Dear Inner Circle,
This edition is late, and I would rather say so than pretend otherwise. The last one went out on 1 July. The sending machinery behind this letter broke in the interval — a story for another day — and while the daily writing never stopped, the fortnightly gathering-up of it did. It resumes here.
What follows is not a summary of everything published since. It is four items I keep returning to, each one a case where the number everybody quoted turned out not to be the number that matters. That is the whole theme of this edition, and it was not planned that way.
Almost every report on CERT-In’s 2026 artificial-intelligence guidance collapsed into one figure: patch internet-facing critical vulnerabilities inside twelve hours. The figure is real. It is also the least useful thing in the document set, and quoting it alone has left a great many small firms worrying about the wrong deadline.
CERT-In did not publish one AI rulebook. It published three connected instruments in seven weeks. An advisory on 26 April 2026, Defending Against Frontier AI Driven Cyber Risks (CIAD-2026-0020). A Blueprint on 25 May 2026 — nine subject areas across fourteen sections, with a three-phase roadmap — which is where the twelve-hour expectation sits, alongside AI asset inventories, SBOM and AIBOM adoption, India-resident log retention and a new CERT-In AI Cyber Defence Centre. And on 10 June 2026, a set of guidelines aimed at OEMs and technology vendors selling into India.
Read them in order and the priority inverts. The twelve-hour window is framed conditionally — close internet-exposed critical exposure within twelve hours where feasible — and carries no penalty clause. The obligation with teeth is four years older and barely mentioned in the AI coverage: CERT-In Directions No. 20(3)/2022-CERT-In, issued under Section 70B of the IT Act on 28 April 2022 and in force from 27 June 2022, require a reportable incident to be notified within six hours of it being noticed, with 180 days of log retention and clocks synchronised to Indian NTP servers. Non-compliance attracts action under Section 70B(7) — up to a year’s imprisonment, a fine of up to one lakh rupees, or both. The June OEM guidelines restate that six-hour duty as live.
There is a further wrinkle that I have not seen named anywhere. Section 3.1 of those OEM guidelines sets indicative timelines for how long a vendor may take to ship a fix: for a responsibly disclosed critical flaw in an IT product, five days. So for most of your twelve-hour window, the patch you are told to apply does not yet exist. CERT-In is explicit that where immediate deployment is not feasible the answer is interim mitigation — which means the clock was never a patching instruction. It is an instruction to reduce exposure by whatever means available, and to keep reducing it until the vendor catches up.
For you: if you fix one thing this quarter, make it the ability to notice an incident and file a preliminary report inside six hours. That report is roughly nine fields — category, detection timestamp, affected systems, estimated scope, a named contact, containment attempted. Root cause is not expected at that stage. Firms miss the deadline not because the form is hard but because nobody owns it and nobody has written down where to send it.
Two studies, five months apart, both about Indian companies. In March 2026, Deloitte’s State of AI in the Enterprise found 40 per cent of Indian respondents reporting significant or full AI usage against a global average of roughly 28 per cent — strongest in product development (62 per cent), strategy and operations (56 per cent), marketing and sales (55 per cent) and supply chain (48 per cent). In August 2026, ET Edge’s CIO&Leader surveyed 300-plus senior technology leaders and found 60 per cent still at pilot or exploration stage after two or more years, and only 12 per cent able to point to significant, measurable return.
Both can be true, because they measure different things. Deloitte measured deployment. ET Edge measured demonstrated return. The interesting number is neither of those: it is the 57 per cent who report no measurable return or cannot tell. The report calls that a measurement failure rather than a performance failure, and the distinction is the whole story. It does not claim the AI is not working. It claims a majority of Indian organisations built nothing capable of detecting whether it worked.
“The spending arrived. The returns have not. That is not a story about a market failing for lack of vision — it is a lack of process discipline, in how pilots are selected, who owns the business case, and how success is measured.”
— R. Giridhar, Editorial Director, Technology, ET EdgeThe budgeting pattern explains most of it. Eighty-three per cent named productivity improvement as the primary motive, yet 58 per cent allocate under 10 per cent of the IT budget to AI, and 55 per cent either overran their AI costs in the past year or do not track AI spend separately from general IT at all. If the spend is not a separate line, the return cannot be a separate line either. The board is then handed a question that has been made structurally unanswerable.
For you: this one is uncomfortable and worth sitting with. If you did not record what a process cost before you automated it, you have permanently lost the ability to prove what the automation saved. There is no retrospective fix. Whatever you are about to automate next, spend the first week measuring the thing you are replacing.
