The ground rules in detail

How the government buys: cost-plus price, published spec, speed first

The government stops asking for the lowest bid. It pays a published cost-plus price, starts work fast, and makes abuse of that trust very expensive, so firms compete on quality, speed and coverage.

Every chapter in this book that buys, builds or rolls out anything follows the rules in this section.

The rules

1. No lowest-bid (L1) tenders. For every product, service or rollout, the government publishes the spec and a fixed price per unit or per verified outcome. Any certified vendor who meets the spec can supply at that price. There is no bidding and no price discovery, so there is nothing to rig. Vendors compete on quality, speed and coverage, not by cutting corners.

2. Cost-plus price, no price discovery. Most of what the state buys has a clear, known cost structure: roads, pipes, power lines, devices, buildings, standard services. For all of these there is no auction and no bid to "discover" the price. The price is simply the audited cost plus a fixed margin. Three independent private cost consultancies (quantity surveyors and engineering cost firms, certified to an open spec) each price every item from a published cost model: materials, labour, equipment and logistics, plus a 15% margin. The published price is the median of the three.

   • The firms are paid a flat fee and rotated every year.
   • A firm may not advise any contractor or supplier while it prices for the government, or for 3 years after.
   • A firm loses certification if its price misses the audited actual cost by more than 10% at two reviews running.
   • Prices are reviewed every 6 months against audited cost data from completed work and against global benchmarks.

3. A national rate card for infrastructure. One price per unit of finished work for the whole country: per lane-km of road built to spec, per km of water pipe by diameter, per household tap or sewer connection, per km of power line by voltage, per km of drain, per toilet block. Tunnels and long-span bridges are separate lines on the same card. Only three formula adjustments are allowed, and none is negotiated:

   • terrain: plains 0%; hills, desert, flood plain or island up to +10%;
   • a state labour and material index: ±5%;
   • monthly indexation for steel, cement, bitumen and diesel.

The draft card is published within 30 days, starting from the schedules of rates already used by the Central Public Works Department (CPWD), the Ministry of Road Transport and Highways (MoRTH) and the Jal Jeevan Mission.

4. Targets, bond, build, inspect, pay. The government publishes its targets (every road, pipeline, connection and drain still needed, by district) cut into work packages at the rate-card price.

   • Any certified contractor can take a package by posting a performance bond upfront: 10% of the package value, or 20% for packages of ₹100 crore or more. The bond can be cash, a fixed deposit, a bank guarantee or an insurance surety bond, which insurers have been allowed to sell since 2022.
   • There is no bid and no negotiation.
   • Payment comes only after independent inspection by a certified inspector assigned at random: per inspected milestone on large packages, on completion on small ones. The government pays within 30 days of a passed test.
   • The work carries the 10-year defect warranty in Chapter 20.
   • A contractor can hold only as many packages as its bonds and audited track record cover.
   • Every district's targets are cut into packages of several sizes, including packages under ₹1 crore, so small firms can take part.

5. Price finds its level without bidding. A package left unclaimed for 30 days gets +5%, and +10% at most. Where every package in a district is claimed in the first 24-hour window, that district's price falls 5% at the next review.

6. Who gets the work. Packages open at a time announced 7 days ahead on the public portal. Every claim is time-stamped on a public log. All claims made in the first 24 hours count as simultaneous, and where two or more firms want the same package it is allocated by a public lottery drawn live. Where an Indian and a foreign certified product claim the same package in that window, the Indian one wins the tie before any lottery (Chapter 25). After that, packages go first come, first served among certified vendors, within district quotas. Each quarter, work shifts toward the vendors with the best audited quality scores.

7. Open to startups and firms of any size. Certification has no turnover or years-in-business threshold. It needs only the spec test and the bond. The first certified product in a new field gets a guaranteed first order (as in Chapter 17).

8. Speed over the last rupee. Time lost costs the country far more in growth than any saving on price can recover, so every rule is built for speed.

   • A price is published within 15 days of a need being set. If the three consultancies are not ready in time, the provisional price is the existing CPWD, MoRTH or Jal Jeevan schedule rate plus 15%, trued up at the next review. No work waits for a better price.
   • Finishing early earns a bonus of 1% of the package for each month early, up to 5%. Finishing late costs 1% for each week late, up to 10%, after which the package is re-offered and the bond is forfeited.
   • Approvals that block a package (land, utility shifting, forest or traffic permissions) carry the deemed-approval clock in Chapter 7: 30 days, after which the work proceeds.

