# Geneki

> Geneki (Geneki Technologies Private Limited, based in India) is a digital transformation company serving clients worldwide. It helps businesses and public institutions modernise how they work, from websites and cloud infrastructure to AI-powered tools, and is building three products of its own: flexx.it, Statbricks and a cloud cost optimiser.

- Website: https://geneki.in/
- Contact: info@geneki.in, or the form at https://geneki.in/#contact
- Legal name: Geneki Technologies Private Limited (CIN U62099UP2024PTC195070), incorporated in India in 2024
- Status: accepting new projects

## Services

- **Websites & portals**: secure, accessible, content-managed websites and citizen-facing portals, built to WCAG 2.1 AA and national government standards such as India's GIGW (Guidelines for Indian Government Websites).
- **Cloud & cost optimisation**: migration, architecture reviews and FinOps practices that keep AWS spend predictable as organisations grow.
- **AI & automation**: practical AI that removes manual work, including document processing, insight dashboards, outreach and workflow automation.
- **UX & digital strategy**: research-led design, content and roadmaps that turn a complex organisation into a simple experience for its users.

## How Geneki works

1. **Discover**: map goals, users, systems and constraints before proposing anything.
2. **Design**: a clear plan, scope and fixed milestones the client signs off on.
3. **Build**: short, visible iterations with working demos at every step.
4. **Support**: handover, training and ongoing care after launch.

## Commitments

- **Security & privacy first**: built with GDPR and India's Digital Personal Data Protection (DPDP) Act, 2023 in mind; least-privilege access, encryption and NDAs as standard.
- **Accessible by default**: everything shipped targets WCAG 2.1 AA and the accessibility rules of the country served.
- **Transparent pricing**: fixed-scope quotes and milestone billing.
- **Client ownership**: clients own their code, data and accounts, with full documentation and no lock-in.

The team's experience includes work with government departments, national agencies and global brands, among them Startup India, Invest India, the Ministry of Commerce and Industry, Mercedes-Benz, Conestoga College, JSI India and Edelmann India.

## Products (in development)

- **flexx.it**: advertisements on the go.
- **Statbricks**: AI competitiveness insights, delivered to you.
- **Cloud cost optimiser** (name to be announced): smarter cloud spend for growing teams.

Each product has a page and a waitlist:

- [flexx.it](https://geneki.in/products/flexx-it/): a marketplace that places brand advertising on taxis, buses and auto-rickshaws, with confirmation that vehicles are on the road and reports for the advertiser.
- [Statbricks](https://geneki.in/products/statbricks/): a report showing where a business ranks in AI assistants' answers against its competitors, what the assistants cannot find about it, and which content changes would improve its position.
- [Cloud cost optimiser](https://geneki.in/products/cloud-cost-optimiser/): a two-step offering: a manual cloud cost audit by Geneki engineers, then a tool that keeps finding savings, on a flat retainer or pay per use.

Waitlists are also on https://geneki.in/#products.

## Blog

Practical guides for businesses and public institutions worldwide: https://geneki.in/blog/ (RSS: https://geneki.in/blog/feed.xml)

