1. Introduction

AI cybersecurity tool liability claims arise when an artificial-intelligence-powered cybersecurity product causes, contributes to, or fails to prevent harm.

Examples include AI systems used for:

• malware detection;
• intrusion detection;
• vulnerability scanning;
• endpoint protection;
• fraud detection;
• automated incident response;
• threat intelligence;
• identity and access management;
• phishing detection;
• network monitoring;
• security-code analysis; and
• automated blocking or remediation.

Indian law does not presently recognise a single, standalone cause of action called “AI cybersecurity tool liability.” Liability is instead determined through existing principles of:

• contract;
• tort and negligence;
• professional negligence;
• consumer protection;
• information technology law;
• data protection;
• constitutional law;
• confidentiality;
• breach of statutory duties;
• corporate governance; and
  -, in appropriate cases, criminal law.

The central question is generally:

Did the provider, deployer, administrator, or user of the AI cybersecurity system fail to exercise the level of care reasonably required in the circumstances, and did that failure cause legally recognisable harm?

2. What Is an AI Cybersecurity Tool?

An AI cybersecurity tool is software that uses machine learning, generative AI, statistical models, behavioural analytics, or related automated techniques to identify or respond to security threats.

Examples include:

Defensive AI

• malware classification;
• anomaly detection;
• phishing detection;
• ransomware detection;
• vulnerability prioritisation;
• automated patch recommendations.

Offensive-security AI

• penetration-testing assistants;
• automated vulnerability discovery;
• attack-surface mapping;
• red-team automation.

Autonomous response systems

Some systems can automatically:

• disable an account;
• isolate a device;
• block an IP address;
• delete a file;
• terminate a process;
• modify firewall rules; or
• revoke credentials.

The more autonomous the system becomes, the greater the potential liability if its decisions cause substantial harm.

3. Typical AI Cybersecurity Liability Claims

Claims can arise from either failure to act or wrongful action.

Failure to detect

An AI security system fails to identify malware.

Result:

• ransomware;
• data loss;
• financial loss;
• business interruption.

False negative

The system classifies a genuine cyberattack as harmless.

False positive

The system incorrectly identifies legitimate activity as malicious.

Result:

• account suspension;
• transaction blockage;
• employee dismissal;
• loss of business.

Automated destructive response

The AI automatically deletes legitimate files or shuts down critical infrastructure.

Incorrect vulnerability assessment

The system incorrectly states that a system is secure.

A company relies upon the assessment and subsequently suffers a breach.

Data leakage

The cybersecurity AI itself exposes confidential information or sends sensitive data to an external model.

AI-generated security advice

An AI assistant provides incorrect technical instructions, resulting in a security incident.

4. Principal Legal Framework in India

Several legal regimes may overlap.

Information Technology Act, 2000

Particularly relevant provisions include:

• Section 43;
• Section 43A;
• Section 66;
• Sections 69 and 69A in their appropriate contexts;
• Sections 70 and 70B; and
• intermediary-related provisions where applicable.

Digital Personal Data Protection Act, 2023

Where personal data is involved, obligations concerning:

• security safeguards;
• processing;
• breach management;
• data fiduciary responsibility; and
• accountability

may become relevant.

Indian Contract Act, 1872

Particularly:

• Section 37;
• Section 39;
• Section 73;
• Section 74; and
• contractual indemnity and limitation provisions.

Consumer Protection Act, 2019

Potentially relevant where the cybersecurity product or service is supplied to a consumer and constitutes a deficient service or defective product within the statutory framework.

Tort law

Negligence, negligent misstatement, breach of duty and related principles may apply.

Constitutional law

Where the government deploys AI cybersecurity systems, Articles 14 and 21 can become particularly important.

5. Section 43 — Unauthorised Access and Damage

Section 43 of the Information Technology Act addresses various forms of unauthorised access, downloading, disruption, damage and related conduct involving computer systems.

An AI cybersecurity tool could theoretically create unusual questions where automated defensive activity:

• accesses another computer;
• scans systems;
• modifies data;
• blocks traffic;
• deletes files; or
• disrupts operations.

The legality of the activity depends heavily upon:

• authorisation;
• contractual scope;
• system ownership;
• purpose;
• technical configuration; and
• statutory authority.

6. Section 43A — Security Failure

Section 43A historically provided an important statutory framework concerning compensation for failure by a body corporate to maintain reasonable security practices and procedures in relation to sensitive personal data or information.

