Algorithmic Power and Legal Accountability: The Case for AI Regulation in India

INTRODUCTION

AI is no longer a distant regulatory concern in India. It now influences credit scoring, hiring, insurance, policing, welfare delivery, content moderation, targeted advertising, and the ranking of information that citizens see online. [1]As these systems move from assisting human decision-making to structuring it, the law must confront a deeper question: who bears responsibility when algorithmic systems shape life chances, public discourse, and civil liberties in ways that are opaque, discriminatory, or difficult to challenge? The Indian legal position is still fragmented. There are rules on data protection, cyber offences, intermediary responsibility, consumer harm, and constitutional rights, but there is no dedicated, horizontal framework that addresses the particular risks created by automated decision-making and generative AI.

This article argues that India now needs a principled but context-sensitive model of AI regulation. The case for regulation is not simply that AI can cause harm; many technologies do. The stronger case is that AI concentrates a distinctive kind of power: it enables prediction, classification, persuasion, and surveillance at scale, often without meaningful transparency to the people affected. Existing Indian law addresses pieces of this problem, particularly privacy and platform governance, but it does not yet produce a coherent system of accountability for algorithmic decision-making. A future Indian framework should therefore move beyond abstract ethics and build enforceable duties around risk assessment, transparency, human oversight, auditability, redress, and institutional responsibility[2].

UNDERSTANDING ALGORITHMIC POWERS

The ability of computational systems to influence social and economic outcomes by sorting people, predicting behaviour, allocating opportunities, and curating information is the Algorithmic power. The legal concern is not automation in the abstract, but the fact that these systems increasingly affect access to employment, credit, welfare, education, and online visibility while operating through technical processes that are often opaque to those affected.[3]

This matters because algorithms do more than process data; they can reshape real-world choices and constraints. The central legal question, therefore, is whether such systems can be subjected to standards of fairness, transparency, and accountability consistent with constitutional values such as dignity, equality, liberty, and due process.[4]

LEGAL RISKS CREATED BY AI

The first major risk is privacy. AI systems often depend on large-scale data collection, aggregation, inference, and retention. Where raw personal data is not directly disclosed, algorithmic systems can derive sensitive inferences about health, preferences, political views, location, or socio-economic status. The SC recognition of privacy as a fundamental right in Puttaswamy makes this point constitutionally significant: privacy is not only a matter of secrecy, but also of dignity, autonomy, and decisional freedom. In AI context, legal scrutiny cannot stop at consent forms.[5] It must also consider profiling, function creep, and the disproportionate concentration of informational power.

A second risk is bias and discrimination. AI systems trained on skewed or historically unequal datasets can reproduce and intensify existing social hierarchies. In India, where inequality is deeply structured by caste, class, gender, disability, religion, region, and language, this concern is especially serious. [6]A hiring tool may downgrade candidates from non-elite institutions; a credit-scoring system may penalise people with thin-file or informal economic histories; a content moderation model may perform poorly in Indian languages and dialects. Indian anti-discrimination law in the algorithmic context remains underdeveloped, but Articles 14 and 15 of the Constitution provide a normative basis to question automated practices that operate arbitrarily or produce unjustified unequal effects. The problem is evidentiary as much as doctrinal: unless there is some degree of explanation, testing, or audit access, discrimination may remain invisible.[7]

A third risk is opacity. Many AI systems are difficult to explain, even to the entities deploying them. Others are intentionally kept opaque on grounds of trade secrecy or platform design. This creates obvious legal difficulties. If an individual is denied a loan, suspended from a platform, flagged as fraudulent, or subjected to automated profiling, how is that decision to be contested? A legal order committed to fairness cannot treat explanation as a luxury[8].

A fourth risk concerns deepfakes, misinformation, and manipulation. Generative AI has dramatically lowered the cost of producing synthetic audio, video, and text that appears authentic. These tools can be used for fraud, reputational injury, political deception, non-consensual sexual imagery, and organised disinformation. [9]Deepfakes can distort elections, intimidate women, damage public trust, and overwhelm existing content moderation systems. Indian law offers some partial responses through cyber offences, intermediary obligations, and general criminal law, but enforcement is uneven and remedies are often delayed.

