Technology
Every proposal is a promise about people, data and delivery.
IT services and consulting firms, global capability centres, BPM and engineering-services providers, selling delivery capacity to enterprises that audit everything. We build positioning beyond headcount, proof of delivery that procurement can verify, talent brands for capability centres, and AI-assisted delivery with the governance clients now ask for.
Where the rules biteMap of all forty-one industries
What is shifting
Data law, delivery models, AI rules and procurement evidence are changing what a services proposal has to prove. Each shift names what it demands, with a fact you can check.
It demandsContracts, controls and evidence built around what still applies: the client’s law, security safeguards and accountability.
SignalSection 17(1)(d) of the DPDP Act exempts processing of non-residents’ data under contracts with foreign clients from most of the Act, though not from its security duty.
It demandsDelivery models built for distributed teams, with security that does not depend on the office.
SignalThe DoT liberalised its Other Service Provider guidelines in November 2020 and again on 23 June 2021, removing registration and allowing work from anywhere.
It demandsAI-assisted delivery with model inventories, evaluations and accountable people, documented for the client.
SignalThe EU AI Act’s duties for high-risk systems in Annex III apply from 2 December 2027, after the Digital Omnibus of July 2026 moved the date.
It demandsSBOMs and release evidence produced by the toolchain on every release.
SignalCERT-In’s guidelines of 9 July 2025 name software exporters and the services industry among those urged to make SBOMs a standard practice.
The rulebook
The data law and its offshore exemption, the GDPR, CERT-In, the OSP regime and the EU AI Act, read for a delivery organisation. Your counsel keeps sign-off.
Frameworks we build to
Frameworks we design and build to — not a claim of certification.
Often shapes the work
Department of Telecommunications
Since 2020–21, OSP centres need no registration, data-based services sit outside the guidelines, the domestic and international distinction is gone and agents may work from anywhere, subject to the remaining conditions.
We designDistributed delivery models carry the security controls the client expects, wherever the agents sit.
DoT · OSP guidelines of 5 November 2020, further liberalised on 23 June 2021 Official text: DoT Other Service Provider guidelines
Indian Computer Emergency Response Team
Minimum elements for software, AI, crypto and hardware bills of materials, which software exporters and service companies are urged to make standard practice.
We designSBOMs and AI bills of materials are generated on every release and shared in a form clients can read.
CERT-In · Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, version 2.0, 9 July 2025 Official text: CERT-In guidelines on SBOM and AI bills of materials
Shapes most of the work
Ministry of Electronics and IT
Processors act only under a valid contract and the fiduciary stays responsible; processing non-residents’ data under a contract with a foreign client is exempt from most of the Act, though security safeguards and accountability still apply.
We designData terms and controls are mapped client by client, so each team knows which law governs the data it touches.
DPDP Act, 2023 · sections 8(1), 8(2), 8(5) and 17(1)(d) Official text: DPDP Act, 2023 — processors and the offshore exemption
European Union
Processors act on documented instructions, use sub-processors only with authorisation and help the controller with breaches and audits; transfers out of the EU rely on mechanisms such as the 2021 standard contractual clauses.
We designSub-processor lists, records of processing and transfer documents are kept with the delivery, not in a drawer.
Regulation (EU) 2016/679 · Article 28 · Commission Implementing Decision (EU) 2021/914 of 4 June 2021
Shapes most of the work
Indian Computer Emergency Response Team
Service providers and companies in India report listed cyber incidents within six hours of noticing them and keep logs of all ICT systems for a rolling 180 days within India.
We designLogging and incident runbooks are part of every client setup, with the six-hour clock rehearsed.
CERT-In · Directions under section 70B(6) of the IT Act, 28 April 2022 Official text: CERT-In Directions, 2022
ISO/IEC · AICPA
The certificates and attestation reports clients ask service providers for; the 2025 edition of ISO/IEC 27701 can now be implemented as a privacy management system on its own, without ISO/IEC 27001.
We designControls and their evidence come out of the delivery toolchain, ready for your auditors.
ISO/IEC 27001:2022 · ISO/IEC 27701:2025 · AICPA Trust Services Criteria
Often shapes the work
W3C
The accessibility level many public and enterprise buyers write into contracts for the products their suppliers build.
We designClient deliverables are designed and tested to WCAG 2.2 AA, with the test evidence handed over.
W3C · WCAG 2.2 Official text: WCAG 2.2 AA
Often shapes the work
European Union
A firm that builds an AI system for a client may be its provider, and the client its deployer; transparency duties apply from 2 August 2026 and high-risk duties for Annex III systems from 2 December 2027 under the 2026 Digital Omnibus.