9. Abuse of trust is expensive. Cost-plus works only if cheating costs more than it pays.

   • An inflated cost claim, a fake invoice or collusion: the bond is forfeited, the firm repays 10 times the overcharge, and the firm and its directors are barred from all government work for 5 years, with prosecution for cheating under the Bharatiya Nyaya Sanhita.
   • Sub-standard work that fails inspection twice, or a defect found within the 10-year warranty that the firm does not fix within 30 days: the bond is forfeited and the repair is charged to the firm.
   • A cost consultancy that colludes with a supplier loses certification for life and repays 10 times its fees.
   • An official who approves a false claim faces the same prosecution and loses their post (Chapter 13).

10. Auctions only when the government sells. Auctions are never used for building, buying or services. Land, mineral blocks, spectrum and company stakes are still sold by open e-auction to the highest bidder, because selling a scarce public asset at a fixed price is how the 2G spectrum and coal block losses happened.

Legal route

• The central rules sit in the General Financial Rules, 2017, which the Ministry of Finance can amend by order. That amendment is issued within 30 days.
• Central public sector companies follow through guidelines from the Department of Public Enterprises.
• States adopt the same rules through a model procurement rule tied to central grants. States that have their own procurement Acts amend them within 1 year.
• The Supreme Court has held that auction is not the only lawful way to allocate public resources (Natural Resources Allocation reference, 2012). A fixed, published price open to every certified firm meets the Article 14 test of fairness and non-arbitrariness.

Timeline

First 30 days: amend the General Financial Rules to make cost-plus pricing, the speed bonus and the abuse penalties the default; publish the draft national rate card; certify the first panel of three cost consultancies; open the public claims portal and the live price and quality dashboard.

Within 1 year: every central purchase and work package runs on published prices; the full rate card is in force after the first 6-monthly review; all states have adopted the model rule.

Guardrails

• Every price, its cost model, every claim time-stamp and every vendor's volume and quality score are published live.
• If the market price falls more than 10% below the published price, the price is cut at the next 6-monthly review.
• If no vendor signs up within 30 days, the cost panel reviews the price within 15 days.
• A failed inspection means no payment for that milestone; a second failure on the same package forfeits the bond, and a vendor that fails a certification audit is de-certified within 7 days.
• A cost consultancy that misses audited cost by more than 10% at two reviews running loses certification.

Where it already works

• Fixed prices, any qualified provider, England. Since 2002, NHS hospitals in England have been paid fixed national prices per treatment, set from average costs, under "Payment by Results". Providers compete on quality and patient choice, not on price (King's Fund).
• Fixed package rates, India. Ayushman Bharat PM-JAY pays every empanelled hospital the same published package rate for each listed procedure (National Health Authority, HBP 2.2 manual).
• Pay per verified outcome, India. Aadhaar paid registrars a fixed amount per Aadhaar generated, ₹50 today for registrars outside the in-house model, rather than tendering each enrolment (UIDAI order, 2025).
• Auction when selling, India. After the Supreme Court cancelled 122 spectrum licences in 2012 and 214 coal block allocations in 2014, both were re-allocated by open auction (Down To Earth).

Concerns, and how the rule answers them

• Concern: Without bidding the state may pay a little more. Answer: for items with a clear cost structure, bidding adds months and invites rigging, while saving little. Cost-plus with audited costs, a fixed margin and 10x penalties for abuse gets the work done sooner, and the time saved is worth far more in growth than the last rupee of price.

• Concern: First come, first served can be gamed by insiders, as in the 2G allocation. Answer: claims open at a time announced 7 days ahead, every claim is time-stamped publicly, and any contested package in the first 24 hours goes by a live public lottery.

• Concern: A fixed price set too high hands contractors a windfall. Answer: prices are the median of three independent firms, reviewed every 6 months against audited actual cost, and fall automatically when packages sell out in a day or the market price is more than 10% lower.

• Concern: A 10% to 20% bond upfront shuts out small firms and startups. Answer: the bond can be an insurance surety bond or bank guarantee rather than cash, and package sizes are cut so small firms can take small packages.

• Concern: Without competitive bidding, quality may slip. Answer: no payment without an independent inspection, a 10-year defect warranty, bond forfeiture on repeated failure, and work shifting each quarter to the best quality scores.

• Concern: The cost consultancies could be captured by contractors. Answer: three firms with the median taken, yearly rotation, a 3-year ban on advising contractors, and loss of certification for repeated misses against audited cost.