A fifth risk is liability diffusion. AI systems are frequently built, fine-tuned, integrated, and deployed by different actors. One entity develops a base model, another supplies training data, another embeds the model in a service, and yet another uses its outputs for consequential decisions. When harm occurs, each actor may claim that responsibility lies elsewhere.[10] Traditional legal categories, especially fault-based models tied to a single identifiable wrongdoer, struggle in such settings.

EXISTING INDIAN LEGAL FRAMEWORK

India still does not have a standalone statute dealing specifically with AI, yet harms are not entirely outside the law. The present framework is a mix of constitutional principles, data protection law, cyber law, intermediary regulation, and consumer protection. This patchwork can address parts of the problem, but it does so indirectly, which is why the framework often feels reactive rather than purpose-built[11].

The starting point is the Constitution, especially after Puttaswamy, where the SC recognised privacy as a fundamental right under Part III. That judgment is highly relevant to AI because modern AI systems often depend on intensive data processing, behavioural profiling, and predictive inference. More importantly, Puttaswamy treated privacy not merely as secrecy, but as an aspect of dignity, autonomy, and individual choice. In the AI context, this means that legal concerns arise not only when data is stolen or leaked, but also when individuals are persistently monitored, profiled, or nudged through systems they do not meaningfully understand.[12]

The DPDPA, 2023 is now the central statutory reference point for personal data governance in India. It creates obligations for data fiduciaries, recognises consent-based processing and certain legitimate uses, and gives data principals rights such as access to information, correction, erasure, and grievance redressal.[13] For AI regulation, these provisions matter because many high-impact AI systems rely on personal data and large-scale processing. Still, the Act remains a data protection law, not an AI accountability code. Even so, section 8 is important because it requires data fiduciaries to ensure accuracy and completeness where personal data is likely to be used for decisions affecting the data principal. That provision can be read as an indirect safeguard against harmful or unreliable AI-assisted decisions.[14]

The IT Act, 2000 also continues to play a major role. Section 43A provides compensation where a body corporate fails to maintain reasonable security practices in handling sensitive personal data and thereby causes wrongful loss or gain.[15] Other provisions, such as sections 66C and 66D, are relevant to identity theft and cheating by personation, which may become increasingly important in cases involving AI-generated impersonation, voice cloning, or synthetic fraud. Sections 66E, 67, 67A, and 67B may also become relevant in cases involving privacy violations, sexualised synthetic content, or non-consensual deepfake material circulated online.[16]

Another important component is the intermediary liability framework. Section 79 of the IT Act grants conditional safe harbour to intermediaries, subject to due diligence and compliance with the law. [17]This becomes significant where harmful AI-generated content is hosted, amplified, or distributed through digital platforms. The Supreme Court’s decision in Shreya Singhal v. Union of India remains central because it both struck down section 66A and clarified the limits of intermediary takedown obligations. The challenge is to create accountability for harmful synthetic content without reviving overbroad censorship by another route.[18]

The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 add another layer to this framework. These Rules require intermediaries to exercise due diligence, maintain grievance redressal mechanisms, and, in the case of significant social media intermediaries, comply with additional obligations relating to officers, reporting, and user complaints. They are increasingly relevant in discussions around misinformation and deepfakes because the government has expressly linked the Rules to prohibited misinformation, impersonation, and AI-enabled deepfake harms. [19]However, these Rules are still essentially platform-governance instruments. They help with content response and intermediary obligations, but they do not establish a complete legal framework for algorithm design, model testing, explainability, or allocative decision-making.

The Consumer Protection Act, 2019 is also relevant, though it is often overlooked in AI discussions. Where AI tools are marketed to consumers as reliable, neutral, or efficient but in fact generate deceptive, harmful, or deficient outcomes, consumer law may offer remedies through concepts such as unfair trade practice, misleading representation, or deficiency in service. This is particularly relevant in sectors such as fintech, e-commerce, insurance technology, and health-tech applications, where algorithmic outputs may materially influence consumer decisions. Consumer law cannot solve constitutional or structural AI harms, but it does provide a practical route for addressing market-facing misuse. [20]

Taken together, the present Indian legal framework does provide a foundation for regulating some AI-related harms. Privacy can be argued through Puttaswamy and the DPDPA; cyber-enabled impersonation and harmful content can be addressed under the IT Act; platform response duties can be triggered through the IT Rules; and commercial misrepresentation can be examined under consumer law. [21] It does not yet treat AI as a distinct source of regulatory power requiring specific obligations around explainability, non-discrimination, human oversight, and liability allocation. That is precisely why the next step in Indian law must move from indirect control to more direct forms of algorithmic accountability.

