6.1 AI Governance and Liability
Artificial Intelligence systems present novel legal challenges around accountability, transparency, and liability. Understanding the emerging regulatory framework is essential for advising clients deploying AI solutions.
India's AI Regulatory Landscape
India does not yet have comprehensive AI-specific legislation but is developing its framework:
- NITI Aayog National AI Strategy: Guiding principles for responsible AI development
- MeitY AI Guidelines: Principles for AI governance in government applications
- Draft Digital India Act: Proposes provisions for high-risk AI systems
- Sectoral Regulations: RBI (AI in banking), SEBI (algorithmic trading), IRDAI (AI in insurance)
NITI Aayog Seven Principles:
1. Safety and Reliability
2. Equality
3. Inclusivity and Non-discrimination
4. Privacy and Security
5. Transparency
6. Accountability
7. Protection and Reinforcement of Positive Human Values
AI Liability Framework
In the absence of AI-specific liability laws, existing frameworks apply:
| Liability Theory | Legal Basis | Application to AI |
|---|---|---|
| Product Liability | Consumer Protection Act 2019 | AI as defective product causing harm |
| Negligence | Common law tort | Failure to exercise reasonable care in AI design/deployment |
| Vicarious Liability | Principal-agent relationship | Organizations liable for AI system actions |
| Contractual Liability | Indian Contract Act | Breach of warranties about AI performance |
| Criminal Liability | BNS provisions | Reckless/negligent AI deployment causing harm |
AI Risk Categories
High-Risk AI Applications
- Credit Scoring: Automated lending decisions affecting financial access
- Employment: AI in recruitment, performance evaluation, termination
- Healthcare: Diagnostic AI, treatment recommendations
- Law Enforcement: Predictive policing, facial recognition
- Education: AI-driven assessment and grading
AI systems may perpetuate or amplify discrimination based on protected characteristics. Under Article 15 of the Constitution and various anti-discrimination laws, organizations may face liability for discriminatory AI outcomes even without discriminatory intent. Recommend bias audits for high-risk AI systems.
AI Governance Best Practices
- AI Ethics Board: Establish cross-functional governance body
- Impact Assessments: Conduct algorithmic impact assessments before deployment
- Documentation: Maintain model cards, data documentation, decision logs
- Human Oversight: Ensure meaningful human review for high-stakes decisions
- Audit Trail: Enable explainability and auditability of AI decisions
- Monitoring: Continuous monitoring for drift, bias, and performance
6.2 IoT Security Obligations
The Internet of Things (IoT) creates unique security and privacy challenges. Organizations deploying IoT must navigate overlapping regulatory requirements and manage significant security risks.
IoT Regulatory Framework in India
Applicable Regulations
- IT Act 2000: Applies to IoT as "computer systems" and "computer networks"
- DPDPA 2023: IoT collecting personal data triggers Data Fiduciary obligations
- CERT-In Direction 2022: 6-hour incident reporting applies to IoT breaches
- BIS Standards: Specific standards for IoT device security (IS 16868)
- DoT Guidelines: M2M/IoT registration and security requirements
IoT Security Checklist
| Security Domain | Requirements | Legal Basis |
|---|---|---|
| Authentication | Strong credentials, no default passwords | Section 43A, BIS standards |
| Encryption | Data in transit and at rest encryption | SPDI Rules, sectoral guidelines |
| Update Mechanism | Secure firmware update capability | Reasonable security practices |
| Access Control | Role-based access, least privilege | Section 43A |
| Logging | Security event logging, 180-day retention | CERT-In Direction |
| Incident Response | 6-hour reporting, response procedures | CERT-In Direction |
IoT Privacy Considerations
IoT devices often collect extensive data, triggering DPDPA obligations:
- Notice: How to provide meaningful privacy notices on devices with no screens?
- Consent: Obtaining valid consent for continuous data collection
- Purpose Limitation: Restricting use to disclosed purposes
- Data Minimization: Collecting only necessary data
- Security: Appropriate protection for collected personal data
For IoT devices without screens, implement a "layered notice" approach: (1) Short notice on packaging, (2) Detailed notice accessible via QR code or companion app, (3) Setup wizard requiring acknowledgment before activation. Document consent mechanisms thoroughly.
6.3 Blockchain Legal Considerations
Blockchain technology presents unique legal challenges around immutability, jurisdiction, smart contract enforceability, and regulatory compliance. Understanding these issues is crucial for advising blockchain projects.
Blockchain Regulatory Status in India
Current Legal Position
- Blockchain Technology: Not specifically regulated; generally permitted
- Cryptocurrency: Not legal tender; taxation under VDA provisions (30% tax)
- Smart Contracts: Legal validity under Indian Contract Act principles
- NFTs: Treated as Virtual Digital Assets; subject to VDA taxation
Finance Act 2022 introduced 30% tax on gains from VDA transfers with no deductions allowed (except cost of acquisition). 1% TDS on transfers above threshold. This applies to cryptocurrencies, NFTs, and potentially some blockchain tokens.
