Governance in the Age of AI: A CFO's Playbook for Mid-Sized Indian Companies

This is the real state of AI governance in Indian mid-sized companies today: not a hypothetical future risk, but a live, quarter-on-quarter exposure sitting inside systems that already touch payments, filings, and financial statements. Nearly half of Indian enterprises (47%) now have multiple Generative AI use cases live in production, with another 23% in pilot (EY-CII report, November 2025). Deployment has outrun governance, and CFOs are the ones left holding the balance sheet consequences.

Why Should the CFO Own AI Governance, Not IT?

Because AI in finance functions today isn't a chatbot experiment — it's making or influencing decisions that hit the general ledger. AI now auto-classifies TDS sections, reconciles GST returns against e-invoices, flags anomalies in expense claims, and increasingly recommends provisioning and forecasting adjustments. When these systems err, the loss shows up as a financial control failure, not a technology bug.

The pressure compounding this is uncomfortable but well documented: 85% of Indian finance leaders report pressure to demonstrate measurable ROI on AI investments, while only 8% say governance is prioritized over speed of deployment (VARIndia survey). That imbalance is contributing to the significant governance gap.

The accountability vacuum is structural, not anecdotal. More than one in four Indian finance leaders (27%) say accountability for significant AI-related errors is either unclear or assigned to no one at all (VARIndia survey). And nearly a quarter (24%) admit their internal controls haven't been updated in the past year to reflect that AI agents are now making or recommending business decisions (VARIndia survey). Layering AI decisioning on top of an already-challenged internal control structure increases risk.

The financial stakes are not abstract. A recent global survey found 99% of companies using AI reported financial losses tied to AI-related issues, and nearly two-thirds suffered losses exceeding US$1 million (IOD India, Governance Matters). For a mid-sized Indian company running on thinner margins and leaner audit teams than an MNC subsidiary, a single incident of that scale can wipe out a quarter's profit.

What Does India's Regulatory Approach Actually Require of You?

India has deliberately chosen not to legislate AI through a single overarching law. The India AI Governance Guidelines issued by MeitY in November 2025 explicitly adopt a "light-touch, innovation-friendly" posture — voluntary codes, principle-based guidance, and an emphasis on not slowing deployment (EY analysis). Instead, India relies on existing sector-specific regulators — RBI, SEBI, IRDAI — and cross-cutting statutes like the DPDP Act to police AI risk through the frameworks that already exist (Unified Chambers analysis).

This "light-touch" framing is easy to misread as "low obligation." It isn't. Three specific regulatory threads already bind mid-sized companies, whether or not they think of themselves as AI companies:

The DPDP Act, 2023 covers any "wholly or partly automated operation" performed on personal data — which includes the AI models scoring your customers' creditworthiness, screening job applicants' resumes, or personalizing collections outreach. Penalties run up to ₹250 crore per contravention (Unified Chambers analysis). If your AI vendor's model was trained on customer PII without a documented lawful basis, that liability sits with you as the data fiduciary, not the vendor.

RBI's draft Guidance on Regulatory Principles for Model Risk Management (June 2026) is the clearest signal yet of where sector regulators are heading. It mandates board-level accountability for AI/ML models and requires a formal "three lines of defense" structure — business unit ownership, independent risk oversight, and internal audit (RMA India analysis). Even if you're not an NBFC or bank, this is the template your auditors and lenders will increasingly expect to see replicated in your own risk committee minutes — banks are already asking mid-sized borrowers about model governance as part of credit renewal diligence.

SEBI's forthcoming AI/ML guidelines for capital markets will mandate human oversight, data control requirements, and "kill-switch" mechanisms for algorithmic systems (Economic Times). Listed mid-caps and companies preparing for IPO should treat this as a preview of disclosure expectations coming their way, not a rule that applies only to brokers and asset managers.

One structural point often missed in boardroom AI debates: the Companies Act, 2013 defines a "director" as a natural person, which legally precludes any AI system from holding a directorship or fiduciary role in an Indian company (IRCCL analysis). That's not a technicality — it means the accountability for every AI-influenced decision, without exception, legally traces back to a human director or officer. There is no scenario in which "the algorithm decided" is a defensible board minute.

How Do You Build a "Three Lines of Defense" for AI at a Company That Isn't a Bank?

RBI's model doesn't need to be reserved for regulated financial entities — it's the most practical governance scaffold available, and it maps cleanly onto a mid-sized company's existing org chart.

Line 1 — Business ownership. The functional head who uses the AI tool (AP manager, tax head, FP&A lead) owns the outputs it produces, just as they'd own a manual process. Every AI use case needs a named business owner in writing — not "the finance team," but a person.