Sources: King's Fund: Payment by Results · NHA: HBP 2.2 manual · UIDAI: revised rates of assistance · Down To Earth: 214 coal blocks cancelled · Assam Tribune: SC cancels 122 spectrum licences · Bar and Bench: auction not a constitutional mandate · SCC Online: IRDAI surety insurance guidelines, 2022

No licence raj: register, don't ask permission

Anyone can start any activity the same day by registering online; only a short list of truly dangerous activities still needs a licence, and the owner carries full responsibility for harm.

Indian businesses today face 69,233 separate compliance requirements, and 26,134 of them carry a possible prison term (ORF and TeamLease, 2022). This section replaces permission with registration and responsibility.

The rules

1. The default is no licence, no permit and no NOC for any activity. A citizen or business registers online on the one Business ID (Chapter 7) in minutes and starts the same day. Rules are published as specs (safety, fire, food, building code). Compliance is self-certified and checked by random faceless audits (5% a year, Chapter 13) and on complaint. A breach means a fine. A danger to life means immediate closure until it is fixed.

2. The critical list. Only these still need a licence, because a mistake can kill people or lose public assets. Each application is decided within 90 days at most, with written reasons, and none is ever auto-approved. Some chapters set a shorter clock (30 days for a bank licence or for entry to a sovereign sector), and a brand-new reactor design, certified once for every later unit, gets 180 days (Chapter 19):

   1. Nuclear materials and reactors (radiation).
   2. Explosives, arms and ammunition (public safety).
   3. Medicines, vaccines, medical devices and narcotics (patient safety).
   4. Hazardous chemicals above set quantities, and the most polluting "Red category" industries (accident risk, as at Bhopal in 1984).
   5. Mining and other scarce public resources, such as mineral blocks and spectrum (sold by auction).
   6. Banking, insurance and payments that hold the public's money (protects savers).
   7. Running aircraft, ships and trains (passenger safety).
   8. Professionals whose sign-off protects life: doctors, pilots, and the structural and fire engineers who certify buildings. The person is licensed once by exam; each job needs no permit.
   9. Driving licences and vehicle fitness.
   10. Classified defence production (Chapter 17).
   11. Operating in a Sovereignty first sector, Tier 1 or Tier 2 (a security check of the directors and the spec test).

3. Everything else needs no licence. That includes shops, restaurants and street food (food-safety registration only), trade licences, non-hazardous factories, warehouses, food processing and cold chains, pollution consent for the less polluting industry categories, and labour registrations.

   • Ordinary buildings are certified by a licensed engineer and then randomly audited.
   • Buildings over 15 m, and venues where more than 100 people gather (cinemas, malls, hospitals, schools, gaming zones), are certified by a licensed structural and fire engineer assigned at random through the faceless system (Chapter 13), never the owner's choice, and 20% of them are audited every year.

4. When self-certification fails. Freedom comes with full responsibility.

   • The owner pays, always. The business and its directors are strictly liable for any harm their premises, product or building causes, whether or not they meant it. For hazardous work, the Supreme Court's absolute-liability rule applies (M.C. Mehta v. Union of India, 1987).
   • Insurance first. Every business that serves or employs the public carries third-party liability insurance from a published table by risk class: for example ₹10 lakh for a small shop, and ₹1 crore for a factory, a restaurant or a building over 15 m. Proof of cover is part of registration. The insurer pays victims within 30 days and recovers the money from the owner. Insurers price risk, so unsafe operators pay more: a second check alongside the state's audits. If no insurer quotes within 7 days, the business buys cover from a pool run by the public-sector insurers at the table rate plus a published loading.
   • Victims are paid fast. Claims are decided within 90 days by the commercial courts (Chapter 6). Where insurance falls short, the owner's assets are attached within 30 days.
   • Losing the right to self-certify. One proven false certificate: the business loses self-certification for 3 years but keeps trading. For those 3 years every certificate it needs comes from a certified third-party inspector, assigned at random through the faceless system, paid by the business at the published price per inspection, and never the same inspector two years running. The inspector is liable for what it signs. The business also faces 100% audits for 2 years. It stops trading only:
   • if an inspection finds a danger to life, until it is fixed and re-inspected within 7 days;
   • if it has no valid third-party certificate within 30 days of losing self-certification; or
   • if the false certificate caused a death, until the inspection clears it.

   A second false certificate, or any death caused by one, bars its directors from self-certifying any business for life.