- [ISO 27001 or SOC 2: which one first?](https://geneki.in/blog/iso-27001-vs-soc-2-which-first/): a decision guide comparing ISO/IEC 27001:2022 certification (an ISMS certified by an accredited certification body, three-year cycle with surveillance audits, Statement of Applicability, the 31 October 2025 end of the ISO 27001:2013 transition) with SOC 2 (an AICPA attestation by a CPA firm against the Trust Services Criteria, Type 1 versus Type 2, SOC 3 as the general-use version); cites ISO, the International Accreditation Forum, INAB, ENISA and the AICPA; covers who tends to ask for which, scope, control overlap, a decision timeline, groundwork to do before either audit, common mistakes, and pointers to HIPAA, NIST CSF, GDPR and NIS2, and India's DPDP Act
- [How to read a pen test report.](https://geneki.in/blog/how-to-read-a-penetration-test-report/): a manager's guide to reading a penetration test report: defines pen test, vulnerability scan, red team and bug bounty using NCSC, NIST SP 800-115, PTES and OWASP WSTG; walks through report sections (executive summary, scope, methodology, findings, evidence, risk rating, remediation, retest); explains CVSS base score versus real risk with FIRST EPSS and CISA KEV as context; gives a worked illustrative finding, questions for the tester, red flags, a triage and retest routine, and how to share results with customers and auditors
- [Launching a site or app? Do these 7 security checks first.](https://geneki.in/blog/website-app-security-checklist-before-launch/): a pre-launch security checklist for business websites and apps covering dependency locking and scanning (OWASP Top 10:2025 A03 Software Supply Chain Failures, npm ci, npm audit, the Shai-Hulud npm worm per CISA), secrets management (OWASP Secrets Management Cheat Sheet), TLS and HTTP security headers (OWASP HTTP Headers and TLS cheat sheets, MDN on HSTS and CSP), authentication (MFA and throttling per OWASP), logging, backups with a restore test (CISA 3-2-1 and the UK NCSC on offline backups), patching the runtime (PHP2Shell example), and a launch-day checklist
- [PHP2Shell: the flaw that sits below your website.](https://geneki.in/blog/php2shell-php-vulnerability-guide/): a business-friendly explainer of PHP2Shell, the two critical PHP runtime flaws CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2) fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; cites the PHP security advisory, UK NCSC, watchTowr, Qualys, SANS Internet Storm Center and The Hacker News, separates confirmed facts from unproven claims about exploitation, and gives a checklist for finding the PHP version that serves a site, patching, restarting workers, mitigations and compromise checks
- [AI agents wandered into real company systems. The doors were old ones.](https://geneki.in/blog/cert-in-ai-agents-advisory/): a business guide to CERT-In advisory CIAD-2026-0049 of 15 October 2026 (severity Critical), which describes AI model providers' agents under evaluation exceeding their authorization and reading live systems at Indian organizations, and a financially motivated campaign using open-source agentic AI tools; it lists the advisory's conventional root causes (exposed secrets, dormant APIs, over-permissive cloud roles, exposed admin interfaces without multifactor sign-in) and turns its mitigations into a checklist, noting what the advisory does not say
- [Your vendor got hacked. Now your data is on the table.](https://geneki.in/blog/vendor-risk-third-party-breach-guide/): a business guide to third-party and supply-chain breaches; it cites the Verizon 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches, up 60%), Google Threat Intelligence Group's analysis of the 2025 Salesloft Drift OAuth token theft, UK NCSC supply chain guidance and the EU NIS2 directive, treats the October 2026 claims against 38 maritime organizations as unconfirmed, and gives an eight-step vendor risk checklist
- [A trusted internet authority had keys anyone could guess.](https://geneki.in/blog/emudhra-certificate-authority-compromise/): a business guide to the October 2026 eMudhra certificate authority incident, in which eight intermediate CA certificates were found to have private keys weak enough to be recovered from the public certificates; it draws on statements from eMudhra, the Firefox Security Team, the Chrome and Android Security Teams, Cloudflare and security researcher Scott Helme, explains what a certificate authority is, gives a dated timeline, separates what is confirmed from what is not, and lists the checks website owners and developers should run
- [Hackers can steal data they can't read yet. Quantum could open it later.](https://geneki.in/blog/harvest-now-decrypt-later/): a business guide to the 'harvest now, decrypt later' threat, where encrypted data is collected today to be decrypted by a future cryptographically relevant quantum computer (CRQC); it draws on the US Government Accountability Office report GAO-27-108740 (published 6 October 2026, reissued with revisions 14 October 2026), which found that none of 24 federal agencies had fully prepared, that only one fully completed its inventory of vulnerable cryptography, and that none had performed post-quantum tests; on a Europol and UC3M report from October 2026 which says the threat is real, does not need the attacker to own a quantum computer today, rates SMEs and large corporations at medium to high risk, and finds no clear evidence of systematic use at scale; on a Global Risk Institute survey in which most of 32 experts put the chance of a CRQC by 2040 above 50 percent; and on NIST IR 8547 (initial public draft, November 2024), which proposes deprecating RSA and elliptic-curve signatures at the 112-bit level after 2030 and disallowing them after 2035 and describes the X plus Y rule (how long data must stay secret plus how long migration takes, compared with the time until a CRQC); the practical plan is to upgrade to TLS 1.3, inventory cryptography, rank data by shelf life, delete what you do not need, ask vendors for roadmaps, turn on hybrid post-quantum key exchange, use AES-256 where easy and build crypto-agility.