This is particularly relevant to AI cybersecurity because a company may argue:

“We purchased an AI security product, therefore we satisfied our security obligations.”

That proposition does not necessarily follow.

Using an AI tool does not automatically establish that reasonable security practices were maintained.

An organisation may still need to demonstrate:

• appropriate configuration;
• monitoring;
• access controls;
• testing;
• human oversight;
• incident response;
• risk assessment; and
• appropriate safeguards.

7. Digital Personal Data Protection Framework

Where an AI cybersecurity system processes personal data, the Digital Personal Data Protection Act, 2023 may become relevant.

For example, an organisation might feed into an AI security system:

• employee logs;
• customer identifiers;
• IP addresses;
• behavioural information;
• authentication data;
• security alerts;
• communications metadata.

The organisation must consider whether the processing complies with applicable statutory requirements.

A cybersecurity purpose does not automatically make every form of AI processing lawful.

8. Contractual Liability

Contract is likely to be one of the most important sources of AI cybersecurity liability.

Cybersecurity contracts commonly contain:

• security warranties;
• service-level agreements;
• uptime guarantees;
• incident-response obligations;
• vulnerability-management obligations;
• confidentiality clauses;
• indemnities;
• exclusions;
• liability caps;
• audit rights;
• compliance warranties.

Suppose a vendor states:

“Our AI system detects 99.9% of known ransomware.”

A customer purchases the system relying upon that representation.

The system fails to detect a known ransomware attack.

The contractual questions include:

1. Was the representation contractual?
2. Was there a warranty?
3. Was the limitation clause applicable?
4. Was the loss within the parties' contemplation?
5. Did the vendor breach an express or implied obligation?
6. Did the customer's own configuration contribute to the failure?

9. Negligence

A cybersecurity AI liability claim may be framed around ordinary negligence.

The basic structure is:

Duty → Breach → Causation → Damage

Duty

Did the defendant owe the claimant a duty of reasonable care?

Breach

Did the defendant fail to meet the applicable standard?

Causation

Did that failure cause the loss?

Damage

Was legally recognisable damage suffered?

10. Standard of Care for AI Cybersecurity Providers

The standard cannot simply be:

“What does an ordinary software program do?”

The relevant standard may require consideration of:

• industry practice;
• product documentation;
• security standards;
• known vulnerabilities;
• foreseeable attack methods;
• model limitations;
• testing;
• validation;
• monitoring;
• human oversight;
• update procedures;
• incident response.

A sophisticated cybersecurity provider may reasonably be expected to exercise a higher degree of technical competence than an ordinary software supplier.

11. Professional Negligence

Where the AI cybersecurity product is supplied as part of a professional cybersecurity service, professional-negligence principles may become relevant.

For example:

A cybersecurity consultancy tells a company:

“Your AI-based security assessment confirms that your critical systems have no material vulnerabilities.”

The company relies upon this assessment.

A known vulnerability is overlooked.

The company subsequently suffers a major cyberattack.

Potential claims could involve:

• contractual breach;
• professional negligence;
• negligent misstatement;
• economic loss;
• breach of confidentiality; and
• statutory data-protection obligations.

12. Case Law

Indian courts have not yet developed a dedicated Supreme Court doctrine specifically called “AI cybersecurity tool liability.”

The following authorities provide the principal legal principles that can be applied to such disputes.

1. Jacob Mathew v. State of Punjab

(2005) 6 SCC 1

The Supreme Court discussed professional negligence and the standard applicable to professionals.

The Court emphasised that professional negligence must be assessed by reference to the knowledge and skill reasonably expected from a competent professional.

Relevance to AI cybersecurity

If an organisation engages a cybersecurity professional or specialist AI security provider, the provider may be judged against the competence reasonably expected of such a professional.

The fact that an AI system was involved does not necessarily eliminate professional responsibility.

Principle: Professional services are assessed against an appropriate professional standard of care.

2. Shreya Singhal v. Union of India

(2015) 5 SCC 1

The Supreme Court considered online speech and intermediary liability under the Information Technology Act.

Relevance

Modern cybersecurity tools frequently operate through:

• online platforms;
• cloud infrastructure;
• intermediaries;
• automated monitoring;
• digital communication systems.

The case is useful for understanding that liability under internet law depends upon the precise statutory role and legal obligations of the actor.

Principle: Internet-related liability must be analysed according to the statutory framework applicable to the particular intermediary or actor.

