The distance between an impressive AI demonstration and a signed purchase order is where most enterprise AI effort in India is spent and where most of it is lost. Vendors blame procurement. Procurement blames vendors who cannot answer a security questionnaire. Business sponsors blame both. The honest description is that enterprise AI procurement in India is a multi-owner process with at least seven stages, each held by a different function, and that almost no one inside the buyer sees all of it.
The global data on complex B2B buying sets the baseline. Gartner finds that more than three-quarters of customers surveyed described their purchase as very complex or difficult, that "the typical buying group for a complex B2B solution involves six to 10 decision makers", and that buyers spend only 17 per cent of their buying time meeting potential suppliers, with "only 5% or 6%" spent with any one sales representative. 6sense's 2024 buyer research puts the average B2B cycle at 11.3 months with an 11-person buying group. AI purchases sit at the hard end of this distribution because they add questions that ordinary software does not raise: what data will the system see, where will it be processed, how will its outputs be checked, and who is liable when it is wrong.
This article describes how Indian enterprises buy AI from the buyer's side, with a stage map naming the owner and an indicative duration for each stage. It separates three buyer types, private enterprise, regulated financial institutions and public sector undertakings, whose processes differ materially. Where published Indian data exists it is cited. Where it does not, which is most of the procurement process, the description is qualitative and drawn from practice, and the article says so.
Why AI is harder to buy than software
Four features of AI systems push them into longer, more scrutinised procurement than conventional software.
The first is data access. Most software is evaluated on its features; an AI system is evaluated on its performance against the buyer's own data, which means the buyer must release data to a vendor before it has a contract. That single fact creates the pilot, the non-disclosure agreement, the data-sharing addendum and the information security review that precede any commercial discussion.
The second is outcome uncertainty. A buyer cannot know in advance whether a model will reach the accuracy the workflow needs. The MIT NANDA report of August 2025 claimed that about 95 per cent of enterprise generative AI pilots deliver no measurable profit and loss impact and that only about 5 per cent reach production with value; it also reported that purchased vendor tools succeed roughly twice as often as internal builds. The report's methodology has been criticised, and the figures should be treated as indicative rather than precise, but the direction matches other surveys. Menlo Ventures' December 2025 enterprise survey found 47 per cent of AI deals reaching production against 25 per cent previously, which is an improvement and still a coin toss. Buyers who know this build in exit points, and exit points lengthen the cycle.
The third is regulatory classification. In regulated sectors a hosted AI service is an IT outsourcing arrangement. The RBI's Master Direction on Outsourcing of IT Services, in force since 1 October 2023, requires a board-approved outsourcing policy, due diligence covering qualitative, financial, operational, legal and reputational factors, a materiality assessment, and contracts containing audit rights over the vendor and its sub-contractors, India-only data storage, confidentiality controls and exit provisions. SEBI's March 2023 cloud framework confines regulated entities to MeitY-empanelled cloud providers and prohibits shared ownership of any function between the entity and the provider. Each of these is a document a buyer must produce or check before signing.
The fourth is speed as a decision criterion. EY India's Outlook 2026 survey of over 200 Indian enterprise leaders found 91 per cent rank speed of deployment as the top buy-versus-build factor. That sounds like good news for vendors; in practice it means buyers who choose to buy expect the vendor to absorb the integration and compliance work, and they test for that during procurement.
A stage map for enterprise AI procurement in India
The map below is the original contribution of this piece. It is drawn from practice across PanScience Innovations' enterprise ventures and from the regulatory instruments above, not from a survey, and the durations are indicative ranges rather than measured medians. No published Indian dataset on AI procurement stage durations was found; readers should treat the ranges as a planning scaffold to be replaced by their own records.
Three structural features of the map matter more than any individual duration.
Stages 3, 4 and 5 run in parallel in well-run organisations and in series in most. When the information security review begins only after a pilot has succeeded, the buyer has spent months proving value on a system it then discovers it cannot lawfully deploy. The sequencing fix is cheap: start the data flow mapping and vendor security evidence at stage 2.
Stage 7 is not a formality. India's financial year runs April to March, and most large enterprises fix budgets in the final quarter of the preceding year. A request that surfaces in August competes for unallocated funds or waits until the next cycle. The AI-specific complication is classification: a per-token or per-seat subscription is operating expenditure; an on-premise deployment with hardware is capital expenditure with its own approval path. Vendors who can price either way remove a stall.
