Resources Categories
INDUSTRY FACT FILE · AI, ANALYTICS & AUTOMATION
Industry Overview: AI, Analytics and Automation in India
Who builds and adopts AI, analytics and automation, the rules and standards that apply, who buys AI security and why each needs a distinct approach.
|
In this document 1. Why AI security matters now 2. The ecosystem at a glance 3. Categories of AI, analytics and automation players 4. The rules and standards shaping AI risk 5. Government, regulator and private participants 6. Who buys AI security inside an organisation 7. Why each player type needs a different approach 8. How Codec Networks works with AI builders and adopters |
|
Sector scope Sector: AI, analytics and automation — AI product firms, enterprise AI adopters, analytics providers and chatbot and AI agent developers. Primary service proposition: AI/LLM security testing, data leakage testing, model risk, AI governance and privacy. SaaS vendors and cloud and GPU providers are covered in separate fact files. |
1. Why AI security matters now
AI has moved from experiments to production. Indian start-ups build domain models and assistants, analytics providers embed machine learning in decisions, and banks, insurers, hospitals and government departments deploy chatbots, copilots and agents that read sensitive data and take actions.
|
Nov 2025 India AI Governance Guidelines released |
20 Feb 2026 IT Rules amendment on synthetic content in force |
6 hours To report cyber incidents to CERT-In |
May 2027 Most DPDP obligations take effect |
AI introduces new attack paths. Hidden instructions in emails or web pages can hijack assistants (prompt injection); agents with broad permissions can take unsafe actions; personal data can leak through answers or training data; and deepfakes enable fraud. In 2024, a multinational firm reportedly lost about US$25 million after an employee joined a video call with deepfaked executives, and a Canadian tribunal held an airline responsible for its chatbot's incorrect advice.
India released AI Governance Guidelines in November 2025, favouring a principles-based approach that relies on existing laws and sector regulators. An IT Rules amendment on synthetically generated information came into force on 20 February 2026, and the DPDP framework governs personal data used to train and run AI.
|
Key takeaway AI security is not only about the model. It is about what the system can read, what data it holds and what it is allowed to do—and proving those controls to customers, regulators and Boards. |
2. The ecosystem at a glance
Figure 1: India's AI, analytics and automation ecosystem.
3. Categories of AI, analytics and automation players
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
AI product firms |
Foundation, domain-specific and vertical AI products |
Start-ups, scale-ups and technology companies |
IT Act; DPDP; IT Rules (where intermediaries); customer contracts |
|
Chatbot and AI agent developers |
Customer assistants, copilots and autonomous agents |
Product firms and service providers |
DPDP; consumer protection; customer contracts |
|
Analytics providers |
Data platforms, BI, predictive and decision analytics |
Analytics and data companies |
DPDP; sector rules of clients |
|
Automation and RPA providers |
Intelligent automation and workflow AI |
Automation vendors and integrators |
Customer contracts; sector rules of clients |
|
Enterprise AI adopters |
Organisations using AI in operations and customer service |
Enterprises across sectors |
Sector regulators; DPDP; India AI Governance Guidelines |
|
BFSI AI adopters |
Banks, NBFCs, insurers and market entities using AI |
Regulated entities |
RBI FREE-AI framework; SEBI and IRDAI expectations; DPDP |
|
AI platforms and MLOps providers |
Model hosting, pipelines and AI infrastructure |
Cloud and platform companies |
CERT-In Directions; customer contracts |
4. The rules and standards shaping AI risk
|
Instrument |
What it means for AI builders and adopters |
|
India AI Governance Guidelines (MeitY, 5 November 2025) |
Seven guiding principles, including trust, people first, accountability, understandability and safety A light-touch approach relying on existing laws and sector regulators rather than a new AI law |
|
IT Rules amendment on synthetically generated information (in force 20 February 2026) |
Intermediaries must label synthetic content and act quickly on flagged unlawful content, including faster takedown timelines |
|
DPDP Act 2023 and DPDP Rules 2025 |
Lawful processing, notice and consent, security safeguards and rights for personal data used in training and operation; most obligations from May 2027 |
|
CERT-In Directions (2022) |
Cyber incidents, including those affecting AI systems, reported within six hours; 180-day logs |
|
RBI FREE-AI framework (2025) |
Framework for responsible and ethical enablement of AI in the financial sector, guiding BFSI adopters |
|
EU AI Act, ISO/IEC 42001 and NIST AI RMF |
Risk-based obligations for AI in EU markets (phased); certifiable AI management system standard; voluntary AI risk framework |
|
How these apply Applicability depends on whether you build, host or use AI, your sector and your markets. Confirm against the official texts. |
5. Government, regulator and private participants
- MeitY leads AI policy, including the India AI Governance Guidelines and the IndiaAI Mission, and administers the IT Rules and DPDP framework.
- Sector regulators such as RBI, SEBI and IRDAI set expectations for AI used by regulated entities.
- CERT-In handles cyber incident reporting and advisories.
- Model providers and platforms supply the commercial and open-source models adopters build on.
- Enterprise buyers increasingly run AI-specific security reviews.
6. Who buys AI security inside an organisation
|
Stakeholder |
What they care about |
What they buy |
|
Board and CEO |
AI risk, liability and reputation |
AI governance programmes, Board briefings |
|
Chief AI / data officer |
Safe, compliant AI at scale |
AI governance, model risk management |
|
CTO and engineering |
Secure AI applications and agents |
AI/LLM and agent security testing |
|
CISO |
New AI attack paths and shadow AI |
AI red teaming, monitoring, policies |
|
Data protection officer |
Personal data in training and prompts |
DPDPA programme for AI |
|
Risk and compliance |
Sector regulator expectations |
Model risk and governance assessments |
|
Product and customer teams |
Trust in AI answers |
Output safety and leakage testing |
7. Why each player type needs a different approach
|
Player type |
Highest-consequence risk |
Starting point for assurance |
|
AI product firm |
Model theft, training-data privacy, supply-chain risk |
Model risk review, leakage testing, governance |
|
Chatbot and agent developer |
Prompt injection and excessive agency |
Injection and agent security testing |
|
Analytics provider |
Bulk data leakage and bias |
Data access reviews, model governance |
|
Automation / RPA provider |
Unsafe automated actions |
Permission scoping and approval controls |
|
Enterprise adopter |
Shadow AI and data leakage to tools |
AI usage policy, DLP, approved tools |
|
BFSI adopter |
Regulatory scrutiny of AI decisions |
Model risk and FREE-AI-aligned governance |
8. How Codec Networks works with AI builders and adopters
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For AI builders and adopters we deliver AI/LLM and agent security testing, data leakage testing, model risk and supply-chain reviews, AI governance aligned to ISO/IEC 42001 and India's guidelines, and DPDPA programmes for AI data.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. AI governance instruments are summarised from public sources. Confirm obligations against the official MeitY, CERT-In, sector-regulator and international texts before making compliance decisions.