The lean startup sequence is so familiar that it has stopped being a method and become a reflex: build the minimum viable product, put it in front of users, measure, learn, iterate. It works because the product's quality is visible to the person using it. A user can tell whether a checkout flow is confusing or a dashboard is useful, and the founder can watch them do it.
That assumption breaks in AI-native company building, where the product's core is a model. A user cannot tell whether a contract-review system missed one clause in forty, whether a credit model is systematically wrong for one segment of borrowers, or whether a clinical summariser is confident and mistaken. Nor, in most cases, can the founder. The quality of a model-based product is a statistical property that only shows up against a reference set with known right answers, and building that set requires data the venture may not have the right to use, in a jurisdiction that increasingly regulates how it is obtained. A team that ships first and evaluates later produces something that demonstrates well and cannot be judged, which is to say a demo.
This article argues that in AI ventures the build order inverts: data access and an evaluation harness come before the product, and the product comes before go-to-market, because the product's claim to a customer is a measured one. It sets out why with reference to the Digital Personal Data Protection Act 2023 and its 2025 Rules, the NIST AI Risk Management Framework, ISO/IEC 42001 and the Stanford AI Index, and closes with an AI-Native Build Sequence.
Why the lean sequence produces demos
The lean sequence is a learning loop, and a learning loop needs a signal. In conventional software the signal is behavioural: activation, retention, conversion. In a model-based product those signals measure the wrong thing, because a user who does not know the model is wrong will keep using it. Retention of a confidently incorrect tool is not evidence of quality; it is evidence of trust that has not yet been tested.
The signal a model-based product needs is accuracy against ground truth, disaggregated by the inputs that matter, measured under conditions that resemble deployment. The NIST AI Risk Management Framework, released on 26 January 2023 as a voluntary framework, organises AI risk work into four functions, Govern, Map, Measure and Manage. Its Measure function asks organisations to document testing procedures and metrics, including why metrics were selected and which were considered and rejected (Measure 1.1); to measure systems before deployment under conditions similar to expected use and document the differences from the deployment environment (Measure 2.3); to compare production performance with pre-deployment testing so that drift triggers alerts (Measure 2.4); to measure performance under stress and beyond known limitations (Measure 2.6); and to disaggregate performance across groups and monitor dataset representativeness (Measure 2.2 and 2.11) (NIST AI RMF 1.0 Measure subcategories, as reproduced by EPIC; NIST, AI RMF page).
Read as a product specification rather than a compliance document, these subcategories describe the evaluation harness: a test set, metrics with recorded rationale, deployment-like conditions, a drift monitor and stress cases. None of it can be built after the product without rebuilding the product. The test set defines what "good" means, and a team that has not defined it will build towards whatever is easiest to demonstrate.
The same logic appears in ISO/IEC 42001:2023, published on 18 December 2023 and described by ISO as the world's first AI management system standard. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system using the plan-do- check-act cycle, with risk assessment and treatment at its core, for organisations of any size that develop, provide or use AI (ISO). A buyer moving toward 42001 will ask for evidence that the model was evaluated, by whom, against what, and how it is monitored. A venture that cannot answer has a sales problem that no go-to-market effort will solve.
Data rights come before data
The second inversion concerns data. In a conventional product the data is generated by use: a user signs up, a record is created, a behavioural trail accumulates. In a model-based product the data must exist before the product can, and the question of whether the venture has the right to use it is a legal question that India has now answered in statute.