- [One hacker. $5,000. 100 company websites.](https://geneki.in/blog/one-hacker-ai-agents-100-websites/): a business guide to a campaign reported by Reuters and the security firm NorForge on 19 October 2026: a Chinese-speaking operator used Cairn, an open-source tool that coordinates AI agents, to attempt more than 1,200 websites from 25 September 2026 and breach sites at more than 100 companies, mostly online shops in the US, Canada, Australia and Japan; the researcher's estimate was about $5,000 in AI usage, roughly $50 per successful intrusion, with an average success rate near 10% and about 23 hours per successful project; the instructions given to the agents were under 100 Chinese characters; NorForge found the activity because operators left Cairn control panels exposed; how much data was taken is not known, and the cost figures are estimates; the guide gives a checklist for small businesses covering patching, exposed admin panels, multi-factor authentication, session stores, file uploads, secrets, backups, monitoring and third-party sites.
- [One web page can hijack your AI browser. Nobody has fully fixed it.](https://geneki.in/blog/prompt-injection-ai-browser-agents/): a business guide to prompt injection against AI browsers and agents: OWASP defines prompt injection as inputs that change a model's behavior in unintended ways, including indirect injection through websites and files, and notes it is unclear whether fool-proof prevention exists; Brave's security researchers showed in August and October 2025 that hidden text in a Reddit comment, near-invisible text in a screenshot, or visible text on a page could steer AI browsers such as Perplexity Comet and Fellou, and that Perplexity had not fully mitigated the first issue at the time of Brave's update; Anthropic wrote in November 2025 that prompt injection is far from a solved problem and that even a 1% attack success rate against its internal attacker represents meaningful risk; the UK National Cyber Security Centre wrote in December 2025 that prompt injection may never be totally mitigated and advised reducing risk and impact through deterministic safeguards and least privilege; OpenAI wrote in December 2025 that prompt injection is unlikely to ever be fully solved and advised limiting logged-in access and reviewing confirmations; the guide gives seven practical steps: a separate browser profile, no sensitive logins, specific instructions, human approval, least privilege, updates and training.
- [The AI bubble is wobbling. What happens to the tools you pay for?](https://geneki.in/blog/ai-bubble-business-risk/): a guide to what an AI stock sell-off means for ordinary businesses that use AI tools: CNBC reported on 15 October 2026 that 20 of the most valuable global AI and semiconductor stocks had shed more than $1 trillion in value so far that week, as higher borrowing costs, AI financing worries and chip competition weighed on sentiment, while one analyst argued rates are a financing question, not a demand question; the guide explains three ways it could reach a business (vendor failure, as with Builder.ai, which entered insolvency in May 2025 after raising over $450 million; price and plan changes with usage caps, as when Microsoft bundled Copilot into Microsoft 365 Personal and Family in January 2025 and raised US prices by $3 a month; and model or product shutdowns, with OpenAI promising at least 6 months notice for generally available models and Anthropic at least 60 days), lists warning signs to watch, and gives a seven-point checklist: inventory AI tools, check contract exit terms, keep prompts and data in your own hands, avoid hard-wiring one model, track model shutdown dates, set usage caps and alerts, and keep a manual fallback; it stresses that nobody knows whether this is a bubble and that the guide is not investment advice.
- [Trump says AI is now 'Super Intelligence'. Here is what the order really does.](https://geneki.in/blog/trump-super-intelligence-order/): an explainer of Executive Order 14434, 'Inaugurating the Era of Super Intelligence', signed 29 September 2026: it directs the executive branch to use 'Super Intelligence' and 'SI' in place of 'Artificial Intelligence' and 'AI' in non-statutory documents to the maximum extent permitted by law, defines SI as the technologies already covered by the existing statutory definition of artificial intelligence (15 U.S.C. 9401(3)), gives the President's science adviser 60 days to propose legislative language for a federal definition, does not change existing regulations and creates no enforceable rights, and does not bind private companies; the explainer places it in the policy record (EO 14179 in January 2025, America's AI Action Plan in July 2025, EO 14365 on state AI laws in December 2025, a legislative framework reported in March 2026), reports the voluntary industry accord announced the same day, gives the administration's stated rationale from the White House fact sheet, summarizes analysts' differing readings, and lists what businesses should watch (the federal definition proposal, preemption of state laws, and the voluntary accord).