3. Anvar P.V. v. P.K. Basheer

(2014) 10 SCC 473

The Supreme Court addressed electronic evidence and Section 65B of the Evidence Act framework.

Relevance to AI cybersecurity litigation

Cybersecurity disputes are heavily dependent upon digital evidence, including:

• security logs;
• AI alerts;
• model outputs;
• incident reports;
• access records;
• automated decisions;
• server records;
• forensic images.

The party seeking to prove that an AI system detected or failed to detect an attack may need to establish the evidentiary reliability and admissibility of relevant electronic records.

Principle: Electronic evidence must satisfy applicable evidentiary requirements.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal

(2020) 7 SCC 1

The Supreme Court further clarified the evidentiary requirements concerning electronic records.

Relevance

AI cybersecurity litigation may depend upon proving:

• what the model predicted;
• when it generated the prediction;
• what data it received;
• whether an alert was issued;
• whether an administrator received it;
• what automated response occurred.

System logs and electronic records can therefore become central evidence.

Principle: Proper proof of electronic records is crucial in technology-related litigation.

5. Justice K.S. Puttaswamy (Retd.) v. Union of India

(2017) 10 SCC 1

The Supreme Court recognised privacy as a fundamental right under Article 21.

Relevance to AI cybersecurity

Cybersecurity systems often process enormous amounts of personal information.

AI monitoring may involve:

• employee behaviour;
• communications;
• location information;
• authentication patterns;
• browsing activity;
• device information.

Security purposes do not automatically eliminate privacy interests.

Any government or other legally regulated processing may need to satisfy applicable requirements of:

• legality;
• legitimate purpose;
• necessity;
• proportionality; and
• appropriate safeguards.

Principle: Privacy remains constitutionally protected even in technologically intensive environments.

6. K.S. Puttaswamy (Aadhaar) v. Union of India

(2019) 1 SCC 1

The Supreme Court considered proportionality, privacy and large-scale technological processing.

Relevance

An AI cybersecurity system deployed by a government authority may collect and analyse enormous datasets.

The legality of such systems can therefore involve:

• statutory authority;
• purpose limitation;
• proportionality;
• data minimisation;
• safeguards;
• oversight.

Principle: Technological systems affecting privacy must satisfy constitutional requirements of legality and proportionality.

7. Internet and Mobile Association of India v. Reserve Bank of India

(2020) 10 SCC 274

The Supreme Court considered the proportionality of regulatory action affecting digital activity.

Relevance

AI cybersecurity systems can produce regulatory and economic consequences.

For example, an automated system might:

• block transactions;
• suspend accounts;
• restrict access;
• classify entities as security threats.

Where governmental action is involved, proportionality becomes particularly important.

Principle: Regulatory measures affecting digital activity must satisfy constitutional proportionality requirements.

8. State of Maharashtra v. Praful B. Desai

(2003) 4 SCC 601

The Supreme Court recognised the legal significance of technological methods in judicial proceedings, including video-conferencing.

Relevance

The case illustrates the judiciary's willingness to apply existing legal principles to technological systems rather than treating technology as inherently outside ordinary legal doctrine.

For AI cybersecurity disputes, technological complexity therefore does not itself create immunity from ordinary legal standards.

Principle: Existing legal principles can be applied to technologically mediated processes.

9. Municipal Corporation of Greater Bombay v. Lala Pancham

AIR 1965 SC 1008

The Supreme Court discussed principles concerning causation and liability in the context of damage.

Relevance

Cybersecurity litigation requires more than showing:

“The security system failed and the company suffered a cyberattack.”

The claimant must establish the legally relevant causal connection between:

• the cybersecurity failure;
• the breach;
• the particular loss claimed.

Principle: Causation is central to establishing liability.

10. M.C. Mehta v. Union of India

(1987) 1 SCC 395

The Supreme Court developed the principle of absolute liability for hazardous industries.

Relevance

This is not an ordinary cybersecurity case and should not be mechanically applied to software providers.

However, it demonstrates that Indian law can impose particularly stringent liability where an activity creates exceptionally serious and foreseeable risks.

For AI cybersecurity systems controlling critical infrastructure, the broader principle of heightened responsibility for dangerous activities may become conceptually relevant, although ordinary cybersecurity disputes would ordinarily remain governed by contract, negligence and statutory law.

13. Case Law — Quick Table

14. False Positives

False positives are an especially important AI-specific liability issue.

