The National e-Governance Division (NeGD), under the Ministry of Electronics and Information Technology (MeitY), has awarded Indian AI startup CoRover.ai a ₹3.63 crore contract to build a unified agentic AI assistant and bot platform for government services. DigiLocker will be the first service to use the platform, which is designed as reusable infrastructure for departments rather than a single-purpose chatbot. CoRover.ai won the deal through a Quality and Cost Based Selection (QCBS) process, scoring 100 against Kyndryl Solutions at 91.24.
What Has MeitY Awarded to CoRover.ai?
The contract covers a project formally titled AI/ML Project - Unified AI Assistant & Bot. NeGD issued a restricted request for quotation in July 2026 and received four bids. Two bidders, CoRover.ai and Kyndryl Solutions, cleared the technical stage. Cactus Technology Solutions and NEC Corporation India were eliminated during technical evaluation.
The financial bids of the two qualified firms were opened on 18 September 2026, and the evaluation document is dated 24 September 2026. CoRover.ai finished with a combined score of 100, while Kyndryl Solutions scored 91.24.
| Bidder | Status | Final QCBS Score |
|---|---|---|
| CoRover.ai | Selected | 100 |
| Kyndryl Solutions | Technically qualified, ranked second | 91.24 |
| Cactus Technology Solutions | Disqualified at technical stage | Not evaluated |
| NEC Corporation India | Disqualified at technical stage | Not evaluated |
CoRover.ai has said the wider request for proposal process drew more than 80 companies, including Deloitte, EY, PwC, KPMG, Tata Consultancy Services, NEC, Kyndryl and Jio Haptik. The company also said six firms were empanelled after technical and commercial evaluation, and that it secured the highest technical score along with the lowest commercial bid. These figures come from the company, while the published tender record shows the four-bid restricted stage.
The project is structured as a bot-as-a-service capability. NeGD wants a reusable conversational and agentic framework that other ministries can adopt, instead of every department building its own chatbot from scratch. The framework is meant to support an ask, do and escalate model, where an assistant answers a query, performs an approved task through a connected government system, and routes complex cases to a human official.
Project Milestones and Delivery Timeline
The DigiLocker deployment is the minimum viable product under the contract. It has to be delivered in four months, split into a foundation milestone and a go-live milestone. The selected agency will then provide 12 months of operations and maintenance support.
| Stage | Deliverable | Duration |
|---|---|---|
| Foundation phase | Core platform, integrations and governance controls | Part of the four-month build |
| Go-live phase | DigiLocker assistant as the first live deployment | Completed within four months |
| Operations and maintenance | Support, monitoring and upkeep | 12 months after go-live |
What Is the National e-Governance Division?
The National e-Governance Division is MeitY’s programme management and technical advisory body for e-governance, created in 2009 as an independent business division under the Digital India Corporation. It runs national platforms such as DigiLocker, UMANG, Entity Locker, API Setu, OpenForge and myScheme.
NeGD is not a technology vendor and it is not a regulator. It supports ministries and states in designing, appraising and executing e-governance projects. Its work includes preparing model tenders and contracts, evaluating project architecture and security, building capacity within government, and measuring the impact of digital service delivery. The division also handles recruitment and deployment of specialised staff for State e-Governance Mission Teams.
UMANG, the single-window mobile application for government services, is also run by NeGD. As of 31 July 2026, it offered about 2,575 services from 241 departments and had more than 11.66 crore registered users.
NeGD, rather than a private buyer, floated the tender and signed the contract. The platform it is buying will sit inside the government’s shared digital infrastructure.
NeGD and Digital India Corporation: What Is the Difference?
The two bodies are often confused because NeGD functions under the Digital India Corporation umbrella. Digital India Corporation is the parent company. It began as Media Lab Asia in 2001, a not-for-profit set up with the MIT Media Lab and the Department of Electronics and Information Technology, and was renamed Digital India Corporation in September 2017. NeGD is a division within that company.
| Feature | Digital India Corporation | National e-Governance Division |
|---|---|---|
| Nature | Section 8 not-for-profit company under MeitY | Independent business division under DIC |
| Established | Media Lab Asia in 2001, renamed in 2017 | 2009 |
| Main role | Strategic support and overall leadership for Digital India | Programme management and technical support for e-governance projects |
| Example platforms | IndiaAI, Bhashini and other Digital India initiatives | DigiLocker, UMANG, API Setu, Entity Locker |
What Is Quality and Cost Based Selection?
Quality and Cost Based Selection is a procurement method in which technical quality and price are both scored, using weights announced in advance. Only bidders who cross a minimum technical threshold move to the financial stage, and the highest combined weighted score wins.
