Co-authored by:
Sonia Baldia*: Partner, Kilpatrick Townsend & Stockton LLP
Vishal Vijay**: CEO, GCCBase
Why India is Back on the GCC Agenda
For many U.S. companies, AI is moving from experimentation to execution. The harder questions are where to find the talent, how quickly to build the capability, and what level of control the business needs over the people, data, tools and work product that will support that effort. India is increasingly part of that calculus. The case is being shaped by three related developments: the maturity of India's GCC ecosystem, the growing use of India centers for AI and technology capability, and a regulatory environment that is becoming clearer around AI governance and data protection.
For purposes of this discussion, a Global Capability Center, or GCC, refers to the India-based operating platform through which a U.S. company builds, manages and scales enterprise capability. An AI Center of Excellence, or AI CoE, refers to the specialized AI, data, engineering and governance capability that may sit within that platform. In other words, the GCC is the operating structure; the AI CoE is the mandate.
The GCC ecosystem has matured.
India now hosts more than 2,100 Global Capability Centers (GCCs) across roughly 3,700 individual units, employing over 1.9 million professionals, more than half of the world's GCC footprint.[1] The nature of the work has also evolved. According to the EY India GCC Pulse Survey 2025,[2] 58% of India-based GCCs are investing in agentic AI and 83% are scaling generative AI. India centers are increasingly being used for AI-enabled transformation, supported by a specialized AI talent base estimated at more than 120,000 professionals. Recent entrants offer a useful signal: Harvey, the legal AI company, opened its first India office in Bengaluru to support engineering, sales and operations, while Cognite, a U.S.-headquartered industrial AI company, inaugurated an AI-focused India Center of Excellence (CoE) in Bengaluru with hiring across AI, machine learning and data science. The significance lies in the type of work -- specialized AI, engineering and product capability built closer to the core of the business, not simply offshore support capacity.
AI and digital transformation are changing the mandate of India centers.
As GCCs take on more AI, data, engineering, product and automation work, governance can no longer be treated as a separate compliance exercise. In February 2026, India released its AI Governance Guidelines, a principle-based framework anchored in seven guiding “sutras”.[3] The framework does not create a standalone AI statute. Instead, it relies on existing law supplemented by new oversight bodies, a materially different posture from the EU AI Act. For companies evaluating an AI-focused India GCC, AI governance will be shaped largely by rules they already navigate — privacy, IP, employment and sector-specific obligations.
Data protection rules are becoming clearer.
In November 2025, India notified the Digital Personal Data Protection Rules, with key compliance obligations taking effect by May 2027.[4] That timing matters because an AI-focused GCC will depend on data access from the outset. Once a center is live, data flows, access rights, vendor arrangements, retention practices and model-development processes can become difficult to unwind. Companies building now have an opportunity to design those controls into the center before operating habits, technology architecture and contracts are already locked in.
These developments explain why India is receiving renewed attention. But the business case still depends on what a company is trying to build, how quickly it needs to build it, and whether that capability is important enough to own and govern over time.
The Business Case and Operational Playbook
The Strategic Rationale
Cost still matters. For some U.S. companies, India can make it possible to build an AI, data or engineering team of a size and depth that would be difficult to sustain domestically. But cost alone is a weak foundation for a GCC. The center still has to be managed, governed, integrated with the business and supported by the right infrastructure, contracts and leadership.
The stronger case rests on capability, speed and control. Many companies need AI engineers, data scientists, platform architects, MLOps talent and product engineers faster than they can realistically hire and retain them in the U.S. That gap is especially pronounced for companies that have reached the point where AI is central to their product or operations but cannot yet compete for talent on the same terms as the largest technology firms. The constraint can become a time-to-market issue when work is tied to product releases, customer experience, internal automation or data modernization. A dedicated India GCC, with an AI CoE mandate, can help close that gap while building a team that learns the company's systems, data and workflows over time. That continuity is often what distinguishes a GCC from a vendor-capacity model.