We designEach AI component has a named provider, a model card and evaluation results the client can rely on.
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 Official text: EU AI Act — providers and deployers
Compiled 3 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
What we hear in almost every IT services & capability centres brief — on the customer’s side of the screen, and on yours.
Clients want outcomes and accountable teams, not rate cards.
Security, privacy and AI questionnaires answered once, with evidence.
Transitions, attrition and handovers that never show up in the client’s numbers.
What we build
A typical programme here draws on each discipline in this mix. Every line names what it builds for the industry and links to the capability that does the work.
Positioning beyond headcount, and a talent brand for capability and delivery centres.
Evidence portals, delivery dashboards and the integrations clients audit.
Case evidence, points of view and bid content that procurement and AI assistants can cite.
AI-assisted delivery with inventories, evaluations and accountable owners.
Account-based journeys and bid pipelines across long deals with many people.
Client portals and internal tools that make delivery visible.
Programmes
The way in collects what clients and procurement ask, and shows which answers you can already prove. Lengths are typical, never promised.
The way in
We collect the questions clients and procurement ask, and show which ones your site, case evidence and controls already answer.
What it hands over
02Project · 8–12 weeks
A capability story beyond headcount, case evidence in one structure and bid content that stays consistent.
MovesWin rate on qualified bids
Services: Brand foundation & positioning · Brand narrative & messaging · Content strategy & editorial plan
Enquire about Positioning and proof system03Project · 8–12 weeks
An employer brand built on the work teams own, with a careers site that shows real roles, teams and technology.
MovesOffer-to-join rate for key roles
Services: Logo & identity system · Website · Always-on social media management
Enquire about Capability-centre talent brand and careers site04Milestone · 3–6 months
An inventory of AI in the delivery, evaluation sets per use case and the documentation EU clients will ask for under the AI Act.
MovesShare of AI use cases with an owner and an evaluation set
Services: AI use policy, rights & disclosure · Brand fidelity evaluation · AI readiness assessment
Enquire about Governed AI in deliveryHow success is measured
The number we moveWin rate on qualified bids
AI, under the rules
Each use case keeps one client’s data away from another’s, has an evaluation set and a log, and a person signs off whatever reaches the client.
Use case 01
Measured byDays to clear client due diligence
Tested forOWASP LLM09 · Misinformation
Ships only with its evaluation set, its guardrail and an owner
Use case 02
Measured byAnswer accuracy on each client’s evaluation set
Tested forOWASP LLM02 · Sensitive information disclosure
Ships only with its evaluation set, its guardrail and an owner
Use case 03
Measured byRelease notes accepted without rework
Tested forOWASP LLM06 · Excessive agency
Ships only with its evaluation set, its guardrail and an owner
Work and insights
Projects in this industry are published once a client approves the write-up. Until then, here is what we have written on the rules that apply.
A typical programme · composite
A global capability centre replaced its generic careers site with a talent brand built on the work its teams own, and gave the parent company’s auditors one evidence portal for its security and privacy controls.
Anonymised and illustrative: the shape a programme takes, never a named client.
Nothing published on IT services & capability centres yet. Ask us what we are seeing in the industry.
Ask usQuestions
Something else on your mind? Ask us directly
Largely not, where you process data of people outside India under a contract with a foreign client: section 17(1)(d) exempts that processing from most of the Act. Security safeguards and accountability still apply, and so do the client’s own laws, such as the GDPR. Your counsel confirms the position contract by contract.
Yes: positioning inside the parent company and in the hiring market, a careers site built on real roles and teams, and content that shows the work the centre owns.
We inventory where AI is used, agree with you who is the provider and who the deployer for each use, and build the documentation, evaluations and human oversight the EU AI Act expects. Counsel confirms each classification.
Yes. We build an anonymised evidence structure — sector, scale, problem and measured result — that procurement can verify under NDA, and add names only when a client approves in writing.
Keep exploring
Next · Same sector
B2B technology
Qualified pipeline
Same sector
Consumer internet & apps
Day-30 retention
Same sector
Cybersecurity
Evaluation-to-contract conversion
Media, telecom & entertainment
Telecom & media
Self-service resolution
Media, telecom & entertainment
Media & publishing
Reader-to-subscriber conversion
Tell us what you’re building. We’ll answer straight.
01About 2 minutes
You get A reply from a lead, not a sales queue
02About 8 minutesMost useful
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
