Attribution and Acknowledgment in AI Communications under the IT Act

1. Attribution: Who is the "Originator" of an AI's Message?

When an AI system sends an email, posts a social media update, or executes a trade, a fundamental legal question arises: who is legally responsible for that action? The IT Act addresses this through the concepts of "originator" and "attribution."

First, let's define the key term. Section 2(1)(za) of the IT Act defines an originator as a person who sends, generates, stores, or transmits an electronic message, or causes it to be sent, generated, stored, or transmitted. Crucially, this definition excludes intermediaries.

The rules for attributing a record to an originator are laid out in Chapter IV of the Act.

As you've just read, Section 11 provides three ways to attribute an electronic record to an originator. The most significant for our purposes is Section 11(c), which states that a record is attributed to the originator if it was sent:

"by an information system programmed by or on behalf of the originator to operate automatically."

This provision, written long before the advent of modern generative AI, is remarkably forward-looking. It establishes a clear principle: if you deploy an automated system, you are the legal originator of the messages it sends.

• Simple Case (Rule-based Chatbot): If a bank deploys a chatbot with pre-programmed responses about account balances, and the chatbot provides a user with their balance, the bank is the originator of that message. The chatbot is an "information system programmed by... the originator."

• Complex Case (Generative AI): Imagine your former consulting client, a healthcare clinic, uses a sophisticated AI chatbot (integrated via an API from a major tech company) to answer patient queries. If that chatbot provides incorrect medical advice, the clinic cannot simply blame the AI or its original developer. By deploying the system to act on its behalf, the clinic has "caused" the message to be sent, making it the legal originator under the IT Act.

This principle is a cornerstone of AI governance. It prevents entities from deploying autonomous systems and then disclaiming responsibility for their actions, a concept often termed "accountability laundering."

2. Acknowledgment of Receipt: Can an AI Confirm a Transaction?

Just as important as sending a message is confirming its receipt. The IT Act also provides a framework for this, ensuring certainty in electronic transactions. Let's revisit the text of the Act.

Refer back to Section 12 from the previous reading. This section deals with the acknowledgment of receipt. Specifically, Section 12(1)(a) states that an acknowledgment can be given by:

"any communication by the addressee, automated or otherwise;"

This clause explicitly validates automated acknowledgments. When you submit an online form and instantly receive a confirmation email saying, "We have received your submission," that automated response has legal weight. It serves as proof that the recipient's system has received your electronic record.

In the context of AI, this means:

• An AI-powered e-commerce platform that automatically confirms an order.
• A CRM system that logs a customer complaint and sends an automated reply with a ticket number.
• An AI agent that receives a contractual offer and is programmed to automatically send a "receipt confirmed" message.

These are all legally valid acknowledgments, creating binding timelines and proof of communication without any direct human intervention.

3. The New Acknowledgment: The Duty to Disclose AI's Presence

The IT Act's "acknowledgment" provisions are about confirming receipt. However, in the contemporary discourse on AI governance, "acknowledgment" has taken on a second, crucial meaning: the duty to disclose or label when a user is interacting with an AI or viewing AI-generated content.

This shift is driven by concerns about transparency, bias, and the potential for deception through technologies like deepfakes. Regulators are now moving to ensure users know when they aren't dealing with a human.

As the expert highlighted, the MeitY advisory insists on "full disclosure to the users that there are AI tools at play." The stated goal is to give users notice about potential "inconsistencies" or "inaccuracy." This represents a significant policy move beyond the original IT Act framework, creating a proactive duty of transparency.

This policy is now being formalized into binding rules, especially concerning synthetic media.

These draft rules introduce two critical concepts for AI-driven communication:

1. A Broad Definition: "Synthetically generated information" is defined as anything artificially created or altered that "reasonably appears to be authentic or true." This covers everything from deepfake videos to LLM-generated text that could be mistaken for human writing.

2. Mandatory Labeling: The rules propose that intermediaries offering tools to create such content must ensure it is prominently labeled or embedded with a permanent, unique identifier.

This move from the abstract principle of "attribution" in the IT Act to the concrete requirement of "labeling" in the new rules shows the rapid evolution of the law to address the specific challenges of generative AI. It's no longer just about who is legally responsible after the fact; it's about providing transparency up front.

Conclusion

In this lesson, we dissected the legal mechanics of responsibility for AI-driven communications under the Indian IT Act and looked ahead to emerging transparency obligations.

Key Takeaways:

• Attribution of Origin: Section 11(c) of the IT Act clearly attributes electronic records sent by an automated system to the person or entity who programmed or deployed that system. This makes you legally responsible for the outputs of the AI you use.
• Acknowledgment of Receipt: Section 12 validates automated communications as a means of acknowledging receipt, bringing legal certainty to automated workflows and transactions.
• The Evolving Duty of Disclosure: Beyond the original Act, a new and crucial form of "acknowledgment" is emerging through policy and draft rules. This is the duty to transparently label AI-generated content and disclose when a user is interacting with an AI system.

Preview of the Next Lesson:

We've now established that an entity deploying an AI is the originator of its messages. But many AI services are hosted on large platforms like social media sites, search engines, or app stores. Are these platforms also liable? In our next lesson, we will dive into one of the most contentious areas of internet law: defining an 'intermediary' and analyzing the scope of 'safe harbour' protections under Section 79 of the IT Act.