India is home to over 2,100 global capability centres, with a talent base of around 2.36 million professionals, according to the CII GCC summit in July 2026. These centres are increasingly involved in AI, data, cybersecurity, and product ownership, which means they design, train, test, and run AI models. The issue of who is liable when an AI system makes a mistake remains unclear.

The Indian government has released the India AI Governance Guidelines, which propose a graded liability system based on the function a party performs, the level of risk involved, and whether the party observed due diligence. The Guidelines do not propose a separate AI statute at this stage, instead relying on existing legislation to handle AI risk.

Existing Laws and Liability

The Digital Personal Data Protection Rules, 2025, with main operational duties applying from mid-May 2027, will govern data protection for AI systems. The Rules mandate reasonable security safeguards and breach reporting to the Data Protection Board and affected individuals, with a detailed report to the Board within 72 hours. Penalties for non-compliance can go up to ₹250 crore.

Other laws that apply to AI systems include the IT Act, the Intermediary Rules, and the Consumer Protection Act, 2019. Section 85 of the IT Act can fasten liability on persons in charge of a company’s business when the company contravenes the Act. The Intermediary Rules require labelling and provenance metadata for synthetically generated information, applicable to intermediaries. The Consumer Protection Act can reach manufacturers, service providers, and sellers of products or services that use AI.

Sector regulators, such as the Reserve Bank of India and SEBI, also have guidelines for AI use in regulated entities. These guidelines require board-approved AI policies, risk-based AI audits, and responsibility for data security and legal compliance.

AI Inventory and Governance

A prudent GCC should build an AI inventory, listing every model and AI tool in use or development, and conduct a system-by-system assessment of purpose, function, autonomy, data used, potential inaccuracies, legal compliance, and safeguards. This includes recording the degree of autonomy, data used, and chance of inaccurate or discriminatory outcomes. The GCC should also map roles system by system, checking the source of data and confirming the legal basis for using it.

Rework the intra-group agreement to cover liability allocation, indemnities, audit and documentation rights, IP ownership, and response to Indian regulators, as generic templates often lack these provisions. Start DPDP readiness well before May 2027, including data mapping, notices, consent flows, and a breach response playbook that meets the 72-hour report requirement.

Put human oversight where decisions affect people, such as hiring, credit, insurance, and customer eligibility. Keep records of how humans can review and override AI output. An employee AI-use policy should be framed, specifying what data can be fed into public generative AI tools and backing it up with training and technical controls.

Tighten vendor and model-provider contracts to include IP indemnities, restrictions on data use for training, incident notification, security standards, and limits of liability. The Indian board should be involved, with a periodic AI risk report, an incident response route, and a review of cyber and technology errors-and-omissions cover.

Four developments deserve attention over the coming months: the DPDP deadline, the national GCC policy framework, the continuing work on a liability regime under the AI Governance Guidelines, and court rulings on copyright, personality rights, and negligence. The regulatory position is complex, with data protection penalties and new rules on synthetic content.

Implementing AI Governance in GCCs

Given the evolving regulatory system, GCCs should prioritize building an AI inventory, which involves listing every model and AI tool in use or development. This inventory should include details such as the data touched by each system, ownership, and affected parties. By doing so, GCCs can better understand their AI footprint and identify potential risks.

Key Legal Considerations for AI in India

Contract and tort law remain relevant for civil claims. Negligence and breach of contract can lead to damages.

Criminal law also applies, with the Bharatiya Nyaya Sanhita covering cheating, forgery, and defamation. Courts have protected personality rights against deepfakes and unauthorised voice or image cloning.

Intellectual property questions are still being tested, with the Delhi High Court finding that OpenAI’s use of ANI’s works fell within the fair dealing exception in the Copyright Act. However, this is not a general assurance that training or running an AI system on third-party content is lawful.

Preparing for Future Regulations

With the DPDP deadline approaching in May 2027, GCCs should start preparing for the new data protection regime. Processor agreements with vendors and model providers should also be reviewed and updated to ensure compliance with the new regulations.

Furthermore, GCCs should involve their boards in AI risk management, providing periodic AI risk reports and defining incident response routes. Cyber and technology errors-and-omissions cover should also be reviewed to ensure that it includes AI-related risks. By taking these steps, GCCs can demonstrate their commitment to responsible AI governance and minimize potential liabilities.