The Compliance Ledger is India's first open, evidence-qualified publication dedicated to proactive artificial intelligence gap analysis. We evaluate automated decision systems deployed in sensitive Indian sectors—such as credit underwriting, algorithmic hiring, clinical healthcare triage, and adaptive ed-tech—against binding Indian statutory law and open voluntary frameworks before algorithmic harms or enforcement actions occur.

Existing global trackers, such as the AI Incident Database and MIT AI Risk Repository, document algorithmic failures retrospectively after harm has already occurred, and focus almost exclusively on US and European legal contexts (e.g., EU AI Act, FTC consent decrees). The Compliance Ledger evaluates Indian automated systems proactively before harm occurs, benchmarking public disclosures directly against domestic Indian statutes (DPDPA 2023, RBI Digital Lending Guidelines, Consumer Protection Act 2019) and the SutraCheck rubric.

No. All assessments are conducted strictly on publicly accessible, verifiable documentation—including published privacy policies, terms of service, developer APIs, regulatory filings, engineering whitepapers, and customer-facing disclosures. We evaluate what enterprises disclose to Indian citizens, consumers, and regulators under applicable transparency mandates.

Evaluations benchmark against key statutory and technical governance frameworks: 1) Currently binding statutes including the Reserve Bank of India (RBI) Digital Lending Guidelines (2022/2023) and the Consumer Protection Act 2019 & CCPA Rules; 2) Enacted statutes with staged commencement, notably the Digital Personal Data Protection Act (DPDPA 2023), where Stage 1 (Data Protection Board) commenced in November 2025 while substantive provisions (Section 5 consent notice, Section 6 purpose limitation, Section 9 protections for minors) commence in Stage 3 on May 13, 2027; alongside technical baselines such as 3) Telecommunications Engineering Centre Standard TEC 57090:2025 (AI Incident Database Schema & Taxonomy).

To ensure legal defensibility and prevent false equivalence, The Compliance Ledger physically segregates evaluations into three distinct columns: Column 1 ("Binding Law") flags instances where public disclosures fail to substantiate compliance with mandatory Indian statutory requirements currently in force with direct legal liability (e.g., CPA 2019, RBI directives). Column 2 ("Enacted, Not Yet in Force") tracks provisions enacted by Parliament whose substantive enforcement dates are pending (such as DPDPA 2023 Sections 5, 6, 8, 9, and 13, which commence in Stage 3 on May 13, 2027; companies face no statutory penalty exposure today). Column 3 ("Voluntary Governance") tracks progressive industry benchmarks—such as demographic fairness parity, human-in-the-loop escalation workflows, and plain-language adverse decision explainability—derived from the open SutraCheck rubric.

Under Section 9 of the DPDPA 2023 (enacted by Parliament, scheduled for Stage 3 commencement on May 13, 2027), Data Fiduciaries will be strictly prohibited from undertaking behavioural tracking, targeted advertising, or algorithmic profiling directed at individuals under 18 years of age without verifiable parental consent. In sectors like EdTech and online platforms, systems that ingest student biometric data or usage patterns without verifiable parental workflows are tracked under our "Enacted, Not Yet in Force" tier so enterprises can adjust architectures before statutory penalty exposure attaches in 2027.

Unlike generative LLM-as-a-judge approaches that produce variable, non-repeatable opinions and hallucinate citations, SutraCheck uses a static Boolean rule-based runtime. It maps verified evidentiary facts directly to codified statutory triggers, producing identical classification outputs, matrix scores, and cryptographic SHA-256 verification hashes for identical inputs.

To preserve journalistic objectivity and prevent defamatory assertions of illegality, all findings are formulated through a strict evidentiary template: "No public evidence found of [specific mechanism], as of [date], based on review of [source]." We report the verifiable absence or presence of public technical documentation rather than asserting conclusive legal guilt.

Composite cases (such as Composite — Digital Lending) model archetypal AI deployments across Indian industries using synthesized, representative facts. They allow the research community and industry participants to inspect and stress-test the rubric's logic on messy real-world scenarios without prematurely naming individual corporations.

Prior to publishing an audit of any named corporate entity, a draft copy of the gap analysis is formally delivered to the subject's designated Grievance Officer or legal counsel. The organization is granted 7 business days to submit factual corrections or updated public documentation. If verified, the report is amended accordingly, and the enterprise's formal statement is published alongside the audit verbatim.

Enterprises deploying automated decision systems in India can submit an evaluation request via our Feature 5 Opt-In Track at complianceledger.in/request. Our team verifies public documentation against the three-tier matrix, providing an objective public benchmark of governance and compliance readiness that builds trust with regulators, enterprise clients, and end users.

When an evaluated organization updates its public documentation, algorithms, or compliance policies, it can request a re-evaluation. Re-evaluations are recorded as dated revisions in the report's Version History table, ensuring an immutable, transparent historical record of the enterprise's compliance progression.