The Digital Personal Data Protection Act 2023 permits processing of personal data only for a lawful purpose and either with the data principal's consent or for one of the "certain legitimate uses" in section 7 (section 4). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data necessary for the stated purpose (section 6), and the data fiduciary bears the burden of proving that notice was given and valid consent obtained if the question arises (section 6(10)). Where personal data is likely to be used to make a decision affecting the data principal, the fiduciary must ensure its completeness, accuracy and consistency (section 8(3)). The fiduciary remains responsible for processing done by its data processors (section 8(1)), must implement reasonable security safeguards (section 8(5)), must notify the Board and affected individuals of a breach (section 8(6)) and must erase data when consent is withdrawn or the purpose is served (section 8(7)). The Central Government may designate significant data fiduciaries, which must appoint a data protection officer based in India, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits (section 10). Processing "necessary for research, archiving or statistical purposes" is exempt from most of the Act's obligations, provided it is not used to take a decision specific to a data principal and follows prescribed standards (section 17(2)(b)). The penalty schedule runs to ₹250 crore for failing to maintain security safeguards, ₹200 crore for failing to notify a breach or for breach of obligations relating to children, ₹150 crore for breach of significant data fiduciary obligations and ₹50 crore for any other contravention (Digital Personal Data Protection Act 2023, as published on India Code).
The Rules that operationalise the Act were notified on 14 November 2025, with an eighteen-month period for phased compliance. They establish a digital Data Protection Board of India with four members, require consent managers to be companies based in India, require data fiduciaries to respond to access, correction and erasure requests within ninety days, and specify that significant data fiduciaries must undergo independent audits and impact assessments, with stricter checks when using new or sensitive technologies and, in some cases, government directions on restricted categories of data that may include local storage (Press Information Bureau, 17 November 2025). Coverage of the notification reported that registration and obligations of consent managers, notice requirements and other processing norms would phase in over twelve to eighteen months (Deccan Herald, 14 November 2025).
Three consequences follow. First, training and evaluation data must be acquired under a specific, documented purpose, because consent is purpose-limited and the fiduciary must prove it; a dataset collected for one product cannot silently become the training set for another. Second, section 8(3) makes accuracy a legal obligation where data feeds a decision about a person, so the evaluation harness is part of the compliance record, not only a product tool. Third, the research exemption in section 17(2)(b) is real but narrow: it covers work that does not lead to decisions about specific individuals, which describes model development and evaluation but not deployment.
Sector rules add a second layer. The Reserve Bank of India constituted a committee on 26 December 2024 to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence, and on 13 August 2025 published its report. The framework rests on seven principles the committee calls sutras, six pillars (infrastructure, policy, capacity, governance, protection and assurance) and 26 recommendations, including AI innovation sandboxes, indigenous financial AI models, and governance, audit and incident reporting mechanisms (RBI press release 2025- 2026/902; KPMG summary, August 2025). A venture selling a model into an Indian bank should expect its evaluation evidence, audit trail and incident process to be examined against this framework before a pilot, not after.
Model cost and latency are design constraints, not afterthoughts
The third inversion is economic. The Stanford AI Index 2025 records that the inference cost for a system performing at the level of GPT-3.5 dropped more than 280-fold, that hardware costs have declined by 30% annually while energy efficiency has improved by 40% each year, and that open- weight models reduced the performance difference against closed models from 8% to 1.7% on some benchmarks in a single year. It also records that scores on harder benchmarks introduced in 2023 rose by 18.8, 48.9 and 67.3 percentage points on MMMU, GPQA and SWE-bench respectively within a year, and that 78% of organisations reported using AI in 2024, up from 55% the year before (Stanford HAI, AI Index Report 2025, top takeaways).
Those trends cut two ways. Falling inference cost and a narrowing open-closed gap mean a venture can run a capable model on its own infrastructure, on-premises or in a sovereign cloud, at a cost unavailable two years earlier, which matters in India because regulated buyers increasingly want the model near the data rather than the data near the model. But the same trends make any single model a depreciating asset: whatever a venture builds on today will be matched by an open model within a year, and its durable value is the data it has the right to use, the harness that proves the product works, and the integration into the customer's workflow. Model choice, deployment location and latency budget therefore have to be fixed before the product is designed, because they determine what it can promise. A venture that designs around a frontier API and then discovers the customer requires on-premises deployment will rebuild.
The Stanford report also records that "standardized RAI evaluations remain rare among major industrial model developers" and that AI-related incidents are rising sharply. If the largest developers do not routinely publish standardised evaluations, a venture that does has a sales argument, and one that does not is asking customers to take on faith what the model developers themselves have not measured.