   • Fines and jail. A false certificate is fined at 10 times the cost of the compliance it skipped. If it causes death or serious injury, the directors face criminal prosecution, tried within 90 days.
   • The certifying professional. An engineer, auditor or doctor who signs a false certificate is suspended at once, loses the licence for life on a second offence or any death, and carries professional indemnity insurance (the Chapter 20 builder rule).
   • Audits tighten automatically. If more than 2% of audits in a sector find false certificates in a quarter, that sector's random audit rate rises from 5% to 20% until it falls back below 2%. Every finding is published on the business's public ID profile.

Legal route

• Central rules and orders. Licences created by central rules, notifications or executive orders end by government order from day 31.
• Central Acts. Licences written into central Acts end through the Great Repeal Act (Chapter 8), introduced in the first session of Parliament and passed within 1 year. Where Parliament is not sitting, an ordinance under Article 123 can bridge the gap. Pollution consent is already easier: the Water (Prevention and Control of Pollution) Amendment Act, 2024 lets the Centre exempt categories of industry from consent by notification; the Air Act gets the same power through the Great Repeal Act.
• States. Trade licences, shop registration and most municipal permits are state subjects. States adopt the same rule through a model act tied to central grants.

Timeline

First 30 days: every ministry and state publishes every licence, permit and NOC it issues; the critical list and the insurance table are published; licences under central rules and orders end from day 31; the Great Repeal Act is introduced; the Business ID registers new activities the same day.

Within 1 year: the Great Repeal Act is passed; every state has adopted the model act; the random-audit system covers every sector; the insurance pool is live.

Guardrails

• Adding anything to the critical list needs an Act of Parliament with a published risk case. The list is reviewed every year.
• Any official who demands a permit not on the list pays a ₹1 lakh fine personally and faces a misconduct inquiry completed within 30 days; this penalty is written into the Great Repeal Act, and until then is applied under the conduct rules.
• Every licence decision on the critical list is made within 90 days (180 days for a new reactor design) with written reasons, and the time taken is published for every application.
• A sector whose false-certificate rate passes 2% in a quarter moves to 20% audits automatically.

Where it already works

• Georgia cut the number of activities needing a licence or permit from 909 to 159 under its 2005 Law on Licensing and Permits (World Bank, Doing Business case study).
• Rajasthan lets new micro, small and medium enterprises start on an online registration, with no approvals and no inspections for their first 3 years, under its 2019 MSME facilitation law (YourStory).
• India's Parliament decriminalised 183 provisions across 42 central Acts through the Jan Vishwas (Amendment of Provisions) Act, 2023 (PIB).
• Compulsory liability insurance for hazardous work has been the law in India since the Public Liability Insurance Act, 1991 (iPleaders overview).

Concerns, and how the rule answers them

• Concern: Without a licence, unsafe operators will open and people will be hurt. Answer: anything that can kill at scale stays on the critical list; everyone else carries mandatory insurance, strict liability, random audits and immediate closure for any danger to life.
• Concern: Fire deaths in crowded venues come from exactly this kind of self-certification. Answer: tall buildings and venues for more than 100 people are certified by a randomly assigned, licensed and insured fire and structural engineer, with 20% audited every year.
• Concern: A central order cannot cancel licences that Acts of Parliament or state laws require. Answer: the order covers only licences under central rules and orders; Acts change through the Great Repeal Act within 1 year, and states through a model act tied to grants.
• Concern: Small businesses may not find insurance at a fair price. Answer: a published table sets the cover, and a public-sector pool offers it at a published rate when no private insurer quotes within 7 days.
• Concern: Officials will keep demanding unofficial permits. Answer: a personal ₹1 lakh fine and a 30-day misconduct inquiry for any official who asks for a permit not on the list.

Limits to know

Licences that come from state laws can be ended only by the states themselves. The Centre's lever is the model act tied to central grants, and the full rule applies in each state from the day it adopts that act.

Sources: ORF and TeamLease: Jailed for Doing Business (2022) · World Bank: Licensing activities in Georgia · YourStory: Rajasthan MSMEs need no approvals for 3 years · PIB: Jan Vishwas Act, 2023 · PRS: Water (Prevention and Control of Pollution) Amendment Bill, 2024 · ESCR-Net: M.C. Mehta v. Union of India (1987) · iPleaders: Public Liability Insurance Act, 1991

Sovereignty first: no foreign control of critical sectors

India's security and mission-critical systems are owned, run and keyed by Indians, while foreign firms stay welcome as suppliers, licensors and minority investors.

