In this exclusive conversation with Rajeev Ranjan, Editor, Digital Terminal, Pankaj Goel, CTO, LeadSquared explores the evolving security challenges as AI systems move beyond assisting employees to independently executing business tasks. He discusses the importance of protecting sensitive customer data, establishing clear access controls, and strengthening privacy safeguards for Voice AI and CRM platforms.
Rajeev: What new security risks emerge when AI agents move beyond assisting employees to independently executing tasks across customer-facing business workflows?
Pankaj: When AI moves from suggesting an action to executing it, every mistake can have a direct business consequence. It is no longer just an incorrect recommendation but an unauthorized refund triggered, a loan approved or KYC data shared without human intervention. RBI's FREE-AI framework calls this out through its focus on 'Safety and Resilience'. An AI agent should never have more authority than the employee it is acting on behalf of.
Rajeev: How can enterprises give AI systems access to sensitive customer data while maintaining strict control over permissions, usage and automated actions?
Pankaj: Access needs to be scoped, time-bound and limited to a specific purpose. An AI agent can recommend an action, but a policy engine should determine whether it is permitted to execute it. The agent should access only the data fields required for the task and only for as long as necessary. Between DPDP's purpose-limitation mandate and RBI's FREE-AI 'Accountability' Sutra, controlled access isn't best practice anymore, it's the baseline regulators expect.
Rajeev: What additional privacy and security safeguards are needed when deploying Voice AI and call analytics in sectors such as BFSI and healthcare?
Pankaj: A voice recording combines biometric, behavioral, and medical data in a single file, arguably the most sensitive information a customer can share, often within seconds. Four guardrails must be non-negotiable: redact sensitive data at capture, so card numbers, PINs, and health conditions are never stored; obtain explicit, revocable consent, making clear that AI is analyzing the call rather than merely recording it “for quality”; maintain data residency in India, consistent with RBI and applicable sectoral norms; and prohibit model training on raw call data without robust de-identification. RBI’s FREE-AI framework rightly places “People First” at its core. The real test is whether a customer would feel comfortable knowing exactly how their conversation was used.
Rajeev: How should organizations establish accountability, auditability, and human oversight as AI becomes embedded in critical business decisions?
Pankaj: AI can be the co-pilot, but a human must remain the captain. “The algorithm decided” is not an answer a regulator or customer will accept. RBI’s FREE-AI Sutras make this explicit through Accountability and “Understandable by Design.” Every AI workflow needs a named human owner, an immutable audit trail, and human-in-the-loop oversight for high-stakes decisions. If a decision cannot be explained clearly, it should not be automated. Enterprises need to remain accountable for how AI influences decisions that affect a person's creditworthiness, access to care or future.
Rajeev: How does integrating AI directly into CRM platforms change the traditional approach to access control, data protection and cybersecurity?
Pankaj: A CRM holds the entire customer relationship, from contact details and consent to conversations and transactions. When AI is embedded into the platform, the CRM moves beyond being a passive data store and becomes an active participant in business workflows. The AI must inherit the same role-based permissions, data-access boundaries, and audit controls as the human user it acts for. It should operate as a teammate within the user’s existing permission boundaries, not as a superuser. This is FREE-AI’s accountability principle put into practice.
Rajeev: What practical steps should Indian enterprises take to scale AI adoption without compromising customer trust, regulatory compliance and data security?
Pankaj: Enterprises need to scale AI with the same discipline they apply to building customer trust. This is the spirit of RBI’s FREE-AI framework: “Innovation over Restraint,” built on a foundation of trust. Organisations need to understand their data, make consent machine-readable, enforce least-privilege access, retain human oversight for critical actions and maintain audit trails they would be comfortable showing customers. The winners will not necessarily be those who adopt AI the fastest, but those who can scale it while giving customers confidence in how their data is used and how decisions are made.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram
