Quarterly AI Governance Review Agenda

The standing item called Digital Initiatives had become a slideshow graveyard. In April the AI pilot was green. In July it was still green, though the prompt had changed, the SI's god-mode was still active, two sections had moved to a public chatbot during an outage, and nobody had updated the register. The CIO asked for a dedicated quarterly. The first one ran 90 minutes over and decided nothing because there was no agenda, only vendors. The second one used a two-page agenda and killed a write path before lunch.

This is a paste-ready quarterly agenda for a ministry, state department, PSU or university that already has, or is about to have, an official agent. It is written for the CIO who chairs and the DPO who brings the uncomfortable rows. Two hours. Papers circulated 48 hours prior. Vendors in the waiting room, not at the table, unless a specific item needs a factual answer.

It is not a statutory form. Nothing in DPDP or in the 5 November 2025 India AI Governance Guidelines forces this exact agenda. It is how you operationalise oversight before CAG, an incident, or a newspaper does it for you.

Who is in the room

Chair: CIO, chief risk officer, or the officer the competent authority named as AI owner. Standing members: DPO, CISO, business owners of live workflows, administration or registrar, internal audit as observer. Optional: finance when money workflows are live; exam controller when exam workflows are live.

Not in the room by default: account managers, the philosophy professor from the ethics seminar, and anyone whose only contribution is a principle. The ethics committee's register is a paper, not a second meeting hidden inside this one.

Quorum should include the DPO and CISO or their named deputies. A review that proceeds without both will approve residual risk that neither has seen.

The agenda you can paste

Circulate a pack, not a speech. Each item below is a pre-read of one to three pages. If the pre-read is missing, the item is deferred and the workflow cannot expand. Deferral is a decision. Record it.

Time boxes are suggestions for a two-hour sitting with two live workflows. Cut demo time first if you run over. Never cut incidents or SoD exceptions.

Two-hour quarterly. Papers 48 hours prior. Decisions in the minutes, not in chat.

Minutes	Item	Decision you must leave with
10	Register: what is live, staging, unofficial	Is the register true. What will be added or retired this quarter.
15	Incidents and near-misses since last sitting	Class, closure, whether a workflow stays frozen.
15	Shadow AI and AUP exceptions	Which unofficial tools remain. Which official path will replace them.
20	SoD, access reviews, vendor break-glass	Which combined duties still exist. Dated conditions.
15	Model, prompt, corpus versions and evals	What changed. What was re-tested. What must be rolled back.
15	DPDP / CERT-In / records clock	Lawful basis still true. Logs still in India. Retention still matching the file.
15	Requests to expand write/send or remove a human gate	Go, conditional go, no-go. No expansion on a verbal assurance.
15	Budget, people, AMC, residual risk for the competent authority	What you will ask money or headcount for. What you will not claim.

Papers that must exist before the sitting

A register extract. Name, owner, data class, write/send (yes/no), human gate (yes/no), hosting posture, go-live date, last hash change.

An incident extract. Class, date, frozen or not, open actions.

An access-review extract. Who holds admin, who held break-glass, which SoD exceptions are still open.

A one-page DPDP and logs status. Fiduciary, processors, any unofficial processing discovered, CERT-In log proof for the official systems.

If any of those four is missing, the chair should shorten the meeting to a decision that production will not expand this quarter. That decision is governance. A meeting that improvises the facts is not.

• No live vendor demo unless an acceptance test is itself the item.
• No new principle for its own sake. Principles live in the charter.
• Every action has an owner and a date. 'Socialise with stakeholders' is not an action.
• Minutes issued in five working days. Unsigned minutes are rumours.

How this sits next to other bodies

The ethics or review committee decides go / no-go on specified workflows and residual harm. This quarterly reads their register and handles operations: versions, access, incidents, money.

The change-advisory or IT CAB still owns ordinary infrastructure changes. Do not steal their job. Do steal any AI change that alters a write path or a prompt in production — those should be visible here even if CAB already ticked them.

Internal audit samples. They should not chair. If they only ever see the slideshow, the quarterly has failed them.

Guidelines from 5 November 2025 can appear as a briefing annex when they change. They should not occupy twenty minutes of every sitting.

Failure modes of the quarterly

It becomes a vendor showcase. Ban slides with product roadmaps.

It becomes a congratulations hour. Require at least one uncomfortable metric: unofficial tools still in use, open SoD exceptions, frozen workflows.

It becomes a second ethics seminar. Send purpose debates back to the committee with a one-page memo.

It never kills or conditions anything. If four quarterlies pass without a dated condition, you are rubber-stamping. Ask internal audit to observe the fifth.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We do not have enough live AI to need a quarterly.

If you have unofficial paste, you have AI. If you have a pilot, you have a register. A short quarterly prevents the first silent write. Waiting until you are 'big enough' is how you grow ungoverned.

Two hours is impossible to schedule.

Then run 75 minutes with only register, incidents, SoD and expansion requests. Cut the budget tour. Do not cut the four papers.

The competent authority will not read minutes.

Send a one-page extract: decisions, residual risks, asks. File the full minutes anyway. The extract is for them. The minutes are for the auditor.

Our ethics committee already meets.

Good. This is the operations sitting. Different papers. If you merge them, keep the veto and the four extracts or the ethics half will eat the clock.

Stand up the first quarterly in 21 days

The first sitting will be ugly. That is the point. Do not postpone until the pack is pretty.

1. Days 1–7: name the chair and standing members. Draft the register even if it only has unofficial tools and one pilot.
2. Days 8–14: collect the four papers. Issue the AUP if it does not exist. Schedule the room.
3. Days 15–21: sit. Record at least one dated condition. Issue minutes in five working days. Put the next date in the calendar before people stand up.

How this shows up in the file

The file holds the standing order that creates the quarterly, the four papers each sitting, the minutes, and the one-page extract to the competent authority. A calendar invite without papers is not a review.

After a year you should be able to show four packs and at least one workflow that was frozen, retired, or conditioned. If you cannot, write that failure in the fifth pack.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, academic-regulation or engineering advice. Confirm against the current Gazette, DPDP text and Rules, CERT-In direction, India AI Governance Guidelines, UGC/AICTE/NAAC notices, NEP documents, GFR, departmental manual and your counsel before you file it. Guidelines are not statute. Circulars move.

How this survives CAG, RTI or the Board

“Quarterly AI Governance Review Agenda” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

If AI governance only happens when a vendor wants a go-live, you do not have governance. You have appointments. Use a quarterly agenda that can fail a workflow in two hours. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI governance review agenda” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Quarterly AI Governance Review Agenda” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI governance review agenda” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.