India's Current Liability Gap

When an AI contract analyzer misreads a clause or an AI tutor gives a child wrong information, Indian law offers no clear answer on who pays. The Information Technology Act, 2000 addresses intermediaries, not autonomous decision-makers, and the DPDP Act, 2023 governs data processing rather than algorithmic harm. Courts have begun wrestling with whether the deployer, developer, or user bears responsibility, but no statute assigns fault when an AI system acts without meaningful human review.

Also worth reading: How Does Agentic AI Legal Liability Insurance Address Risks in AI eDiscovery and Legal Drafting? · How is AI legal drafting transforming India's legal workflow in 2025? · How Is Agentic AI Legal Tech in India Solving Real Pain Points for Lawyers?

GCCs and legal teams in India currently manage this ambiguity through contracts, indemnity clauses, and insurance, effectively privatizing liability that legislation has not allocated. For AI eDiscovery, legal research, and document drafting tools, the practical result is that liability flows to whoever deployed the system, regardless of where the defect originated. Until Parliament enacts a dedicated AI liability framework, Indian organizations should assume they carry the risk.

AI eDiscovery Risks in Litigation

When AI gets it wrong in India, liability rarely lands on the model itself. Under the Information Technology Act, 2000, intermediaries enjoy safe harbour, but that shield weakens once a tool is deployed for legal work rather than passive hosting. The advocate or firm that relies on AI-generated eDiscovery output, contract analysis, or drafted pleadings typically owns the error, because professional negligence and the Advocates Act place the duty of care squarely on the human who signs off. Vendors shift risk through contracts, disclaimers, and indemnity clauses, leaving clients to absorb the fallout.

For in-house counsel and Global Capability Centres, the picture is murkier. If an AI system is given authority to act, Indian courts have yet to settle whether the principal or the tool provider bears responsibility. Data protection under the DPDP Act adds another layer, since flawed training data can trigger separate penalties. The practical lesson from India's early AI contract analyzers is blunt: liability follows accountability, and accountability follows whoever chose to trust the output without verification. Until regulators clarify, lawyers remain the last line of defence.

Contract Drafting Errors and Accountability

When an AI tool drafts a contract, reviews discovery documents, or flags a clause in India, the immediate question is who answers for the mistake. Under current Indian law, liability generally rests with the human or entity that deploys the AI, not the AI itself, since machines lack legal personality. A lawyer who relies on an AI-generated clause without independent verification remains professionally accountable under the Advocates Act and Bar Council rules, while a company using AI for eDiscovery or contract analysis typically bears contractual and tortious liability for resulting harm. The Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, add layers of compliance exposure, but neither squarely addresses autonomous AI errors.

The practical lesson from building an India-focused contract analyzer is that accountability cannot be outsourced to the model. Courts and regulators are watching cases involving AI-run corporations and rogue outputs, and Indian law is not yet fully ready. Until dedicated AI liability rules emerge, the safest posture is contractual allocation: clear indemnities, disclosure of AI use, human-in-the-loop review, and documented audit trails. Whoever profits from the AI's speed must also own its errors.

Lessons from the EU AI Act

India currently lacks a dedicated statutory framework pinning liability on a specific party when AI systems cause harm, so claimants must rely on scattered provisions in the Information Technology Act, the Indian Contract Act, and tort law. In practice, liability often lands on the deployer—the hospital, bank, or company using the AI—rather than the developer, because the deployer controls the context of use and holds the direct relationship with the affected person. This mirrors the EU AI Act's risk-based allocation, where providers bear heavier duties for high-risk systems but deployers remain accountable for oversight failures.

For India's GCCs and AI-run entities, the picture grows murkier when autonomous agents negotiate or execute contracts, since Indian law still presumes a human author with legal capacity. Courts will likely ask who selected the model, who set its boundaries, and who could have prevented the error. Until Parliament enacts clear rules, contracts, indemnities, and insurance will quietly decide who pays when AI gets it wrong.

Building Trustworthy AI Governance

In India, there is no dedicated statute that squarely answers who bears liability when an AI system causes harm, so courts and regulators fall back on existing frameworks. Under the Information Technology Act, 2000, intermediaries enjoy safe harbour only if they act as passive conduits, but an AI that drafts contracts, advises clients, or autonomously negotiates may not qualify. The Consumer Protection Act, 2019 and the Digital Personal Data Protection Act, 2023 add duties around deficient services and data misuse, while sector regulators like RBI and SEBI increasingly expect human accountability for algorithmic decisions. The practical result: liability often lands on the deployer, not the developer.

For Indian legal professionals, the risk is sharpest in eDiscovery, legal research, and document drafting, where an AI contract analyzer can misread a clause or fabricate a citation. Bar Council rules on advocate conduct do not excuse errors simply because a tool produced them, and professional negligence claims will target the lawyer or firm that relied on the output. The safer path is contractual: allocate liability explicitly, require human review of every AI-generated artifact, log model versions and prompts, and disclose AI use to clients. Until Parliament enacts clear AI liability rules, governance means assuming responsibility rather than outsourcing it.

Liability Frameworks: India vs EU AI Act

QuestionIndiaEU AI Act
Who bears liability when AI causes harm?No dedicated AI liability statute; liability falls on the deployer or user under existing tort, contract, and IT Act provisions, with developers rarely held directly liable.Providers (developers) bear primary liability for high-risk AI systems, with deployers liable for misuse or failure to monitor.
Is there a statutory basis for AI liability?No. Courts rely on Sections 43A and 66 of the IT Act, 2000, plus consumer protection and contract law.Yes. The AI Act imposes explicit obligations on providers, deployers, importers, and distributors.
How is fault determined?Through general negligence principles; the burden is on the victim to prove causation and fault.Through a risk-based tiered system; high-risk systems require conformity assessments, logging, and human oversight.
What remedies exist for victims?Civil damages, compensation under the IT Act, and consumer forum complaints; no AI-specific redressal mechanism.Fines up to €35 million or 7% of global turnover, plus market withdrawal and civil liability under the AI Liability Directive.
India lacks a dedicated AI liability framework, leaving victims to navigate fragmented tort, contract, and IT Act provisions where fault and causation are hard to prove against opaque models. The EU AI Act instead assigns clear, tiered obligations to providers and deployers, backed by heavy fines and mandatory risk assessments. For India's GCCs and AI-driven businesses, this gap creates legal uncertainty that demands urgent statutory clarity.