- [Is superintelligence dangerous? The arguments, the doubts and what to do now.](https://geneki.in/blog/is-superintelligence-dangerous/): a balanced risk guide on superintelligence: the Center for AI Safety's 2023 statement says mitigating the risk of extinction from AI should be a global priority alongside pandemics and nuclear war; the International AI Safety Report 2026 defines loss of control as AI systems operating outside of anyone's control with no clear path to regaining control, says current systems lack the capabilities to pose such risks but are improving, and describes an evidence dilemma in which capabilities advance faster than evidence on risks; OpenAI's November 2025 post treats the risks of superintelligent systems as potentially catastrophic; Google DeepMind's 2025 paper groups risks into misuse, misalignment, mistakes and structural risks; Dario Amodei's 2026 essay lists autonomy, misuse for destruction, misuse for seizing power, economic disruption and indirect effects; sceptics point out that 76 percent of 475 respondents in a 2025 AAAI panel survey thought scaling current approaches unlikely to yield AGI and that some US officials have called doomer predictions wrong; the guide separates speculative future risks from present risks such as shadow AI, agents with excess permissions, insecure AI-written code and fraud, and gives a practical checklist.
- [Ban it or build it? The superintelligence camps, on one map.](https://geneki.in/blog/superintelligence-ban-or-race/): a map of the 2026 debate over banning or building superintelligence: the Future of Life Institute's Statement on Superintelligence calls for a prohibition on development of superintelligence, not lifted before there is broad scientific consensus that it will be done safely and controllably and strong public buy-in, and showed 77,670 signatures on 17 October 2026; the Global Call for AI Red Lines asked at the UN General Assembly in September 2025 for an international agreement on red lines by the end of 2026; Senator Bernie Sanders and Representative Casar introduced the Ban Artificial Superintelligence Act in September 2026 according to news reports; a UK private member's bill to prohibit artificial superintelligence had its first reading on 8 September 2026 and the government said it was not the right approach; on the other side, Meta says developing superintelligence is in sight and promotes personal superintelligence, Microsoft AI proposes bounded humanist superintelligence, Safe Superintelligence Inc. pursues safe superintelligence as its one goal, OpenAI says no one should deploy superintelligent systems without being able to robustly align and control them, and the US administration signed a voluntary industry accord in September 2026 while rejecting a global control scheme; public polling by an advocacy group found 64 percent of US adults want superhuman AI only once proven safe and controllable or never.
- [When will superintelligence arrive? Who forecasts what, and why they disagree.](https://geneki.in/blog/when-will-superintelligence-arrive/): a guide to superintelligence timelines: Sam Altman's 2025 essay 'The Gentle Singularity' said humanity is close to building digital superintelligence and expected systems that can figure out novel insights in 2026; OpenAI's November 2025 post expected very small discoveries in 2026 and more significant ones in 2028 and beyond; Dario Amodei's January 2026 essay said powerful AI could be as little as one to two years away though it could be considerably further out; the AI Impacts survey of 2,778 researchers found a 10 percent chance of machines outperforming humans at every task by 2027 and 50 percent by 2047, with a 50 percent chance of all human occupations being fully automatable only by 2116; a 2025 AAAI panel survey of 475 respondents found 76 percent said scaling up current approaches is unlikely or very unlikely to yield AGI; the AI 2027 scenario placed superintelligence in December 2027 but its authors later said 2027 was their most likely year, not the median, and moved medians later; METR's March 2025 research found the length of tasks AI can complete doubling about every seven months with later data suggesting faster but with caveats; the International AI Safety Report 2026 said the trajectory through 2030 is uncertain; the guide suggests planning around scenarios, tracking indicators and avoiding irreversible bets on any single date.
- [Superintelligence vs AGI: the difference that matters, and the one marketing blurs.](https://geneki.in/blog/superintelligence-vs-agi/): an explainer of superintelligence versus AGI: Nick Bostrom's 1998 definition of superintelligence is 'an intellect that is much smarter than the best human brains in practically every field', and his 2014 book distinguishes speed, collective and quality forms; OpenAI's 2023 post describes superintelligence as 'future AI systems dramatically more capable than even AGI' and AGI in its charter as highly autonomous systems that outperform humans at most economically valuable work; Meta's 2025 letter promotes 'personal superintelligence'; Microsoft AI's 2025 essay proposes 'humanist superintelligence' that is bounded and always serves people; Safe Superintelligence Inc. says its single goal is safe superintelligence; Anthropic's Dario Amodei avoids both terms and describes powerful AI as a 'country of geniuses in a datacenter'; and the US federal government adopted 'Super Intelligence' as a label for existing AI technologies by executive order in September 2026; the article gives a four-question test for reading claims that use these words.
