The Data Security Council of India (DSCI) has proposed an industry framework to determine liability when autonomous AI agents cause harm. It recommends assigning responsibility across the AI value chain based on the decisions each participant makes and the extent of its control over the system.
The discussion paper, titled ‘AI Liability: Industry Guidance for Agentic AI’, seeks to apply existing laws, contractual obligations and sectoral regulations to agentic AI systems rather than introduce a new regulatory framework.
It identifies five groups involved in enterprise AI deployment: end-user organisations, service providers and integrators, product companies and startups, tool and framework providers, and cloud and infrastructure providers. AI model providers are examined separately.
DSCI argues that liability should not rest solely with the company deploying an AI system or the technology provider supplying it. Instead, accountability should be determined by examining who controls key decisions, from model selection and system configuration to tool access, permissions and human oversight.
The paper highlights the risks posed by the shift from generative AI to agentic AI. While conventional AI systems primarily generate outputs for human review, AI agents can independently plan tasks, access tools, interact with application programming interfaces (APIs) and execute instructions with limited human intervention.
This raises the risk of unauthorised transactions, incorrect payments and data breaches, particularly when multiple agents interact or delegate tasks across organisations, potentially leading to cascading errors and wider disruptions.
DSCI identifies 12 areas of potential harm, including privacy breaches, security threats, discrimination, safety risks, inaccurate outputs, intellectual property violations, deepfakes, loss of control and AI-enabled cybercrime.
It also flags operational challenges that could complicate liability assessments such as changes in model behaviour, autonomous decision-making, human approval fatigue, delegation between agents and difficulties in reproducing how an AI system arrived at a particular action.
Liability To Depend On Control Across AI Value Chain
The framework draws on existing legal principles, including duty of care, product liability, causation and comparative negligence. It proposes an authority map to establish who controlled a particular decision and whether they could have prevented or limited the resulting harm.
Under this approach, companies deploying AI agents would be responsible for choosing use cases, setting permissions, assessing operational risks and deciding when human approval is required. Product companies could be held accountable for product claims, default settings and model versions, while system integrators would be responsible for system design, approval mechanisms and handling failures.
Tool and framework providers would be accountable for the orchestration, memory and safety features they supply. Cloud and infrastructure providers would have responsibilities around system isolation, identity management, data retention and platform logs.
The framework also links liability to the type of AI model and how it is deployed. Companies using open-source or open-weight models on their own infrastructure would take on greater responsibility for auditing, modifying and monitoring them.
Those using closed models through managed APIs could seek contractual recourse against model providers, although this would depend on the terms of their agreements and applicable liability caps.
DSCI said model providers should remain responsible for the capabilities they develop, safety measures, disclosures about known limitations and notifications of significant changes in model behaviour. However, their liability could reduce when other participants take control of how models are deployed and used.
DSCI Recommends Layered Safeguards For AI Agents
To limit these risks, the framework proposes six safeguards, including removing unnecessary capabilities, restricting system permissions, requiring human approval for significant or irreversible actions, monitoring AI behaviour, enabling systems to scale back operations safely and deploying kill switches with clearly defined ownership.
It also recommends that organisations assess risks before deploying AI agents, include liability provisions in procurement contracts and regularly review safeguards.
DSCI has also invited AI developers, industry members, policy think tanks and other stakeholders to submit feedback on the proposal. The council plans to publish further guidance on authority mapping, AI deployment in physical and biological systems, and agents operated by customers and business partners.
The proposed framework comes amid growing scrutiny of the risks posed by increasingly autonomous AI systems. Last month, MeitY proposed a consent-based framework to facilitate data sharing for AI model training in India.
Called the Data Empowerment and Protection Architecture (DEPA) for AI Training, the framework aims to help startups, businesses and academic institutions access large-scale, India-specific datasets while protecting citizens’ privacy and ensuring compliance with the Digital Personal Data Protection (DPDP) Act.
It also proposes a techno-legal architecture that would allow organisations to collaborate on AI model training without directly transferring the underlying datasets.
Separately, the Telecom Regulatory Authority of India (TRAI) released draft guidelines on the responsible use of AI in telecom networks and service delivery. The regulator has invited stakeholder comments on the proposals by November 27.
The post DSCI Floats Framework To Determine Liability For Harm Caused By AI Agents appeared first on Inc42 Media.