Blockchain and DPDPA Compliance
Blockchain's immutability creates tension with data protection principles:
| DPDPA Requirement | Blockchain Challenge | Possible Solutions |
|---|---|---|
| Right to Erasure | Immutable ledger prevents deletion | Off-chain storage, encryption key destruction |
| Right to Correction | Data cannot be modified | Append correction records, off-chain corrections |
| Data Minimization | Full history retained | Hash references instead of raw data |
| Cross-Border Transfer | Decentralized nodes globally | Permissioned chains, data localization |
Smart Contract Legal Issues
Contract Formation Requirements
For a smart contract to be legally enforceable under the Indian Contract Act:
- Offer and Acceptance: Clear terms that parties agreed to
- Consideration: Value exchanged between parties
- Capacity: Parties legally capable of contracting
- Free Consent: Not obtained through coercion, fraud, or mistake
- Lawful Object: Purpose not illegal or against public policy
Smart contracts execute automatically regardless of changed circumstances. Unlike traditional contracts, they cannot easily accommodate force majeure, frustration, or changed circumstances. Advise clients to include off-chain dispute resolution mechanisms and emergency stop functions.
6.4 Regulatory Sandbox Frameworks
Regulatory sandboxes allow innovative products and services to be tested in a controlled environment with relaxed regulatory requirements. Multiple Indian regulators have established sandbox frameworks.
Available Regulatory Sandboxes in India
| Regulator | Sandbox Focus | Key Features |
|---|---|---|
| RBI | FinTech innovations | 6-month cohorts, limited customer base |
| SEBI | Capital markets innovation | Testing with limited participants |
| IRDAI | InsurTech solutions | Controlled testing period |
| IFSCA | Financial services in GIFT City | International financial center sandbox |
| TRAI | Telecom innovation | Pilot projects with relaxed licensing |
RBI Regulatory Sandbox Framework
The RBI sandbox is particularly relevant for fintech innovations:
Eligibility Criteria
- Entity Type: Companies incorporated in India
- Innovation: Product must be genuinely innovative
- Consumer Benefit: Clear benefit to end consumers
- Technology: Use of new or emerging technology
- Testing Need: Genuine need for live testing environment
Sandbox Process
- Application: Submit detailed proposal with innovation description
- Evaluation: RBI assesses innovation and risk factors
- Entry Conditions: Negotiate specific testing parameters and boundaries
- Testing Phase: Typically 6 months with limited customers
- Exit: Either full licensing, modification, or discontinuation
For clients developing innovative fintech products: (1) Engage early with the relevant regulator before formal application, (2) Document all consumer protection measures, (3) Prepare clear risk mitigation strategies, (4) Plan for regulatory approval path post-sandbox. Sandbox approval signals regulatory openness but does not guarantee full licensing.
6.5 Emerging Technology Advisory Framework
Advising clients on emerging technologies requires a structured approach that addresses current regulatory gaps while anticipating future developments.
Technology Risk Assessment Framework
- Technology Mapping: Understand the technology, its capabilities, and limitations
- Use Case Analysis: Identify specific applications and affected stakeholders
- Regulatory Scan: Map applicable existing regulations (even if not tech-specific)
- Gap Analysis: Identify regulatory uncertainties and risks
- Risk Mitigation: Design governance frameworks for identified risks
- Monitoring: Track regulatory developments and emerging standards
Contractual Risk Allocation
For emerging technology deployments, contracts should address:
- Liability Caps: Clear allocation of liability between technology provider and deployer
- Regulatory Change: Who bears cost of compliance with new regulations?
- IP Ownership: Clear ownership of AI models, training data, outputs
- Performance Standards: Measurable benchmarks for technology performance
- Audit Rights: Rights to audit algorithms, data practices, security
- Exit Rights: Data portability and transition assistance provisions
When advising on emerging technologies in regulatory grey areas: (1) Document the analysis supporting current compliance position, (2) Build flexibility into contracts for regulatory changes, (3) Recommend governance structures exceeding current requirements, (4) Consider voluntary standards and certifications, (5) Maintain regular touchpoints for compliance reassessment.
"Emerging technologies do not operate in a legal vacuum. While specific regulations may be absent, fundamental principles of liability, contract, and constitutional rights continue to apply. The corporate counsel's role is to bridge the gap between innovation and accountability." Emerging Technology Legal Practice, CyberLaw Academy
Key Takeaways
- AI governance in India follows NITI Aayog principles; existing liability frameworks apply
- IoT devices must comply with IT Act, DPDPA, CERT-In, and BIS standards
- Blockchain is permitted but cryptocurrencies face 30% VDA taxation
- DPDPA rights (erasure, correction) conflict with blockchain immutability - use off-chain solutions
- Regulatory sandboxes (RBI, SEBI, IRDAI) offer controlled testing environments for innovation
- Contract risk allocation is critical for emerging technology deployments
Knowledge Check
Part 6 Quiz: Emerging Technologies
Test your understanding of AI, IoT, and blockchain legal considerations.