Choosing the Right Build Model
The first decision is usually the operating model. A company may build the India center directly, use a managed model, or pursue a build-operate-transfer structure. That choice affects almost everything that follows: entity formation, hiring, workspace, technology infrastructure, governance, IP ownership, data access and local vendor management.
In a direct build, the company typically forms a wholly owned India subsidiary and handles the setup work itself. That structure can provide greater control over IP, data and people, but it requires more upfront management attention: incorporation, regulatory and tax registrations, banking setup, local employment documentation, hiring, vendor selection and an intercompany agreement explaining how the India entity will provide services to the parent. Those early choices matter because they affect transfer pricing, ownership of work product, data access and the ability to use India-created assets across the enterprise.
In a managed or BOT model, a local partner helps stand up the operation before the company assumes greater control or ownership. That can reduce early execution burden and spread entry costs while the center proves itself. The key is clarity at the outset on the terms that will govern any eventual transfer: what the company will receive, what it will pay, how employees and contracts will be handled, and what transition support the partner will provide. A well-structured arrangement addresses these points upfront and preserves the company's flexibility as the center matures.
Regardless of model, the strongest centers start with a business mandate, not a staffing target. For many companies, the real question is what capability the business needs to build and why that capability is important enough to own. That clarity helps the center attract the right leadership, stay connected to U.S. decision-makers and demonstrate value early. It also gives management a practical way to measure success: not by headcount alone, but by whether the center is improving product velocity, data capability, automation, customer experience, cybersecurity or other priorities that matter to the business.
The Legal and Regulatory Framework
Once the operating model is selected, the legal structure should be built around the role the India center is expected to play. An AI-focused GCC is not simply an offshore staffing arrangement. It may create technology, process sensitive data, develop product features, build institutional know-how and support AI-enabled workflows or customer-facing solutions. The legal framework should therefore address entity structure, ownership, data access, governance, employment, vendor dependencies and transfer rights from the outset.
Structure the GCC for the Role It Will Play
The entry and intercompany structure should match how the India center is expected to operate. A company should decide early whether the center will be built through a wholly owned subsidiary, a managed or BOT model, or another local structure, and how that choice affects capitalization, funding, tax treatment, transfer pricing, treaty considerations and repatriation of profits or cost recoveries. Cross-border issues such as withholding tax, GST and indirect tax, foreign tax credits, intercompany charges, secondments and potential permanent establishment risk should be considered as part of that analysis. Depending on the location and operating model, companies may also evaluate Special Economic Zones (SEZs), STPI registration, state GCC policies, and incentives tied to employment, skilling, R&D, real estate or infrastructure, but incentives should support — not drive — the operating model. If the India center is expected to take on greater technical, product or operational judgment over time, the legal agreements and tax position should reflect that reality from the start.
Plan for Exit, Transfer and Flexibility
Although it may seem counterintuitive to plan for exit at the time of entry, companies should have a clear view from the outset of how the center could be transferred, restructured, scaled down or wound down if business priorities change. This is especially important in managed or BOT models, where the company should understand the back-end commercial terms before launch, including transfer fees, employee transition costs, contract assignment costs, facility obligations, technology migration costs and any termination or wind-down charges. Without that visibility, the company may have limited leverage at the transfer or exit stage. Addressing exit rights, transition obligations and exit economics early helps preserve flexibility and avoid vendor dependency as the GCC's role evolves.
Secure Ownership, Data Rights and Cross Border Access
Ownership is equally critical. For an AI-focused GCC, the relevant assets extend well beyond traditional software code. They may include models, fine-tuned tools, prompts, curated datasets, evaluation methods, workflows, documentation, product insights and operational know-how. U.S. companies should not assume that global template agreements will cover all of these assets or that ownership will automatically reside where the business expects. Employment agreements, contractor arrangements, vendor contracts and intercompany agreements between the parent and the India entity should work together so the company can use India-created assets globally, including in products, internal platforms and customer-facing solutions.
