INDUSTRIES · ENERGY AND UTILITIES
AI for the corporate side of the utility, kept out of the control loop.
Consumer care, filings, documents and software on your own network, with sensitive data designed to stay in India and a recorded trail behind every step. The models never sit in an OT control loop.
IN SHORT
For power and utility companies, AgentAnywhere covers the IT and corporate side only, and is never in the OT control loop. It is designed to run inside your own perimeter in India. Aavaran, our data-masking layer, masks consumer identifiers before a model reads them, Seva assists consumer-care desks, AgentAnywhere Vaani is designed to take voice notes in Indian languages, Manthan reads long documents and drafts filings and replies for review, and Taksha works on software on your own network. Every step is recorded, in a trail you can export as CSV.
01 · Sensitive data has a home
From 1 April 2027, regulation 5(19) of the CEA cyber security regulations says sensitive data resides within India only, including cloud-hosted data.
02 · Six hours to report
Regulation 7(3)(a) asks for incidents to be reported within six hours to CSIRT-Power and CERT-In. A tool in the path has to help with the timeline.
03 · IT is connected to the grid
The regulations reach OT linked to the interconnected grid and the IT connected to it. A corporate system, an AI tool included, can fall in scope if it is connected. Your team decides.
WHY IT FITS
Sovereign, our models, and the Trust Platform.
Three things, in the terms of energy and utilities: where it runs and who controls it, which models do the work, and the controls and the record around every call.
01 · Sovereignty
It runs in India, inside your own environment, on the IT side.
- Inside your perimeter: your own cloud account in an Indian region, or your own hardware. Region-pinned, and designed to deploy air-gapped.
- Swaraj, the sovereign deployment, is designed to pin a deployment to the region you choose, which suits sensitive data the regulations keep in India.
- It is IT-side and corporate work only. The models never sit in an OT control loop or a safety function.
02 · Our models
The line we select, measure and serve, for the corporate desk.
- Seva assists consumer-care desks. AgentAnywhere Vaani is designed to take voice notes in Indian languages; its masking, routing and tally are ours, and speech recognition and synthesis are open-licensed external components used for now.
- Manthan reads long documents and drafts filings and replies for review. Taksha works on billing and portal software on your network.
- Seva, Manthan and Taksha are built on open foundation models, measured and served by us. You can bring your own open model.
03 · The Trust Platform
Controls around every call, and a timeline you keep.
- Aavaran masks consumer identifiers before a model reads them, with a signed Trust Receipt for each masking call.
- Kavach is designed to screen each request for prompt injection and unsafe output. The Agent Gateway applies your policy at the point of the call.
- Every step is recorded, in a trail you can query and export as CSV.
INSIDE YOUR PERIMETER
What happens to one consumer's request.
Follow one request from the moment it arrives to the receipt an auditor can check. Raw values are designed not to cross the boundary.
One request · start to receipt
Illustration
Your perimeter · your cloud, your region, or designed to deploy air-gapped
Step 1 of 5
A request arrives
A question comes in. It carries a name, an account, a card number: the things that must not travel.
THE RULES
The rules that bind you.
What each instrument requires in plain words, where it stands today, and what it means for AI in energy and utilities. Dates that have not arrived are written as dates.
CEA (Cyber Security in Power Sector) Regulations, 2026, F. No. CEA-HY-91-19/8/2024, 31 July 2026: scope and dates
From 1 Apr 2027
What it requires
In force from 1 April 2027, a few regulations later by CEA order. They apply to entities owning or operating OT linked to the interconnected grid and their connected IT; generation, captive and storage at 50 MW or more.
What it means for AI
Connected IT is in scope, so the corporate side of a utility is not outside the rules. We keep to that side and never to the control loop.
CEA Cyber Security Regulations 2026, regulation 5(19)
From 1 Apr 2027
What it requires
Sensitive data resides within India only, including cloud-hosted data.
What it means for AI
AI that reads sensitive data should run in India. AgentAnywhere is designed to run in your own cloud account in an Indian region or on your hardware, region-pinned.
CEA Cyber Security Regulations 2026, regulation 7(3)(a)
From 1 Apr 2027
What it requires
Report incidents within six hours to CSIRT-Power and CERT-In.