GAPS IN THE CURRENT INDIAN FRAMEWORK

The present Indian framework still leaves important gaps, although the problem is not that there is no law at all. The real difficulty is that the existing laws address AI-related harms only indirectly. They regulate data processing, cyber misconduct, intermediary obligations, and consumer injury, but they do not create a direct and coherent framework for algorithmic accountability. Legal control often begins only after harm has occurred, rather than requiring structured safeguards before high-risk AI systems are deployed.[22]

One major gap is the absence of a clear framework for automated decision-making. Indian law does not yet provide a general right to know when an important decision has been materially shaped by AI, nor does it clearly guarantee a right to seek human review of such a decision. This becomes significant in areas like recruitment, lending, insurance, education, and welfare, where algorithmic outputs may influence opportunities in ways that are difficult to detect or challenge. The Digital Personal Data Protection Act, 2023 improves personal data regulation, but it does not fully address the legal consequences of scoring, ranking, profiling, or exclusion through AI systems. [23]

A second gap lies in explainability, bias, and discrimination. The law still does not require deployers of high-impact AI systems to give intelligible reasons for consequential outcomes, and this weakens procedural fairness. It also makes discrimination harder to identify, because opacity can conceal unequal treatment behind claims of technical neutrality. Indian constitutional law, especially Articles 14 and 15, offers a normative basis to challenge arbitrary or unequal treatment, but there is no detailed statutory mechanism designed specifically for discriminatory algorithmic outcomes.[24] This is especially serious because AI bias is often indirect.

Another weakness lies in institutional and public-law oversight. The DPDPA creates the Data Protection Board, but India still lacks a specialised regulatory structure focused on AI risk itself. [25]This matters because AI-related disputes often involve technical questions about model design, testing, deployment, and downstream harm which ordinary institutions may not always be equipped to assess quickly or consistently. The constitutional logic of Puttaswamy suggests that any data-intensive state deployment must satisfy legality, necessity, and proportionality. Yet section 17 of the DPDPA contains broad exemptions, creating concern that some of the most intrusive state uses of AI may evade ordinary safeguards.[26]

Finally, Indian law still does not clearly allocate liability across the AI chain. The entity that develops a model may be different from the one that fine-tunes it, integrates it into a service, or relies on its output for a consequential decision. Existing legal categories can sometimes respond, but they do not yet provide a consistent framework for deciding when liability should rest with the developer, deployer, platform, or end-user institution. Current law provides useful entry points, but it does not yet function as a coherent and rights-protective system of AI governance.[27]

COMPARATIVE PERSPECTIVE WITH THE EU AI ACT

A brief comparison with the European Union is useful because the EU AI Act offers the first comprehensive legislative model for AI governance by a major regulator. It adopts a risk-based approach, prohibits certain unacceptable uses, and imposes stricter obligations on high-risk systems, particularly where health, safety, or fundamental rights may be affected. [28]The Act also places emphasis on ongoing risk management and documentation rather than relying only on remedies after harm has occurred[29].

India need not replicate the EU model in full, since enforcement capacity, market realities, and regulatory priorities differ. But the EU approach still offers a practical lesson, not all AI systems should be treated alike, and systems used in areas such as employment, credit, policing, and public services should attract higher standards of transparency, review, and accountability. [30]For India, the comparative value lies less in copying foreign law and more in recognising that a structured, risk-based framework is more effective.

WAY FORWARD FOR INDIA

India should move towards a clearer and more structured AI governance framework based on risk, accountability, and constitutional values. A risk-based model would be more suitable than a one-size-fits-all approach, because all AI systems do not create the same level of legal harm. High-impact uses in credit, employment, healthcare, policing, education, and public services should therefore attract stronger safeguards. [31]

First, India should require algorithmic impact assessments before high-risk AI systems are deployed. These assessments should examine privacy risks, discrimination, data quality, and possible social harm. This approach is consistent with the DPDPA’s recognition of impact assessments and audits for Significant Data Fiduciaries.[32]

Secondly, the law should create a limited right to explanation and human review in cases where AI materially influences an important decision. A person denied a benefit, job, loan, or service should at least know that AI played a role and should be able to seek human reconsideration. This would improve procedural fairness and reduce opaque exclusion.

