DSCI: Agentic AI doesn’t need new laws; It needs controls you can prove

Picture a customer-service agent that can issue refunds on its own. The company’s policy is clear: refunds above Rs 25,000 need a manager’s approval. On paper, the risk is handled.

Now ask the question a regulator, a court or an investigator would ask after something goes wrong. Was that limit set on the refund tool itself, or only written into the agent’s instructions? In the words of the Data Security Council of India (DSCI): “Does the system block the payment, or only flag it afterwards?”

That single distinction sits at the heart of the AI Liability Industry Guidance for Agentic AI, a discussion paper DSCI released on 30 October. It is an India-focused attempt to answer the question that has quietly stalled many enterprise AI programs: when an AI agent acts and something goes wrong, who bears the consequences?

The question holding back adoption
The paper opens by naming the problem directly. Agentic AI promises workflows executed at machine speed, services that respond dynamically and complex multi-step processes orchestrated autonomously.

But it raises, in DSCI’s words, “a question that cannot yet be answered with confidence: when an AI agent acts and something goes wrong, who bears the consequences?”

DSCI argues that this uncertainty is itself an obstacle. Business leaders, general counsels, CISOs and chief risk officers are being asked to approve systems whose outcomes emerge from a chain of model outputs, retrievals, tool calls, integrations and human decisions, often assembled from several vendors. When harm occurs, non-deterministic reasoning makes fault hard to isolate, and the damage can reach well beyond the organization that deployed the system.

DSCI’s response is notable for what it declines to do. It does not propose a new regulatory regime.
“AI liability would not need inventing new law. The courts will reach for these tests, from Roman ideas of causation to 20th century product liability.”

Instead, the paper maps centuries-old doctrines onto the agentic stack: causation and intervening causes, reasonable foreseeability, apparent authority, principal-agent law, non-delegable duty, duty of care, comparative negligence and product liability. The gap, DSCI says, is not in the law but in applying it to software that exercises autonomous discretion.

It also rejects the instinct to settle the matter by picking a single culprit. “Framing it as an either/or choice between the end user organization and upstream player in the value chain would be legally flawed.”

A third variable enters the enterprise
For four decades, the paper observes, enterprise technology liability rested on a stable pairing of purpose and means. The enterprise declared the purpose; vendors supplied deterministic means. Even as the supply chain fragmented into dozens of players, none of them exercised independent judgement.
Foundation models change that.

They introduce what DSCI calls “generalized and probabilistic wisdom,” intelligence built for the world rather than for a particular bank, insurer or hospital. Its judgement drives deterministic business processes, and when it is connected to tools, the safety net that human reviewers once provided disappears.

“The causal buffer between the AI’s response and real-world action disappears.” The consequence for everyone in the chain is spelled out plainly: “Purpose and means could be specified in advance. Wisdom cannot, so it has to be domesticated — and that work is distributed across everyone in the chain.”

That shifts the role of integrators, product companies, framework providers and infrastructure providers from delivering technology to bounding it. They are now expected to build the guardrails, harnesses and oversight gates that turn unbounded intelligence into decisions an enterprise can safely audit.

Intent is not control
If there is one idea CIOs should carry out of the paper, it is the distinction between what an organization intends and what it can actually enforce. DSCI lays it out as a three-step chain. Governance intent is what policy requires. Decision space is whether the architecture lets you make that choice at all. Instruments of execution are the levers, such as permission scopes, logs, circuit breakers and approval interfaces, that turn a decision into a hard constraint.

Liability, the paper argues, collects where that chain breaks. “The gap between intent and actual on ground instrument of execution or control is the place where liability usually sits. When something goes wrong, investigators would not ask what the organisation meant to happen. They ask whether it could have made that happen, and whether it did.”

There is a corollary for vendors. DSCI states that the value chain players, from model provider to integrator, “need to provide the means or instruments to enforce policy intent. Withholding them or not making them available would expose them to responsibility and liability.” The principle that ties it together appears early in the guidance: “Each party is responsible for what it was able to decide and had the tools to enforce.”

The paper also warns that a control that exists only on paper is worse than none. “A control that is written down but switched off or never built shows the risk was known and left open.” And ignorance of how AI arrived is no defence: it counts eleven routes into the enterprise, from unmanaged browser use and default-on copilots to open-source libraries and agents run by customers and partners. “Liability doesn’t wait for visibility.”