The method is codified in Rule 192 of the General Financial Rules, 2017, which applies to consultancy services where quality is the prime concern. The RFP must state the minimum qualifying technical score and the relative weights for quality and cost, such as 70:30 or 60:40. The technical weight can never exceed 80 percent.
The evaluation runs in two stages. First, a committee scores technical proposals against published criteria. Only responsive bids that meet the minimum score proceed. Then financial bids are opened, normalised against the lowest price, and combined with the technical score.
In simple terms, the technical score equals the bidder’s marks divided by the highest technical marks, multiplied by 100. The financial score equals the lowest quoted price divided by the bidder’s price, multiplied by 100. Each is then multiplied by its weight and added together.
QCBS vs L1: What Is the Difference?
The L1 method selects the lowest-priced responsive bidder, with technical compliance acting only as a pass or fail gate. QCBS allows a technically stronger but slightly costlier bidder to win if the quality advantage is large enough.
| Feature | QCBS | L1 (Least Cost) |
|---|---|---|
| Basis of award | Combined technical and financial score | Lowest evaluated price |
| Technical score | Carries weight, usually 70 to 80 percent | Pass or fail, no weight |
| Suited for | Complex, knowledge-intensive work | Standard goods and routine services |
| Risk | More complex evaluation | May reward low quality |
For an AI system, price alone is a poor guide. Accuracy, multilingual performance, security architecture and the ability to integrate with government systems decide whether the tool works in practice. That is why NeGD used QCBS for this tender. A weak technical bid cannot be rescued by a low price, which matters when the system will handle official documents.
What Is Agentic AI?
Agentic AI refers to systems that can plan and carry out multi-step tasks on their own, using software tools and connected systems, instead of only answering questions. The user sets the goal and the limits, while the AI decides the sequence of actions needed to complete the work.
A conventional chatbot reads a question and produces a reply. An agent goes further. It breaks the request into steps, chooses a tool, calls an application programming interface, checks the result and tries another route if the first one fails. A large language model usually acts as the reasoning engine, while the tools, permissions and guardrails decide what the agent is allowed to do.
Analogy · Receptionist Versus Office Assistant Expand analogy
A generative chatbot is like a receptionist who can explain where a form is available. An agentic assistant is like a staff member who can walk to the correct counter, fill the form, attach the documents and bring back the receipt, while checking with a senior officer when something is unusual.
The Ask, Do and Escalate Model
NeGD has built the tender around three functions. In the ask stage, the assistant answers questions about a service in plain language. In the do stage, it performs an approved action through a connected government system, such as fetching a document or checking a status. In the escalate stage, it hands over cases that need human judgment, verification or an exception.
For DigiLocker, this could mean a citizen asking which documents are available, requesting a specific certificate, and receiving it through a consent-based flow. If the issuer has not uploaded the record or the identity check fails, the agent passes the case to a human official rather than guessing.
Agentic AI vs Generative AI: Key Differences
| Feature | Generative AI | Agentic AI |
|---|---|---|
| Main output | Text, images or audio in response to a prompt | Completed tasks and actions |
| Autonomy | Low, responds to one request at a time | Plans and executes multiple steps |
| Use of tools | Limited or none | Calls APIs, databases and government systems |
| Error handling | Produces a new answer | Retries, changes approach or escalates |
| Typical example | A writing assistant | A document assistant that fetches and shares records |
Why DigiLocker Is the First Implementation
DigiLocker offers the new platform a large, document-heavy user base with an established consent system. That makes it a useful proving ground before the framework is extended to other ministries.
What Is DigiLocker?
DigiLocker is a cloud-based digital document wallet launched by MeitY on 1 July 2015 under the Digital India programme. It lets citizens access, store and share authentic documents issued by government departments, banks, boards and universities, with legal validity under the Information Technology Act, 2000.
The scale is substantial. As of 31 July 2026, DigiLocker had more than 72.43 crore registered users and offered 5,437 document types and services, including 661 from the central government and 4,776 from states and union territories. More than 2,800 issuers have onboarded the platform, and over 930 crore documents have been issued through it.
The platform runs on a simple chain. An authorised issuer creates a digitally signed document and places it in a repository. The citizen sees it in DigiLocker and can share it with a verifier only after giving consent. The verifier checks the issuer’s digital signature instead of relying on a photocopy. This removes the need for physical visits and reduces the scope for forged certificates.
Citizens reach the service through the DigiLocker mobile app or website. Sign-in uses a registered mobile number or an Aadhaar-linked account, with OTP, PIN or biometric verification, and every share is recorded in the user’s access log.
