Technology
We work with IT services, consulting, BPM and engineering-services firms and global capability centres. We build positioning beyond headcount, evidence of delivery that procurement can verify, talent brands and AI in delivery with the records clients ask for.
Where the rules biteMap of all forty-one industries
What is shifting
Data law, delivery models, AI rules and procurement evidence are changing what a services proposal has to prove. Each shift names what it demands, with a fact you can check.
What it requiresContracts, controls and evidence built around what still applies: the client’s law, security safeguards and accountability.
EvidenceDPDP Act section 17(1)(d) exempts processing of non-residents’ data under foreign-client contracts from most of the Act, but not its security duty.
What it requiresDelivery models built for distributed teams, with security that does not depend on the office.
EvidenceThe DoT liberalised its Other Service Provider guidelines in November 2020 and again on 23 June 2021, removing registration and allowing work from anywhere.
What it requiresA documented inventory of AI in delivery, with test results and an accountable person for each use.
EvidenceThe EU AI Act’s Annex III high-risk duties apply from 2 December 2027, after the July 2026 Digital Omnibus moved the date.
What it requiresSBOMs and release evidence produced by the toolchain on every release.
EvidenceCERT-In’s guidelines of 9 July 2025 urge software exporters and the services industry to make SBOMs standard practice.
The rulebook
The data law and its offshore exemption, the GDPR, CERT-In, the OSP regime and the EU AI Act, read for a delivery organisation. Your counsel keeps sign-off.
Frameworks we build to
We design and build to these frameworks; this is not a claim of certification.
Often shapes the work
Department of Telecommunications
Since 2020–21, OSP centres need no registration and data-based services fall outside the guidelines. The domestic and international distinction is gone, and agents may work from anywhere under the remaining conditions.
We designDistributed delivery models carry the security controls the client expects, wherever the agents sit.
DoT · OSP guidelines of 5 November 2020, further liberalised on 23 June 2021 Official text: DoT Other Service Provider guidelines
Indian Computer Emergency Response Team
Minimum elements for software, AI, crypto and hardware bills of materials, which software exporters and service companies are urged to make standard practice.
We designSBOMs and AI bills of materials are generated on every release, in a form clients can read.
CERT-In · Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, version 2.0, 9 July 2025 Official text: CERT-In guidelines on SBOM and AI bills of materials
Shapes most of the work
Ministry of Electronics and IT
Processors act only under a valid contract, and the fiduciary stays responsible. Work on non-residents’ data under contract with a foreign client is exempt from most of the Act, except security safeguards and accountability.
We designData terms and controls are mapped per client, so each team knows which law governs its data.
DPDP Act, 2023 · sections 8(1), 8(2), 8(5) and 17(1)(d) Official text: DPDP Act, 2023: processors and the offshore exemption
European Union
Processors follow documented instructions, use sub-processors only with authorisation and help the controller with breaches and audits. Transfers out of the EU rely on tools such as the 2021 standard contractual clauses.
We designSub-processor lists, records of processing and transfer documents are kept current with the delivery.
Regulation (EU) 2016/679 · Article 28 · Commission Implementing Decision (EU) 2021/914 of 4 June 2021
Shapes most of the work
Indian Computer Emergency Response Team
Service providers and companies in India report listed cyber incidents within six hours of noticing them. They keep logs of all ICT systems in India for a rolling 180 days.
We designLogging and incident runbooks are part of every client setup, with the six-hour clock rehearsed.
CERT-In · Directions under section 70B(6) of the IT Act, 28 April 2022 Official text: CERT-In Directions, 2022
ISO/IEC · AICPA
The certificates and attestation reports clients ask service providers for. Since its 2025 edition, ISO/IEC 27701 can stand alone as a privacy management system.
We designControls and their evidence come out of the delivery toolchain, ready for your auditors.
ISO/IEC 27001:2022 · ISO/IEC 27701:2025 · AICPA Trust Services Criteria
Often shapes the work
W3C
The accessibility level many public and enterprise buyers write into supplier contracts.
We designClient deliverables are designed and tested to WCAG 2.2 AA, with the test evidence handed over.
