Artificial intelligence is moving beyond answering questions and generating content. AI agents can now interact with software, access information, use external tools and carry out tasks with limited human involvement. But this creates an important question for businesses: who is responsible when an AI agent makes a mistake?
The Data Security Council of India (DSCI) has addressed this issue through a new industry guidance document titled AI Liability: Industry Guidance for Agentic AI. The framework explains how responsibility may be assessed when autonomous AI systems cause harm, particularly when several companies and technology providers are involved.
Importantly, this is an industry guidance document, not a new government law or binding regulation. Its purpose is to help Indian businesses understand existing legal principles and apply them to the growing use of agentic AI.
Why AI Agent Accountability Is Becoming Important
Traditional software generally follows instructions programmed by developers. AI agents are different because they can interpret requests, make decisions, select tools and complete multi-step tasks. For example, a company could use an AI agent to process customer refunds. The agent might access customer records, check payment information, communicate with a payment system and initiate a refund.
Now imagine that the agent processes the wrong refund or transfers money to an incorrect account. Who should be held responsible? The business that deployed the agent? The company that developed the AI model? The software provider that connected it to the payment system? Or the cloud provider hosting the technology?
In many real-world deployments, these different components work together. This makes it difficult to assign responsibility to just one participant. That is the problem DSCI wants businesses to consider before deploying autonomous AI systems.
DSCI Says Responsibility Cannot Be Assigned to Just One Company
One of the central ideas in the guidance is that liability should not automatically fall entirely on the organisation using an AI system or solely on the technology provider. Instead, responsibility needs to be assessed across the value chain. The guidance identifies several participants involved in bringing agentic AI into use:
- User Organisations: Businesses that deploy AI agents and decide what tasks they can perform.
- Service Providers and Integrators: Companies that connect AI models with business applications, systems and workflows.
- Product Companies and Startups: Developers that build AI products and applications.
- Tool and Framework Providers: Companies supplying the tools and software frameworks that agents use to perform tasks.
- Cloud and Infrastructure Providers: Businesses providing the computing infrastructure and hosting environment.
Model providers are also an important part of the wider AI ecosystem. The responsibility of each participant depends on its role, decisions, level of control and ability to prevent or manage the risk.
Why Hosting And Control Matter
An important aspect of the DSCI guidance is the relationship between hosting architecture and liability. Consider two businesses using the same AI model.
The first company uses a third-party AI service with limited control over the underlying infrastructure. The second hosts the model itself, connects it to internal applications and independently controls the tools and permissions available to the agent. Their responsibilities may be different.
A company that controls the infrastructure, agent permissions, instructions and decision-making environment may have greater responsibility for how the system operates. In simple terms, businesses cannot assume that using an external AI model automatically transfers all responsibility to its developer. The way an AI system is configured and deployed matters just as much as the model itself.
What This Means For Indian Businesses
The guidance is particularly relevant as Indian companies experiment with AI agents in banking, customer service, e-commerce, healthcare, insurance and enterprise software. Businesses are increasingly allowing AI systems to interact with customer databases, internal documents, financial applications and other sensitive information.
This creates risks that go beyond incorrect answers. An AI agent could expose confidential information, execute an unauthorised transaction, change important records or make a decision that affects a customer. Companies should therefore consider several safeguards before deploying autonomous AI agents:
- Define Permissions: Give AI agents access only to the information and tools they actually need.
- Maintain Human Oversight: Require human approval for sensitive actions, such as financial transactions or major account changes.
- Maintain Activity Logs: Record the instructions, tool calls and decisions made by AI agents.
- Test Before Deployment: Check how agents behave when they receive incorrect, misleading or unexpected instructions.
- Establish Accountability: Clearly document which teams and technology partners are responsible for different parts of the system.
- Prepare Incident Response Plans: Establish procedures for stopping an agent and investigating its actions if something goes wrong.
These measures can help businesses reduce operational risks and understand where responsibility may lie.
Is DSCI Introducing A New AI Law In India?
No. This distinction is important. DSCI is an industry body, and its document is intended as practical guidance for organisations adopting agentic AI. It does not independently create new legal obligations, impose penalties or replace existing Indian laws. Instead, it explains how established legal principles may apply to complex AI deployments involving multiple companies and technology providers.
The document also highlights the need for proportionate governance, appropriate oversight and clearly allocated responsibilities. This means businesses should treat the guidance as a reference for strengthening their AI governance practices, while continuing to comply with applicable laws and regulations.
DSCI’s AI Liability Guidance: Key Areas
| Area | What It Covers |
|---|---|
| User Organisations | Deployment, permissions and operational oversight |
| AI Developers | Product design and development responsibilities |
| Service Providers | Integration and workflow configuration |
| Tool Providers | Software frameworks and external tools |
| Cloud Providers | Hosting and infrastructure control |
| Governance | Monitoring, risk management and accountability |
| Legal Position | Application of existing legal principles, not a new law |
Conclusion
AI agents are becoming more capable, but greater autonomy also creates new questions about accountability. When an AI system interacts with multiple platforms and companies, identifying who controlled a particular decision becomes increasingly important.
DSCI’s guidance gives Indian businesses a useful starting point for addressing this challenge. As agentic AI becomes more common, companies will need to focus not only on what their AI systems can do, but also on the permissions, safeguards and responsibilities surrounding them.
Follow Us: Facebook | X | Instagram | YouTube | Pinterest