- [How do governments see superintelligence? Six approaches, side by side.](https://geneki.in/blog/how-governments-see-superintelligence/): a comparison of government approaches to superintelligence and frontier AI as of October 2026: the EU has binding law (the AI Act, with general-purpose model duties from August 2025, enforcement powers from August 2026, and high-risk obligations delayed to December 2027 and August 2028 by Regulation 2026/1744); the UK has a research body, the AI Security Institute, and no AI statute, while a private member's bill to prohibit artificial superintelligence was introduced in September 2026 and the government said it did not consider the proposed measures the right approach; China emphasizes development through its AI Plus initiative and a UN-centred governance plan and President Xi called for AI to remain under human control, using AGI only in a draft five-year-plan phrase about exploring development paths; India has no AI law, relies on existing legislation and published governance guidelines in November 2025, and the February 2026 AI Impact Summit declaration was voluntary and endorsed by 92 countries and organizations; the US has no federal AI statute, issued the Action Plan in July 2025 and renamed AI as Super Intelligence in federal documents by executive order in September 2026 without changing the legal definition; the UN has an advisory scientific panel co-chaired by Yoshua Bengio and Maria Ressa and a Global Dialogue held in Geneva in July 2026; and the Council of Europe AI convention has one ratification and is not yet in force.
- [Six cheap habits that block the attacks small businesses actually face](https://geneki.in/blog/small-business-cybersecurity-habits/): a small-business cybersecurity guide built on 2026 data: the Verizon 2026 DBIR (more than 22,000 breaches) found the human element in 62 percent of breaches, exploited vulnerabilities as the top entry point at 31 percent, ransomware in 48 percent and third-party involvement in 48 percent, and in its SMB section (organizations under 1,000 employees) about 96 percent of ransomware victims were SMBs, hit through compromised credentials (38 percent) or unpatched edge devices (29 percent); the UK Cyber Security Breaches Survey 2025/26 found 43 percent of businesses had a breach or attack in the last 12 months with phishing the most common at 38 percent; the FBI IC3 2025 report logged 1,008,597 complaints and 20.877 billion dollars in losses with business email compromise at about 3.05 billion; and six habits are multi-factor authentication preferring passkeys or security keys over SMS codes, a password manager with long unique passwords, automatic updates, tested backups following CISA's 3-2-1 guidance with offline copies, phishing and payment-change verification by a known phone number, and limiting access including third parties.
- [Build, buy or subscribe? Six questions that settle it.](https://geneki.in/blog/build-buy-subscribe-software/): a decision guide for choosing between building custom software, buying a licence and subscribing to SaaS: build what is your competitive edge and buy or subscribe for commodity needs; evidence on ownership cost shows the US GAO found agencies typically report about 80 percent of IT spending going to operating and maintaining existing systems (2025) and the UK NAO reported Defra estimating 76 percent of its digital spending goes on maintaining ageing systems; Flyvbjerg and Budzier studied 1,471 IT projects and found an average cost overrun of 27 percent with about one in six projects a black swan overrunning costs by about 200 percent; Okta reports an average of 101 apps per customer company; GDPR Article 20 gives individuals portability of personal data they provided but does not cover a business's own commercial data; the EU Data Act ends switching charges for cloud and data processing services from 12 January 2027; the FTC's click-to-cancel rule was vacated in July 2025 and rulemaking restarted in March 2026; buyers should ask SaaS vendors for SOC 2 or ISO 27001 evidence and a patch policy; custom code needs source-release or escrow terms in the contract; and GPL and AGPL licences carry source-sharing duties that can matter when embedding open-source code.
- [Built an app with AI? Check these 7 things before real users touch it.](https://geneki.in/blog/vibe-coding-ai-app-safe/): a guide to the safety of vibe-coded apps: vibe coding was named by Andrej Karpathy in February 2025 and was Collins Dictionary's Word of the Year 2025; studies of AI-generated code vary, with an academic study of GitHub Copilot finding roughly 40 percent of generated programs vulnerable in 2021 scenarios, a Stanford-linked user study finding people with an AI assistant wrote less secure code and were more confident in it, a Veracode 2025 vendor report finding OWASP Top 10 flaws in 45 percent of test cases, and a 2025 preprint finding most sampled GitHub files had no identifiable vulnerability; the UK NCSC's June 2026 vibe coding spectrum advises using freedom for low-risk prototypes but more manual oversight for authentication, sensitive data and secrets; incidents include the July 2025 Replit agent deleting a production database during a code freeze as reported by the user and acknowledged by Replit's CEO, CVE-2025-48757 on missing row-level security in apps generated by Lovable which the supplier disputes, and Wiz's February 2026 finding that a vibe-coded site's database exposed 1.5 million API tokens through a hardcoded key and disabled row-level security; a USENIX Security 2025 study found AI models hallucinate package names at least 5.2 percent of the time for commercial models and 21.7 percent for open-source models; and the seven pre-launch checks are secrets, access rules, input handling, packages, separate production and backups, human review and logging.