Two related systems sit inside this ecosystem. The National Academic Depository (NAD) stores academic awards such as degrees, diplomas and mark sheets. The Academic Bank of Credits (ABC) records academic credits, and its unique student identifier is the APAAR ID, a 12-digit number linked to the student’s Aadhaar and DigiLocker account. As of July 2026, 26.35 crore verified APAAR IDs had been generated.
How the DigiLocker AI Assistant Will Work
Under the contract, the first bot will let citizens interact with DigiLocker in natural language. The proposed use cases include fetching authentic documents from source systems, sharing them with the required consent, and managing documents through a conversational interface.
The design also requires consent management and analytics to be built as reusable components. That means a future ministry bot can use the same consent trail and monitoring tools without rebuilding them. The platform, not the DigiLocker bot alone, is the real deliverable.
Is DigiLocker Safe?
DigiLocker is generally considered safe because documents come from verified issuers with digital signatures, data travels over encrypted connections, and every share requires explicit user consent. Access is protected by OTP, PIN or biometric authentication, and security audits are conducted by CERT-In empanelled agencies.
The platform uses 2048-bit SSL encryption, hosts data in ISO 27001 certified facilities, keeps access logs and applies multi-zone redundancy. A useful distinction for users is that the Issued Documents section holds signed records from authorised issuers, while the Uploaded Documents section is personal storage. For official purposes, the issued version carries stronger legal weight.
How the AI Governance Layer Will Work
NeGD has made an AI governance layer mandatory because the system is driven by large language models and can act on its own. The tender asks for controls that let officials see what the model is doing and stop it when something goes wrong.
The required controls include version control for prompts and models, approval and rollback workflows, validation of the arguments an agent passes to a tool, and defences against prompt injection and jailbreak attempts. Prompt injection is an attack where hidden instructions inside a document or message trick the AI into ignoring its original instructions. Jailbreaking is an attempt to bypass the safety rules built into a model.
The platform must also monitor agent behaviour, tool calls, task completion, failures, latency and AI-related costs. Separate evaluation mechanisms are expected to track hallucinations, tool accuracy, multilingual performance and safety. These are not cosmetic features. An agent that fetches the wrong document or shares it with the wrong person can cause real harm.
Human-in-the-Loop and Data Protection
The contract requires human-in-the-loop workflows, where a government official can review an AI-generated response or step in before an irreversible action is taken. Audit trails and consent records make it possible to reconstruct who asked for what and which system returned the answer.
The Digital Personal Data Protection Act, 2023 provides the legal backdrop for such processing. It requires clear consent, purpose limitation and reasonable security safeguards. DigiLocker already follows a consent-based model, and the new assistant has to work within that framework rather than around it.
India’s AI Governance Guidelines
MeitY released the India AI Governance Guidelines in November 2025, built on seven principles or sutras. The framework is voluntary and principle-based, and it relies on existing laws plus digital public infrastructure rather than a single new AI Act.
| Sutra | Core Idea |
|---|---|
| Trust is the Foundation | Trust must run through the technology, the builder and the supervisor |
| People First | Humans should retain final control and oversight |
| Innovation over Restraint | Responsible innovation should be preferred over blanket caution |
| Fairness and Equity | Systems should avoid bias and exclusion |
| Accountability | Responsibility should match the function and the risk |
| Understandable by Design | Users and regulators should get clear explanations |
| Safety, Resilience and Sustainability | Systems should be robust, secure and resource-efficient |
The DigiLocker project reflects several of these ideas in practice. Human oversight, audit trails, rollback options and explicit consent are governance requirements written into a procurement contract, not optional good practices.
Where the Platform Fits in India’s AI Push
The contract is a small purchase with a large strategic purpose. It creates a shared layer that ministries can reuse, which is cheaper and safer than letting each department buy a separate chatbot with its own security flaws.
NeGD has asked that reusable services be registered on its common AI Services Platform, while reusable datasets, connectors and evaluation assets go to AIKosh, the dataset platform of the IndiaAI Mission. In effect, the government wants the DigiLocker exercise to leave behind building blocks for other government bots.
IndiaAI Mission at a Glance
The IndiaAI Mission was approved by the Union Cabinet on 7 March 2024 with an outlay of ₹10,371.92 crore for five years. It is implemented by IndiaAI, an independent business division under the Digital India Corporation.
| Feature | Detail |
|---|---|
| Approval | Union Cabinet, 7 March 2024 |
| Outlay | ₹10,371.92 crore over five years |
| Implementing body | IndiaAI division under Digital India Corporation, MeitY |
| Compute pillar | More than 38,000 GPUs onboarded, available at about ₹65 per GPU hour |
| Dataset platform | AIKosh, with thousands of datasets and AI models |
| Foundation models | Support for Indian large language and multimodal models |
| Safety pillar | Safe and Trusted AI projects on bias, explainability, auditing and governance testing |
Bhashini, the language translation platform under the National Language Translation Mission, adds another layer. Launched in 2022, it supports voice services in 22 scheduled languages and text services in 36 languages, and has completed more than four billion language inferences. A multilingual government assistant can draw on this stack instead of building language capability from zero.