Suppose a bank's AI cybersecurity system classifies a legitimate customer as a fraudster.

The system automatically:

• freezes the customer's account;
• reports the transaction;
• blocks access; and
• terminates the customer relationship.

Potential claims may include:

• contractual breach;
• deficiency of service;
• negligence;
• unfair treatment;
• privacy violations;
• constitutional claims if a public authority is involved.

The crucial issue becomes whether the organisation had a reasonable human review mechanism before taking irreversible action.

15. False Negatives

A false negative may be even more expensive.

Example:

An AI cybersecurity system identifies a ransomware file as legitimate.

The organisation relies upon the system.

The malware encrypts:

• customer databases;
• financial records;
• intellectual property;
• operational systems.

A claim could allege that the vendor:

• inadequately trained the model;
• failed to update threat intelligence;
• overstated detection capability;
• failed to warn about limitations; or
• negligently designed the automated response.

16. AI Hallucinations in Cybersecurity

Generative AI cybersecurity assistants may hallucinate:

• nonexistent vulnerabilities;
• incorrect CVE identifiers;
• false patches;
• imaginary security threats;
• incorrect commands;
• unsafe remediation procedures.

Suppose an AI security assistant tells an administrator:

“Delete this system file to eliminate the malware.”

The administrator follows the instruction and destroys critical business data.

The resulting claim requires examination of:

1. who supplied the AI;
2. what warnings were provided;
3. whether human verification was required;
4. whether the advice was represented as reliable;
5. whether the user reasonably relied upon it;
6. whether the harm was foreseeable; and
7. whether contractual limitations apply.

17. Autonomous Incident Response

The most difficult liability questions may arise when AI has authority to act automatically.

For example:

Threat detected → AI isolates entire corporate network.

If the detection was wrong and the company loses eight hours of production, the question becomes:

Who bears responsibility for the automated decision?

Potentially:

• AI vendor;
• cybersecurity consultant;
• system integrator;
• employer;
• security administrator;
• cloud provider;
• or multiple parties.

The answer depends on control, contractual allocation, foreseeability and causation.

18. Human-in-the-Loop Systems

A human-review mechanism can substantially change liability analysis.

System A

AI automatically shuts down servers without human review.

System B

AI produces a risk score and requires a qualified security officer to approve shutdown.

If System B causes harm because the administrator ignores an obvious warning, the vendor may have a stronger defence.

Conversely, if the AI vendor represents that the risk score is highly reliable but the model has a known defect, the vendor may face greater exposure.

19. Vendor vs Customer Liability

Cybersecurity liability frequently involves shared responsibility.

Vendor may be responsible for:

• defective software;
• inadequate testing;
• false security representations;
• failure to patch;
• negligent design;
• inadequate documentation.

Customer may be responsible for:

• poor configuration;
• ignoring warnings;
• failing to update;
• disabling security controls;
• granting excessive privileges;
• failing to train personnel.

Integrator may be responsible for:

• improper implementation;
• incorrect configuration;
• unsuitable integration;
• failure to follow specifications.

Therefore, courts may have to determine concurrent or proportionate responsibility.

20. Contractual Limitation Clauses

AI cybersecurity agreements often contain provisions such as:

“The vendor shall not be liable for indirect or consequential loss.”

or:

“Total liability shall not exceed fees paid during the previous twelve months.”

The enforceability and interpretation of such clauses must be examined under Indian contract law.

Important questions include:

• Was the clause negotiated?
• Is it clear?
• Does it cover the particular loss?
• Does it exclude negligence?
• Does another statute apply?
• Is the clause unconscionable?
• Was there fraud or deliberate misconduct?
• Is the claimant a consumer?
• Does public law impose an independent obligation?

A liability cap therefore does not automatically resolve the dispute.

21. Data Breach Caused by the Cybersecurity Tool

Imagine:

A company deploys an AI security platform. The platform transmits sensitive customer data to an external processing environment without appropriate safeguards.

A breach follows.

Possible legal issues include:

• contractual confidentiality;
• data-protection obligations;
• security safeguards;
• negligence;
• breach notification;
• statutory penalties;
• compensation where legally available.

The fact that the tool was acquired for cybersecurity purposes does not necessarily immunise the processing of personal data.

22. Government Deployment of AI Cybersecurity

Government use creates an additional constitutional dimension.

Suppose a government agency deploys an AI system that identifies citizens as “security threats.”