The AINative Build Sequence
Putting the three inversions together gives a build sequence that differs from the lean sequence in its first three steps. This is the article's analytical contribution. The sequence is stated for a venture whose product's core is a model; a venture that uses a model as one feature of a conventional product can still follow the lean sequence, with the evaluation step added where the model enters.
| Step | Lean sequence | AI-native sequence | Why the order changes |
| 1 | Build MVP | Secure data rights: identify the data the product needs, acquire it under a documented purpose and lawful basis (DPDP sections 4 to 7), assign ownership of derived artefacts to the venture, and settle deployment location (on-premises, sovereign cloud, public cloud) | Consent is purpose-limited and the fiduciary must prove it; the data cannot be acquired retrospectively for a purpose it was not collected for |
| 2 | Get users | Build the evaluation harness: a held-out reference set with known answers, metrics with recorded rationale, disaggregation by the input types that matter, deployment-like test conditions, a drift monitor (NIST Measure 1.1, 2.2, 2.3, 2.4, 2.6) | Quality is a statistical property; without the harness the team cannot tell whether a change made the product better, and the customer cannot be told what the product does |
| 3 | Measure and learn | Choose and constrain the model: fix the latency budget, cost per query and deployment target; select the model that meets them; record the baseline on the harness | Cost and latency determine what can be promised; model choice is reversible but only if the harness exists to compare candidates |
| 4 | Iterate | Build the product around the measured capability: design the workflow, the human review points and the failure handling for the error rate the harness shows | The product's promise is the measured number, not a demo; the interface must expose the model's uncertainty where it matters |
| 5 | Scale | Go to market with evidence: evaluation results, audit trail, incident process, compliance posture (DPDP, sector rules, 42001 readiness) as part of the offer | Regulated buyers and their auditors ask for the evidence before the pilot; the sales cycle starts when the evidence exists |
| 6 | Iterate on the harness as much as the product: add cases from production, re-run on each model upgrade, publish results to customers | Models depreciate; the harness and the data rights are the durable assets |
The sequence has two properties worth stating. First, it front-loads cost: steps one to three produce nothing a customer can see and may take six months in a regulated sector, which is why the sequence is more naturally executed inside a studio or a well-capitalised team than by a founder on a bridge round. Second, it changes what product-market fit means. In the lean sequence fit is observed in user behaviour. In the AI-native sequence fit is a measured capability that a customer has agreed is sufficient for a defined task, documented in a way that survives the customer's own audit.
Building the infrastructure first: a practice example
One studio's portfolio illustrates the sequence at portfolio level. PanScience Innovations, a New Delhi studio founded in 2021, reports that eight of its 24 co-founded ventures are in AI infrastructure. The ventures it names in that category include Eigen (on-premises AI), Insituate AI (on-premises retrieval-augmented generation and agents), Proteus (an LLM gateway), Own360 (an AI control plane), FlexiBench (a managed AI workforce the company reports at more than 30,000 annotation experts) and Indika AI (data-centric AI, with company-reported annotation accuracy of around 98%). All figures are company-reported.
Read against the build sequence, these ventures map onto steps one to three. Annotation and data- centric ventures produce the labelled reference sets a harness needs. On-premises inference and retrieval ventures resolve the deployment-location constraint regulated Indian buyers impose. A gateway and a control plane are the layer at which model choice becomes reversible, because they let an application switch models and compare them on the same harness. The effect is that the studio's application ventures, in finance, law, health and industry, can start at step four with the infrastructure in place: a studio that builds AI infrastructure first is amortising steps one to three across its portfolio, which is the only way those steps become affordable for a single early-stage venture. The example should not be over-read. It shows that one portfolio is consistent with the sequence, not that the sequence caused its results.
