The Data Security Council of India (DSCI) has released a discussion paper proposing an industry framework to allocate liability when autonomous AI agents cause harm.
Key takeaways
- Liability based on control: Responsibility is tied to decisions and control points across the AI value chain.
- Five stakeholder groups: End‑user organisations, service providers and integrators, product firms and startups, tool/framework providers, and cloud/infrastructure providers are identified.
- Agentic AI risks: Independent planning, tool access and API interaction raise chances of unauthorized transactions, data breaches and cascading errors.
- 12 harm categories: Include privacy breaches, security threats, discrimination, safety risks, inaccurate outputs, IP violations and AI‑enabled cybercrime.
- Legal basis: The model draws on duty of care, product liability, causation and comparative negligence principles.
Framework details
DSCI’s paper, titled “AI Liability: Industry Guidance for Agentic AI,” recommends applying existing laws, contractual duties and sectoral regulations rather than creating new legislation. It separates AI model providers from other participants and proposes an authority map to pinpoint who controlled a specific decision and could have mitigated harm.
Stakeholder responsibilities
Under the proposed scheme, end‑user organisations would choose use cases, set permissions, assess operational risks and decide when human approval is required. Product companies could be liable for product claims, default settings and model versions. Service providers and system integrators would bear responsibility for system design, approval mechanisms and failure handling. Tool and framework providers, as well as cloud and infrastructure vendors, would be accountable for the capabilities they enable.
Challenges in assessing liability
The paper notes operational difficulties such as evolving model behaviour, autonomous decision‑making, human approval fatigue, delegation between agents and the difficulty of reproducing an AI’s decision path. These factors could complicate causation analysis and comparative negligence assessments.