Thirdly, India should require independent audits for high-risk AI systems. Internal compliance alone is rarely sufficient where systems affect rights at scale. Regular audits can help test accuracy, bias, robustness, and compliance over time rather than only at the point of deployment.[33]

Fourthly, India needs clearer rules on deepfakes and synthetic media. Harmful AI-generated audio, video, or images should be subject to prompt takedown and grievance mechanisms, while synthetic content should be identifiable where feasible. This reflects the broader regulatory trend towards labelling AI-generated content.

Fifthly, the law should provide clearer liability allocation across the AI chain. Developers, deployers, platforms, and institutions using AI should not be able to shift responsibility endlessly onto one another.

Sixthly, stronger safeguards are needed for state use of AI. Any public-sector deployment should satisfy legality, legitimate aim, necessity, in line with the constitutional reasoning in Puttaswamy. This is especially important where AI affects surveillance, welfare, policing, or other core public functions. [34]

CONCLUSION

AI has moved beyond the realm of technical convenience and now affects rights, opportunities, and public discourse in ways that law can no longer ignore. In India, the existing legal framework does provide important starting points through constitutional privacy doctrine, the DPDPA, 2023, the IT Act, 2000, and intermediary obligations. Yet these measures remain fragmented and do not adequately address the distinctive problems created by algorithmic systems, including opacity, automated discrimination, deepfakes, misinformation, and the diffusion of liability across multiple actors.

The real case for AI regulation in India is therefore not based on fear of innovation, but on the need to ensure that technological power remains subject to legal accountability. Puttaswamy makes clear that privacy is closely tied to dignity, autonomy, and personal choice, and those constitutional values cannot be preserved if high-impact systems operate without transparency or effective review. India’s future framework should accordingly encourage innovation, but only within limits that protect fairness, accountability, and human dignity. In the long run, the legitimacy of AI in India will depend not on how rapidly it is adopted, but on whether its use remains consistent with constitutional rights and democratic values.

Reference(S):

[1] Digital Personal Data Protection Act 2023, No 22 of 2023, https://www.indiacode.nic.in/handle/123456789/22037?view_type=browse accessed 20 June 2026.

[2] Digital Personal Data Protection Act 2023; Information Technology Act 2000, No 21 of 2000, WIPO Lex https://www.wipo.int/wipolex/en/legislation/details/23164 accessed 20 June 2026

[3] Justice K S Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1; Supreme Court Observer, ‘Fundamental Right to Privacy’ https://www.scobserver.in/cases/puttaswamy-v-union-of-india-fundamental-right-to-privacy-case-background/ accessed 20 June 2026.

[4] Justice K S Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1; CLPR TransLaw, ‘Justice K.S. Puttaswamy vs. Union of India’ https://translaw.clpr.org.in/case-law/justice-k-s-puttaswamy-anr-vs-union-of-india-ors-privacy/ accessed 20 June 2026.

[5] Justice K S Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1, https://www.scobserver.in/cases/puttaswamy-v-union-of-india-fundamental-right-to-privacy-case-background/ accessed 20 June 2026.

[6] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 20 June 2026.

[7] Constitution of India Articles14 and 15.

[8] Information Technology Act 2000, ss 66C, 66D and 66E, India Code PDF https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf accessed 20 June 2026

[9] Future of Life Institute, ‘The Act Texts’ (EU Artificial Intelligence Act) https://artificialintelligenceact.eu/the-act/ accessed 20 June 2026.

[10] Future of Life Institute, ‘The Act Texts’ (EU Artificial Intelligence Act) https://artificialintelligenceact.eu/the-act/ accessed 20 June 2026.

