Policy & Debate
The Case Against Buying Foundation Models
· 10 minute read
Argues against the obvious choice. A P1 CIO/CTO working “build vs buy AI government” should leave with one dated artefact, one owner after the next posting, and a stop rule — not a workshop photograph.
“The Case Against Buying Foundation Models” is the search phrase. The file needs a decision. A P1 CIO/CTO who cannot attach a signed processing schedule should not schedule another workshop. This guide is the decision, the artefact, and the stop rule — written for Indian government, PSU and campus buyers, not for a global CIO newsletter.
Policy debate in this cluster is not a substitute for a file. Sovereignty is a set of enforceable paths: where prompts go, who can compel the operator, what happens on contract exit, and which law you are actually invoking. “Indian-owned” is not a statutory definition. Write the clause.
We will not invent a circular, a GMV, or a percentage so the heading looks like research. Where the title bank dangles a figure, we treat it as a hook to interrogate. Where the law is silent, we say so. Confirm everything against the live Gazette, the live GeM term, and counsel. This is not legal, procurement or engineering advice.
What is actually true — and what the heading is hiding
Take the heading literally. “The Case Against Buying Foundation Models” is either a control you can show a stranger, or it is decoration. Decoration is how a Navratna PSU tender cell ends up with a public agent, an undeclared tool, and a noting that says “AI-enabled.”
The India AI Governance Guidelines (November 2025) are a MeitY-associated guidance document. They are not DPDP, not CERT-In, and not a Gazette that creates a new offence. Use them to structure a conversation. Do not tell a secretary they are “the law.”
The primary keyword “build vs buy AI government” is useful for search. It is useless in a file unless you define the object, the owner, the artefact and the revisit. Those four fields are the whole article, restated for this title.
IndiaAI compute access, NICSI application-software empanelment, and a GeM catalogue entry are three different legal persons and three different clocks. Mixing them on one slide is how founders apply to the wrong portal. Open the live notice.
- Define build vs buy AI government in one sentence a stranger can score.
- Name a designation, not a vendor, as owner of “The Case Against Buying Foundation Models.”
- Attach a signed processing schedule or write the date it will exist.
- Name the instrument. Do not name a mood.
| Claim in the deck | What the file needs | Fail if missing |
|---|---|---|
| We handle build vs buy AI government | Named owner (the programme director) plus a signed processing schedule | A heading with no attachment |
| a Navratna PSU tender cell is ready | A dated readiness note with a stop rule | A photograph of a workshop |
| Compliant / sovereign / secure | The instrument: DPDP schedule, CERT-In mapping, GFR clause, or guideline paragraph | An adjective without a PDF date |
| Pilot succeeded | Held-out task, baseline, and a kill sentence | A newspaper line |
How this fails in a real Indian file
The common failure is a photograph. Someone ran a demo titled The Case Against Buying Foundation Models, used a live row because “otherwise it will not impress,” and left no pack, no deletion, and no owner. Six months later the question is not “did the model work.” The question is “who has the log.”
Open weights can help inspectability and reduce a licence-server hop. They do not, by themselves, make a stack sovereign. A foreign crash reporter on an Indian weight is still a hop. A fine-tune on uncleared personal data is still a DPDP problem. Provenance of the base model is a supply-chain question — write the card, the date, and the licence, not a flag emoji.
The second failure is a transferred champion. Indian postings are not a risk register line you add for colour. If build vs buy AI government lives in one officer’s inbox, it will die in that inbox. Write a deputy. Write a zip. Write a runbook a stranger can run.
The third failure is mixing legal persons. NIC is not NICSI. IndiaAI compute access is not an application empanelment. A GeM catalogue is not a PAC. A guideline is not a Gazette. Mixing them is how you apply to the wrong portal and then blog that the state is hostile.
- Workshop photograph, no artefact.
- Champion posted out, no deputy, no zip.
- Live personal data in a demo, no schedule.
- Guideline sold as statute, or a forecast sold as a measurement.
- Wrong legal person: NIC / NICSI / IndiaAI / GeM / PAC mixed on one slide.
What “The Case Against Buying Foundation Models” is actually asking
Start with a sentence a secretary can repeat: what build vs buy AI government is, what it is not, and what you will attach. Then collect a signed processing schedule. If you cannot collect it this week, write the date you will, and do not demo until that date.
Do not invent a national registry, a new regulator, or a percentage of “agentic adoption.” If you propose an institution, say it is a proposal. If you cite a forecast, name the house and refuse to treat it as a measurement of Indian districts.
Keep personal data off the demo path. Use a pack you brought. Write training and improvement rights as refused unless counsel says otherwise. If the buyer insists on live data, insist on a processing schedule and a deletion certificate, or walk.
