Source Code Escrow for AI: Does It Help?

The bid-security conversation drifted, as it often does, into continuity. Someone said put the source in escrow, the NIC officer nodded, and the draft gained a clause naming a bank locker and a release on bankruptcy. Nobody asked what would be in the locker, in what format, or which government engineer would compile it. Two years later the vendor missed a payroll. The locker held a tarball of an old microservice and a binary blob labelled model.v3. The blob did not load.

This is an honest opinion, not a crusade against escrow. For classical application source — the workflow UI, the tool-router, the connector code — escrow plus a documented build can save you when a startup dies. For model weights, tokenisers and proprietary index formats, escrow without a tested load path is comfort theatre. Indian buyers should stop treating the locker as a substitute for an export they have actually restored.

What escrow is good at

It is good at holding source and build scripts for software you could, in anger, hand to a competent SI. Release conditions — insolvency, material breach, failure to support — are familiar. Verification that the deposit matches the production version is the part departments skip and should not.

It is good as a second copy of connectors written for your MIS, if those connectors are actually deposited after every release, not once at kickoff. It is good politics. Audit understands lockers. Use that, and then spend the rest of the paragraph on the restore drill.

What escrow is weak at

Model weights. A 70-billion-parameter dump in a vendor layout, without the loader, tokenizer files, quantisation scheme and hardware assumptions, is not continuity. It is geology.

Fine-tunes that only the vendor runtime can apply. If the adapter is a closed object, the locker has a souvenir. Hosted components cannot be escrowed. If production depends on a third-party model API, the locker is a distraction. Builds that need the vendor's licence server, container registry or signing key will not become yours because a bank has a disk.

Deposit versus drill.

Artefact	Escrow value	What to demand instead or as well
Platform application source	High if verified and buildable	Quarterly verification; successor-SI right
MIS connectors	High	Assignment plus deposit after each release
Prompts, evals, traces	Low — you should already have them	Nightly export to your store; do not wait for bankruptcy
Base weights	Low unless format is standard and complete	Licence to a loadable release; offline entitlement
Adapters / LoRA	Medium only with loader + test	Restore on your GPU as a paid milestone
Closed vector index	Near zero	Rebuild recipe from your corpus

If you still escrow — do it like an adult

Name the deposit contents. Name the format. Require a verification report, not a courier receipt. Require an update after each production release. Name who may receive the release — a successor contractor, not only a mythical in-house team. Name the hardware assumptions.

Price a yearly restore onto department or NIC hardware. If the restore needs the vendor in the room every time, you do not have escrow. You have a scheduled visit. Do not let escrow replace offline licence entitlement. A locker will not keep inference up next Tuesday when the licence daemon fails.

Startups, DPIIT, and honesty

Requiring escrow is not anti-startup. Requiring a fantasy deposit of foundation weights the startup does not have rights to deposit is how you get a fake tarball. Ask what they can legally deposit. Then ask what you can actually load. DPIIT recognition is not a continuity plan.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Without escrow we have no protection if they die.

Without a loadable export you have no protection even with escrow. Buy both for source; buy the drill for weights.

NIC will compile whatever we get.

Ask NIC, in writing, whether they will. Many will not. Name the successor SI in the clause.

Escrow agents are expensive.

Then escrow only the source that matters and spend the rest on quarterly exports you already control. A cheap locker of junk is more expensive.

The vendor says weights are a trade secret and cannot be deposited.

Then they cannot be your continuity plan. Licence a loadable runtime you can run through the term plus wind-down, or do not depend on those weights.

An escrow decision that fits on one folio

1. List artefacts you would need to run for ninety days without the vendor.
2. Mark each: already exported nightly / escrow / licence / rebuild.
3. For anything marked escrow, write format, verification, update cadence, release trigger, successor SI.
4. Price one restore this year. If finance will not fund the restore, do not boast about the locker.

How this shows up in the file

Subject: Continuity — escrow and restore, distinguished.

Escrow is proposed for platform source and MIS connectors, with verification and post-release updates. Model weights and adapters will be treated as continuity only if a documented format loads on department hardware in a yearly drill. Prompts, evals and traces will be exported on a schedule to our store and are not left to a bankruptcy trigger. This note is not legal advice.

Name the successor before you need one

An escrow release to the President of India is a patriotic sentence and an operational vacuum. Name a class of recipient: the department's nominated SI, NIC if they have accepted in writing, or a successor contractor appointed under a fresh bid. If nobody will take the tarball, the locker is a museum.

Ask that nominated party, during the original bid period, whether they will even attempt a restore. A letter that says we will consider at the time is the same as no letter. Price a standby restore in the AMC so the successor is not meeting the code for the first time at a funeral.

Keep a copy of the last successful restore minutes with the locker certificate. Audit likes PDFs. Operations likes minutes that say the build completed on named hardware on a named date. File both. If you only have the certificate, you have the weaker half.

This article is a field guide for Indian public buyers, not legal, procurement, financial or audit advice. Confirm every citation against the live GFR compilation on doe.gov.in, the relevant DoE procurement manual, GeM terms, CVC guidance and your own counsel before a sentence enters a tender file.

How to put this in the RFP, not the preamble

A P2 Procurement who searches “source code escrow AI” is usually drafting or scoring a bid. “Source Code Escrow for AI: Does It Help?” belongs in eligibility, the evaluation matrix, or a numbered annexure. If it only lives in the covering note, L1 will ignore it.

Escrow is a respectable continuity tool for application source. For agents it often becomes a disk of weights nobody can load. Buy a restore drill; treat the vault as backup, not magic. QCBS weights are a choice you must publish before opening. Accuracy is a task plus a dataset, not a slogan. SLAs for agents must name tool-calls, human gates and log export — uptime alone is a hosting metric.

Do not let a vendor write the specification and then bid on it. Record unsolicited proposals. Pay for pilots that touch personal data. Write exit before you write go-live.

1. Move the control from the preamble into a scored or eligibility row.
2. Attach a one-page definition (accuracy, SLA, language, data handling).
3. Require an artefact in the technical bid, not a slide.
4. Extend the bid date if a corrigendum is material.
5. Minute the demo on your data, offline if you claimed air-gap.

Close this loop before the next CAB

Put “Source Code Escrow for AI: Does It Help?” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P2 Procurement, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “source code escrow AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Source Code Escrow for AI: Does It Help?” belongs in a file, not only in a search result. A P2 Procurement should be able to point at one artefact that proves “source code escrow AI”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Escrow is a respectable continuity tool for application source. For agents it often becomes a disk of weights nobody can load. Buy a restore drill; treat the vault as backup, not magic. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C5 AI Tenders: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “source code escrow AI”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.