Data Security Council unveils AI liability guide for Indian enterprises
Bengaluru, Oct 30, 2026
The DSCI guide outlines how liability should be allocated across enterprises, AI developers and service providers, highlighting governance risks in autonomous AI systems
The Data Security Council of India (DSCI) has released an India-focused AI liability industry guide for agentic AI. This guide could go a long way in determining who bears responsibility if an agent goes rogue or deviates from its duties.
Rather than proposing new standards, the guidance explains how established binding doctrines apply to autonomous, multi-vendor AI systems and maps where responsibility sits across the value chain that brings AI into use.
It covers the domains of agentic AI, the forms of impact and risks these systems may create, and the factors that shape accountability. It also sets out why a proportionate, clearly allocated approach to governance, oversight and liability matters for India, to guide the user industry while accelerating responsible AI adoption.
“Ascertaining liability based on where they are hosted and who is owning and controlling the models would play an important role in determining the liability. The hosting choices allocate liability differently. Hosting architecture and choices dictate whether liability is distributed across a value chain or concentrated within the enterprise, leading to the central paradox of enterprise AI deployment. Architectural control and ownership over the decision spaces eliminate your external liability shield. The enterprises would likely become the primary legal owners of both infrastructure and agent behaviour,” the report said.
The responsibility essentially lies with five groups that bring AI into use. They are user organisations, service providers and integrators, product companies and startups, tool and framework providers, cloud and infrastructure providers, besides the model providers.
“Liability as a binary choice between the end-user organisation and players in the value chain. Framing it as an either/or choice between the end-user organisation and an upstream player in the value chain would be legally flawed. It would be technically inaccurate, commercially paralysing, and erode the level playing field,” it cautioned.
The report also said that AI enters enterprises through various routes, such as browsers, co-pilots, GenAI in enterprise software, and AI models and tools. Each route carries its own liability question, and hence every route needs attention and careful examination. Exposure that is not known or identified would leave the enterprise accountable without having had the opportunity to act.
“Organisations need clear decision spaces and instruments they can actually implement. Unless these are factored in across the value chain, conversations on liability will not turn into practical, sector-specific action. Lastly, AI brings conditions and risks we are not yet equipped to anticipate, and the framework must stay adaptive enough to deal with them as they emerge,” Vinayak Godse, CEO of DSCI, said.
[The Business Standard]
