STQC Certification: Do You Need It?

The ATC said 'STQC certified' in a bullet copied from a 2017 website development tender. The buyer meant, when asked, that the public page should follow GIGW. The founder heard that their model needed a laboratory blessing before they could bid. Both people left the pre-bid meeting with the wrong shopping list.

STQC — Standardisation Testing and Quality Certification — is an attached office of MeitY. It tests and certifies electronics and IT products, runs quality-management schemes, and, separately, supports website quality certification against the Guidelines for Indian Government Websites. Those are different counters in the same building.

This decision guide is for founders staring at an ATC bullet, and for buyers about to type that bullet. It is not an application form and not a promise that any particular product scheme exists for large language models. Open stqc.gov.in and the live notice.

What STQC is — and the two meanings of 'certified'

STQC operates laboratories and certification schemes for quality, safety, security-related testing and e-governance artefacts. A product that went through an STQC lab has a report against a named standard or scheme. That report has a scope. The scope is the entire value.

GIGW is a set of guidelines for government websites and apps. Website Quality Certification / Certified Quality Website processes, as described on STQC and GIGW sites, are about those properties — authenticity, accessibility, quality of a government web property — not about whether your on-prem agent reasons well over a scholarship corpus.

If a bid says STQC, ask which scheme, which standard, which artefact. If they cannot answer, they copied a bullet.

When you probably need to walk toward STQC

When the artefact is a government website or app that the department wants CQW / GIGW certification for. That is a website project, even if an agent sits behind it. Plan time; certification is not a weekend sticker.

When the bid names a specific STQC product-testing scheme that your device or software type actually falls under — common in hardware, biometrics, some security products. If you sell those, you already know your scheme. If you sell an agent platform, do not pretend a biometric scheme applies.

When a user department’s own policy, not only an ATC habit, requires STQC testing for e-governance components you will hand over as their website. Then it is their certification journey as much as yours. Write who applies, who pays, and who fixes non-conformities.

Unnamed 'STQC' is not a requirement. It is a prompt to ask a better question.

What the buyer says	What they may mean	What you should put in a pre-bid question
Must be STQC certified	Copied from a web tender; they want GIGW on the public page	Please name the scheme, standard and artefact (website / product / process)
GIGW compliant	The public website/app follows GIGW; possibly CQW later	Is CQW mandatory at go-live or is self-declaration plus later audit enough?
STQC security tested	They want some independent test	Is a CERT-In empanelled audit acceptable? Which scope?
ISO instead of STQC	A quality-system habit	Which ISO, which scope, whose legal entity?
No certificate named	They want a working system	Do not volunteer a two-year lab path you do not need

When you probably do not need it for the agent itself

A departmental on-prem agent with no public website is not a GIGW object. Forcing CQW onto a dark VLAN tool is category error.

Model quality is not an STQC website property. Evaluation sets, human review and security audit are the usual tools. Do not wait for a lab scheme that the ATC invented.

DPIIT recognition, ISO 27001, and a CERT-In empanelled application audit are not STQC. If the bid named those, bring those. Substituting a GIGW certificate for an application pen-test is another category error, in the opposite direction.

If the bullet is real — plan it like a project

Name the applicant: department versus vendor. Many website certifications attach to the government property, not to your company forever.

Name the scope: URLs, environments, languages, accessibility level. Scope games fail at audit.

Name the calendar: gap assessment, fixes, lab/audit slots, non-conformity cycles. Do not put CQW on the same milestone as first inference.

Name the maintenance: GIGW is not a one-time badge if the site keeps changing. Write whose change board keeps the certificate honest.

• Read stqc.gov.in for the named scheme, not a consultant’s brochure only.
• Read guidelines.india.gov.in if GIGW is the real object.
• Keep the certificate out of the DPIIT drawer in your evidence pack.
• If you cannot meet a named scheme before opening, pre-bid for a post-award timeline or no-bid.

Advice to the officer about to type the bullet

If you want a quality public website, say GIGW / CQW and whose site. If you want an independent security test of an application, say CERT-In empanelled auditor, scope application, independence, and a retest of criticals. If you want a hardware scheme, name it.

If you type 'STQC certified' with no scheme, you will either over-filter honest AI vendors or accept irrelevant certificates. Both outcomes are worse than a precise sentence.

Pressures that keep the vague bullet alive

Vague certification language feels safe. It is how you buy the wrong sticker.

Every serious government IT product has STQC. It is safer to demand it.

Every serious purchase has a named control. Safety is a CERT-In-scoped audit, a residency clause, an evaluation set — not a borrowed website scheme.

Vendors can always get STQC later; make it mandatory now.

Lab and audit calendars are not your go-live calendar. If you need a certificate at opening, you have shrunk the field to whoever already had a different product certified. Be sure that is what you want.

GIGW and STQC and CERT-In are basically the same independence.

They are independent in different ways against different objects. Independence without scope is a slogan.

If we ask a pre-bid question we look unprepared.

You look like someone who reads schemes. Committees prefer that to a certificate you cannot map to the work.

Five days to decide if STQC is your problem

Start from the live ATC sentence, not from fear.

1. Day 1: quote the sentence. Search the rest of the bid for GIGW, CQW, ISO, CERT-In.
2. Day 2: read the named scheme on stqc.gov.in or guidelines.india.gov.in. If nothing is named, draft the pre-bid question.
3. Day 3: map artefact — website, product, process, agent — to the scheme. Write fit / no-fit.
4. Day 4: if fit, plan applicant, cost, calendar, whose milestone. If no-fit, plan pre-bid or no-bid.
5. Day 5: update the evidence pack drawer only if a real certificate or a real application exists. Do not file a wish.

What goes in the file — scheme, scope, artefact

Buyers: the sentence you published, the scheme note, and why that scheme matches the artefact. If you deleted a vague STQC bullet after pre-bid, file that corrigendum like a trophy. It is one.

Vendors: the pre-bid question, the answer, and any certificate with its scope highlighted. A scope that names a different product is not your certificate.

STQC schemes and GIGW processes change. This is not an application guide, not a list of current product schemes for AI models, and not legal advice. Confirm on stqc.gov.in, guidelines.india.gov.in and the live bid.

How to run the route without confusing the letterhead

“STQC Certification: Do You Need It?” is a route problem. A P5 GovTech Founder should know which legal person they are talking to — NIC, NICSI, a state IT corporation, iDEX, or a GeM buyer — and which paper that person can actually issue. Searching “STQC certification software” is not the same as being on a panel that can receive a work order.

STQC is a real MeitY directorate with real schemes. It is not a mandatory blessing for every agent platform. Read the scheme the bid named — and whether they meant GIGW. Empanelment letters are not purchase orders. DPIIT recognition is not a technical score. Reserved startup seats, if a notice writes them, are local to that notice. IndiaAI compute empanelment is not NICSI application-software empanelment.

Keep a warm evidence pack: CIN, GST, DPIIT, Udyam, financials, work-completion letters, architecture one-pager, DPA draft. Renewals are lost by people who treat the panel as a trophy.

• Screenshot the live RFE paragraph you are relying on, dated.
• Match the bidding entity name across every certificate.
• Do not mix iDEX, TDF, NICSI and GeM clocks on one tracker cell.
• Record the validity end date 90 days before it dies.

Close this loop before the next CAB

Put “STQC Certification: Do You Need It?” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P5 GovTech Founder, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “STQC certification software” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.