What AI-native company building means for studios and investors
For a studio, the sequence implies that the shared technology function should include an evaluation capability, not just engineering capacity, because the harness is what each venture needs first and cannot afford alone. It also implies that the legal function should treat data rights as a month-zero deliverable alongside incorporation, because training data acquired without a documented purpose is a defect that surfaces at the first customer audit and is expensive to cure. For an investor, the diligence questions change. The lean-era questions, users, retention, growth, are necessary but not sufficient. The AI-native questions are: what data does the venture have the right to use, under what purpose; what is the held-out reference set and what does the model score on it, disaggregated; what are cost per query and latency at the deployment target the customer requires; and what does the venture do when the model is wrong. A venture that answers all four has done steps one to three. One that answers with a demo has not. For a founder, the first six months of an AI-native venture consume money and produce evidence, not revenue; that evidence is the asset, and the raise should be sized to produce it.
Conclusion
The lean sequence assumes that the product's quality is visible to the user. For model-based products it is not, and the consequences run through the whole build. Data must be acquired under a documented purpose because the Digital Personal Data Protection Act makes consent purpose- specific and puts the burden of proof on the fiduciary. Evaluation must precede product because quality is a measured property and the frameworks that buyers and regulators use, NIST's Measure function, ISO/IEC 42001, the RBI's financial-sector framework, all ask for the measurement. Model cost, latency and deployment location must be fixed before design because they determine what can be promised, and because the model itself depreciates faster than the data rights and the harness. The AI-Native Build Sequence puts those three steps first. It is slower and more expensive at the start, which is why studios that build the infrastructure once and share it across ventures have a structural advantage in executing it, and why ventures that skip it tend to produce demos rather than companies.
Methodology and sources
This article's argument is analytical: it derives a build sequence from three constraints (data rights, evaluation, model economics) and checks each constraint against primary legal and standards texts and one measured dataset. The AI-Native Build Sequence is the author's construction. Its principal limitation is scope: it applies to ventures whose product's core is a model, and the claim that it is "slower and more expensive" at the start is a qualitative judgement rather than a measured cost. The legal description is a summary of statutory text and official notification material, not legal advice, and sector-specific obligations beyond the RBI framework (for example in health or telecoms) are not covered. The PanScience example is company-reported and is used to illustrate how a portfolio can be read against the sequence, not as evidence that the sequence produces better outcomes.
Sources opened: Digital Personal Data Protection Act 2023, Act No. 22 of 2023, India Code (https://www.indiacode.nic.in/bitstream/123456789/22037/2/a2023-22.pdf); Press Information Bureau, explainer on the Digital Personal Data Protection Rules 2025, 17 November 2025 (https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf); Deccan Herald, "Centre notifies DPDP Rules; implementation planned in phases spread over 12-18 months", 14 November 2025 (https://www.deccanherald.com/india/centre-notifies-dpdp-rules- implementation-planned-in-phases-spread-over-12-18-months-3798465); NIST, AI Risk Management Framework page, giving the 26 January 2023 release of AI RMF 1.0 and the 26 July 2024 Generative AI Profile (https://www.nist.gov/itl/ai-risk-management-framework); EPIC, "Framing the Risk Management Framework: Actionable Instructions by NIST in the Measure Section of the AI RMF", reproducing the Measure subcategories (https://epic.org/framing-the-risk- management-framework-actionable-instructions-by-nist-in-the-measure-section-of-the-ai-rmf/); ISO, ISO/IEC 42001:2023 standard page (https://www.iso.org/standard/42001); Stanford HAI, AI Index Report 2025, top takeaways (https://hai.stanford.edu/assets/files/hai_ai_index_report_2025.pdf); Reserve Bank of India, press release 2025-2026/902, "RBI releases the report of the Committee on FREE-AI", 13 August 2025 (https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=61018); KPMG India, summary of the RBI FREE-AI committee report, August 2025 (https://kpmg.com/in/en/insights/2025/08/rbi- free-ai-committee-report-on-framework-for-responsible-and-ethical-enablement-of-artificial- intelligence.html); PanScience Innovations website, company-reported portfolio and venture descriptions (https://panscience.xyz), read 24 October 2026.