By: Raghuveer Kancherla, co-founder, Sprinto
Enterprises have outgrown the way they manage promises
For a long time, enterprises could reasonably believe they had a clear view of what they had promised. Contracts sat with Legal, regulatory requirements were managed by Compliance, security frameworks were handled by Security, and internal policies had their respective owners. That model worked when businesses had fewer customers, markets, vendors and technologies to manage.
As businesses have grown more complex, that expectation has become increasingly difficult to maintain. Every new customer introduces contractual obligations, every new market brings regulatory requirements, and every vendor adds another set of terms. The rapid adoption of AI is creating further questions around data use, governance and accountability.
This is what makes Infinite Commitments an increasingly relevant way to think about the modern enterprise. The real difficulty is understanding how those commitments relate to one another.
Responsibility remains divided across teams with each point of contact focused on its own set of obligations. What is often missing is a way to follow a commitment from the team that accepted it to the people whose work must reflect it.
Many of these processes were designed when the business had fewer commitments to coordinate. As the company expands, more obligations have to pass between teams, increasing the chance that context or ownership will be lost along the way.
Promises get lost between the document and the operator
Even in well-run organizations, I have seen commitments fall through because too much gets lost between the document and the person responsible for acting on it.
Consider a customer contract requiring notification of a security incident within 24 hours. Legal can negotiate the clause and Compliance can record it, but neither action changes the incident-response process. The security team needs to know about the shorter deadline, reflect it in its escalation workflow and retain evidence that the process was followed.
Signing and cataloging a commitment are only the beginning. Someone must then translate it into operational changes, assign responsibility and decide what evidence will show that the promise is being kept.
A company can even pass an audit while breaking such a promise. An audit may confirm that a general control exists without revealing that one customer was promised a stricter standard. The control may be present, the evidence may be complete, and the organization may still fail to meet the commitment it actually made.
Periodic compliance can show what was true. Trust requires knowing what is true now.
Traditional compliance infrastructure was built to demonstrate that a requirement had been met at a particular point in time. That remains important, but enterprises increasingly need to answer a more immediate question: are we keeping our commitments now?
The operating environment rarely stays still. Contracts are renegotiated, regulations evolve, vendors change their practices and systems are reconfigured. A commitment signed two years ago may have been amended or superseded, while a new clause added during renewal may never reach the team responsible for acting on it.
Commitments therefore cannot be managed as static records. Organizations need to know which obligations remain active, what has changed, who owns them and what evidence shows they are still being fulfilled.
India’s own regulatory calendar makes this concrete. The Digital Personal Data Protection Rules were notified in November 2025, with key provisions taking effect in stages through May 2027. Yet an EY survey published in January found that more than 83% of organizations had not begun implementing the requirements across relevant processes and systems. Around 80% had not started updating their policies, while 81% had not begun establishing a privacy governance structure.
The challenge is not simply understanding the regulation. It is connecting an obligation that cuts across product, technology, Legal, Security and vendor management to the work and people responsible for fulfilling it.
Leaders must therefore look beyond assessments completed or documents collected. Those measures show that governance activity has taken place. They do not show whether every active commitment has reached the right owner or whether the business can respond when circumstances change.
The answer is a different operating model, not fewer commitments
Enterprises cannot reasonably expect the number of commitments to decline as they grow. What they can change is how those commitments are understood and managed.
What enterprises need is a unified view of their commitments, with every promise connected to the people and processes responsible for keeping it. Visibility is the starting point. Accountability is what turns it into action.
That requires a question that rarely appears in a compliance review: what changed in the business because we accepted this obligation? If the answer is nothing, the commitment probably still exists only on paper.
The same discipline should apply when a promise changes. A contract renewal should trigger more than a filing exercise. The business needs to identify what processes are affected and ensure the relevant owners know what is now expected of them.
AI shows why this matters. An internal policy may permit the use of an AI tool while a customer contract restricts how its data can be shared. The vendor’s terms may add another condition. Each decision can appear reasonable in isolation, yet the combination can still break a customer promise.
This is why AI governance cannot be confined to an AI policy or a register of approved tools. Enterprises must connect how AI is being used with the commitments they have already made around customer data, vendor access and regulatory responsibility.
Growth will keep adding promises to the enterprise, and existing promises will continue to change. The work is to ensure that accountability changes with them. A dependable enterprise should be able to trace a promise from the moment it is made through the work required to keep it. That is a higher standard than audit readiness, and it is where enterprise trust will increasingly be earned.
