Sub-Contracting Rules on Government Projects

A MeitY-adjacent project in Delhi allowed 'specialist subcontractors with prior approval'. The prime quietly sent citizen-grievance text to an annotation vendor in another city, and sent embeddings to a foreign model host because the 'sub' was 'just an API'. Neither name was on the bid. A later audit asked who had processed the personal data. The file had one legal entity. The packets had three.

Subcontracting rules on Indian government projects are not a single number. Works contracts sometimes cap labour subcontracting. Goods contracts care about the manufacturer. Service and software contracts care about disclosure, key personnel, and whether the prime is a postbox. Some GCCs say no subcontracting without written approval. Some allow a percentage of the contract value. Some forbid subcontracting of 'the whole' or of 'core' work. Inventing a national 25% or 49% rule is how you write a wrong internal policy.

For agentic AI the hidden sub is often not a civil contractor. It is a model provider, a cloud region, a labelling firm, a '24x7 SOC' in another country, or a 'implementation partner' who actually holds the passwords. The GCC still applies. DPDP processor language applies on top.

This explainer is for primes, for product OEMs who are really subs, and for departmental CISOs who should ask for a named list. It is not legal advice. Quote the GCC in your hand.

Read the GCC, then the SCC, then the bid

Start with the General Conditions of Contract attached to the NIT or the GeM SLA. Search for subcontract, sub-let, assign, consortium, OEM, third party, outsourcing. Write down: is approval needed, is there a percentage or a qualitative limit, must names be in the bid, what happens if you breach (termination, forfeiture, blacklisting).

Then read Special Conditions. SCCs often tighten the GCC for IT: no change of OEM, no offshore support, no cloud region outside India, key experts named. The stricter line wins when they conflict, unless the document says otherwise.

Then read your own bid. If you promised 'all work by permanent employees in Bengaluru', a later sub in Indore is a deviation even if the GCC would have allowed it with approval. You bound yourself.

Places a sub hides in an AI project

Hidden party	Why people pretend it is not a sub	Why the file should name it	Typical control
Foundation-model API host	'It's just software'	They process prompts and may retain logs	Disclose; prefer on-prem weights; contract no-training
Cloud account in the prime's name but vendor-operated	'We hold the tenant'	The operator is a processor	Name the operator; residency; admin rights
Annotation / eval vendor	'Temporary staff'	They see personal or sensitive text	Approve, minimise, delete, audit
Offshore NOC / L2	'Follow-the-sun support'	They can see tickets and sometimes screens	Many gov GCCs forbid or require approval
Implementation SI under a product prime	'Our delivery arm'	They hold keys and talk to the buyer	Disclose; do not exceed any % cap; keep architecture.

There is no single percentage

Some Central PWD-descended works GCCs have historically limited subcontracting and required approval. Some IT service contracts cap the share of work or of value that may leave the prime. Some startup-friendly RFEs are silent except for 'no assignment'. Some defence contracts are far tighter. Copying a 25% rule from a highway EPC into an agent contract is cargo-cult compliance.

If the document is silent, do not assume freedom. Assignment of the contract is usually restricted even when subcontracting of parts is not. Write to the engineer-in-charge or the nodal officer and ask. Keep the email. If they say 'follow GFR', note that GFR is not a complete subcontracting code for software. You still need their written practice.

Percentage games are how people fail. Routing 80% of the money through a 'professional fees' invoice to a sister company is still subcontracting in substance. Committees and auditors now look at substance more than they did in the body-shopping decade.

How to disclose without sinking the bid

In the bid, include a one-page 'third parties and processors' table: legal name, role, location of processing, data classes, whether personal data is seen, whether approval is sought now. Short and dull. Evaluators prefer dull to a surprise in year two.

If a party is not yet chosen (you will tender annotation later), say 'to be appointed with prior written approval; will be an Indian entity; will not receive raw personal data' — only if that is true.

If the RFE forbids subcontracting of 'core' work, define core in your bid: the runtime, the model weights, the retrieval store, the identity integration. Keep those. Sub the wiring, the helpdesk of the helpdesk, the furniture. Do not sub the brain and keep the furniture.

• Never put a foreign model host in a footnote after you ticked 'data stays in India'.
• Never use a personal ChatGPT login on department text. That is an undisclosed sub and a transfer.
• Never let an SI swap your disclosed OEM after technical marks. That is a different bid.
• If you are the sub, insist the prime actually discloses you. Their non-compliance becomes your unpaid invoice and your reputation.

DPDP and security sit on top of the GCC

Even a perfectly approved sub is a processor or a sub-processor when they see personal data. The fiduciary (usually the department) still needs a contract chain. Your prime contract should flow down purpose limitation, security, deletion, and audit. DPDP commencement is phased; the duty to be able to explain the chain will not get easier.

CERT-In logging and incident clocks do not pause because 'the sub had the box'. Write who reports. Write in whose SIEM the packets live.

Air-gap claims die when a sub opens a support tunnel 'just this once'. Put tunnel rules in the subcontract, not only in the prime's slide.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Everyone uses APIs; we do not need to list them.

Everyone used to say that about cloud admin access too. If the API sees department text, list it. If you cannot name a host because it is 'whatever region is cheapest tonight', you cannot bid an Indian government workload.

Our lawyer said the statutory cap is 25%.

Ask them to show the statute that applies to this software service contract. If they show a works GCC from another ministry, that is not your cap. Your cap is your GCC.

Disclosure will lose us marks against a 'pure play' rival.

A rival who hides the same API is a later scandal. A clean table can be scored as maturity. If the RFE forbids that API, you would have lost anyway.

We will disclose after award so the bid stays simple.

If the GCC wants names in the bid or prior approval before engagement, after-award is a breach. Simple is not the same as compliant.

A one-week subcontract map

Do this on every live government project, including 'pilots'.

1. Extract every GCC/SCC sentence on sub-let, assignment, OEM and third parties into a one-pager.
2. List every party who can see text, weights, logs, or admin. Include APIs and the founder's favourite SaaS.
3. Mark each: disclosed / needs approval / must be removed.
4. Write the flow-down: no-training, residency, deletion, incident clock, no standing tunnel.
5. Send the approval request before they see data, not after the invoice.
6. File the approvals next to the GCC. Brief the CISO.

How this shows up in the file

File note for the buyer: 'The contractor shall not subcontract processing of departmental data or replacement of the disclosed runtime / model host without prior written approval. A table of current processors is at Annex A. Percentage limits, if any, are as in GCC clause … We do not treat an API host as outside this clause.'

File note for the vendor: 'We will not enter a government workload on an undisclosed model host. If the GCC is silent we will still disclose processors. We will not quote a universal % in policies; we will quote the contract.'

What the next noting must contain

“Sub-Contracting Rules on Government Projects” belongs in a file, not only in a search result. A P4 Security/CISO should be able to point at one artefact that proves “subcontracting government contract”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

There is no universal Indian percentage for subcontracting. The General Conditions of Contract, the RFE and the work order decide. Hide a model host or an annotation farm and you have a compliance incident, not a staffing plan. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C4 Empanelment & Routes: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “subcontracting government contract”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.

This article is informational field guidance for Indian public institutions and their vendors, not legal, tax, procurement or engineering advice. Confirm the live circular, RFE, GCC, GeM term, state G.O. and your counsel before you file anything. Incentives, ceilings and portal screens change.