No foreign power, and no company a foreign state controls, may own, run or reach into India's national security and mission-critical systems. Every other sector stays open under the ownership rules in Chapter 10.

The rules

1. Tier 1: 100% Indian ownership and control (no foreign shareholder at all):

   • classified defence production (Chapter 17);
   • intelligence;
   • nuclear fuel and reactor operation;
   • space launch and satellite navigation;
   • power-grid control centres;
   • national payment rails (UPI and the RBI's payment systems);
   • data centres that hold government data and the digital public infrastructure (Aadhaar, the privacy ledger);
   • air traffic control.

2. Tier 2: Indian majority and control: telecom core networks and undersea cable landing stations, ports, airports, critical minerals and strategic oil reserves.

   • At least 74% Indian ownership, so foreign investors from non-state sources can hold up to 26%.
   • An Indian majority on the board, and a resident Indian chief executive and chief security officer.
   • No shareholding at any level by an entity owned or directed by a foreign government, military or ruling party.

3. Data and keys stay in India. All data in these sectors is stored and processed in India. Encryption keys are held by Indian entities on hardware in India. There is no remote access, update or kill switch from abroad: every software update is delivered as signed code, tested in an Indian lab before it is installed. Source code and firmware are held in escrow with the National Cyber Security Coordinator, opened only on the order of a court or the National Security Council Secretariat.

4. Trusted equipment, one neutral test. Every device and piece of software in these sectors is certified by an Indian lab against an open security spec. The test has two parts, applied to every country alike:

   • Technical: the product gives its maker no path to Indian data, keys or control.
   • Legal: a vendor fails if a law it is subject to can force it to hand over data or cooperate with a foreign intelligence service without an independent court check.

5. Foreign technology, Indian control. Foreign firms can still sell, license and transfer technology (reactors, jet engines, chips), but only as suppliers and licensors to Indian-controlled operators, with manufacturing in India and source-code access. Allied engineers can work on these systems under Indian management.

6. No outside consent. No treaty or trade deal may bind these sectors. India invokes the WTO national-security exceptions (GATT Article XXI and GATS Article XIV bis) where they apply, and lists these sectors as reserved in every trade agreement.

7. Open to Indian startups. Any Indian-owned company, startup or established firm can enter every sovereign sector. Operating in one is on the critical list (No licence raj): a security check of the directors and the spec test, decided within 30 days.

8. Existing holders are bought out fairly.

   • Foreign shareholders in Tier 1 entities sell to Indian buyers at an independent fair valuation within 1 year. For example, the company that runs UPI counts foreign banks and a foreign-owned payment app among its shareholders.
   • In Tier 2, the board, chief executive and security officer rules apply within 1 year, and foreign voting rights are capped at 26% from the same date.
   • Holdings linked to a foreign state are sold at independent fair value within 1 year. Holdings by non-state foreign investors above 26% are sold down by the end of year 3.
   • The buyer-of-last-resort window in Chapter 16, run by NIIF, buys at the independent valuation, so no holder is forced to sell into an empty market.

Timeline

First 30 days: publish the Tier 1 and Tier 2 lists, the open security spec and the ownership rules; all new government workloads go only to Indian-controlled data centres; every Tier 1 and Tier 2 entity files its full ownership chain.

Within 1 year: existing government data is moved to Indian-controlled data centres; Tier 1 foreign shareholders and all foreign-state-linked holdings are bought out; every Tier 2 entity meets the board, management and voting rules; every device in these sectors is certified; India files its reserved-sector lists in its trade agreements.

Outcomes after year 1: non-state foreign holdings above 26% in Tier 2 are sold down by the end of year 3.

Guardrails

• Beneficial ownership is traced to the last individual every quarter through the Business ID and PAN records. Any ownership change over 1% is reported within 7 days.
• A hidden foreign-state link means a forced sale within 90 days, suspension until it closes, and prosecution of the directors.
• The tier lists change only by Act of Parliament, after a review by the National Security Council Secretariat and a Parliamentary committee, so incumbents cannot use them to shut out new entrants.
• A certified device that fails a field audit is de-certified within 7 days and removed from service within 90 days.