From AskDISHA to DigiLocker: CoRover’s Government Track Record
CoRover.ai is a Bengaluru-based company founded in 2016 by Ankush Sabharwal, Kunal Bhakhri and Manav Gandotra. Its flagship product is BharatGPT, which the company describes as a sovereign AI model built with government support. The firm says its platform supports more than 100 languages and has been used by clients including IRCTC, LIC, NPCI, SEBI and several banks.
Its best-known government deployment is AskDISHA, the IRCTC chatbot launched in October 2018 and built by CoRover. It was India’s first AI chatbot deployed by a public sector enterprise. By the early 2020s, AskDISHA was handling about 1.5 lakh passenger queries a day and had recorded more than 10 billion interactions. The upgraded AskDISHA 2.0 allows ticket booking, cancellation and refund checks through a conversational interface, using an OTP instead of the IRCTC password.
That track record matters for a QCBS award. A bidder that has already run a high-volume public service bot scores better on technical experience than one with no comparable deployment. The DigiLocker contract extends the same model from travel queries to official documents, where the cost of an error is higher.
What Are the Risks of Agentic AI in Government?
Agentic AI in government raises concerns about accountability, security and exclusion. An agent can act at speed and scale, so a wrong tool call or a manipulated prompt may affect many citizens at once, while it may be unclear who is responsible for the resulting harm.
Accountability and Security
When a chatbot gives a wrong answer, the damage is usually limited to a bad reply. When an agent takes a wrong action, it may share a document with the wrong verifier, block a legitimate request or expose personal data. The tender’s audit trails and human checkpoints reduce this risk, but they do not remove it.
Connected systems also widen the attack surface. An assistant that can reach backend government databases becomes a high-value target for phishing, credential theft and prompt injection. Least-privilege access, strong authentication and continuous monitoring are necessary, not optional.
Inclusion and Vendor Dependence
DigiLocker has more than 72 crore users, but a large share of Indians still rely on common service centres, helplines and physical offices. An AI assistant works best for people with smartphones, data connectivity and reasonable digital literacy. It should remain an additional channel, not a replacement for assisted service delivery.
There is also a question of lock-in. The platform is meant to be reusable, but it is being built on a vendor’s proprietary architecture. Open APIs, data portability and clear exit provisions matter if the government wants to switch providers later without losing the investment.
The Way Forward
The immediate test is the four-month DigiLocker rollout. Its success will depend on whether the assistant can fetch the right document, apply consent correctly and hand over difficult cases to a human without delay. A smooth first deployment would give other departments a working template.
The bigger test is standardisation. If reusable services are registered on the AI Services Platform and datasets are shared through AIKosh, the cost of building the next government assistant falls sharply. If every ministry treats the platform as a one-off project, the expected savings and safety gains will not materialise.
For now, the contract marks a shift in how the state buys AI. It is moving from pilots and chatbots to a governed, reusable layer that can act on government systems. The DigiLocker bot is the first visible part of that layer, and its performance will shape how far and how fast the model travels.
Key Takeaways
- The National e-Governance Division (NeGD) awarded CoRover.ai a ₹3.63 crore contract to build a Unified AI Assistant and Bot platform for government services.
- CoRover.ai scored 100 in the QCBS evaluation, while Kyndryl Solutions scored 91.24; the financial bids were opened on 18 September 2026.
- DigiLocker will be the first implementation of the platform, with a four-month build period followed by 12 months of operations and maintenance.
- QCBS is governed by Rule 192 of the General Financial Rules, 2017, and the technical weight in such evaluations cannot exceed 80 percent.
- DigiLocker was launched on 1 July 2015 and had more than 72.43 crore registered users and 5,437 document types as of 31 July 2026.
- NeGD was created in 2009 as an independent business division under the Digital India Corporation, which was renamed from Media Lab Asia in 2017.
- The IndiaAI Mission was approved on 7 March 2024 with an outlay of ₹10,371.92 crore, and more than 38,000 GPUs have been onboarded under its compute pillar.
- CoRover.ai, founded in 2016, developed BharatGPT and built AskDISHA, the IRCTC chatbot launched in October 2018.
