PSU CSR Reporting Automation

The CSR officer of a maharatna had seventeen implementing agencies, a board committee date, and a folder of JPEGs from a district that would not send utilisation certificates. The vendor offered an 'impact intelligence platform' that would write the annual report chapter. The first generated paragraph invented a women's self-help group that did not exist. The company secretary, who signs real documents, asked that the tool be confined to retrieval.

This case study is a composite of CPSE CSR cells we have watched, not a named client. The lesson is stable. Companies Act, 2013 section 135, the CSR Rules, and DPE expectations for CPSEs create a reporting machine: eligible spend, board committee, annual report, MCA filings, and a trail CAG can sample. An agent that retrieves invoices, maps them to projects, and flags missing UCs is useful. An agent that writes impact is a reputation incident.

CSR files contain personal data — beneficiary lists, Aadhaar photocopies a district should not have sent, photographs of children. DPDP applies. So does basic decency. Do not embed those lists in a vendor model.

Not legal advice. Read the current section 135, the CSR Rules, any DPE guideline that applies to your CPSE, and counsel. Thresholds and form numbers move.

The machine you are actually in

Section 135 is about a committee, a policy, a spend test, and disclosure. It is not about a dashboard. The painful work is matching bank advice to an approved project, noticing that an implementing agency's registration expired, and finding the board note that approved a mid-year change. That is retrieval and reconciliation. It is also where CPSEs get paras.

DPE and board secretariats add CPSE-specific reporting. Some companies still maintain a parallel Excel for the ministry. Automating the parallel Excel without killing it is how you get two truths. Pick the system of record first.

Automate the trail. Do not automate the claim.

Job	Agent may	Agent may not
Spend map	Match invoices and UCs to approved projects	Reclassify an ineligible spend as eligible
Committee pack	Assemble the last quarter's papers	Invent a resolution the committee did not pass
Annual report draft	Fill tables from the system of record	Write beneficiary stories or impact percentages
MCA-facing fields	Flag empty mandatory fields	File the form

What the composite company did

They picked one year of closed projects. They hashed every invoice, UC, board extract and agency registration. The agent answered only: which document is missing, which date does not match, which agency certificate expired. A CSR officer accepted or rejected each flag. The annual-report tables were exported from that accepted set. Narrative paragraphs stayed human.

They moved beneficiary lists to a restricted index. Photographs of minors were excluded from the model path entirely. The vendor's 'impact score' SKU was left in the brochure.

Cycle time for the committee pack dropped. That was the business case. Not 'AI-driven inclusive growth', which is a caption, not a control.

CAG and CVC will sample a village

When an auditor picks a project, they want the approval, the money trail, the UC, and someone who can say they went there. A generated case study is a liability. Keep field photographs and visit notes as evidence objects with authors. Do not let the agent write that the school was 'transformed'.

Related-party implementing agencies are a vigilance magnet. The agent may flag name matches against the vendor master and the related-party list. A human writes the conflict note. Do not let a model clear a conflict.

Personal data in the district scan

Districts will email Aadhaar cards. Your purpose is not to hold them. Write a rejection path: return, delete, do not index. If a beneficiary list is required for a later audit, store it with a purpose, a retention, and no training. An agent that greets a helpdesk user with a beneficiary's account number is a DPDP and a newspaper story.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

The ministry wants impact stories.

Officers write stories from visits. Models write fiction that looks like stories. If you need volume, template the human note. Do not outsource the noun 'woman' to a sampler.

Our implementing agencies already use a startup app.

Then integrate a document feed with hashes, or do not. Two systems of record will diverge before the board date. Pick one.

Section 135 software we bought in 2019 is enough.

If it already matches invoices to projects and flags expired agencies, do not add a chat window for theatre. If it is a dead licence, say so and replace the function, not the adjective.

Photographs prove impact.

Photographs with authors, dates and consent-where-needed are evidence. Loose JPEGs in a model index are personal data and a deepfake waiting room. Keep them out of the prompt path.

A four-week CSR pack playbook

Run it on last year's closed set before you touch the live year.

1. Week 1: list approved projects, agencies, and the system of record. Kill dual Excels or name the winner.
2. Week 2: hash invoices, UCs, board extracts, registrations. Build missing-document flags only.
3. Week 3: pull beneficiary lists and minor photographs out of the general index. Write the DPDP purpose and the delete path for Aadhaar scans.
4. Week 4: produce one committee pack from accepted flags. Human narrative only. Time it. That time is the CFO metric.

How this shows up in the file

Subject: CSR agent — retrieval and completeness, no generated impact.

The tool matches documents to approved projects and flags gaps. It does not reclassify eligibility, does not file MCA forms, and does not write beneficiary or impact narrative. Exceptions require a committee object. Personal data in beneficiary lists is restricted and will not train a vendor model.

Section 135 duties remain with the committee and the board. This note is not legal advice.

This article is informational field guidance for Indian public sector undertakings and their vendors, not legal, audit, labour, energy-regulatory, banking-regulatory or procurement advice. Confirm the live circular, DPE guideline, CVC instruction, sector regulator text, purchase manual and your counsel before you file it.

How this clears vigilance and the board

A P1 CIO/CTO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “PSU CSR Reporting Automation” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

A CPSE CSR cell drowns in invoices and district letters, not in vision. Retrieve and tabulate. Do not generate beneficiaries. Section 135 and the CSR committee still sign. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “PSU CSR Reporting Automation” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “CSR reporting automation” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “PSU CSR Reporting Automation” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “CSR reporting automation”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “CSR reporting automation” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“PSU CSR Reporting Automation” earns a line in the noting only if a P1 CIO/CTO can attach proof of “CSR reporting automation.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “CSR reporting automation.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.