AI Governance and Digital Sovereignty: Navigating Risks in India’s Digital Transformation
By Mohan Veloo, Chief Technology Officer, Asia Pacific, China & Japan, F5
India’s rapid digital acceleration is now a widely acknowledged reality. In sectors including banking, telecommunications, and digital services, artificial intelligence has transitioned from experimental phases to large-scale production. According to recent findings, nearly half of Indian enterprises are actively deploying multiple AI use cases in operational environments.
This evolution fundamentally shifts the discourse; the question has moved from how swiftly organizations can implement AI to whether they can maintain control over these systems once operational. AI has emerged as part of the essential infrastructure, and a lack of control introduces a new category of risk that is less visible, harder to detect, and increasingly complex to manage.
The Immediate Challenge: Governance of Generative AI in Production
One of the foremost challenges facing Indian enterprises is the security and governance of generative AI systems in production. Unlike traditional software applications that may fail predictably, AI systems can produce subtly incorrect, biased, or non-compliant outputs without obvious alert signals. These behavioral failures complicate monitoring and management.
As organizations expand AI applications in customer service, fraud detection, and operational workflows, the gap between deployment and control has widened. Many enterprises have shown capability in deploying AI models but lack mechanisms for visibility and governance in real-world settings. Although AI adoption may appear successful, operational confidence often remains alarmingly low. The crucial risk stems not from whether AI is utilized, but from how well its behavior is comprehended and managed over time.
AI and the Expanding Enterprise Attack Surface
Simultaneously, AI is fundamentally altering the enterprise attack surface. The advent of inference as an operational layer is characterized by dynamic traffic patterns and intricate dependencies among models, data sources, and applications. Traditional security frameworks, designed for predictable systems, are increasingly ill-equipped for this new paradigm.
Moreover, AI itself has become a target for exploitation. Attack vectors such as prompt injection, data leakage, adversarial inputs, and deepfake-driven fraud are practical concerns, not merely theoretical scenarios. A significant number of organizations in India currently consider AI-enabled threats to be a top security concern, with many having experienced incidents involving deepfakes and AI manipulation.
In industries such as banking and telecommunications, where AI operates in real-time and at a national scale, the implications extend significantly beyond technical risk. These systems directly affect customer trust, financial stability, and service continuity. Thus, securing them involves more than protecting infrastructure; it also requires safeguarding decision-making processes that are inherently probabilistic and adaptive.
Proximity of Quantum Risk
While immediate AI-related risks require attention, organizations must also prepare for the encroachment of quantum computing, which poses a secondary and less visible threat. The rise of quantum technology is projected to undermine current cryptographic foundations securing digital ecosystems, a concern often viewed as a distant issue. However, timelines indicate that sensitive data captured today could be stored and decrypted in the future as quantum capabilities evolve.
Transitioning to post-quantum cryptography is a multifaceted endeavor, demanding coordinated changes across applications, APIs, networks, and overall infrastructure. Organizations delaying this transition may encounter not only technical hurdles but also regulatory pressures as quantum readiness becomes an expectation.
Digital Sovereignty as an Operational Necessity
Geopolitical tensions have highlighted an increasingly critical aspect: digital sovereignty is not merely a theoretical notion but an operational requirement. Instability in global energy corridors, particularly around significant routes such as the Strait of Hormuz, underscores the rapid disruptions that interconnected systems can face.
Asia, especially energy-importing countries like India, remains vulnerable to geopolitical shocks and uncertainties in supply chains. This predicament emphasizes a broader lesson concerning systemic risk. Dependency without control fosters fragility. Governments must now reassess resilience strategies, diversify supply chains, and ensure the continuity of critical infrastructure amid uncertain conditions.
In the digital sphere, enterprises are heavily reliant on global cloud platforms, cross-border data movement, and externally managed AI infrastructures. While this model offers efficiency and scalability, it exposes organizations to greater risk under stress. Companies now face the imperative to assess not just the reliability of these platforms, but their control and accessibility in fluctuating conditions.
Digital sovereignty is about retaining oversight over application operations, data residency, and system behavior during external changes, rather than severing ties with global ecosystems. The lessons learned from energy security are directly applicable to digital infrastructures; resilience requires optionality, visibility, and control.
An Integrated Approach to Upcoming Challenges
A frequent error is to categorize AI security, quantum preparedness, and digital sovereignty as distinct initiatives. Instead, these challenges converge on shared systems, data flows, and architectural choices. The infrastructure developed today to support AI must also withstand future cryptographic disruptions and adapt to evolving geopolitical constraints.
Security cannot simply be an add-on; it must be integrated within the architecture, especially at critical points where traffic flows, decisions occur, and data is processed. Static controls are inadequate at AI scale; systems must dynamically respond to changing inputs, emerging threats, and new regulatory demands.
Here, a control plane becomes essential, ensuring real-time policy enforcement, continuous visibility, and capability to address anomalies as they arise.
Regulatory Pressures and the Need for Governance
India’s Digital Personal Data Protection framework emphasizes increased accountability in data handling, including for AI-driven systems. Organizations must now show not only data protection but also how data is accessed, processed, and governed throughout its lifecycle.
Many enterprises still struggle with significant visibility issues, with only a minority reporting comprehensive awareness of their data’s residence and flow across systems. This lack of clarity generates compliance and operational risks, necessitating consistent enforcement of policies across increasingly complex environments.
The Future of Digital Control in India
As India progresses through its digital evolution, the focus is shifting from mere access and adoption to governance. Controls over AI behavior, data movement, and decision-making processes are crucial. Geopolitical and regulatory pressures will necessitate that organizations manage AI systems with a high degree of autonomy and compliance within established parameters.
Three timelines are currently at play: immediate needs for securing AI in production, long-term preparations for transitioning to post-quantum cryptography, and evolving requirements driven by geopolitical instability and the call for digital sovereignty.
Addressing these challenges separately creates fragmentation and elevates risk. Adopting a unified architectural approach focused on control will allow organizations to build resilience across all dimensions.
India’s digital future will not be defined by the swift deployment of AI but by its governance, security, and management at scale. The cloud was engineered for efficiency; the next decade will require a redesign prioritizing resilience and control. Organizations that acknowledge this transformation early will position themselves to create systems that are not only innovative but also trustworthy and robust against technological and geopolitical disruptions.
The author is Mohan Veloo, Chief Technology Officer – Asia Pacific, China & Japan, F5.
Disclaimer: The views expressed are those of the author, and ETCIO does not necessarily endorse them. ETCIO shall not bear any responsibility for direct or indirect damages caused to any person or organization.