Stage 5 exists only in regulated sectors but, where it exists, it is the hardest stage to shorten, because its content is set by the regulator rather than the buyer. A hosted model provider whose terms do not permit regulator access or India- only storage cannot pass it, however good the pilot. This is a structural reason for the on-premise and private-cloud deployment pattern in Indian banking and securities, and a separate PanScience Research piece in this series maps the full stack of those obligations.
Three buyer types and how they differ
Treating "Indian enterprise" as one buyer is the most common error in both vendor planning and policy commentary. Three types behave differently.
Private enterprises
The stage map above describes the private enterprise most directly. Authority is concentrated: a business head and a CFO can approve, and the CISO can block. Pilots are common and informal, and a vendor that performs well in one business unit can often expand to another without a fresh tender. The constraint is attention, not procedure. The Gartner finding that buyers spend 5 to 6 per cent of their time with any one supplier applies in full; most of the buying work happens in internal meetings the vendor never attends.
Regulated financial institutions
Banks, NBFCs, insurers and securities-market participants follow the same stages with stage 5 added and stage 4 formalised. The RBI direction's materiality test asks whether an arrangement, "if disrupted or compromised shall have the potential to significantly impact the RE's business operations" or whether unauthorised access to customer information could materially affect customers; most production AI touching customer data passes that test and therefore attracts the full set of obligations. For payment data, the RBI's 2018 circular requires a system audit by a CERT-In empanelled auditor covering storage, backup and security. These requirements are not AI-specific, which is precisely the problem: they were written for outsourcing in general, and a model API is a poor fit for the contract language they require. The FREE-AI committee's August 2025 recommendations, including board-approved AI policies and periodic audit of deployed AI systems, are not yet binding, but compliance teams are already reading them as the shape of future supervisory expectations.
Public sector undertakings and government
Public procurement is the most structured and the least documented in terms of AI-specific outcomes. The structure is public. Government purchases of common goods and services are mandated through the Government e Marketplace under Rule 149 of the General Financial Rules 2017. GeM reported cumulative gross merchandise value of ₹18.4 lakh crore as of April 2026, with ₹5 lakh crore transacted in the 2025 to 2026 financial year, micro and small enterprises accounting for 68 per cent of orders, and startups recording the highest year-on-year growth in orders at 36 per cent. The Ministry of Finance's Manual for Procurement of Consultancy and Other Services sets out the selection methods: least cost selection, quality and cost based selection, single source selection and fixed budget selection, with consultancy procured through a two-stage process in which quality is assessed before, or alongside, cost. Micro and small enterprises are exempt from earnest money deposits, and global tenders below ₹200 crore require competent authority approval under the Make in India order.
What the structure does not record is how AI specifically fares inside it, and the article makes no claim that it does. Qualitatively, three features of public procurement shape AI buying. Specifications must be written before a tender, which favours well-understood products over systems whose performance is discovered in a pilot. Least cost selection, where it is used, rewards the lowest compliant bid rather than the best-performing model, and buyers who want quality weighted must choose a quality-and-cost method and defend it. And earnest money and performance bank guarantees tie up a vendor's working capital for the life of the tender, which disadvantages small vendors despite the MSE exemptions. None of these features is unique to AI, but AI's outcome uncertainty makes each one bite harder. No published Indian figures on AI tender durations or success rates were found, and readers should treat this section as description rather than measurement.
The security review, from the buyer's chair
The information security review is the stage vendors complain about most and buyers understand least, because it is the one stage whose content is set by neither party but by the buyer's own certification obligations and its regulator.
Vanta's State of Trust research, now in its third edition with 3,500 business and IT leaders surveyed, reports that 59 per cent say "AI risks outpace their expertise" and 61 per cent say they "spend more time posturing than protecting"; its 2024 edition put the compliance workload at 11 working weeks a year. A buyer's security team is therefore assessing AI vendors while itself under-resourced and under-confident on AI risk. The predictable response is to fall back on evidence it already knows how to read: ISO 27001 and SOC 2 reports, penetration test results, data flow diagrams and a signed data processing addendum.
For the buyer, this stage goes faster when three things are true. The data the system will see has been classified before the vendor conversation starts. The deployment model has been decided, because an on-premise system and a hosted API raise entirely different questions. And the DPDP readiness of the arrangement has been mapped, since the substantive DPDP Rules, including significant data fiduciary obligations and 72-hour breach reporting to the Data Protection Board, become enforceable in May 2027, inside the life of most contracts being signed now.