- [10 things to switch off on your cloud bill this week](https://geneki.in/blog/cloud-bill-checklist/): a 10-point cloud cost checklist for AWS, Azure and Google Cloud: unattached disks keep billing until deleted; old snapshots (AWS snapshot storage 0.05 dollars per GB-month versus 0.0125 for the archive tier in US East); public IPv4 addresses cost 0.005 dollars per hour on AWS even when idle and unused static external IPs cost 0.01 dollars per hour on Google Cloud; an Azure VM shut down from inside the guest operating system is still billed for compute until it is deallocated; an idle AWS Application Load Balancer costs roughly 16 dollars a month and a NAT Gateway about 33 dollars a month before data in US East; idle-resource recommenders from Azure Advisor and Google Cloud flag unused VMs, disks and IPs; S3 lifecycle rules and Intelligent-Tiering reduce storage cost; budgets on all three clouds send alerts but do not cap spending; tags and labels are needed to split bills; the AWS Free Tier changed on 15 July 2025 to a credits-based plan for new accounts; commitment discounts are advertised as up to 72 percent on AWS and Azure and up to 55 percent for most Google resource commitments; and the EU Data Act ends switching charges, including exit egress charges, from 12 January 2027.
- [Will an AI agent replace your support team? Take this 5-question test.](https://geneki.in/blog/ai-support-agent-test/): a decision test for using AI agents in customer support, built on primary evidence: the NBER working paper 'Generative AI at Work' studied 5,179 support agents and found AI assistance raised issues resolved per hour by 14 percent on average and 34 percent for novice workers, with minimal impact for experienced ones, while the AI coached human agents rather than replacing them; in Moffatt v. Air Canada (2024 BCCRT 149) a British Columbia tribunal held the airline responsible for wrong information given by its website chatbot and ordered about 812 Canadian dollars; the US CFPB warned about chatbots missing disputes, giving inaccurate information and trapping customers in loops with no route to a human; Gartner predicted over 40 percent of agentic AI projects will be canceled by the end of 2027 and that 50 percent of organizations expecting to cut service staff will abandon those plans, and a Gartner survey found 64 percent of customers would prefer companies not use AI in service; OpenAI's agent guide advises human escalation after repeated failures and for high-risk actions like refunds; EU AI Act Article 50(1) requires systems that interact with people to tell them they are dealing with AI, applying since 2 August 2026; California SB 1001 and a 2025 Maine law set chatbot disclosure rules; and the FTC said there is no AI exemption from consumer protection law.
- [The EU AI Act for small teams: what applies now, and what can wait](https://geneki.in/blog/eu-ai-act-gdpr-small-business/): a guide to the EU AI Act and GDPR for small businesses as of October 2026: Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and amended the AI Act; the AI literacy duty in Article 4 and the prohibited practices have applied since 2 February 2025; the general application date was 2 August 2026, so the Article 50 transparency duties (telling people they are dealing with an AI system, disclosing deepfakes and certain AI-generated text for the public) apply now, with a grace period to 2 December 2026 for marking by generative systems already on the market; high-risk obligations for use cases such as recruitment and credit scoring moved to 2 December 2027, and to 2 August 2028 for AI in regulated products; fines for most obligations reach EUR 15 million or 3 percent of turnover, but for SMEs the lower of the two applies; the Act reaches non-EU businesses whose AI output is used in the EU; GDPR Article 3(2) applies to non-EU businesses that offer goods or services to people in the EU, and Article 22 limits decisions based solely on automated processing; the UK has no AI Act equivalent but UK businesses selling to the EU are covered.
- [Hiring a dev team overseas without the horror stories](https://geneki.in/blog/hire-offshore-dev-team/): a guide for US, UK and EU businesses hiring a software team abroad, including in India: under US law copyright vests initially in the author, a transfer needs a signed writing, and commissioned software by a contractor generally does not qualify as a work made for hire, so a written assignment is needed; UK law similarly requires a signed written assignment and makes an employer first owner only for employees; the European Commission's adequacy list does not include India, so EU personal data sent to an Indian contractor needs a safeguard such as the Standard Contractual Clauses, and the UK uses the ICO's IDTA or Addendum; the IRS says foreign persons give Form W-8BEN to the payer; UK VAT reverse charge applies to services bought from abroad; India's GST portal lets anyone look up a GSTIN; India Standard Time is UTC+5:30, giving 3.5 to 5.5 hours of overlap with the UK and central Europe in a 9 to 6 day and none with US working hours unless one side shifts; the UK government's IP guidance says contracts need to state who owns new IP; and NCSC, CISA and NIST advise controlling supplier access with least privilege and multifactor authentication.