If the system automatically:

• restricts access;
• blocks benefits;
• places a person on a watchlist;
• prevents transactions; or
• triggers adverse governmental action,

Articles 14 and 21 may become relevant.

Potential issues include:

• arbitrariness;
• procedural fairness;
• natural justice;
• privacy;
• proportionality;
• lack of transparency;
• inability to challenge an automated decision.

23. Article 14 and Algorithmic Security Decisions

Article 14 prohibits arbitrary state action.

Suppose:

An AI security system assigns a citizen a high-risk score because of an undisclosed algorithmic pattern.

If governmental action is then taken solely on that score, the claimant may question:

• the legal authority;
• classification;
• rationality;
• arbitrariness;
• evidentiary basis;
• review mechanism.

The government cannot necessarily avoid constitutional review simply by saying:

“The algorithm made the decision.”

24. Privacy and AI Security Monitoring

Cybersecurity monitoring may involve legitimate security purposes, but it can also become intrusive.

Examples:

• continuous employee surveillance;
• keystroke monitoring;
• biometric monitoring;
• email scanning;
• behavioural profiling;
• location tracking.

The legality of such monitoring depends on the applicable legal framework and circumstances.

Under Puttaswamy, privacy is not limited to secrecy.

It encompasses broader informational and decisional interests.

25. Confidentiality

Cybersecurity tools routinely process extremely sensitive information:

• passwords;
• credentials;
• source code;
• vulnerability reports;
• customer information;
• trade secrets;
• incident-response plans.

A vendor may therefore face liability for:

• unauthorised disclosure;
• inadequate access control;
• improper use;
• onward transfer;
• confidentiality breaches.

Contractual confidentiality provisions can become as important as copyright or data-protection provisions.

26. Causation in AI Cybersecurity Cases

Causation may be particularly difficult because cyber incidents commonly involve several contributing factors.

For example:

AI missed vulnerability → administrator failed to patch → attacker exploited vulnerability → ransomware deployed → backup failed → ₹10 crore loss.

The court must determine:

Which events legally caused the recoverable loss?

The vendor may argue:

• the customer failed to patch;
• the customer ignored warnings;
• the attack was unforeseeable;
• another vulnerability caused the breach;
• backups were inadequate.

Thus, proving that the AI system made an error is not enough by itself.

27. Foreseeability

Foreseeability becomes particularly important in cybersecurity.

Known risks include:

• adversarial attacks;
• model drift;
• false positives;
• false negatives;
• data poisoning;
• prompt injection;
• adversarial examples;
• outdated threat intelligence.

A cybersecurity provider may be expected to anticipate reasonably foreseeable failure modes.

But liability should not automatically arise for every previously unknown or extraordinary cyberattack.

28. Adversarial Attacks Against AI Security Systems

Attackers may deliberately manipulate the AI system.

Examples:

• adversarial inputs;
• data poisoning;
• model evasion;
• prompt injection;
• malicious feedback;
• manipulated telemetry.

This creates a complicated defence:

“The AI was attacked and therefore its failure was unavoidable.”

Whether that defence succeeds depends on:

• whether the attack was foreseeable;
• whether safeguards existed;
• whether the provider warned users;
• whether the system was properly maintained;
• whether the failure was caused by negligent design.

29. Product Liability

Depending upon the factual and statutory setting, AI cybersecurity software may also raise product-liability questions.

Particularly relevant issues can include:

• defective design;
• manufacturing/software defects;
• inadequate warnings;
• insufficient instructions;
• dangerous foreseeable use.

Where the product is supplied together with services, determining whether the dispute is fundamentally about a product or service may be important.

30. Consumer Protection

Where the claimant qualifies as a consumer, potential allegations may involve:

• deficiency in service;
• defective goods/product;
• unfair trade practices;
• misleading representations.

For example, if a cybersecurity company advertises:

“Complete protection against all cyberattacks,”

such a representation could become legally significant if the product does not provide the promised protection.

Cybersecurity vendors should therefore avoid absolute claims that substantially exceed the system's tested capabilities.

31. Misrepresentation

AI cybersecurity products can create liability where vendors make exaggerated claims concerning:

• detection rate;
• accuracy;
• zero-day protection;
• autonomous response;
• compliance;
• privacy;
• security guarantees.

The more specific and measurable the representation, the more easily it may become relevant to a contractual or misrepresentation claim.

