Vigilance and CVC Concerns in PSU AI Projects

A CVO asked whether the Commission had issued the AI circular yet. The room waited as if a PDF would dissolve every hard question. We have not found a CVC instrument that creates a new, specialised duty titled for artificial-intelligence agents. If you have one, cite it with a date and a number. If you do not, do not invent it, and do not wait for it.

The Central Vigilance Commission exists. Its statute, its procurement-related instructions over many years, CTE-type examinations, integrity-pact practice, and the ordinary expectations of fairness, competition and documented application of mind already apply to an AI purchase. New nouns — model, agent, RAG — do not cancel those expectations.

This explainer is for the CVO, the CISO and the director who can feel a future complaint in the way a hosted POC was accepted as a specification. It is field guidance, not a substitute for the Commission's own site or for counsel.

Do not invent the circular

Inventing a circular number is worse than having none. Officers who cite imaginary instruments become the story. Vendors who put CVC AI compliant on a slide are making a marketing claim, not a legal one, unless they show the instrument.

As of 17 August 2026, treat any such badge as unsourced until you open cvc.gov.in and read the text. Our not finding a specialised AI circular is not a finding that none will ever exist. It is a finding that you must not pretend one already binds your file.

If a circular appears tomorrow, attach it and interpret it with counsel. Until then, apply the old tests to the new object.

Old tests, new object

Ordinary vigilance questions applied to an agent purchase.

Old test	How it shows up in AI	What to put on the file
Haste / fait accompli	Go-live promised for a foundation day; POC on live data	Dated register row before production data
Brand-specific specs	Named model or named cloud as mandatory without reason	Performance and isolation needs; equivalents allowed
Splitting to dodge competence	Ten small chatbot POs instead of one platform note	One commercial picture for the board or competent authority
Gifts and free POCs	Vendor trains on your corpus for free, then bids	Written POC terms; no live personal data; no leftover access
L1 on unlike things	Cheapest hosted chat versus air-gapped gates	Eligibility that actually tests isolation and exit
Missing application of mind	Officer pastes the model's allegation or award line	Accept control in the system of record; corpus hygiene
Conflict / revolving door	Author of the spec joins the winner	Ordinary recusal and cooling-off practice, recorded

What a CVO should sample without becoming a data scientist

Pick one awarded AI-related PO and one cancelled bid. Ask for the specification, the pre-bid replies, the evaluation sheet, the POC terms, and one production packet if live. You are not scoring BLEU. You are scoring whether two bidders could have understood the same isolation story, and whether an officer's mind is visible on a case.

Ask whether support can open a session from outside the approved perimeter. That is not a fashion question. It is an access question.

Ask whether Aadhaar, vendor bank details, or bid prices sit in model traces. That is a data question and a fairness question together.

Integrity pacts, CTE, and the limits of paper

Where your CPSE already uses integrity pacts or similar instruments, use them. They do not become obsolete because the object is software. They also do not, by themselves, make a hosted tenant fair.

CTE-style examination, where it applies, will still look at estimates, extras and whether the executed work matches the sanction. An AI transformation sanction that delivered a single FAQ bot is an extras-and-scope conversation, not a model-quality conversation.

Paper that nobody tests is decoration. Run the month-six restore and the packet export. Vigilance is easier when internal audit already burned you.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

Until CVC writes an AI circular we cannot buy

You can buy under existing rules. Waiting for a specialised text is how haste then arrives as a foundation-day panic.

The vendor is CVC empanelled for AI

Check what any empanelment actually says. Do not accept a badge that cites an instrument you cannot open.

Vigilance will block innovation

Vigilance blocks informal innovation on public money. Formal, reconstructable, competitive innovation is still available. It is just less theatrical.

Our CVO is not technical

They do not need to be. They need the old tests and two sample files. Give them those, not a model card.

Four weeks to a vigilance-ready AI file

1. Week 1: search cvc.gov.in and your internal vigilance circulars for anything that actually names AI or automated decision. File what you find and what you do not.
2. Week 2: map the old tests to your live or proposed buy using the table above. Mark red cells.
3. Week 3: sample one PO and one cancelled bid, or one POC. Repair branded clauses and leftover vendor access.
4. Week 4: write a one-page CVO brief that refuses the invented circular and shows the ordinary tests. Invite internal audit to the packet export.

How this shows up in the file

Subject: Vigilance treatment of agent purchases — no invented circular.

As of the date of this note we have not placed on file a CVC circular that creates a new specialised duty for AI agents. Existing standards of competition, fair specification, recorded competence, gifts and POC control and application of mind continue to apply.

Vendor claims of CVC AI compliance shall be ignored unless the instrument is attached. This note is an internal aid. It is not legal advice and not a Commission instruction.

What Prcept will not print

We will not print a fake circular number to make a slide land. We will not sell a CVC-compliant badge. We will help you write the old tests onto an agent file and keep the packet export in the department. If a specialised instrument is later published, attach it. Until then, honesty is the compliance.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, engineering or board advice. Confirm against the live Gazette, GFR, GeM term, CVC instruction, CERT-In direction, UIDAI regulation, DPE guideline, DPDP text, departmental charter, plant safety manual and your counsel before you file it.

How this clears vigilance and the board

A P6 Compliance/DPO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “Vigilance and CVC Concerns in PSU AI Projects” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

There is a Central Vigilance Commission. There is not, in our reading, a magic AI circular you can hide behind — or invent. Use the ordinary tests. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “Vigilance and CVC Concerns in PSU AI Projects” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “CVC guidelines AI procurement” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “Vigilance and CVC Concerns in PSU AI Projects” is only a heading, it will not survive a file inspection. A P6 Compliance/DPO should be able to attach one artefact that proves “CVC guidelines AI procurement”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “CVC guidelines AI procurement” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.