On 13 October 2026, IBM and MeitY Startup Hub, an initiative of India's IT ministry, signed an MoU to support deep-tech startups. Deccan Chronicle's report says startups will get technical help on IBM watsonx, IBM Bob and IBM Sovereign Core, plus mentorship, enterprise proofs of concept and skilling, with a stated priority on founders from Tier 2 and Tier 3 cities. At IBM Think 2026, IBM also announced 'Bharat Core', an AI stack optimised for India that runs on top of Sovereign Core. IBM India and South Asia managing director Sandip Patel framed the goal as 'Digital Swaraj': control over data, technology assets and AI execution, which goes beyond storing data locally to retaining operational control.
The MoU matters less for the money, which no coverage we found quantifies, than for the definition of sovereignty it assumes.
The strongest case for the sovereignty push
The argument for treating sovereignty as a policy goal is serious. A country whose hospitals, banks and ministries run AI workloads on infrastructure governed by another jurisdiction's laws has a real dependency. Where data sits is a thin guarantee if the people who administer the stack, patch it, and decide who gets access are elsewhere. EFF's September 2026 analysis notes that governments across the global majority use the term to argue for greater control over data and communications infrastructure and to boost their economies. It also says companies now market 'sovereign cloud' products to reassure customers that their information stays under local jurisdiction. Seen that way, a vendor pitch about operational control answers a genuine procurement worry.
What the 'Digital Swaraj' framing gets right
IBM's framing is more useful than the data-localisation debates of the past decade. Localisation mandates ask where bytes are stored. The operational-control idea asks who can run, audit, update and switch off the system. That is closer to what a regulator, a bank or a startup needs to know. It is also a market-based answer: it lets Indian buyers choose among vendors and architectures instead of pushing them into a single state-designated platform.
India's data-protection law already points the same way. The Digital Personal Data Protection Act, 2023 takes a negative-list approach to cross-border transfers: PRS Legislative Research notes that data may move abroad except to countries the central government restricts by notification. The government can restrict specific destinations, but the Act sets no blanket localisation rule. We did not find any restricted-country notification in the sources we reviewed, though readers should check the Gazette for the latest position.
The compliance runway is also long. According to the Press Information Bureau backgrounder, the DPDP Rules were notified on 14 November 2025 after 6,915 consultation inputs, with an eighteen-month phase-in. A Delhi government office memorandum dated 3 July 2026 sets out the schedule: Rule 4 takes effect on 14 November 2026, and Rules 3, 5 to 16, 22 and 23 on 14 May 2027. The core obligations on notice, consent, safeguards, breach reporting and Data Processors therefore bite roughly seven months from now. Buyers will be asking vendors what 'sovereign' means in contract terms before then, and a pitch that stresses control over data and AI execution lands at that moment.
Where the risks sit
The sovereignty label is flexible, and flexibility cuts both ways. EFF warns that states can pursue sovereignty to fragment or cut off access to the internet, citing Iran and Russia, and that there is 'no point' in replacing the influence of a few mostly US-based tech companies with equally dominant firms elsewhere. That second warning applies to this MoU. A startup that builds on Bharat Core, which runs on IBM Sovereign Core, gains local relevance and a government-linked channel, but it also takes on a dependency on one vendor's stack. Sovereignty that means 'control for the buyer' is a good outcome. Sovereignty that means 'control passes from one vendor to another' is not.
The announcement is also thin on detail. StartupFeed's coverage, as summarised in our search, notes that the agreement names no cohort size, funding, start date or selection process. The coverage we reviewed gave no pricing or availability for Bharat Core. Until those details appear, the MoU is an intent to cooperate, not a programme with measurable outcomes.
What proportionate policy looks like
Three principles follow, and each is consistent with India's current regulatory direction.
- Define sovereignty by outcomes, not by vendor nationality or data location. Ask who controls operations, keys, updates and exit. Contracts and standards can verify that, and a localisation mandate cannot.
- Keep the negative-list model for transfers. Section 16 lets the government restrict particular destinations when it has a specific reason. It should not be stretched into a general preference for domestic infrastructure that raises costs for startups.
- Protect portability and open standards in government-linked programmes. If MeitY Startup Hub steers founders toward any single stack, including a foreign vendor's 'India-optimised' one, it should require open-source components, data portability and multi-vendor options. EFF's recommendation of free and open-source tools, interoperable standards and easy user exit is a workable test.
One caution about the evidence. Digital sovereignty is easy to claim and hard to measure, and no independent data yet shows that 'sovereign stacks' deliver better security or lower costs than well-governed conventional cloud. Policy should require that evidence before offering preferences to any vendor.
The IBM-MeitY MoU is a reasonable, low-commitment bet that startups benefit from enterprise access and sovereign-ready tooling. The right response is to welcome it and keep the rules neutral. India's light-touch data law gives it room to treat operational control as a standard that any provider can meet, and the credibility of 'Digital Swaraj' will depend on whether Indian buyers can switch providers without losing their data.