India's AI accountability is moving faster than the law

The reality of current liability

Many businesses believe they have a grace period while the Indian government drafts a formal AI law. However, the legal reality is that courts and sectoral regulators are already assigning liability for AI failures. Companies that wait for a specific statute to begin their compliance efforts are preparing for the wrong deadline.

A recent case in the Supreme Court of India demonstrated this clearly. The court quashed orders that were based on citations generated by an AI tool, which the tool incorrectly attributed to the Supreme Court itself. This incident forced a move toward creating disciplinary norms for advocates who file AI-generated content.

This situation proves that ordinary law, as applied by judges, is already doing the work of regulating AI. The parties involved had to bear the costs of a machine error that no human caught before filing. No new AI statute was required to reach this outcome, showing that the legal system is already reacting to these technologies.

Regulators are moving faster

The sharpest edge of regulation in India is currently coming from sectoral regulators rather than the legislature. For example, the Reserve Bank of India (RBI) recently set a deadline of June 30 for banks and other supervised organizations to turn in assessments regarding cyber risks from frontier AI. Notably, the RBI required the board of directors, rather than just the Chief Information Security Officer, to sign off on these notes.

The RBI also shared a preliminary version of 'Guidance on Regulatory Principles for Model Risk Management' to create a framework for the financial sector. This framework covers models used by commercial banks, payments banks, and other financial institutions. It specifically includes third-party models, AI, and machine learning systems used for commercial purposes.

A critical takeaway from these guidelines is where the risk sits. If a model licensed from a vendor influences a lending choice, the risk lies with the entity putting the AI system to use. The vendor who built the model is not the one held responsible for the operational risk in this specific context.

The DPDPA and data rules

While the government's legislative position on a dedicated AI law is still a work-in-progress, other laws are already in motion. The Digital Personal Data Protection Act (DPDPA) will take full effect on May 13, 2027. This act will apply to any AI system that handles personal data, regardless of whether the processing is done by an external vendor.

Businesses must understand that a pending AI law will only sit on top of existing case laws and sectoral circulars. It will not replace them. Therefore, treating a pending statute as a milestone for compliance is a backwards strategy. Companies must already be compliant with data protection and sectoral rules before a new AI law even arrives.

The core requirement across all these domains is the ability to show your working. For any consequential decision made by an AI system, organizations must have visibility into the process. They must be able to identify which model produced an output, what data it used, and whether a human reviewed it before it was finalized.

Architecture over policy

Many Indian firms have already written policies and appointed committees, but they still cannot answer basic questions about their AI systems. This indicates that the problem is one of architecture rather than just policy. It is often difficult to reconstruct the history of an AI decision after it has happened if the system was not designed to record it from the start.

Recording the model version, the specific prompt used, the retrieved data, and the human sign-off for every decision is only affordable if it is built into the system design. If these logs are not captured in real-time, it can become nearly impossible to reconstruct them later. This is a technical hurdle that requires proactive planning rather than a reactive policy update.

Businesses should be rigorous when questioning AI vendors before procurement. Companies need to know if the system records which model version handled each request and if those records can be exported. They must also understand where inference physically happens, what happens to inputs after processing, and exactly where a human is required to act in the workflow. If a vendor cannot answer these questions plainly, they are effectively transferring the risk to the buyer.