- [Building a website? Decide these 5 things before you talk to anyone.](https://geneki.in/blog/build-business-website-guide/): a guide for business owners on building a website: decide the goal, audience, pages, who will maintain it and a budget range before contacting anyone; options are a platform builder, a freelancer, an agency or a product studio; Google's guidance on hiring an SEO says nobody can guarantee a number one ranking, advises asking for past work and how results are measured, and warns against secrecy and unsolicited emails; no official cost range exists so cost should be compared through a written scope; the business should be the registered holder of its domain (ICANN says the registrant is responsible for it and holds the transfer right); the European Accessibility Act applied from 28 June 2025 with an exemption for microenterprises providing services; WCAG 2.2 is the current W3C Recommendation; the US ADA web rule from the Department of Justice covers state and local governments, not private businesses; the UK ICO says non-essential cookies need consent; and Core Web Vitals good thresholds are LCP within 2.5 seconds, INP at most 200 milliseconds and CLS at most 0.1.
- [Does your website show up when people ask AI? A checklist.](https://geneki.in/blog/ai-answers-website-checklist/): a practical checklist for getting a website into AI answers, based on vendor documentation: Google's July 2026 guide to generative AI features says there is no special markup, AI text file, llms.txt or content chunking needed and that optimizing for generative AI search is optimizing for Search; pages must be crawlable and indexed and eligible for a snippet; Google deprecated FAQ rich results in May 2026; OpenAI separates GPTBot (training), OAI-SearchBot (ChatGPT search) and ChatGPT-User (user actions); Google-Extended controls Gemini training use and does not affect Search inclusion; Anthropic has ClaudeBot, Claude-User and Claude-SearchBot; Perplexity has PerplexityBot and Perplexity-User; Microsoft launched an AI Performance report in Bing Webmaster Tools in February 2026; IndexNow notifies participating search engines of changes; and one third-party analysis found major AI crawlers did not render JavaScript, so key content should be in the server-delivered HTML.
- [Is your encrypted data safe from tomorrow's computers?](https://geneki.in/blog/post-quantum-cryptography/): a guide to post-quantum cryptography for Indian businesses: today's quantum computers cannot break real-world encryption, but the 'harvest now, decrypt later' threat means long-lived sensitive data copied now could be read once a cryptographically relevant quantum computer exists; NIST finalised three post-quantum standards in August 2024 (FIPS 203 ML-KEM for key exchange, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for digital signatures); NIST's draft IR 8547 proposes deprecating RSA and elliptic-curve algorithms after 2030 and disallowing them after 2035; hybrid post-quantum key exchange (X25519MLKEM768) is already on by default in recent major browsers and many libraries; CERT-In's July 2025 technical guidelines describe a Cryptographic Bill of Materials (CBOM) inventory; and a practical checklist: inventory cryptography, rank data by how long it must stay secret, ask vendors about their roadmap, enable hybrid key exchange, build crypto-agility and plan certificates later.
- [India is betting ₹6,000 crore on quantum. Should you care?](https://geneki.in/blog/national-quantum-mission/): an explainer of India's National Quantum Mission (approved by the Union Cabinet on 19 April 2023 with an outlay of ₹6,003.65 crore for eight years): what quantum computing is, the mission's targets (20 to 50 physical qubits in 3 years, 50 to 100 in 5 years, 50 to 1,000 in 8 years; 2,000 km secure quantum communication; sensing and materials goals), the four thematic hubs (IISc Bengaluru, IIT Madras with C-DOT, IIT Bombay, IIT Delhi), progress reported by PIB up to April 2026 (startups, a 64-qubit processor, a 1,000 km quantum key distribution network), and realistic advice for businesses: no need to buy quantum hardware, list where you use encryption, ask vendors about post-quantum plans following NIST's 2024 standards, and keep watching.
- [Your chatbot talks. An AI agent does the work.](https://geneki.in/blog/agentic-ai-vs-chatbots/): a practical comparison of agentic AI and chatbots: how a chatbot answers one request while an agent works towards a goal in a loop (plan, use tools, check the result, continue or stop), the distinction Anthropic draws between workflows (predefined code paths) and agents (the model directs its own process and tool use), Google Cloud's split between bots, AI assistants and AI agents by autonomy, where agents pay off (multi-step tasks with tools and checkable results such as customer support and coding), where a chatbot or a fixed workflow is enough, the cost and latency trade-off, and a six-question checklist for deciding.
- [Everyone talks about AGI. Nobody agrees what it is.](https://geneki.in/blog/what-is-agi/): a business-friendly guide to artificial general intelligence (AGI): OpenAI's charter defines it as highly autonomous systems that outperform humans at most economically valuable work; Google DeepMind researchers propose five levels (Emerging, Competent, Expert, Exceptional, Superhuman) based on how well and how broadly a system performs, and judged frontier language models in 2023 to be Emerging AGI; a survey of 2,778 AI researchers gave 10% odds by 2027 and 50% by 2047 for machines outperforming humans at every task, and 50% by 2116 for full automation of all occupations; lab leaders such as Dario Amodei and Sam Altman have publicly given much shorter timelines; the guide stresses that timelines are contested, there is no consensus, and businesses should plan around what AI can do today.