What it means for AI
A recorded trail of what an AI tool read and did gives the security team a timeline inside the six hours. The report is yours to file.
What it requires
Report listed incidents within 6 hours of noticing. Keep ICT logs for a rolling 180 days within Indian jurisdiction.
What it means for AI
An AI system produces ICT logs. A recorded trail that stays in your deployment is the material for the log duty. Reporting stays with you.
What it requires
Government can declare a computer resource that affects critical information infrastructure a protected system.
What it means for AI
Any AI added to a system that is declared protected sits inside that status. Plan it as part of that system.
What it requires
Commenced by G.S.R. 843(E) of 13 November 2025. Section 8(5): protect personal data, including data with a processor, by reasonable security safeguards. Rule 7(2)(b): a fuller breach report within 72 hours. Rule 6(1)(e): logs and personal data kept one year.
What it means for AI
Consumer data is personal data. Masking before a model reads it, and a trail you can query, help you show the safeguards and rebuild an incident.
This is what the rules say, not legal advice. Your compliance function owns the reading and the filing.
USE CASES · BY FAMILY
What runs on the IT side of a utility.
Each card opens the page for that family or machine. Tell us your setting and we will show you the closest demonstration.
WORK SCENES
What it looks like on a working day.
The problem, what runs, and what the person at the desk gets. Each scene is an illustration of how the work is designed to go, not a customer account.
Scene 01
A billing complaint on the phone
The problem
- A consumer reads out a mobile number and an account number to dispute a reading.
What runs
- Aavaran masks them in the transcript before the model reads it, and Seva suggests the next step.
What they get
- The agent sees a suggested reply and compliance flags, and the record shows a signed Trust Receipt for each masking call.
Scene 02
A helpline voice note
The problem
- Consumers leave voice notes about outages and bills in their own language.
What runs
- AgentAnywhere Vaani is designed to understand, mask, classify and route each note on Indian infrastructure.
What they get
- The right desk receives a masked, categorised request, and urgent or uncertain notes go to a person.
Scene 03
A regulatory filing to draft
The problem
- An officer assembles a filing from long documents and previous submissions.
What runs
- Manthan reads the documents inside your perimeter and drafts the filing text.
What they get
- The officer edits, decides and signs, and the drafting step is recorded.
Scene 04
Billing and portal software
The problem
- Your engineers maintain corporate software that cannot be sent to an outside tool.
What runs
- Taksha works on your own network, and an independent referee checks each claimed success.
What they get
- Your engineers receive each change with the referee's verdict, and your release process decides what ships.
Scene 05
The incident review
The problem
- After an IT incident, the security team needs a timeline of what the AI tools read and did.
What runs
- Every step is recorded, and the trail can be queried by person, action and time.
What they get
- The team exports the trail as CSV. The six-hour report is yours to file.
THE SOVEREIGNTY TEST
The sovereignty test, for energy and utilities.
If an AI system cannot answer these from its own records, you are renting it. Beside each question: what a rented AI service usually answers, and how we answer. Read the test.
01Where does the data run?
What a rented AI service usually answers
“In a region near you, per the contract.” The vendor decides when the model changes.
How we answer
In India, inside your perimeter: your cloud in an Indian region or your own hardware, region-pinned and designed to deploy air-gapped. IT-side only.
02Which model made that decision?
What a rented AI service usually answers
“The AI.”
How we answer
Model Hub is designed to register each model with an owner and lineage. Seva, Manthan and Taksha are built on open foundation models, measured and served by us.
03What did the model actually see?
What a rented AI service usually answers
The full transcript, with the consumer's number in it.
How we answer
Aavaran masks consumer identifiers before the model reads them, with a signed Trust Receipt for each masking call.
04What stops the agent doing harm?
What a rented AI service usually answers
A prompt that tells the model to be careful.
How we answer
A policy outside the model. Kavach is designed to screen each request for prompt injection and unsafe output, and the Agent Gateway applies your policy at the point of the call. The models never sit in a control loop.
05Who approved the consequential step?
What a rented AI service usually answers
“The system.”
How we answer
A person approves what goes out to a consumer or a regulator, and the approval is recorded.