Where it already works

• Trusted telecom sources, India. Since 2021, India's National Security Directive on the telecom sector has required operators to buy equipment only from trusted sources and trusted products, approved through the Trusted Telecom Portal (Department of Telecommunications).
• Payment data in India. The RBI has required payment system data to be stored only in India since 2018 (RBI notification).
• Hardware-level device security, India. UIDAI phased out software-only (L0) fingerprint devices in favour of devices that secure data in their own hardware (L1) (UIDAI, 2024).
• Foreign-ownership caps, United States. US law limits foreign ownership of broadcast and common-carrier radio licences, generally to 20% directly and 25% through a holding company unless the regulator agrees otherwise (47 U.S.C. § 310).

Concerns, and how the rule answers them

• Concern: Shutting out foreign capital starves these sectors of money and technology. Answer: Tier 2 still allows up to 26% non-state foreign investment; technology comes through licensing and transfer agreements; capital comes from Indian markets, the Chapter 16 domestic fund and long-term tariffs (Chapter 19).
• Concern: It breaks trade commitments and invites retaliation. Answer: WTO rules let every member protect its essential security interests, India lists these sectors as reserved in every agreement, and the United States already caps foreign ownership of its radio licences in the same way.
• Concern: It shuts out allies whose technology India needs. Answer: allies supply and license freely, and their engineers can work on these systems; only ownership, control, data and keys stay Indian.
• Concern: The neutral legal test could exclude almost every foreign vendor. Answer: because data, keys and updates stay under Indian control, most products pass the technical test by design, and the legal test fails only vendors whose home law compels intelligence cooperation with no independent court check.
• Concern: Forcing existing investors out is expropriation and invites treaty claims. Answer: every exit is at an independent fair valuation, with the Chapter 16 NIIF window as buyer of last resort, and non-state investors get until the end of year 3 to sell down.
• Concern: Indian front companies will hide foreign-state owners. Answer: quarterly tracing to the last individual, funding-source checks, the 7-day change rule, and a forced sale plus prosecution for any hidden link.

Limits to know

The WTO security exception is not fully self-judging. In Russia: Traffic in Transit (2019), a WTO panel held that a member must invoke it in good faith and that panels can check whether the circumstances fit the exception. Where India already has WTO service commitments in a listed sector, it withdraws them through the GATS procedure for modifying schedules, which can mean offering trade concessions elsewhere; new agreements simply list these sectors as reserved from the start.

Sources: DoT: Trusted Telecom Portal · RBI: Storage of Payment System Data (2018) · UIDAI: phase-out of L0 devices · 47 U.S.C. § 310 · Business Standard: NPCI shareholding widened to 56 banks · WTO: DS512 Russia, Traffic in Transit · Inc42: Amazon Pay, PhonePe, Paytm become NPCI shareholders

How every rollout works: the Aadhaar playbook

Every nationwide rollout in this book copies the structure that gave India's people a digital ID in under a decade, and fixes its known weak spots.

Aadhaar had issued 119.22 crore IDs by 31 December 2017, covering 90.55% of the projected population. About 40,000 enrolment centres were running by April 2017. UIDAI's total spending from 2009-10 to July 2017 was ₹9,056 crore, of which ₹3,820 crore went on enrolment: about ₹78 per ID in all and about ₹33 per ID for enrolment (estimate: ₹9,055.73 crore and ₹3,819.97 crore ÷ 116.09 crore IDs issued by July 2017).

Every nationwide rollout in this blueprint (land scanning, phones, KYC credentials, AI terminals, chargers, sensors, food labs) follows this playbook, together with the pricing rules in How the government buys.

What we copy

• Three layers, many players. A small central authority sets the rules. Registrars (states, banks, post offices, private firms) run regions. Any number of certified agencies do the field work. No single vendor holds the country.
• Open specs and certified kit. The authority publishes the device and software spec plus an open API. Any device that passes the independent test lab (STQC, the government's Standardisation Testing and Quality Certification directorate, or an accredited private lab) can be used, so prices fall through competition.
• Certified people. Every operator passes an online exam before working, and their ID is stamped on every record they create.
• Pay only for outcomes. Agencies are paid per successful, verified result, as Aadhaar paid a fixed ₹40 to ₹50 per Aadhaar generated, with fixed deductions for each error.
• Competition inside. Multiple registrars, agencies and technology providers, with work shifting to whoever performs best.
• Agencies fund their own kit. Equipment is financed by the agency, with Mudra loans available, so government capital stays small.

How devices get approved

This copies Aadhaar's registered-device model.

