Data Security Council unveils India-specific agentic AI liability guide

The DSCI guide outlines how liability should be allocated across enterprises, AI developers and service providers, highlighting governance risks in autonomous AI systems

The Data Security Council of India (DSCI) has released an India-focused artificial intelligence liability industry guide for agentic AI. This could help in determining who bears responsibility if an agent goes rogue or deviates from its duties.  

 

“Organisations need clear decision spaces and instruments they can actually implement. Unless these are factored in across the value chain, conversations on liability will not turn into practical, sector-specific action,’ said Vinayak Godse, CEO of DSCI.

 

Rather than proposing new standards, the guide explains how established binding doctrines apply to autonomous, multi-vendor AI systems. It maps where responsibility sits across the AI use value chain.

 

 

The report covers the domains of agentic AI, the forms of impact and risks these systems may create, and the factors that shape accountability. It guides the industry on the importance of a proportionate, clearly allocated approach to governance, oversight, and liability for India.

 

The DSCI guidance states that liability can be determined based on an understanding of concepts of the hosting and control of AI models.

 

“The hosting choices allocate liability differently. Hosting architecture and choices dictate whether liability is distributed across a value chain or concentrated within the enterprise, leading to the central paradox of enterprise AI deployment,” it said.

 

“Architectural control and ownership over the decision spaces eliminate your external liability shield. The enterprises would likely become the primary legal owner of both infrastructure and agent behaviour,” the report added.

 

The DSCI guide states that responsibility essentially lies with five groups that bring AI into use: User organisations, service providers and integrators, product companies and startups, tool and framework providers, and cloud and infrastructure providers, apart from model providers.

 

However, it cautions against a framing liability model as binaries.

 

“Framing liability as an either/or choice between the end user organisation and upstream player in the value chain would be legally flawed. It would be technically inaccurate, commercially paralysing, and eroding the level playing field,” it cautioned.

 

The report added that AI enters enterprises through browsers, co-pilots, GenAI in enterprise software and AI models and tools. Each route carries its own liability question and, hence, every route needs attention and careful examination. Unknown and unidentified exposure would leave the firm accountable without having had the opportunity to act.

 

“Lastly, AI brings conditions and risks we are not yet equipped to anticipate, and the framework must stay adaptive enough to deal with them as they emerge,” Godse said.