PanScience reports that its enterprise ventures hold ISO 27001, ISO 9001:2015, ISO 45001:2018, GDPR and AICPA SOC attestations as a shared function across the portfolio; the company-reported rationale is that these are the documents stage 4 asks for and that a venture arriving without them restarts the clock. A separate PanScience Research piece in the venture-studio series covers that shared compliance infrastructure from the vendor's side.
Budget cycles and the shape of demand
Two features of Indian budget cycles shape AI demand in ways that neither global surveys nor vendor forecasts capture well.
The first is the financial year. Budgets fixed in January to March for April onward mean that AI requests surfacing mid-year compete for contingency funds. Innovation budgets held centrally by a CIO or chief digital officer ease this, but they are typically small relative to business unit budgets and are the first to be cut in a weak quarter.
The second is the aggregate direction of spend. Gartner's November 2025 forecast for India puts IT spending at about $176 billion in 2026, up 10.6 per cent, with software growing 17.6 per cent and data centre systems 20.5 per cent; it expects 60 per cent of IT services to be powered by generative AI and hyper-automation by 2028. EY India found 47 per cent of surveyed enterprises with multiple generative AI use cases live in production and 10 per cent scaling across the business. Demand is real and growing; what the procurement map shows is that it is released in lumps, at the points in the year when stage 7 opens.
Conclusion
Enterprise AI procurement in India is not a single decision but a relay among eight owners, with the baton most often dropped between the pilot and the security review, and again at the budget gate. The map in this article names the owners and indicative durations so that buyers can sequence the stages in parallel rather than in series, and so that vendors can stop treating a successful pilot as a sale.
Three buyer types need three plans. Private enterprises are governed by attention and the financial year. Regulated financial institutions add a regulatory due diligence stage whose content the regulator sets and whose contract clauses most hosted AI providers cannot sign. Public sector buyers follow a transparent, rule-bound process that was designed for products with known specifications and sits awkwardly with systems whose performance is discovered rather than declared.
The measured facts are few and the article has tried to mark them. The qualitative description is offered as a scaffold, to be corrected by the records of the organisations that keep them. Until Indian enterprises publish their own procurement data, the best any buyer can do is measure its own cycle, stage by stage, and shorten the ones it controls.
Methodology and sources
The eight-stage map, its owners and its indicative durations are the authors' analytical contribution, drawn from PanScience Innovations' company-reported practice across its enterprise ventures and from the regulatory instruments cited. No survey underlies the durations; they are planning ranges and are labelled as such. The three-buyer-type classification is likewise interpretive. The public procurement section describes process from published rules and makes no quantitative claim about AI tender outcomes because no such Indian data was found.
Sources opened on 25 October 2026: Gartner, The B2B Buying Journey (gartner.com/en/sales/insights/b2b-buying- journey); RBI, Master Direction on Outsourcing of Information Technology Services, 10 April 2023 (rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12486); RBI, FAQ on storage of payment system data (rbi.org.in/Scripts/FAQView.aspx?Id=130); SEBI cloud framework of 6 March 2023 via Taxmann (taxmann.com/post/blog/sebi-introduces-framework-for-adoption-of-cloud-services-by-regulated-entities/); Government e Marketplace, About Us, for the GFR Rule 149 mandate (gem.gov.in/aboutus); IANS, GeM GMV report of 6 April 2026 (ianslive.in/gem-hits-rs-18-lakh-crore-gmv-mark-mses-account-for-68-pc--20260406164235); Ministry of Finance, Manual for Procurement of Consultancy and Other Services 2017, updated June 2022, read from a copy hosted by NIT Delhi (old.nitdelhi.ac.in/wp-content/uploads/2024/08/Manual-for-Procurement-of- Consultancy-Other-Services.pdf); Vanta, State of Trust, third edition (vanta.com/state-of-trust); RBI FREE-AI committee report (rbi.org.in/scripts/PublicationReportDetails.aspx?ID=1306); Storyboard18 on the DPDP Rules 2025 (storyboard18.com/digital/breaking-govt-notifies-final-dpdp-rules-sets-staggered-rollout-with-key-obligations-for- data-fiduciaries-84201.htm). Figures from 6sense's 2024 Buyer Experience Report, Vanta's 2024 edition, MIT NANDA's GenAI Divide report (whose methodology has been publicly criticised), Menlo Ventures' State of Generative AI in the Enterprise 2025, EY India's AIdea of India Outlook 2026 and Gartner's India IT spending forecast of 18 November 2025 are as verified by the editor. PanScience certifications are company-reported from panscience.xyz; no client is named.