• One published spec per device type, for example a scanner, camera, terminal, sensor, charger or phone. It covers accuracy, security, durability and the open API. The spec is versioned, and any change gets 90 days' notice.
• Independent testing. Devices are tested by STQC or an accredited private lab, paid for by the maker, against a fixed test plan. The pass or fail decision comes within 30 days.
• Security in hardware. Each device encrypts and signs data inside its own secure hardware, the standard Aadhaar calls Level 1 (L1); software-only devices are not accepted. Each unit carries a unique device ID registered with the authority, and a cloned or tampered device is rejected at the server.
• Public approved list. Every certified model and its maker are listed online. Buyers choose any listed model and pay the published price.
• Central de-registration. A model or single unit that fails field audits is de-registered by the Indian authority within 24 hours, and its maker loses certification for that model for 1 year. This switch sits only with the Indian authority (Sovereignty first).
• Made in India first. In-country certification labs are open to any maker. Imported core parts are allowed only where Chapter 17's 12-month list says so.

What we fix

• Rates that cover cost. Low early rates pushed some Aadhaar operators into payment disputes and some into charging citizens, which UIDAI punishes with a ₹50,000 penalty and suspension. Here the outcome rate is set from a published cost model (equipment, staff, travel, plus a 15% margin) and revised every 6 months.
• Pay in 30 days. Verified outcomes are paid within 30 days, or the agency earns 1.5% a month interest, charged to the budget of the department that paid late.
• Zero charge to citizens. Every rollout service is free to the citizen. An operator caught charging a citizen is de-certified for life after a 7-day show-cause hearing. Citizens report through a one-tap anonymous complaint, and an upheld complaint earns a reward of 10 times the bribe, recovered from the agency.
• Quality audit. 2% of every agency's output is re-checked at random. A failure rate above 1% means suspension for 30 days.
• Penalties apply to the centre's own vendors too. The central technology provider is held to published service levels with automatic penalties, which the national auditor found UIDAI had not enforced.
• Coverage first. A bonus of 25% per result in the 20% of districts with the lowest coverage, so agencies go where it is hardest.
• Privacy by design. Each rollout collects only the data its purpose needs and follows the Digital Personal Data Protection Act, 2023 and the privacy ledger in Chapter 4.

What we copy from India's best builders

India's large conglomerates deliver very large projects within budget and with control. Reliance built the Jamnagar refinery in 33 months (commissioned 1999, over USD 3.4 billion, about ₹25,000 crore at the time); Jio reached 100 million customers in 170 days; Tata Motors built the Sanand plant in 14 months from November 2008. Every rollout in this book adopts their execution habits:

• One owner, end to end. Each project has one named project director, from the private sector or government, answerable for scope, cost and date, with the authority to decide within the published budget.
• Budget and date locked at the start. The cost, the finish date and the 3 to 5 outcome targets are published before work starts. Any change above 5% of cost or 30 days of time needs the mission head's written approval, published within 7 days.
• Long-lead items first. Equipment with long delivery times is ordered in the first 30 days, from certified suppliers at published prices, so the critical path never waits on procurement.
• Standard designs, repeated. A design proven once is reused everywhere (one charger, one lab, one school block, one reactor family), so each new site is faster and cheaper than the last.
• Parallel, modular work. Sites, districts and packages run in parallel with many certified contractors, and modules are built off-site where possible.
• A daily control room. A live dashboard shows cost, progress and risk for every project against plan, read daily by the project director and weekly by the mission head. A project more than 10% behind on cost or time triggers a fix plan within 7 days.
• Lessons captured. Every finished project publishes its actual cost, time and lessons in the Practice Library (Chapter 14), so the next project starts from the best result so far.

Guardrails

• Each rollout publishes a live dashboard of results by district, agency and operator, with cost per result and complaint counts.
• A failure rate above 1% in the 2% re-check suspends the agency for 30 days.
• Late payment beyond 30 days carries 1.5% a month interest.
• A device that fails a field audit is de-registered within 24 hours.

Where it already works

• Aadhaar itself reached 119.22 crore people by the end of 2017 through registrars and certified agencies paid per result (UIDAI reply to Lok Sabha).
• Fixed penalties per error. UIDAI's enforcement policy sets fixed penalties per error, from ₹1,000 for a data error to ₹50,000 for overcharging a resident and ₹1 lakh per machine for bypassing biometrics, with operator suspensions of 1 to 5 years (UIDAI circular, 2022).
• Hardware-secured devices. UIDAI moved all fingerprint authentication devices from software-only (L0) to hardware-secured (L1) registered devices (UIDAI, 2024).

