Centre weighs curbs on AI autonomy, consent rules for deepfakes under new law
Two legal experts have been asked to submit separate draft liability frameworks for AI models
The Ministry of Electronics and Information Technology (MeitY) is exploring a consent-based framework for synthetically-generated content, along with curbs on agentic AI autonomy, and regulatory sandboxes for high-risk applications as it weighs a separate law to regulate artificial intelligence (AI), The Indian Express has learnt.
Synthetically-generated content is digital media made or altered by AI, rather than humans.
The AI law is likely to be presented as a standalone piece of legislation, rather than being under the umbrella of the Information Technology Act, 2000, a senior government official told The Indian Express.
The cyber laws division of the IT Ministry, which is responsible for formulating laws and policies that impact tech companies, has been asked to carry out a regulatory analysis of the IT Act, and the various rules made under it, to understand existing gaps.
In the case of agentic AI, the government is expected to consider how much autonomy such agents should have, and whether they should be permitted to retain and reuse data.
Agentic AI refers to autonomous AI systems that go beyond simply generating text. Given a high-level goal, they independently plan multi-step actions, utilise external tools, and adjust their strategy in real time to achieve the desired outcome with minimal human supervision.
The IT Ministry is also expected to consult the Reserve Bank of India (RBI), and the Securities and Exchange Board of India (SEBI), to set up a regulatory sandbox for AI applications, particularly in high-impact areas such as finance and public services.
Another major issue under discussion is the liability of AI platforms and their developers for the content generated by these models.
In the consumer internet world, social media platforms have something called safe harbour, which is legal immunity from hosting user-generated content. This is based on the idea that platforms can not preempt what a user is going to post, and therefore should not be held liable for any problematic speech they may have made.
In the AI world, however, that same logic is difficult to translate directly. AI models are trained on content present on the internet, and inevitably use that information to build their responses.
However, while pattern matching for keywords, these models also editorialise their responses in a way where it may be hard to track its exact statements back to a particular source.
It is understood that the government has asked two legal experts from the private sector to submit separate draft liability frameworks for AI models.
Queries sent to the IT Ministry remained unanswered until publication.
“Building a consent-based framework for synthetically generated media would be one of the key requirements for an AI law. We have seen the rapid proliferation of deepfakes on the Internet, and most of them, if not all, are generated by using pictures or videos of individuals whose consent has not been sought by the creator or the platform generating such media,” a senior government official said, requesting anonymity.
“Though the Digital Personal Data Protection Act, 2023 looks at broader privacy issues, the questions of consent and data ownership in an AI age merits further examination,” he added.
India’s data protection law exempts personal data that has been voluntarily made public by an individual from any protections that the Act offers.
Many believe that if an AI platform were to scrape pictures of a person’s public social media profile, for instance, such processing is unlikely to have any guardrails under the data protection law.
While the government is now working on an AI law, it had previously said that the country does not need one, and its existing laws were enough to deal with challenges posed by the proliferation of AI platforms.
The government has been enacting piecemeal legislation to bring AI under control. For example, in April, it proposed that social media companies like YouTube, Instagram and X will have to “continuously” display labels on content generated through AI.
However, a broad rethink from targeted lawmaking to an expansive regulatory framework comes amid growing instances of objectionable, high-quality deepfakes, and government’s anxieties over agentic AI.
Earlier this year, it reprimanded Elon Musk’ Grok AI for aiding in the creation of objectionable deepfakes of women.
In a meeting with stakeholders last month, the IT Ministry particularly flagged Singapore’s governance framework for agentic AI (which was announced in May), and how some jurisdictions that have generally followed a lighter-touch approach to regulation were also re-examining their position.
The Ministry of Electronics and Information Technology (MeitY) is exploring a consent-based framework for synthetically-generated content, along with curbs on agentic AI autonomy, and regulatory sandboxes for high-risk applications as it weighs a separate law to regulate artificial intelligence (AI), The Indian Express has learnt.
Synthetically-generated content is digital media made or altered by AI, rather than humans.
The AI law is likely to be presented as a standalone piece of legislation, rather than being under the umbrella of the Information Technology Act, 2000, a senior government official told The Indian Express.
The cyber laws division of the IT Ministry, which is responsible for formulating laws and policies that impact tech companies, has been asked to carry out a regulatory analysis of the IT Act, and the various rules made under it, to understand existing gaps.
In the case of agentic AI, the government is expected to consider how much autonomy such agents should have, and whether they should be permitted to retain and reuse data.
Agentic AI refers to autonomous AI systems that go beyond simply generating text. Given a high-level goal, they independently plan multi-step actions, utilise external tools, and adjust their strategy in real time to achieve the desired outcome with minimal human supervision.
The IT Ministry is also expected to consult the Reserve Bank of India (RBI), and the Securities and Exchange Board of India (SEBI), to set up a regulatory sandbox for AI applications, particularly in high-impact areas such as finance and public services.
Another major issue under discussion is the liability of AI platforms and their developers for the content generated by these models.
In the consumer internet world, social media platforms have something called safe harbour, which is legal immunity from hosting user-generated content. This is based on the idea that platforms can not preempt what a user is going to post, and therefore should not be held liable for any problematic speech they may have made.
In the AI world, however, that same logic is difficult to translate directly. AI models are trained on content present on the internet, and inevitably use that information to build their responses.
However, while pattern matching for keywords, these models also editorialise their responses in a way where it may be hard to track its exact statements back to a particular source.
It is understood that the government has asked two legal experts from the private sector to submit separate draft liability frameworks for AI models.
Queries sent to the IT Ministry remained unanswered until publication.
“Building a consent-based framework for synthetically generated media would be one of the key requirements for an AI law. We have seen the rapid proliferation of deepfakes on the Internet, and most of them, if not all, are generated by using pictures or videos of individuals whose consent has not been sought by the creator or the platform generating such media,” a senior government official said, requesting anonymity.
“Though the Digital Personal Data Protection Act, 2023 looks at broader privacy issues, the questions of consent and data ownership in an AI age merits further examination,” he added.
India’s data protection law exempts personal data that has been voluntarily made public by an individual from any protections that the Act offers.
Many believe that if an AI platform were to scrape pictures of a person’s public social media profile, for instance, such processing is unlikely to have any guardrails under the data protection law.
While the government is now working on an AI law, it had previously said that the country does not need one, and its existing laws were enough to deal with challenges posed by the proliferation of AI platforms.
The government has been enacting piecemeal legislation to bring AI under control. For example, in April, it proposed that social media companies like YouTube, Instagram and X will have to “continuously” display labels on content generated through AI.
However, a broad rethink from targeted lawmaking to an expansive regulatory framework comes amid growing instances of objectionable, high-quality deepfakes, and government’s anxieties over agentic AI.
Earlier this year, it reprimanded Elon Musk’ Grok AI for aiding in the creation of objectionable deepfakes of women.
In a meeting with stakeholders last month, the IT Ministry particularly flagged Singapore’s governance framework for agentic AI (which was announced in May), and how some jurisdictions that have generally followed a lighter-touch approach to regulation were also re-examining their position.