[11] Severyna Magill, ‘The Right to Privacy and Access to Abortion in a Post-Puttaswamy World’ (2020) 3(2) University of Oxford Human Rights Hub Journal 161 https://ohrh.law.ox.ac.uk/wp-content/uploads/2021/04/U-of-OxHRH-J-The-Right-to-Privacy-and-Access-to-Abortion-1.pdf accessed 20 June 2026.

[12] Justice K S Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1, https://www.scobserver.in/cases/puttaswamy-v-union-of-india-fundamental-right-to-privacy-case-background/ accessed 20 June 2026.

[13] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 20 June 2026.

[14] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 20 June 2026.

[15] Information Technology Act 2000, s 43A, India Code PDF https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf accessed 21 June 2026.

[16] Information Technology Act 2000, No 21 of 2000, India Code PDF https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf accessed 21 June 2026.

[17] Information Technology Act 2000, No 21 of 2000, India Code PDF https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf accessed 21 June 2026.

[18] Shreya Singhal v Union of India (2015) 5 SCC 1; Global Freedom of Expression, ‘Shreya Singhal v. Union of India’ https://globalfreedomofexpression.columbia.edu/cases/shreya-singhal-v-union-of-india/ accessed 21 June 2026.

[19] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021; Ministry of Electronics and Information Technology https://www.meity.gov.in/content/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021 accessed 21 June 2026.

[20] Consumer Protection Act 2019, No 35 of 2019, India Code https://www.indiacode.nic.in/handle/123456789/21423?view_type=browse accessed 21 June 2026.

[21] Justice K S Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1, https://www.scobserver.in/cases/puttaswamy-v-union-of-india-fundamental-right-to-privacy-case-background/ accessed 21 June 2026.

[22] Severyna Magill, ‘The Right to Privacy and Access to Abortion in a Post-Puttaswamy World’ (2020) 3(2) University of Oxford Human Rights Hub Journal 161 https://ohrh.law.ox.ac.uk/wp-content/uploads/2021/04/U-of-OxHRH-J-The-Right-to-Privacy-and-Access-to-Abortion-1.pdf accessed 21 June 2026.

[23] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 21 June 2026.

[24] Constitution of India Articles14 and 15

[25] Digital Personal Data Protection Act 2023, ss 8 and 10, Ministry of Electronics and Information Technology https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf accessed 21 June 2026.

[26] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 21 June 2026.

[27] Future of Life Institute, ‘The Act Texts’ (EU Artificial Intelligence Act) https://artificialintelligenceact.eu/the-act/ accessed 21 June 2026.

[28] Future of Life Institute, ‘The Act Texts’ (EU Artificial Intelligence Act) https://artificialintelligenceact.eu/the-act/ accessed 22 June 2026. 

[29] European Parliament, ‘Artificial Intelligence Act: MEPs adopt landmark law’ (12 March 2024) https://www.europarl.europa.eu/news/en/press-room/20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law accessed 22 June 2026.

[30] Future of Life Institute, ‘The Act Texts’ (EU Artificial Intelligence Act) https://artificialintelligenceact.eu/the-act/ accessed 22 June 2026.

[31] Severyna Magill, ‘The Right to Privacy and Access to Abortion in a Post-Puttaswamy World’ (2020) 3(2) University of Oxford Human Rights Hub Journal 161 https://ohrh.law.ox.ac.uk/wp-content/uploads/2021/04/U-of-OxHRH-J-The-Right-to-Privacy-and-Access-to-Abortion-1.pdf accessed 23 June 2026.

[32] The Digital Personal Data Protection Act 2023, No 22 of 2023 (India Code) https://www.indiacode.nic.in/handle/123456789/22037?locale=en accessed 23 June 2026.

[33] Severyna Magill, ‘The Right to Privacy and Access to Abortion in a Post-Puttaswamy World’ (2020) 3(2) University of Oxford Human Rights Hub Journal 161 https://ohrh.law.ox.ac.uk/wp-content/uploads/2021/04/U-of-OxHRH-J-The-Right-to-Privacy-and-Access-to-Abortion-1.pdf accessed 23 June 2026.

[34] Human Dignity Trust, ‘Puttaswamy v. Union of India (2017)’ (24 August 2018) https://www.humandignitytrust.org/resources/puttaswamy-v-union-of-india-writ-petition-civil-no-494-of-2012/ accessed 23 June 2026.