Data access should be mapped early. An AI-focused GCC may need access to employee information, customer data, product telemetry, support records, training data and model-evaluation data. Companies should decide which entity is making decisions about processing, what data the India team can access, how long data will be retained, how incidents will be escalated, and what controls are needed for customer, regulated or sensitive data.
Cross-border access by the U.S. parent to data, models, outputs, analytics and documentation generated in India should be consistent with Indian law, U.S. legal obligations, customer commitments, sector-specific requirements and the company's own security policies.
Build Practical Governance for AI, People and Vendors
AI governance should be practical and tied to the work the center is actually doing. India's current approach is principle-based rather than statute-driven, but AI development will still be shaped by privacy, cybersecurity, IP, consumer protection, employment, contract and sector-specific rules. A company using an India GCC for AI work should have a framework for data provenance, model testing, human oversight, security, explainability where relevant, bias review where appropriate, output monitoring and incident escalation. For agentic AI, the framework should also address what systems are permitted to do autonomously, when human approval is required, and how activity is logged and reviewed.
The people and vendor ecosystem also warrants attention. AI talent is mobile, and many centers rely on a mix of employees, contractors, staffing firms, consultants and local vendors. Employment agreements, confidentiality obligations, invention assignments, conflict of interest rules, security policies, anti-harassment compliance and termination processes all affect how cleanly the center can scale. Vendor contracts for recruiting, payroll, infrastructure, IT support, real estate and managed services can also create gaps if ownership, confidentiality, data protection and transition rights are not properly aligned.
India can offer a significant opportunity for U.S. companies seeking to build durable AI and technology capability. But the value of that opportunity depends on whether the operating model, legal structure and governance framework support the way the business expects to use the center over time.
Getting Started
Questions Worth Asking at the Outset
The case for an AI-focused GCC is ultimately a question of ambition and capacity. Before turning to logistics, it is worth aligning the leadership team around a smaller set of strategic questions.
-
How central will AI be to your competitive position over the next three years, and is your current operating model resourced to deliver on that ambition?
-
Where are you most constrained today: specialized AI and engineering talent, speed to capability, cost, or the ability to retain institutional knowledge?
-
Which AI, data and engineering capabilities would you rather own as durable in-house assets than continue to rent from vendors and contractors?
-
If a dedicated team could be built and integrated into the business, what would you have it build first?
-
Who in your organization would own this center's integration with the business — not just receive its output, but be accountable for its strategic direction — and do they have the bandwidth to make it succeed alongside existing commitments?
The answers should clarify whether the company needs temporary support or a durable AI and technology capability it should own, control and integrate into the business. If it is the latter, an AI-focused India GCC should be designed around that business purpose from the start — including the operating model, legal structure, data strategy and governance framework.
* Sonia Baldia is a partner in the Washington, D.C. office of Kilpatrick Townsend & Stockton LLP and is a dually qualified lawyer in the United States and India. She advises companies on technology transactions, outsourcing, AI, data, IP licensing and cross-border commercial matters, including India-based Global Capability Centers. She can be reached at sbaldia@KTSLaw.com.
** Vishal Vijay is the Chief Executive Officer of GCCBase (GCC Base Solutions Pvt Ltd), a Bangalore-based firm that helps U.S. and U.K. companies establish and operate Global Capability Centers in India, including AI-focused centers of excellence, working end to end from entity formation, real estate and hiring through to operating the center. He can be reached at vishal@gccbase.com.
[1] Zinnov-NASSCOM India GCC Landscape Report 2026. https://zinnov.com/centers-of-excellence/zinnov-nasscom-india-gcc-landscape-2026-report/
[2] EY Global Capability Center (GCC) Pulse Survey 2025, November 2025. https://www.ey.com/content/dam/ey-unified-site/ey-com/en-in/insights/consullting/global-capability-centers/documents/ey-global-capability-center-gcc-pulse-survey-november-2025.pdf
[3]Press Information Bureau / MeitY, India AI Governance Guidelines, February 2026. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2228315®=3&lang=2
[4] Government of India, MeitY, Digital Personal Data Protection Rules 2025. https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa
