The Data Security Council of India (DSCI) has proposed an industry framework to determine liability when autonomous AI agents cause harm. It recommends assigning responsibility across the AI value chain based on the decisions each participant makes and the extent of its control over the system.

The discussion paper, titled ‘AI Liability: Industry Guidance for Agentic AI’, seeks to apply existing laws, contractual obligations and sectoral regulations to agentic AI systems rather than introduce a new regulatory framework.

It identifies five groups involved in enterprise AI deployment: end-user organisations, service providers and integrators, product companies and startups, tool and framework providers, and cloud and infrastructure providers. AI model providers are examined separately.

DSCI argues that liability should not rest solely with the company deploying an AI system or the technology provider supplying it. Instead, accountability should be determined by examining who controls key decisions, from model selection and system configuration to tool access, permissions and human oversight.

The paper highlights the risks posed by the shift from generative AI to agentic AI. While conventional AI systems primarily generate outputs for human review, AI agents can independently plan tasks, access tools, interact with application programming interfaces (APIs) and execute instructions with limited human intervention. 

This raises the risk of unauthorised transactions, incorrect payments and data breaches, particularly when multiple agents interact or delegate tasks across organisations, potentially leading to cascading errors and wider disruptions.

DSCI identifies 12 areas of potential harm, including privacy breaches, security threats, discrimination, safety risks, inaccurate outputs, intellectual property violations, deepfakes, loss of control and AI-enabled cybercrime.

Source link