Put CERT-In-relevant logs in India for the required period if the object is in scope of the 2022 directions. Put DPDP roles on a one-page schedule. Do not claim localisation the Act does not write.
Searchers who type “build vs buy AI government” are rarely looking for a definition. They are looking for a sentence they can put in a note, a bid, or a founder update. This section is that sentence, then the work behind it.
The work is institutional. A P1 CIO/CTO who cannot name the next artefact should not schedule a demo. The demo will become the project, and the project will become a photograph.
- Write one sentence that would still be true if the vendor changed.
- Write one sentence that would be false if build vs buy AI government were only a heading.
- Put both sentences in the note before the next meeting.
What to put in the next note
Next note, three dated sentences: (1) we mean build vs buy AI government as [definition]; (2) the owner is [designation] with deputy [designation]; (3) the artefact is [name] last checked on [date], next check on [date]. If you cannot write the three sentences, you are not ready to buy or to sell.
Attach a signed processing schedule or a one-page reason it does not exist. Refuse a vendor one-pager as the only annexure. A P1 CIO/CTO signs the note. The vendor does not.
Objections you will hear — and what to do with them
These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.
We do not have time for another control
You already have a control: the day someone asks why a citizen got the wrong answer. “The Case Against Buying Foundation Models” is that day, scheduled. A two-page note now is cheaper than a six-month reconstruction later.
The vendor said this is included
Included in a brochure is not included in a statement of work. Ask for the artefact that would exist if build vs buy AI government were true. If they cannot name it, it is not included.
This is only a pilot
A pilot that touches personal data, a public URL, or a write tool is a production-shaped object with a short calendar. DPDP duties and CERT-In clocks do not wait for your go-live banner. Time-box it, use a pack you brought, and write the deletion.
A field playbook for “The Case Against Buying Foundation Models”
Run this as a month, not as a mindset. If a week produces no artefact, stop. A navratna psu tender cell does not need another group photograph.
- Write the one-sentence definition of build vs buy AI government that a secretary can repeat.
- Assign the programme director as the file owner. Put a deputy on the same line for the next posting order.
- Collect a signed processing schedule or write why it does not yet exist and when it will.
- Map the data path for one user-visible answer: prompt, retrieval, tool, log, exit.
- Name the instrument: DPDP schedule, CERT-In 2022 mapping, GFR clause, GeM term, or guideline paragraph.
- Run one non-production rehearsal. Minute what broke. Do not use live citizen rows.
- Put a stop rule and a revisit date in the note. Create the calendar invite.
- Tell the vendor, in writing, which hops and which training rights are refused.
How this shows up in the file
If this article does its job, someone will put “The Case Against Buying Foundation Models” on a change-advisory or a bid-opening agenda as a single line with an owner. That is the success metric. Traffic is not.
Revisit when the model, the SI, the GeM term, the region, or the posting order changes. Unsigned watch items are souvenirs.
This article is informational, not legal, procurement or engineering advice. Confirm against the current Gazette, circular, GeM term and your counsel before you file it.
Questions this usually raises
- Is “The Case Against Buying Foundation Models” a legal requirement?
- Usually no. DPDP, the 2025 Rules, CERT-In’s 28 April 2022 directions, GFR 2017 and sector circulars are the instruments that create duties. This article is a field practice. Confirm against the current Gazette, circular and your counsel. The November 2025 AI governance text is guidance, not a statute.
- Who should own build vs buy AI government inside the institution?
- A P1 CIO/CTO can sponsor it, but the file owner should be a designation that survives a transfer — CIO, DPO, CISO, programme director, or registrar — not “the vendor.” Write a deputy on the same line.
- Can we use a foreign model API if the UI is hosted in India?
- Hosting the UI in an Indian region is not the same as keeping prompts, embeddings and logs in India, and it is not automatically lawful or wise. DPDP is not a blanket localisation statute. Sector rules can still forbid the hop. Write the path and the instrument. Do not file “the website is .in.”
- What is the smallest artefact that would make “The Case Against Buying Foundation Models” true?
- One dated object a stranger can open: a signed processing schedule. If you only have a slide, you have a heading. Headings do not survive audit.
- How does Prcept AI show up in this file?
- As an on-prem / air-gapped agent platform you can fail. Demand the same artefact on us that you demand on anyone else claiming build vs buy AI government in C14 Policy & Debate. We would rather lose a bad unit than inherit a noting we cannot defend. This is not a sales clause and not legal advice.
Sources
- Prcept AI — platform and sovereignty
- Digital Personal Data Protection Act, 2023 (India Code)
- India AI Governance Guidelines (PIB document, November 2025)
- IndiaAI Mission — official programme pages
- CERT-In Directions under Section 70B, 28 April 2022 (PDF)
- Department of Expenditure — General Financial Rules, 2017
- Prcept AI — sovereignty as a procurement problem