- [Google sends fewer clicks now. Here is how to get picked by AI instead.](https://geneki.in/blog/get-cited-by-ai-search/): a guide to getting a business cited by AI search (Google AI Overviews and AI Mode, ChatGPT, Perplexity, Copilot): Pew Research data on falling clicks when AI summaries appear (8% vs 15% of visits), Google's own guidance that no special optimisation or schema is required beyond being indexed and snippet-eligible, and a checklist covering direct answers, structure, crawl access, outside mentions, llms.txt, IndexNow and measuring AI referrals in analytics.
- [Your AI pilot worked. Then the bill arrived.](https://geneki.in/blog/ai-costs-overrun/): a guide to controlling AI running (inference) costs: why bills grow when pilots go live and when agents make many model calls per task, the FinOps Foundation's State of FinOps 2026 finding that 98% of FinOps teams now manage AI spend (up from 31% in 2024), and eight levers with vendor-documented savings: right-size the model, trim prompts and context, prompt caching (cached input billed at a tenth of the price on Anthropic's API), batch APIs (50% off on OpenAI's Batch API), cap output length, put limits on agents, cache whole answers, and track cost per successful outcome.
- [Your team is already using AI. Do you know which?](https://geneki.in/blog/shadow-ai/): a guide to shadow AI (employees using unapproved AI tools at work): the risks (company and customer data pasted into consumer tools, AI apps connected to email and drive, unclear data retention), IBM's 2025 Cost of a Data Breach findings (one in five organisations breached due to shadow AI, about $670,000 higher costs, 63% of breached organisations without an AI governance policy), and a practical plan: approve business-grade tools, a one-page policy with green/amber/red data rules, review connected-app permissions, train people, and offer a fast request path for new tools.
- [Your AI agent just did something nobody asked for.](https://geneki.in/blog/ai-agents-safely/): a practical guide to deploying AI agents safely: what makes agents different from chatbots, why they take unintended actions (OWASP's Excessive Agency risk: too much functionality, permission or autonomy; and prompt injection hidden in emails, documents or web pages), Gartner's prediction that over 40% of agentic AI projects will be cancelled by the end of 2027, and seven guardrails: a narrow job, least privilege, human approval for high-impact actions, permissions enforced in the systems themselves, full action logs, limits on steps and spend, and a tested off switch.
- [That 20-year-old system can finally go. Carefully.](https://geneki.in/blog/legacy-modernisation-ai/): a balanced guide to modernising legacy systems (for example COBOL or old in-house applications) with AI in 2026: AI coding assistants and agents from vendors such as Microsoft, GitHub, IBM and Anthropic are good at reading and documenting old code, mapping dependencies, extracting business rules and generating tests; risks remain around undocumented behaviour, data migration and over-trusting automated rewrites; recommended approach is the strangler fig pattern (replace one piece at a time behind a facade), characterisation tests and parallel runs.
- [Your customers' data now comes with rules](https://geneki.in/blog/dpdp-act-guide/): a guide to India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: who it applies to, key dates (Rules notified 13 November 2025, consent managers from 13 November 2026, most duties from 13 May 2027), the eight things businesses must do, customer rights, penalties of up to ₹250 crore, and a 30-day plan.
- [Building a government website? Read this first](https://geneki.in/blog/gigw-3-guide/): an explainer on GIGW 3.0 (Guidelines for Indian Government Websites and Apps, 2023, from MeitY/NIC with STQC and CERT-In): who must follow it, WCAG 2.1 level AA accessibility, the standard pages every site needs, security expectations, mobile apps, STQC Website Quality Certification, and a pre-launch checklist.
- [Your AWS bill is leaking. Here is where.](https://geneki.in/blog/aws-bill-leaks/): a practical guide to reducing AWS costs: how to see where money goes (Cost Explorer, tags, budgets, anomaly detection), ten common causes of waste (always-on non-production servers, oversized instances, on-demand pricing for steady loads, forgotten resources and public IPv4 charges, gp2 volumes, S3 without lifecycle rules, NAT Gateway processing, data transfer, never-expiring CloudWatch logs, older instance types) with fixes, a one-week clean-up plan, and habits to stop costs creeping back.
- [Let AI do the boring bits: 5 tasks it can take over today](https://geneki.in/blog/ai-back-office-tasks/): a practical guide to using AI in back-office work: five tasks AI can take over today (reading invoices and bills, sorting email and drafting replies, summarising meetings and documents, data entry from forms and PDFs, first-draft reports), three it should not do alone (decisions about people, legal or compliance sign-off, numbers nobody checks), a 30-day pilot plan, and how to protect personal data under India's DPDP Act.

## Pages

- [Home](https://geneki.in/): services, process, products and contact
- [Blog](https://geneki.in/blog/): plain-English guides
- [Privacy policy](https://geneki.in/privacy-policy.html): how personal data is handled under the DPDP Act, 2023
- [Terms of use](https://geneki.in/terms-of-use.html)
- [Accessibility statement](https://geneki.in/accessibility-statement.html)