India's Missing Threshold: What a Pre-Release AI Check Really Costs

The document, as it reached me, had no number. No agency. No date. That is the first thing an auditor notices — before the content, before the argument. In a smart contract audit, the header tells you what you are holding: which commit hash, which deployer, which chain. Strip those fields and you are not reading a contract. You are reading a summary of a contract that someone else claims to have read. India is reported to be weighing pre-release safety checks for frontier AI models. The substance of that report is one sentence. The other five claims — higher costs, delayed launches, weakened competitiveness — are template filler, the kind of generic impact language that gets pasted onto any regulation story because it is never wrong and never specific. I have spent sixteen years reading systems that were described more confidently than they were built. The tone never changes. So let me do what I do with a project that arrives without a header: mark the missing fields, then trace what the structure would have to be. Context first, because this did not appear in a vacuum. India's last serious attempt at AI platform governance arrived in March 2024, when MeitY issued an advisory requiring platforms to label AI-generated content and to avoid deploying models that had not been "adequately tested." The backlash was immediate and global. Within a week, the ministry revised the language and walked back the most aggressive clause. That episode is the most reliable data point in this entire story, and it is absent from the source material. A regulator that retreats inside seven days has demonstrated something measurable: its policy resilience is low. Whatever is "being weighed" today inherits that precedent. The global backdrop is divergent. The EU's AI Act enforces systemic-risk duties on general-purpose models above a training compute threshold of 10^25 FLOPs. US executive order 14110, which set a reporting obligation at 10^26 FLOPs, was rescinded in January 2025. China runs a filing-and-review regime with a content-safety apparatus bolted on. India now sits in the gap — and it hosts the 2026 AI Impact Summit, which means the next eighteen months are a window in which governance signals get released for agenda-setting rather than for enforcement. For anyone who has watched crypto regulators run this play, the choreography is familiar. Announcement, consultation, walk-back, sandbox. The pattern is not a bug. It is the mechanism. Now the core. Four structural problems, and each has a mirror in my own audit history. First: there is no reliable pre-release verification for a frontier model. This is not a policy gap; it is a technical one. The dangerous-capability evaluations that exist — CBRN uplift, cyberoffense, autonomous replication — lean on human red-teaming and a small set of benchmarks, and those benchmarks suffer contamination. Capability emerges after scale, which means the most important behaviors cannot be exhaustively enumerated before deployment. A "pre-release safety check," if it lands, is therefore not a safety proof. It is document review, red-team report review, and selective evaluation. Its cost structure is human and procedural, not cryptographic. The code does not lie, but it often omits — and so do evaluation reports. Second: the coverage of any such rule is decided by one number, and that number is missing. Whether India means 10^25, 10^26, or some local figure determines who is regulated. No threshold, no coverage. In audit terms, this is a contract with an undefined variable in the access-control modifier; you cannot tell who is permitted into the function. India's own frontier ecosystem — Sarvam, Krutrim, the AI4Bharat Indus line — sits below any plausible frontier threshold. The entities most likely to be caught are the foreign providers serving Indian users through APIs. That is not an accident. It is a low-cost, high-sovereignty target. Third: open weights break the enforcement model. Pre-release review is executable against a closed API. You can refuse a launch. You can order a takedown. It is not executable against downloaded weights. If India's rule fails to distinguish open from closed, it produces an asymmetry — domestic closed vendors are constrained, foreign open models are not recallable. This is the derivative-free version of trying to revoke a deployed contract. You can deprecate the interface; you cannot reach the bytecode on someone's hard drive. Fourth, and this is where the incentives clarify: pre-release licensing changes who enters the market, not when. The article frames the harm as "delayed launches." That undersells the instrument. Mandatory pre-approval is the heaviest regulatory form — heavier than disclosure, heavier than registration, heavier than ex-post liability. Its fixed compliance cost, covering legal, evaluation, documentation, and response to inquiries, is amortizable for incumbents and potentially fatal for seed-stage teams. The net effect is concentration. When I audited the Ronin bridge architecture in 2021, I found validator thresholds that looked defensible on paper and failed catastrophically in practice. The lesson was not that checks are worthless. It was that checks designed by the checked tend to be shallow. A certification regime with no independent evaluation market becomes regulatory capture in a single cycle. That is the teardown. But the bulls are not simply wrong, and pretending otherwise would be its own omission. The strongest argument for a precondition is not safety. It is standardization. Right now, AI providers ship with whatever safety posture suits their roadmap, and users have no comparable signal. A shared benchmark, even an imperfect one, creates a floor. Crypto learned this the hard way. Before the ERC standards, every bridge and token was a bespoke attack surface. The standard did not make systems safe, but it made them legible, and legibility is the prerequisite for accountability. Security is the absence of assumptions — and the Indian market today assumes every foreign model is benign because it cannot verify otherwise. A well-formed review framework, with public criteria, an appeals path, and judicial review, would at minimum force disclosure. The second bull point: regulatory clarity, not regulatory strictness, moves capital. Uncertainty is the tax. If a rule eventually lands and is legible, it removes a discount that currently sits on every India-facing deployment decision. The "clarity is bullish" thesis is unfashionable, but it survives contact with data. Capital avoids ambiguity more reliably than it avoids rules. What the bulls miss is that a floor and a gate are not the same instrument. A benchmark everyone publishes is a floor. A license some cannot obtain is a gate. India's history suggests it prefers friction to prohibition — its posture toward crypto was high tax and strict KYC, not a ban — which points toward a high-friction filing regime with rare actual denials. Formally strict, functionally navigable. That is the base case, and it is not the disaster the headlines imply. So here is what to watch, and it is one field. If a future consultation paper names a compute threshold — any number — the policy is real and moving. If it names a reviewing authority, a statutory timeline with a deemed-approval clause, an open-weight exemption, and mutual recognition for EU or US compliance reports, then India is building infrastructure. If it names none of these, you are reading agenda-setting, and the correct response is to change nothing. Zero trust is not a policy; it is a geometry. And a geometry you cannot draw — no threshold, no authority, no date — is not a system. It is a sketch. Compiling the truth from fragmented logs is the whole job. Right now the logs are empty.