Ten heads to burn before AI delivers
Tonight, across India, we burn Ravan’s ten heads. Vijayadashami is the victory of good over evil, and it is also the day we traditionally begin something new.
It is a good moment to name the ten heads that stop most AI projects from delivering anything. I have seen every one of them, in utilities and well beyond. None of them belongs to one industry. A manufacturer, a bank, a government department and a power company will each recognise them.
The ten heads
1. Tool first, problem later. “We need a GenAI strategy” is not a problem statement. Start with a process that costs money, time or customers, then ask whether AI is the right answer.
2. Pilots that never scale. A demo that works for ten users in a sandbox is not a result. Plan the path to production, with integration, support and cost, before the pilot starts.
3. Data nobody trusts. AI is only as good as the data behind it. If the business argues about the numbers today, AI will produce confident answers on top of the same argument.
4. No business owner. When AI belongs to IT alone, it stays a project. Every use case needs a named owner in the business who wants the result.
5. No measure of success. Decide the number before you start: hours saved, errors reduced, revenue protected. If you cannot measure it, you cannot defend the budget next year.
6. Users left out. The people who will use the tool every day know where the real friction is. Design with them, not for them.
7. No DPDP or CERT-In check. AI projects move fast and often skip the compliance review that any other system would get. More on this below.
8. Blind trust in AI output. AI is fluent, not infallible. Decide where a human must check the output, especially for customers, money and safety.
9. Company data in personal AI. The head most boards do not see. More on this below.
10. Fear of starting. The most dangerous head, because it keeps the other nine alive. Waiting for the perfect strategy means your people experiment anyway, without guardrails.
Head 9: same chatbot, very different risk
In most organisations, staff are already using AI. They paste contracts, customer lists, board notes and source code into chatbots on their personal accounts, free or paid, because it helps them work faster. Their intent is good. The risk is real.
On the surface, a personal plan and an enterprise plan look like the same chatbot. Underneath, they are very different:
| What to check | Personal plan (free or paid) | Enterprise licence or API |
|---|---|---|
| Your data used to train the model | Often yes, unless the user opts out | No, by default |
| Data processing agreement | None | Signed with the company |
| Who controls access | The employee’s own login | The company, with single sign-on and instant offboarding |
| Audit logs | None the company can see | Admin and audit logs to export |
| Retention and deletion | The provider’s default | Set by the company |
| After a breach | You may never know | Logs to trace it, a contract to act on |
These are the typical terms of the major AI providers. Details vary, so read your own provider’s contract.
Why this matters under Indian law
The DPDP Act. Under the Digital Personal Data Protection Act and the Rules notified in November 2025, the organisation that decides why and how personal data is processed is responsible for protecting it, including when a vendor processes it. Full compliance is due by 13 May 2027. Failing to take reasonable security safeguards that leads to a breach can attract a penalty of up to ₹250 crore. If an employee pastes customer data into a personal AI account, the company has no contract with that provider, no control over retention and no way to delete it on request.
The CERT-In directions. CERT-In’s 2022 directions require organisations to report specified cyber incidents within six hours of becoming aware of them, and to keep logs of their ICT systems for a rolling 180 days, with a copy available in India. You cannot report an incident you cannot see, or produce logs from a tool you do not control.
The answer is not to ban AI. Bans push usage further out of sight. The answer is to give people a better option than their personal account:
- Provide an approved tool on an enterprise licence or API, with a data processing agreement and training on your data switched off.
- Connect it to single sign-on, so access ends the day someone leaves.
- Turn on audit logs and include them in your log retention and incident response.
- Write a one-page usage policy in plain language: what data can go in, what cannot, and where a human must check the output.
- Add AI services to your DPDP and CERT-In reviews, like any other system that handles personal data.
Burn the ten, start one
Vijayadashami is also the day to begin. Pick one real problem in your business, one owner and one number to improve. Run it on a tool your company controls. Start this week.
Which of the ten heads do you see most often where you work? I would like to hear.