Concerns, and how the playbook answers them

• Concern: Low per-result rates push operators to cut corners or take bribes. Answer: rates come from a published cost model with a 15% margin, revised every 6 months, and payment is guaranteed within 30 days.
• Concern: Lifetime de-certification on one complaint is unfair. Answer: it follows only an upheld complaint after a 7-day show-cause hearing, and the reward is recovered from the agency, not the public purse.
• Concern: Cheap or cloned devices undermine the data. Answer: only hardware-secured devices are accepted, each with a registered ID, and a failed unit is de-registered within 24 hours.
• Concern: Agencies will skip remote and hard-to-reach districts. Answer: a 25% bonus per result in the lowest-coverage 20% of districts, published coverage dashboards, and quarterly shifts of work to the best performers.

Sources: UIDAI: Lok Sabha reply on Aadhaar coverage, 31 Dec 2017 · Business Standard: UIDAI spends ₹9,055 crore (2017) · Karana: Aadhaar enrolment costs · UIDAI: enforcement policy, 2022 · UIDAI: phase-out of L0 devices · CAG: UIDAI performance audit, 2021 · Business Standard: ₹50,000 penalty for overcharging · UIDAI: revised rates of assistance · ThePrint: Jamnagar refinery turns 25 · Reliance: Jio 100 million in 170 days · Tata Motors Sanand plant

Europe for quality of life, America for capitalism

For everything that touches our bodies and daily lives, India takes Europe's standard as its reference level. For the freedom to build, fund, fail and grow, it takes America's. India's own laws set the rule; the two benchmarks show everyone exactly where the bar sits.

The rules

1. Europe is the reference for quality of life. Chemicals, pesticides, food, air, noise, vehicles, buildings and road safety follow the European standard as the reference level.
2. America is the reference for capitalism. Starting, funding, listing, restructuring and closing a business, and the markets for land, capital and talent, follow the American practice as the reference level.
3. Each chapter names its benchmark. The benchmarks adopted so far:
   • Ch3, 7, 10 and 16 (banks, free to build, open to the world, backing builders): US capital markets, Delaware-style incorporation, US Chapter 11 restructuring and venture funding.
   • Ch9 (cities): EU noise limits.
   • Ch11 (farmland): the US farmland market, where owners lease freely to working farmers.
   • Ch14 (scorecards): district air scores counted against the Chapter 21 limits, which step up to EU levels.
   • Ch6 (justice): US Chapter 11 speed of insolvency resolution, with the business kept running.
   • Ch18 (sector cities): US research clusters such as Silicon Valley.
   • Ch19 (energy): the EU Euro 7 vehicle standard, including brake-dust limits and minimum battery life.
   • Ch20 (built right): the Eurocodes for structural design.
   • Ch21 (clean air): the EU Ambient Air Quality Directive 2030 limits.
   • Ch22 (mobility): the EU road-safety path, halving road deaths in a decade on the way to Vision Zero.
   • Ch24 (safe food): EU pesticide approvals, EFSA maximum residue limits and REACH for chemicals.
4. Phase in within 1 year where possible. Each benchmark is adopted within 1 year wherever the change is in India's own hands. Where it takes longer, such as building plants, labs or networks, the chapter publishes a dated path to close the gap.
5. Publish the gap every year. Every year, each ministry publishes, for each benchmark, where India stands, where the European or American level stands, and the date the remaining gap closes. The report sits on the Chapter 14 scorecard.

Guardrails

• Indian law stays sovereign. The benchmark is a reference level only. It is written into Indian law by Parliament or by Indian rules, and no foreign body, court or regulator gains any authority in India.
• Updates come by Indian decision. When Europe or America changes its standard, India reviews the change within 1 year and adopts it by its own decision, never automatically.
• No retrospective burden. A new benchmark applies to new products, approvals and contracts from a published date, with existing ones given a published phase-in path.
• The bar only rises. Where an Indian standard is already stricter than the benchmark, the Indian standard stays.

Sources: European Commission: air quality · European Commission: EU pesticides database · European Commission: EU legislation on MRLs · European Commission: REACH authorisation · European Parliament: Euro 7 deal · European Commission JRC: the EN Eurocodes · European Commission: halving road deaths by 2030 · US Courts: Chapter 11 bankruptcy basics · USDA ERS: TOTAL survey 2014 · Stanford: the Stanford Research Park story