed	Manpower heat map in the deck
Vigilance file	Spec authorship, consideration, Integrity Pact	CMD demo as the procurement path
Cost centre	Platform / purpose / AMS / hardware split	Suspense, or 'digital' with no code
Overlay map	Cited layers (DPDP, sector, CERT-In)	'Compliant with the AI Act' you invented
Language honesty	Working languages plus eval	22 scheduled languages, no test
Stop rule	Metric and date to kill the pilot	Perpetual POC

How to use the score

If OT or classification is red, do not issue the indent. If IR or vigilance is amber, issue only a paper-only discovery, not a corpus-opening POC. If the overlay map is red in a bank or a discom, you are about to invent a statute in the minutes — stop and read the layered pieces in this cluster.

If most rows are green and you still have no GPU, you are ready for a document-heavy purpose on modest hardware. Readiness is not a shopping list.

Who marks

CIO convenes. CISO marks isolation, OT, packet. DPO marks personal and payment. CFO or finance marks cost centre and stop rule. IR marks the union sentence. CVO or vigilance liaison marks the file path. User department marks the purpose and the baseline. The vendor does not mark. The vendor may supply evidence for a row you already own.

What this is not

It is not a substitute for MeitY guidelines, DPDP readiness, or a sector inspection. It is not a reason to buy our product. A unit can be green and still choose a competitor who shows a better packet. That is the point of a scorecard that is about the buyer.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We need an external assessor for credibility.

You can hire one. They will still need your artefacts. Do not outsource the stamp. A consultant's PDF without a stamped corpus is another slogan.

Our peer maharatna is already live, so we are behind.

Peers lie in public and suffer in private. Mark your file. Copy their packet if they will show it, not their press note.

Too many reds will embarrass the CMD.

A red list with owners is a plan. A green lie is how CMDs get newspaper reds. Show the list as a two-quarter close-out.

Startups will fail this scorecard.

Good. Startups should fail a buyer who is red on classification. They should pass a buyer who is green and wants a packet. That is selection, not cruelty.

A four-week self-assessment playbook

One workshop is not enough if nobody brings artefacts. Demand the PDFs.

1. Week 1: circulate the ten rows. Each marker brings evidence or a written red. No verbal greens.
2. Week 2: workshop. Record colours. Any stop-red (OT, classification, invented statute) becomes a named close-out.
3. Week 3: fix the cheapest stop-red. Usually classification stamps or deleting a manpower slide.
4. Week 4: re-mark. If stop-reds remain, do not issue. If they are gone, write the one-page business case for a single purpose.

How this shows up in the file

Subject: AI readiness self-assessment — (date) — indent gate.

Colours against the ten rows are in annexure. Stop-reds: (list). Owners and dates: (list). No ingest or NIT until stop-reds are closed. This assessment is internal. It is not a certificate and not a vendor score.

This note is not legal or audit advice.

This article is informational field guidance for Indian public sector undertakings and their vendors, not legal, audit, labour, energy-regulatory, banking-regulatory or procurement advice. Confirm the live circular, DPE guideline, CVC instruction, sector regulator text, purchase manual and your counsel before you file it.

How this clears vigilance and the board

A P1 CIO/CTO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “PSU AI Readiness Self-Assessment” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

Readiness is not a model-family quiz. If you cannot stamp a corpus, name a cost centre, or say no to OT, you are not ready. Score the file, then pick a purpose. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “PSU AI Readiness Self-Assessment” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “PSU AI readiness assessment” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “PSU AI Readiness Self-Assessment” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “PSU AI readiness assessment”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “PSU AI readiness assessment” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

One more artefact before you close the file

Add a one-page owner map: who runs this after the vendor leaves, who can stop it, and where the logs live. If those three names are missing, the project is still a demo.

Date the page. File it next to the contract. That is the difference between a blog you read and a control you can audit.

What the next file must contain

“PSU AI Readiness Self-Assessment” earns a line in the noting only if a P1 CIO/CTO can attach proof of “PSU AI readiness assessment.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “PSU AI readiness assessment.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.