AI Liability Under the IT Act

1. The Foundation of Civil Liability: Section 43

When harm occurs and the safe harbour of Section 79 doesn't apply, the IT Act provides a framework for imposing civil liability, meaning financial compensation rather than criminal punishment. The central provision for this is Section 43: Penalty and compensation for damage to computer, computer system, etc.

This section lists a series of acts which, if done by a person without the permission of the owner, result in liability to pay damages by way of compensation.

To understand the specific actions that trigger this liability, let's review the detailed breakdown of Section 43.

As the video explained, Section 43 creates liability for a wide range of actions. For our analysis of AI systems, the most relevant contraventions include:

• s. 43(a): Accessing or securing access to a computer or network.
• s. 43(b): Downloading, copying, or extracting any data.
• s. 43(c): Introducing or causing to be introduced any computer contaminant or virus.
• s. 43(d): Damaging or causing to be damaged any computer, system, network, or data.
• s. 43(f): Denying or causing the denial of access to any person authorized to access.
• s. 43(g): Destroying, deleting, or altering any information.

Now, consider how an AI system's malfunction or misuse could map to these contraventions:

• An AI-powered web scraping tool that gathers data from websites without permission could fall under s. 43(b).
• An AI system that hallucinates and writes corrupted data into a critical database could be seen as "damaging data" under s. 43(d).
• A flawed AI-based biometric security system that incorrectly locks out an authorized employee would be "denying access" under s. 43(f).

However, a fundamental assumption is built into the law's language, which creates a major problem when dealing with modern AI.

2. The "Human-Centric" Problem: Applying Old Laws to New Tech

Section 43 begins with the phrase: "If any person... without permission of the owner...". This language presupposes a human actor with agency. This human-centric design, which treats technology as a mere tool, creates profound interpretive challenges when the harm is caused by an autonomous or semi-autonomous AI system.

The following academic paper digs into this precise gap between the law's text and AI's reality.

As the paper argues, the IT Act treats technology as a tool wielded by a human, not as an independent source of harmful conduct. This leads to critical questions:

• If an AI independently generates malware and launches an attack, who is the "person" who committed the act under Section 43?
• If an AI's behavior was not directly programmed or foreseeable by its developer, can we say the developer acted "without permission"?
• Does the chain of legal responsibility break when there is no direct human involvement?

This issue is widely recognized. Legal experts note that the existing definitions in the IT Act are simply not a good fit for complex AI systems.

3. The Adjudication Process: How Liability is Decided

Despite these challenges, a formal process exists within the IT Act for hearing these complaints and awarding compensation. This is not done by a regular civil court, but through a specialized quasi-judicial process.

• Section 46 (Power to Adjudicate): The Central Government appoints an Adjudicating Officer (AO) to hold an inquiry and decide cases of contravention under the Act. The AO has the powers of a civil court.
• Section 47 (Factors to be taken into account by the adjudicating officer): When deciding the amount of compensation, the AO must consider:
  1. The amount of gain or unfair advantage made as a result of the default.
  2. The amount of loss caused to any person.
  3. The repetitive nature of the default.

The following infographic illustrates the step-by-step procedure the AO follows.

As you can see, the process is structured to handle these specific technology-related civil claims efficiently. It begins with a complaint, notice is issued, a hearing is held, and if necessary, a full inquiry with evidence is conducted before the AO passes a final order awarding compensation or dismissing the complaint.

In an AI context, an AO applying Section 47 would have to grapple with complex questions. If an AI's bias causes repetitive discrimination, this would weigh heavily under the "repetitive nature" clause. Quantifying the "loss caused" by an AI's hallucination or the "unfair advantage" gained by a company using a manipulative algorithm would be novel and challenging tasks for an AO.

4. Proposed Solutions: Adapting Liability for the AI Era

Given the inadequacy of the current law, legal scholars and policymakers are actively debating new models for liability. Simply stretching the old definitions is not a sustainable solution. The paper on AI-generated malware you reviewed earlier proposes a more sophisticated, multi-layered approach.

The proposed hybrid liability model offers a structured way to close the liability gap, suggesting a distribution of responsibility:

1. Primary Strict Liability for Developers: This holds the creators of the AI system strictly liable for the harm it causes, regardless of fault. The rationale is that developers are best positioned to build in safeguards and should bear the risk since they profit from the technology.
2. Secondary Responsibility for Deployers: The entity using the AI (like the hospital in our example) would have a duty of care, including monitoring the system and performing due diligence. Liability would attach if they are negligent in this duty.
3. Tertiary AI Entity Recognition: A more radical and long-term idea where highly autonomous AI systems could be granted limited legal personhood, allowing them to be insured and hold assets to pay for damages they cause.

This kind of layered framework moves beyond the simple "who is the person?" question and towards a more nuanced system of risk allocation, which is likely to be the direction future AI regulation takes.

Conclusion

In this lesson, we have moved from the periphery of intermediary liability to the core of direct civil liability under the IT Act. We analyzed the mechanisms for assigning responsibility for technological harm and found them wanting in the face of autonomous AI.

Key Takeaways:

• Section 43 of the IT Act is the primary provision for civil liability, allowing for compensation for harms like unauthorized data access, system damage, and denial of service.
• The Act's human-centric language, requiring a "person" to commit a contravention, creates a significant liability gap when harm is caused by an autonomous AI system whose actions were not directly programmed or intended by a human.
• The IT Act establishes a formal adjudication process where an Adjudicating Officer (AO) investigates claims and awards compensation based on factors like loss caused, unfair advantage gained, and the repetitive nature of the harm.
• Future legal frameworks will likely need to move beyond the IT Act's current limitations and adopt hybrid liability models, such as imposing strict liability on developers and due diligence obligations on deployers, to adequately govern AI.

Preview of the Next Lesson:

We have discussed what happens after harm occurs. The logical next question is: what does the law require to prevent such harm in the first place? In our next lesson, we will delve into the proactive duties the law imposes, as we describe the cybersecurity obligations for organizations deploying AI systems under the Act and associated rules.