On 15 June 2026, at Mahatma Mandir in Gandhinagar, Gujarat announced a five-year industrial policy backdated in force to 1 June 2026. The number that travelled was 45 per cent — the maximum a micro, small or medium unit can draw as a share of Eligible Fixed Capital Investment. Two months on it is being quoted in project reports across the state as though it were a grant rate.
It is a ceiling on three separate instruments combined, and no single one of them reaches it. In a Category-A taluka the capital subsidy tops out at 35 points of the 45-point envelope. The remaining ten cannot be filled with more capital subsidy. They have to come from the interest leg — 7 per cent on a term loan, itself capped at 10 per cent of eFCI, which therefore only exists if you borrow — or from the power leg, generous on paper at 25 per cent of eFCI but paid at ₹2 per unit consumed, so it accrues slowly and only rewards a genuinely energy-hungry line.
The consequence is specific: a debt-free micro unit in a Category-A taluka is structurally capped at 35 per cent, which is the same headline rate a Category-B unit sees. The 45 per cent is real. It is priced in leverage and electricity.
There is also a timing risk nobody has priced. A policy is a statement of intent; the document that creates an entitlement is the Government Resolution and the operating guidelines under it. PwC India’s tax alert of 22 June 2026 recorded that the GR and detailed guidelines were still awaited, and as of late August no public notification of them has surfaced. The policy is in force by its own terms. The machinery to claim under it is not yet published.
For you: if you are in Gujarat and weighing own funds against a term loan, model both routes before assuming the higher figure applies. The interest-subsidy leg can be worth up to a tenth of eFCI, which is often enough to flip the decision. And where the GR eventually differs from the announcement, the GR wins.
A Hindi play about Rama has been staged more than 450 times since January 2024. Humare Ram, produced by Rahul Bhuchar under Felicity Theatre and directed by Gaurav Bhardwaj, opened with seven shows at Delhi’s Kamani Auditorium between 25 and 28 January 2024. It has since played the Jamshed Bhabha Theatre at the NCPA, the Nita Mukesh Ambani Cultural Centre, Dubai Opera in August 2025, and is booked into the Eventim Apollo in London from 9 to 12 July 2026.
Run the arithmetic before celebrating. Four hundred and fifty shows across roughly thirty months is fifteen a month, spread over at least six cities and two countries. That is a touring model, not a residency. A long-running West End title clears 400 performances inside a year at a single address. India has no infrastructure permitting an open-ended sit-down run, so the only way to accumulate an audience is to move — Outlook India reported on 1 May 2024 that the Mumbai leg closed with eight housefull shows and then the set came down. Demand was not the constraint. Available dates were.
The growth around it is real but mostly not theatre. The FICCI-EY Media & Entertainment Report 2026, released 24 March 2026, found live events expanded 44 per cent during 2025 — the fastest-growing segment of a ₹2.78 trillion industry — and attributed that growth to concerts, celebrity performances, weddings, government programmes and religious gatherings. Live events sit at roughly ₹14,500 crore: a small segment growing quickly, not a large one. BookMyShow’s FY25 filings say the same thing from the other side: live-events revenue of ₹756 crore, up 66 per cent from ₹455 crore, with KKR announcing an investment on 18 August 2026. Capital is arriving in Indian live entertainment because of arena-scale music, not proscenium drama.
And underneath both sits the older economy. Ramlila, inscribed on UNESCO’s Representative List of Intangible Cultural Heritage in 2008 and built on Tulsidas’s sixteenth-century Ramcharitmanas, is staged across northern India every autumn by unpaid community performers, in the town itself, with no gate and no scarcity of dates. The Ramnagar cycle at Varanasi runs a month. It reaches tens of thousands per town at zero ticket price, with no ceiling on how many towns can run one at once.
For you: the 450 proves appetite for the epic staged at scale. It does not prove a repeatable economic model, because the production had to solve the venue problem 450 separate times. Epic theatre is riding a wave it did not create and does not control — cheap discovery and a warm ticket-buying public, which is a useful position and a fragile one.
The Gujarat GR. Until the Government Resolution and operating guidelines are notified, every 45 per cent projection in a Gujarat project file is an estimate. When it lands, the taluka lists and claim formats will tell us how much of the announcement survived contact with the treasury.
The CERT-In AI Cyber Defence Centre. Announced in the 25 May Blueprint. What it actually does — whether it becomes a reporting counterpart a small firm can reach, or another portal — will decide whether the six-hour duty is workable for businesses without a security team.
Whether anyone starts measuring. The 12 per cent figure will be re-surveyed. If the next round shows the same number, the problem was never the technology.
MSME policy, Vedic wisdom, AI insights & book updates — fortnightly by Dr. Dibyendu Choudhury. Unsubscribe anytime.
🎁 Free gift: 20 Gita Lessons PDF on confirmation