W3C · WCAG 2.2 Official text: WCAG 2.2 AA
Often shapes the work
European Union
A firm that builds an AI system for a client may be its provider, with the client as deployer. Transparency duties apply from 2 August 2026, and Annex III high-risk duties from 2 December 2027 under the 2026 Digital Omnibus.
We designEach AI component has a named provider, a model card and evaluation results.
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 Official text: EU AI Act: providers and deployers
Compiled 3 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
The problems we hear in most IT services & capability centres briefs, from customers and from your own teams.
Clients want outcomes and accountable teams, not rate cards.
Security, privacy and AI questionnaires answered once, with evidence.
Transitions, attrition and handovers that do not affect the client’s service levels.
What we build
A typical programme here uses each discipline in this mix. Each line says what it builds for the industry and links to the capability behind it.
Positioning, brand architecture and a talent brand for capability and delivery centres.
Evidence portals, delivery dashboards and the integrations clients audit.
Case evidence, points of view and bid content that procurement and AI assistants can cite.
AI strategy and delivery assistants, each recorded in an inventory and tested on your own examples.
Account-based journeys and bid pipelines for long deals with many decision-makers.
Client portals and internal tools that make delivery visible.
Programmes
The way in collects what clients and procurement ask, and shows which answers you can already prove. Lengths are typical, never promised.
The way in
We collect the questions clients and procurement ask, and show which ones your site, case evidence and controls already answer.
What you get
02Project · 8–12 weeks
Positioning and messaging built on capability, case evidence in one library and bid content that stays consistent.
MeasureWin rate on qualified bids
Services: Brand foundation & positioning · Brand narrative & messaging · Content strategy & editorial plan
Enquire about Positioning and case evidence03Project · 8–12 weeks
An employer brand for a capability centre, built on the work its teams own, with a careers site showing roles, teams and technology.
MeasureOffer-to-join rate for key roles
Services: Logo & identity system · Website · Always-on social media management
Enquire about Talent brand and careers site04Milestone · 3–6 months
An inventory of AI in delivery, an evaluation set for each use case and the documentation EU clients ask for under the AI Act.
MeasureShare of AI use cases with an owner and an evaluation set
Services: AI use policy, rights & disclosure · Brand fidelity evaluation · AI readiness assessment
Enquire about AI governance for deliveryHow success is measured
Main measureWin rate on qualified bids
AI, under the rules
Each use case keeps one client’s data away from another’s, has an evaluation set and a log, and a person signs off whatever reaches the client.
Use case 01
Measured byDays to clear client due diligence
Tested forOWASP LLM09 · Misinformation
Goes live only with its evaluation set, automatic checks and a named owner
Use case 02
Measured byAnswer accuracy on each client’s evaluation set
Tested forOWASP LLM02 · Sensitive information disclosure
Goes live only with its evaluation set, automatic checks and a named owner
Use case 03
Measured byRelease notes accepted without rework
Tested forOWASP LLM06 · Excessive agency
Goes live only with its evaluation set, automatic checks and a named owner
Work and insights
Projects in this industry are published once a client approves the write-up. Until then, here is what we have written on the rules that apply.
A typical programme · composite
A global capability centre replaced a generic careers site with a talent brand built on the work its teams own, and gave its parent company’s auditors one portal for security and privacy evidence.
Anonymised and illustrative: the shape a programme takes, never a named client.
Nothing published on IT services & capability centres yet. Ask us what we are seeing in the industry.
Ask usQuestions
Something else on your mind? Ask us directly
Largely not, if the data belongs to people outside India. Section 17(1)(d) exempts that processing, under a contract with a foreign client, from most of the Act. Security safeguards, accountability and the client’s own laws, such as the GDPR, still apply. Your counsel confirms the position for each contract.
Yes. We position the centre inside its parent company and in the hiring market. We build a careers site around its roles and teams, with content that shows the work the centre owns.
We map each AI use to the EU AI Act’s roles and duties. For each use we agree with you who is provider and who deployer, then build the documentation, evaluation sets and human oversight the Act expects. Counsel confirms each classification.
Yes. We record each case anonymously by sector, scale, problem and measured result, so procurement can verify it under NDA. Client names are added only with the client’s written approval.
Keep exploring
You will speak to a lead who would run the work, and get a straight answer on fit.
01About 2 minutes
You get A reply from a named lead
02About 8 minutesRecommended
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
