Financial services and insurance
Agent pilots in Indian banks, NBFCs and insurers work in the demo and stall in risk review. We build the gateway, the audit trail and the review pack that get them through inspection and into production.
A bank or an insurer does not need AI that moves faster than its examiner. It needs AI its examiner can read, and then it needs it quickly.
Where you are
Claims triage, onboarding, servicing, fraud review: somewhere in your organization an assistant already does a job that used to take a person. The platform underneath is settled.
Supervision
The RBI's direction on IT governance puts technology risk with the board, and the RBI committee's FREE-AI framework recommends a board-approved AI policy, an inventory of every AI use and audits sized to the risk. Inspection teams will read your AI against both.
What waiting costs: an inspection observation, and a pilot frozen until the policy catches up with it.
Outsourcing
The RBI's direction on outsourcing of IT services keeps the bank accountable for what it hands to vendors and cloud providers, including the right to audit them. IRDAI and SEBI ask the same of insurers and market intermediaries.
What waiting costs: a vendor's failure becomes your conversation with the supervisor.
Customer data
The Digital Personal Data Protection Act and its 2025 Rules, now phasing in, make consent and purpose binding, the RBI's digital lending directions limit what a lender may collect, and CERT-In expects cyber incidents reported within six hours.
What waiting costs: a breach notice to the Data Protection Board and to every affected customer, written without a trail to explain it.
| Regulator or law | What it asks | What it means for an agent |
|---|---|---|
| RBI, Master Direction on IT Governance, Risk, Controls and Assurance Practices (2023) | Board oversight of IT strategy and risk, an IT asset inventory, access control, logging and periodic assurance. | Every agent and every API it calls sits in the IT inventory with an owner, and its access and logs are reviewed like any other system. |
| RBI, Master Direction on Outsourcing of IT Services (2023) | The regulated entity stays accountable for outsourced IT and cloud services, with due diligence, audit rights and an exit plan. | Model providers and AI services are governed as outsourced IT, with audit rights written into the contract. |
| RBI, Digital Lending Directions (2025) | Need-based data collection with the borrower's explicit consent, a Key Fact Statement, and grievance redress through the lender. | A lending agent reads only what the borrower consented to, and each decision can be shown to the grievance officer. |
| RBI committee, FREE-AI framework (August 2025) | Recommendations including a board-approved AI policy, an AI inventory, risk-based audit, disclosure to customers and AI incident reporting. | A named owner for each AI use, an explanation for customer-facing decisions, and an incident path that works on the first day. |
| IRDAI, Information and Cyber Security Guidelines (2023) | Cyber governance for insurers and intermediaries, incident reporting within six hours, and logs kept in India. | Claims and underwriting agents log every action to a store in India and feed the incident process. |
| SEBI, Cybersecurity and Cyber Resilience Framework (2024) | Governance, log retention, security monitoring and resilience testing for SEBI-regulated entities. | Agents in broking, asset management or market infrastructure sit inside the monitored estate, never beside it. |
| Digital Personal Data Protection Act 2023, DPDP Rules 2025 and CERT-In directions (April 2022) | Consent and purpose limits, breach notice to the Data Protection Board and to the people affected; cyber incidents reported to CERT-In within six hours, with ICT logs kept for 180 days in India. | Agents use personal data only for the purpose consented, their logs stay in India on synchronized clocks, and an incident can be reported inside the window. |
What is in the way
The distance between a pilot and a system your risk, audit and operations teams will accept is made of gateways, audit trails, data access and ownership. The review asks questions a pilot was never built to answer.
If your examiner asked for one decision, its log and its owner by Friday, what would you hand them?
The examiner asks for one decision
Without
Six places to search. No single answer.
With
One record. Every field present.
How we clear it
The institutions that get one governed agent into live use learn from real work while others rewrite a pilot for review.
We put Apigee in front of your estate and design the policies, quotas and logging first.
You hold: a governed API layer with an inventory, an owner for every endpoint and policy your examiner can read.
Apigee and APIsWe build agents on Gemini Enterprise and the Agent Development Kit that work inside the controls your risk team has already set.
You hold: one agent in production, in claims, onboarding or servicing, with review gates built in and a decision log that rebuilds any action.
Gemini Enterprise and agentsWe write the pack model risk and internal audit will ask for: control descriptions, test results, ownership and a sample decision log.
You hold: a review pack you can hand over without a rewrite.
Security and responsible AIEasy to start
Choose one workflow, name one owner, and give us time with the people who sign it off.
We bring engineers and the gateway design, we work inside your environment under your security rules, and we write the review pack alongside the build.
A good first workflow for a bank or NBFC is a digital lending check or a servicing assistant. For an insurer it is claims intake. See the fixed-price ways to start.
What the work feels like
One workflow is chosen and one person owns it. The questions your reviewers will ask are written down before any build starts. Your second line sees the controls in the first week, not at the end.
Governance goes in before the first agent does: the gateway, the audit trail and the access rules. Your risk team sees them working.
A working demo you can show your own review board, not a status slide.
A decision log that can rebuild any action, and a go-live date that was agreed at the start.
Seen it before
Production readiness check
A short readiness check on a live or planned agent workflow. You get a score and the principles worth another look.
Take the readiness checkOur delivery is built on Google Cloud, so the design assumes Apigee, Gemini Enterprise, Vertex AI and BigQuery. If your estate runs another gateway today, we begin with an assessment of what to keep and what to move.
In your environment, under your keys and perimeter. Agents read governed data in place instead of copies of it.
Yes. We ask for them in the first week and write the review pack with them.
The ones in your market. The table above lists the main ones, and we confirm the local rulebook at the start.
One workflow, one owner, a short assessment, then a build with a working demo every week.
For banks and NBFCs, the RBI: its directions on IT governance, outsourcing and digital lending, read alongside the FREE-AI framework its committee published in August 2025. Insurers add IRDAI, market intermediaries add SEBI, and every firm answers to the DPDP Act and CERT-In. We confirm the exact set for your license at the start.
Yes. We design for Google Cloud regions in India, so data, models and logs stay inside the country and inside your perimeter, which is what CERT-In and IRDAI ask of logs. We confirm the region for each service at the start, since product availability varies by region.
Tell us what you are working on. Our Customer Partnership Team will reply to arrange a conversation.
Get answers to your questions
AI assistant. It can make mistakes, so check anything important with our team.
