AI compliance tools ship faster than the rules they encode

Quick Heal launched Seqrite NOVA Data Privacy, an AI-powered compliance tool sold in three tiers to small offices, SMBs and mid-enterprises.

The pitch lands where most buyers have no privacy specialist on staff. NOVA's translation engine renders consent experiences, privacy notices and cookie menus into 22 officially recognised Indian languages, which Quick Heal links to DPDP notice requirements. Pricing was not disclosed, so buyers cannot yet compare the packs against rivals or against doing nothing.

Quick Heal sells DPDP in packs

The tiers are Lite, Essentials and Professional. They span SOHO setups up to mid-enterprises, and NOVA's AI engine discovers and classifies personal data across endpoints, cloud applications, databases and unstructured files, the company says. It also recognises text embedded in scanned documents and images.

"Navigating India's DPDP compliance shouldn't be a complex, resource-heavy ordeal for growing businesses," said Harish Kumar GS, chief executive of Quick Heal Technologies.

Quick Heal promises minimal manual intervention and limited reliance on specialist IT skills.

Two more launches, two more rulebooks

Quick Heal is not the only vendor shipping. Sierra introduced Compliance Console on 28 October 2026, built into its Horizon agent platform. It is a set of configurable guardrails for outbound agent outreach:

• Disclosures per channel, from how a call opens to the unsubscribe link in an email
• Contact windows set by the recipient's local time
• Holiday exclusions by country and region
• Frequency limits, separate for marketing and transactional outreach

The defaults hint at how local the rules are. Sierra states the acceptable contact window in most locales runs from 8AM to 9PM, and that windows can be set differently by day or split within a single day. It cites Spain's National Day, France's Bastille Day and Australia's ANZAC Day as days when marketing outreach is legally restricted.

Fusemachines went at hiring instead. On 29 October 2026 it rolled out an AI Usage Consent Module in HireFoundry.ai, aimed at differing state rules on AI in recruiting. If a candidate declines consent, the interview continues with the recruiter and Interview Agent does not join, listen, transcribe or analyse the call, according to the company.

"Candidate choice needs to control what the technology actually does," said Anish Joshi, head of technology at Fusemachines.

The money behind the compliance push

Vendors are chasing a market forecasters expect to roughly double.

The market was valued at an estimated $35.82 billion in 2025. It is projected to reach $78.85 billion by 2033, a compound annual growth rate of 10.5% from 2026 to 2033, according to a ResearchAndMarkets report. The report names GDPR, CSRD and DORA among the frameworks forcing continuous monitoring and timely reporting.

Rules are diverging, not converging

The rules the software must encode are not converging. The EU passed its AI Act in 2024 with risk-based obligations, while the US has no federal-level unified AI law, according to a Newsweek Japan contribution by Gloria Grobman summarised in a note.com article. California enacted SB 53 in September 2025, and a federal FRONTIER bill was introduced in July 2026.

Enforcement weight differs too. The US NIST AI Risk Management Framework is voluntary, and Office of Management and Budget safety requirements apply only to federal agencies. Korea settled seven AI ethics principles in August 2026 as voluntary guidance without penalties.

India's clock is different again. The DPDP Rules were notified in November 2025, with key provisions taking effect in stages through May 2027. An EY survey published in January found more than 83% of organisations had not begun implementing the requirements across relevant processes and systems.

That gap is the market these vendors are selling into. It is also why a compliance purchase can sit on a budget line for a year without anyone enforcing it.

What non-compliance costs

The downside is not theoretical. Law.asia notes that feeding sensitive personal information into an AI model without consent or de-identification breaches China's Personal Information Protection Law and Data Security Law. A leak in regulated sectors such as finance and healthcare may also trigger article 253-1 of the Criminal Law on infringing citizens' personal information, the same article states.

China also sets thresholds for export. Companies processing personal information of more than one million individuals, or sending abroad data on more than 100,000 people, or sensitive data on more than 10,000, must pass a data export security assessment, according to Law.asia. The article says many multinationals overlook that requirement when syncing domestic user data to overseas AI servers.

Copyright is the other open flank. In the Beijing Internet Court's AI text-to-image case, the court held that substantial prompt design and parameter adjustment could qualify generated content for copyright protection, while simple instructions might not.

None of this settles the question buyers actually face. Pricing for Seqrite NOVA is undisclosed, and Quick Heal has not said how many customers have switched the controls on. The rules will keep arriving on separate clocks, and the tooling will keep shipping ahead of them.