The more control you take, the more you own
Two early architectural choices, the type of model and where it runs, quietly redistribute risk. A closed model behind a provider’s API leaves the enterprise with a narrow decision space but some contractual recourse. Open-weight and open-source models hand over control, and with it the responsibility.
“More freedom you have to inspect, host, or modify the intelligence, more exclusively you would own its failures.”

Hosting works the same way. Moving from a public cloud API toward private cloud or on-premises shifts runtime, data and evidence away from providers and onto the enterprise. DSCI calls the result a central paradox of enterprise AI: “Architectural control and ownership over the decision spaces eliminate your external liability shield.”

The one choice that reduces exposure in every configuration, the paper says, is the engineering built around the model, from context and memory design to identity, delegation and guardrails. That engineering builds the instruments and produces most of the evidence, whichever model or host sits underneath.

Conditions older analysis never faced
The guidance identifies nine operating conditions that strain traditional assumptions about software liability, and several will feel uncomfortably familiar to anyone running pilots today. Human approval gates, for instance, can fail quietly. When reviewers face a flood of requests, DSCI notes, “they stop examining and start clicking.” Content the agent reads can become a command: “An email, document or web page read as content can redirect the agent.”

In multi-agent systems, “Permissions granted once can travel further than anyone intended.” And investigators may be unable to replay an incident at all, because “The same input may not produce the same output twice due to probabilistic nature.”

That last point changes what evidence means. In traditional software, a fault can be reproduced. With agents, the record of what the system saw, decided and did may be the only account there is.
Prevent first, halt last

Perhaps the most practical section of the paper takes on the kill switch, the control most often invoked in AI safety debates. DSCI does not dismiss it, but it refuses to treat it as a blanket answer.

The guidance proposes a graded hierarchy under the heading “Prevent First, Halt Last.” Design the risk out by not granting the capability in the first place. Constrain permissions to the task and validate every parameter. Require human confirmation only where an action is both material and hard to reverse. Observe for drift and anomalies. Degrade gracefully by pausing new work and rolling back to a safe checkpoint. Only then reach for a scoped circuit breaker with a defined safe state and a named owner.

The reasoning is that stopping an agent is itself a consequential decision. “Stopping an agent mid-sequence would not mean a rollback.” A halt can leave a payment half-completed, and the paper is blunt about who answers for it: “The harm is yours.” Over-control carries its own liability too, since logging everything can breach data minimisation and widen what a court can demand in discovery.

What DSCI wants next
DSCI describes the guidance as a living document, open for consultation and to be revised as models, regulation and practice change. Vinayak Godse, CEO of DSCI, framed the release as a move from principle to practice.

“The AI Liability Industry Guidance attempts to consolidate AI governance and safety conversations from principle to practice. For that shift to take hold, the discussion must reach the ground level, across every player in the AI value chain, from those who build models to those who deploy and use them.”

Godse echoed the paper’s central theme on intent and control. “Intent alone is not enough. Organisations need clear decision spaces and instruments they can actually implement. Unless these are factored in across the value chain, conversations on liability will not turn into practical, sector-specific action.”

He also acknowledged the limits of any framework written this early. “AI brings conditions and risks we are not yet equipped to anticipate, and the framework must stay adaptive enough to deal with them as they emerge. DSCI looks forward to working with the government and industry to translate the liability guidance into actionable practice.”

DSCI plans follow-on guidance on applying its authority map decision by decision, on proportionate instruments of execution, on AI in physical and biological systems, and on inbound agents run by customers and partners. It is asking CISOs, CIOs, CROs and other leaders to test the paper against real deployments and report where it strains, what is missing and what does not hold.

The takeaway for CIOs
The most useful reading of the paper is as an audit prompt. For every agent in pilot or production, can you point to the place where policy becomes an enforced setting rather than a sentence in a prompt? Do you know which of the roles in the chain, user, integrator, product company, framework provider or infrastructure provider, you hold for that action? And if the system acted in your name tomorrow, could you show what it saw, decided and did?

DSCI’s message is that liability for agentic AI will not be settled by a new statute or a clever contract clause. It will be settled by whether the organization that wanted to prevent harm was able to, and whether it did.