By Sudip Mazumder, Group Chief Digital Officer and Amit Singh, Swapneel Saha, Digital Product Owners, Algihaz Holding
Enterprises are moving from copilots that suggest to agents that execute. The regulatory answer to the liability question already exists — most boards have not asked it.
A large bank. A customer emails about a missed EMI. An AI agent reads the mail, pulls the loan record, checks the hardship policy, applies a fee waiver, updates the CRM and sends a confirmation. Four systems, no human. It works nine hundred times. On the nine hundred and first it misreads a co-borrower’s account and waives ₹2 lakh it had no authority to waive.
Who approved that? Nobody – and there lies the problem. Every governance artefact you own, from the delegation-of-authority matrix to maker-checker controls, assumes a human sits at the point of commitment. Agentic systems engineer that human out. What they do not do is engineer the liability out with him leading to the debate of accountability.
The Mechanics: What an agent actually does
A copilot / agent suggests; a person commits. An agent decomposes a goal into steps, selects tools, calls them, reads the results and decides what to do next based on the rules – committing state changes in live systems along the way.
Therefore, there is rarely a single identifiable “decision”. A refund is eleven Agentic tool calls, each conditioned on the model’s reading of the last. The fault is usually in step three or seven and only surfaces at step eleven. 99% accuracy in each step results 90% accuracy at the end i.e. one in 10 cases there may a failed transaction from the customer’s point of view. Governance therefore cannot attach to the model. It attaches in two places: the policy gate between intent and execution, and the log.
Figure 1: A loop, not an event. Governance attaches at the gate and the log, not the model.
Rule Books: What the regulators say
India has deliberately not written a standalone AI statute. MeitY’s India AI Governance Guidelines of November 2025, anchored on “do no harm”, take a techno-legal position: existing law already applies — the DPDP Act, the IT Act, consumer protection statutes and sectoral regulation from the RBI, SEBI and IRDAI.
Accountability sits among the seven guiding sutras.
Read that alongside the DPDP Act and the position turns sharp. A Data Fiduciary is the entity that determines the purpose and means of processing. An agent is a means. Deploying one changes nothing about who answers — and the Data Protection Board can penalise from November 2026, with full compliance due in May 2027 and maximum exposure of ₹250 crore. EU and USA regulations also can be compared in such scenario.
| Region | Instrument | Where Liability Lands | Live Now |
|---|---|---|---|
| India | AI Governance Guidelines; DPDP Act and Rules | On the deployer. No separate AI liability regime — existing law is held sufficient. | Enforcement powers Nov 2026; full compliance May 2027 |
| EU | EU AI Act, as amended by the Digital Omnibus (Reg. 2026/1744) | Split provider / deployer duties. Deployers owe human oversight and logging. | Art. 50 from Aug 2026; high-risk deferred to Dec 2027 |
| US | No federal statute. State patchwork; NIST AI RMF as baseline | On the deployer, via consumer-protection and disclosure duties. | CA, TX, IL in force; Colorado ADMT Act Jan 2027 |
Table 1: Three philosophies, one conclusion: the obligation follows whoever put the system into use.
Upside: Why anyone is doing this
The productivity case is real. The gain is not that an agent types faster; it is that cycle time collapses when queuing disappears to near zero. A ticket that waited eleven hours for a free human agent, closes in sixty to ninety seconds. Work that was never economic – reconciling small variances, chasing every stale lead – becomes economic once the marginal cost of attention approaches zero.
There is a governance dividend too: an instrumented agent leaves a complete record of what it considered and why unlike human processes.
Downside: Where it goes wrong
* Compounding error. Autonomy amplifies small inaccuracies.
* Indirect prompt injection. The agent reads an email or PDF carrying instructions while holding live credentials — the confused deputy, with API access to your ledger.
* Over-permissioned identity. Agents inherit an existing service account with far broader scope than the task needs, because provisioning a new one was slower.
* Purpose drift and scope creep. An agent touches personal data collected for another purpose; or a developer adds a tool to an agent approved six months ago, with no re-approval.
Controls: Six controls for this quarter
1. An agent register: Purpose, named accountable human, tools, data classes, autonomy tier, review date. The rule that makes it work: no register entry, no credentials.
2. Scoped identity per agent: Least privilege, short-lived tokens, never a shared service account — sharing destroys attribution before the incident.
3. Autonomy tiers with hard action limits: The test is reversibility and materiality, not model capability.
4. A tested kill switch and a capped blast radius: One command halts an agent class; daily value ceilings stop a runaway before anyone notices.
5. An immutable decision trace: Prompt, plan, tool calls, inputs, outputs and policy decisions.
6. Change control on tools: Adding a tool to an approved agent is a material change. Most incidents start here.
Conclusion: The question is no longer who
India’s framework has already answered the ownership question, and the answer is unglamorous: you do.
The organisation that deployed the agent, through a named human who signed for it. No vendor documentation moves that line.
What remains open is if, when the Board or a customer’s counsel asks what happened on the nine hundred and first transaction, you can answer in an afternoon. Firms that build the register, the tiers and the trace this year will answer with a document. Everyone else will answer with a press release.