67
Autonomous artificial intelligence (AI) agents raise an important question:who is responsible when they cause harm? The Data Security Council of
India (DSCI) has issued guidance on assessing accountability across organisations and technology providers involved in deploying these
systems.
Published on October 28, 2026, the document, AI Liability: Industry Guidance for Agentic AI, explains how established legal principles could apply to autonomous systems operating across multiple vendors. DSCI argues that responsibility should not automatically fall on either the company using an AI tool or the provider that developed its model. Instead, each participant's role, decisions and degree of control must be examined. The guide is an industry discussion document, not a new law or regulatory mandate.
Consider a hypothetical procurement agent authorised to review invoices and initiate supplier payments. If it accepts altered bank details and transfers funds without the required verification, investigators would need to examine the model's output, software integration, access permissions, payment controls and the company's deployment decisions. The key question would be which participants had the authority and technical ability to prevent the transfer. This is an illustration, not a reported incident. DSCI considers the responsibilities of end-user organisations, service providers and integrators, product companies, tool and framework developers, and providers of computing infrastructure and AI models. It also highlights hosting arrangements, system architecture, monitoring and the ability to intervene when an agent behaves unexpectedly.
The document draws on established concepts, including duty of care, causation, foreseeability and product liability. Their application depends on the facts and relevant laws; the guide does not determine liability in individual cases.
DSCI describes the guidance as a living document and is seeking feedback from industry, government, legal and academic stakeholders. As AI agents move from making recommendations to executing business actions, organisations will need clear accountability structures, enforceable safeguards and records of what their systems were authorised to do.
Published on October 28, 2026, the document, AI Liability: Industry Guidance for Agentic AI, explains how established legal principles could apply to autonomous systems operating across multiple vendors. DSCI argues that responsibility should not automatically fall on either the company using an AI tool or the provider that developed its model. Instead, each participant's role, decisions and degree of control must be examined. The guide is an industry discussion document, not a new law or regulatory mandate.
Consider a hypothetical procurement agent authorised to review invoices and initiate supplier payments. If it accepts altered bank details and transfers funds without the required verification, investigators would need to examine the model's output, software integration, access permissions, payment controls and the company's deployment decisions. The key question would be which participants had the authority and technical ability to prevent the transfer. This is an illustration, not a reported incident. DSCI considers the responsibilities of end-user organisations, service providers and integrators, product companies, tool and framework developers, and providers of computing infrastructure and AI models. It also highlights hosting arrangements, system architecture, monitoring and the ability to intervene when an agent behaves unexpectedly.
The document draws on established concepts, including duty of care, causation, foreseeability and product liability. Their application depends on the facts and relevant laws; the guide does not determine liability in individual cases.
DSCI describes the guidance as a living document and is seeking feedback from industry, government, legal and academic stakeholders. As AI agents move from making recommendations to executing business actions, organisations will need clear accountability structures, enforceable safeguards and records of what their systems were authorised to do.