Line 2 — Independent risk oversight. A risk or controllership function (or, in a smaller company, the CFO personally with a designated deputy) independently reviews model outputs on a sample basis, tracks override rates, and maintains an AI risk register. This is distinct from Line 1 because the person using the tool daily is the worst-positioned person to catch its systemic errors.

Line 3 — Internal audit. Quarterly (not annual) internal audit coverage of AI-touched processes — specifically testing exception handling, threshold logic, and vendor SLA adherence.

Is AI Making Your GST and TDS Compliance Safer or Riskier?

Both, depending entirely on whether you've built oversight around it. AI is genuinely transforming Indian tax compliance — automating GST reconciliation between GSTR-2B and purchase registers, validating e-invoices in real time, classifying TDS sections, and helping tax authorities themselves run large-scale fraud detection through initiatives like CBDT's Project Insight (Taxmann expert guide, 2026).

Here's the part CFOs underappreciate: the tax department's AI is now often more sophisticated than the taxpayer's. Project Insight cross-references your GST filings, TDS returns, bank transactions, and even property registrations to flag mismatches automatically. If your own GST reconciliation is still manual or semi-automated, you are effectively being out-governed by your regulator — you'll find out about a mismatch when the notice arrives, not before. Automation without a governance layer just moves the error faster, and governance without automation leaves you structurally behind the tax department's own AI.

How Exposed Are You to Vendor and Cloud Concentration Risk?

Most mid-sized Indian companies don't build their own AI models — they buy or subscribe to a handful of vendor platforms layered on one or two cloud providers. This creates a specific, underestimated risk: heavy dependence on a small number of providers for critical AI capability means a single vendor outage, model update, or contract dispute can simultaneously disrupt multiple business processes, and the resulting failures are harder to isolate and diagnose because they cascade across systems that all trace back to the same upstream dependency (IRM India analysis).

Practical due diligence questions your procurement and legal teams should be asking every AI vendor before signing, none of which are exotic or require a data science background:

1. Where is our data physically stored, and does the vendor's sub-processor list include any entity outside India that would trigger DPDP cross-border transfer obligations?
2. What is the vendor's documented model update cadence, and do they notify us before retraining or upgrading a model that touches our financial data?
3. Can we get audit logs of every AI-generated decision that affected a payment, a tax filing, or a customer-facing figure — and how long are those logs retained?
4. What is the contractual liability cap if the vendor's model error causes us a quantified financial loss — is it capped at 12 months of fees, which is typically far below realistic exposure?
5. Is there a manual fallback process documented and tested if the AI system becomes unavailable for more than 24 hours?

If your finance stack already spans Tally, SAP, or Power BI dashboards, the governance questions compound with each additional layer, influencing how contained (or how cascading) an AI failure ends up being.

What Should a Mid-Sized Company's AI Governance Charter Actually Contain?

Skip the 40-page policy document nobody will read. A working AI governance charter for a company in the ₹100-500 crore revenue range needs five concrete elements, each with an owner and a review cadence:

1. An AI use-case register — every AI tool in use, what decision it influences, who owns it, and its risk tier (low/medium/high based on financial materiality and whether it touches personal data). Update quarterly.
2. A human-in-the-loop threshold for every high-risk use case — a defined rupee or percentage threshold below which auto-approval is permitted, above which mandatory human review applies. Review this threshold every six months against actual error patterns, not once and forget it.
3. An incident and override log — every time a human overrides an AI recommendation or an AI decision causes a financial discrepancy, it gets logged with root cause. This log is your evidence trail for both internal audit and, increasingly, for regulator or lender queries.
4. A named accountable owner at the board or audit committee level — not a committee, a person — who reports AI risk metrics (override rates, incident count, financial impact) quarterly, mirroring the board-level accountability RBI's draft guidance already mandates for regulated entities.
5. A DPDP data-mapping exercise for every AI tool that touches personal data — customer, employee, or vendor — documenting lawful basis and retention period.

None of this requires a data science team. It requires the same discipline mid-sized companies have (hopefully) already applied to statutory internal financial controls — just extended to cover a new category of decision-maker that doesn't sleep, doesn't get audited by default, and doesn't raise its hand when it's wrong.

How BiPivot helps

BiPivot works with CFOs and finance heads of mid-sized Indian companies to build AI governance frameworks that sit inside existing internal control structures — not bolted on as a separate compliance exercise. If you're deploying AI in finance, tax, or reporting workflows and need a practical risk register, vendor due diligence checklist, or board-reporting structure built for your context, visit bipivot.com to start the conversation.