06What will you show the regulator?
What a rented AI service usually answers
A slide for the audit.
How we answer
A recorded trail, queryable and exportable as CSV, with a signed Trust Receipt for each masking call. Your compliance function owns the filing.
STATED PLAINLY
What this is not.
- IT-side and corporate work only. The models never sit in an OT control loop or a safety function, and we do not operate, monitor or control grid or plant equipment, SCADA or protection systems.
- The CEA cyber security regulations are in force from 1 April 2027, with a few regulations later by CEA order. They are not in force today, and your team decides how they apply to you.
- Seva is shown on synthetic conversations. AgentAnywhere Vaani is shown without accuracy figures, and its first pilot deployment is being built.
- A model's draft supports an officer. The officer decides and signs.
- Masking reduces what a model reads. It does not take data outside any law, and your compliance function owns that view.
THE OFFER · THE SOVEREIGN PILOT
Bring your hardest workload. We come to your data.
Pick the one workload your risk committee keeps deferring because the data cannot go anywhere. We run the pilot where the data already sits, with our architects beside your team, and you decide at the end whether it goes live.
For power and utility companies: bring a corporate workload with sensitive data in it, such as the consumer-care desk or a filing cycle. We set up in India, on the IT side, and never in the control loop.
What the pilot is
- One workload, one team, six to ten weeks.
- A sovereign environment by default.
- Solutions Architecture paired with your team for the duration.
- It ends with one agent in production under your governance, or a documented decision not to proceed.
What we add
- The Trust Platform is on from the first call: data masking, policy screening, the Agent Gateway and a recorded trail.
- The record stays with you and is exportable as CSV.
- You can bring your own open model.
- A reply within one business day.
A risk committee has no reason to refuse, because the data does not have to go anywhere to find out. The pilot ends one of two ways: one agent in production under your governance, or a documented decision not to proceed, with the record behind it.
OTHER INDUSTRIES
Other industries
FAQ
Frequently asked questions.
- Can AI be used in a power utility's control room?
- Not by us. AgentAnywhere covers the IT and corporate side only. The models never sit in an OT control loop or a safety function, and we do not operate, monitor or control grid or plant equipment.
- What do the CEA cyber security regulations say about data?
- Regulation 5(19) of the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 says sensitive data resides within India only, including cloud-hosted data. The regulations are in force from 1 April 2027, with a few regulations later by CEA order.
- Who must follow the CEA cyber security regulations?
- Entities owning or operating OT linked to the interconnected grid, and their connected IT. For generation, captive and storage the threshold is 50 MW or more. The regulations are in force from 1 April 2027. Your team decides how they apply to you.
- How fast must a power-sector cyber incident be reported?
- Within six hours to CSIRT-Power and CERT-In, under regulation 7(3)(a) of the CEA regulations from 1 April 2027. The CERT-In Directions of 2022, in force, also ask for listed incidents to be reported within 6 hours of noticing. A recorded trail gives your team a timeline. The report is yours to file.
- Can a utility use AI on consumer data without sending it abroad?
- Yes. AgentAnywhere is designed to run in your cloud account in an Indian region or on your own hardware, region-pinned and designed to deploy air-gapped. Aavaran masks consumer identifiers before a model reads them.
- What can Seva do at a utility's consumer-care desk?
- Seva reads a service conversation and returns a summary, a quality scorecard, compliance flags and a suggested reply for a person to use. It is shown on synthetic conversations and is built on open foundation models, measured and served by us. Automated resolution is work we build with you.
- What record does a utility get of what the AI did?
- Every step is recorded, each masking call carries a signed Trust Receipt, and the trail is queryable and exportable as CSV. Your compliance function owns the filing.
- What does the Sovereign Pilot involve for a utility?
- One workload, one team, six to ten weeks, in a sovereign environment, with Solutions Architecture paired with your team. The workload is on the IT side. The Trust Platform is on from the first call, the record stays with you and is exportable as CSV, and it ends with one agent in production under your governance or a documented decision not to proceed.
Bring your hardest workload.
We come to your data. One workload, one team, six to ten weeks, in a sovereign environment. Tell us the workload and a solutions architect will reach out within one business day.