Testing AI Against India's AI Governance Guidelines and the DPDP Act, in Drupal
In August I published a proposal: AI governance frameworks live in PDFs, while AI features live in prompts, and nothing connects the two. That proposal is now built. The AI Empathy Evaluation module for Drupal can test how an AI model responds against specific governance frameworks, including India's AI Governance Guidelines and the Digital Personal Data Protection (DPDP) Act, 2023, and give each response a policy alignment score.
If you missed the proposal, Your AI Governance Policy Is a PDF. Your Prompt Has Never Read It. explains the problem. This post covers what was built, and why it matters for India's public sector in particular.
What was built
The work is tracked in work item #3608922 and was delivered in five parts, now on the 1.3.x branch of the module and coming in the next release.
- A governance policy catalogue. Fifteen frameworks ship as editable configuration: the EU AI Act, OECD AI Principles, UNESCO Recommendation on the Ethics of AI, the UN's Governing AI for Humanity, the Council of Europe Framework Convention, the G7 Hiroshima AI Process, ISO/IEC 42001, India's AI Governance Guidelines and DPDP Act, the NIST AI RMF, the UK's AI regulation principles, Singapore's Model AI Governance Framework, Canada's voluntary code for generative AI, China's generative AI measures, and a set of general trustworthy-AI principles. Each records its jurisdiction, type (binding law, policy, recommendation, treaty or standard), the themes it covers, its source and an as-of date.
- Choosing which policies apply. Pick policies site-wide, grouped by jurisdiction, or override them for individual scenarios.
- Policies in the evaluation. The selected policies' guidance is added to the evaluation prompt, or delivered as items in the Drupal AI Context Control Centre, or both.
- A policy alignment score. Every response is scored from 0 to 100 for how fully it honours the active policies, compared with a threshold you set, and shown on each result and on the dashboard.
- No code needed to keep it current. Policies are configuration, not PHP. When a framework changes, edit it in the admin UI or ship an updated policy, without waiting for a module release.
Why this matters for India
Government departments and public bodies in India are starting to use AI where it touches citizens directly: answering queries, sorting grievances, helping decide eligibility for schemes, supporting healthcare and education. The question is no longer whether to use AI there, but how to show that a particular model behaves the way India's own rules expect before it is put in front of the public.
Two Indian frameworks are in the catalogue.
India AI Governance Guidelines (MeitY, IndiaAI Mission)
These are principles-based. The module checks whether a response puts people first and builds trust, treats people fairly without discriminating against marginalised groups, is understandable to the person affected, keeps a clearly accountable party, and is safe and resilient, while still enabling beneficial use of AI.
Digital Personal Data Protection Act, 2023
This is binding law. The module checks whether a response uses personal data only for a lawful purpose with valid consent or another legitimate basis, collects only what is needed, keeps it accurate and secure, respects people's rights to information, correction, erasure and grievance redress, and does not disclose one person's data to another without a lawful basis.
The module also ships scenarios set in Indian contexts, covering caste and healthcare, access to services in rural areas, joint-family decisions, gender and education, and religious beliefs in medical decisions. These are exactly the situations where a model trained mostly on Western data can give an answer that is confident, fluent and wrong for the person in front of it.
How a department or institution could use it
- Before choosing a model, run the same scenarios through each candidate with the India policies selected, and compare their empathy and policy alignment scores side by side.
- Before going live, set thresholds for policy alignment and treat a model that falls below them as not ready.
- After going live, re-run the evaluations on a schedule, so a model update that quietly changes behaviour is caught.
- For audit, keep the stored results as evidence of what was tested, against which policies, and when.
It is open source and runs on your own Drupal site. With an open-source model hosted on your own servers, the scenarios and responses never leave your infrastructure, which matters for public-sector data.
The guidance in each policy is a summary for evaluation purposes, not legal advice. Frameworks change, so check each policy's source and as-of date before relying on it.
Try it, or let's work on it together
Developers can try it now from the 1.3.x development branch of ai_empathy by enabling the AI Empathy Governance submodule. It will be in the next tagged release.
I would especially like to hear from government departments, public sector undertakings, universities and research groups in India working on responsible AI. I am happy to give a demonstration, help run a pilot evaluation of the models you are considering, add scenarios for your sector, or run a training session for your team or faculty. Get in touch.