32. Evidence Needed by a Claimant

A claimant should preserve:

AI system records

• model version;
• system configuration;
• prompts;
• outputs;
• alerts;
• confidence scores.

Cybersecurity records

• SIEM logs;
• firewall logs;
• endpoint logs;
• authentication records;
• incident reports;
• vulnerability scans.

Contractual documents

• master service agreement;
• SLA;
• security addendum;
• data-processing agreement;
• warranty;
• indemnity.

Technical evidence

• forensic reports;
• malware samples;
• vulnerability timelines;
• system architecture;
• patch history.

Financial evidence

• business interruption;
• recovery costs;
• forensic costs;
• customer compensation;
• regulatory expenses.

33. Expert Evidence

AI cybersecurity disputes are likely to require expert evidence.

An expert may address:

• whether the model was technically competent;
• whether the vulnerability was reasonably detectable;
• whether the model was appropriately trained;
• whether configuration was reasonable;
• whether an alert should have been generated;
• whether the automated response was proportionate;
• whether the alleged defect caused the breach.

This is especially important where the court cannot reasonably evaluate complex technical matters without specialist assistance.

34. Defences Available to AI Cybersecurity Providers

Common defences include:

No duty

The provider may argue that it did not owe the claimant the alleged duty.

Contractual allocation

The customer accepted responsibility for configuration or monitoring.

Failure by customer

The customer failed to:

• patch;
• update;
• configure;
• monitor;
• respond to warnings.

Intervening cyberattack

The loss was caused by an independent criminal act.

No causation

The AI error did not actually cause the damage.

Unforeseeable attack

The attack was outside reasonably foreseeable risks.

Disclaimer

The product was expressly described as an assistance tool rather than a guarantee.

Liability cap

Contractual limitations may restrict recoverable damages where legally enforceable.

35. Practical Liability Matrix

36. Six Core Legal Questions

A court considering an AI cybersecurity liability claim is likely to ask:

1. What was the system supposed to do?

The contractual and technical specification matters.

2. What did the AI actually do?

The precise system behaviour must be established.

3. Was that behaviour defective or negligent?

An AI prediction being wrong does not automatically establish negligence.

4. Who controlled the system?

Vendor, customer, consultant or integrator?

5. Did the error cause the loss?

Technical failure and legal causation are separate questions.

6. Was the loss legally recoverable?

The court must consider contractual, statutory and tort principles.

37. A Useful Legal Test

An AI cybersecurity liability claim can be analysed through the following sequence:

AI cybersecurity system deployed

↓

Defined security obligation

↓

Duty of care / contractual obligation / statutory duty

↓

System error or inadequate security

↓

Failure of vendor/deployer to meet applicable standard

↓

Causal connection with cyber incident

↓

Actual legally recognised damage

↓

Applicable defences

↓

Compensation / injunction / contractual / statutory remedy

This approach avoids treating every AI failure as automatic negligence.

38. Special Problem: AI Is Not a Legal Person

A claimant cannot ordinarily frame the case simply as:

“The AI negligently failed to detect malware.”

The AI system itself is generally not the legal defendant.

The actual legal actors are likely to be:

• AI developer;
• cybersecurity vendor;
• system integrator;
• employer;
• administrator;
• consultant;
• data fiduciary;
• government authority; or
• other legally responsible person/entity.

Therefore, litigation must identify the human or corporate legal actor responsible for designing, supplying, controlling or deploying the AI system.

39. Why Human Oversight Matters

A cybersecurity organisation should ideally maintain:

• documented model limitations;
• human escalation;
• audit trails;
• access controls;
• validation;
• periodic testing;
• incident response;
• model monitoring;
• vulnerability management;
• data governance;
• rollback mechanisms.

From a liability perspective, these measures can demonstrate that reasonable precautions were taken.

40. Conclusion

AI Cybersecurity Tool Liability Claims in India are an emerging application of established legal doctrines rather than a separate statutory cause of action.

The strongest legal routes generally involve:

• contractual liability;
• negligence;
• professional negligence;
• Information Technology Act obligations;
• data-protection law;
• consumer protection;
• confidentiality;
• constitutional privacy;
• Article 14 review of governmental automated decisions; and
• electronic-evidence principles.

The most relevant authorities include:

1. Jacob Mathew v. State of Punjab, (2005) 6 SCC 1 — professional negligence;
2. Shreya Singhal v. Union of India, (2015) 5 SCC 1 — internet/intermediary framework;
3. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473 — electronic evidence;
4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 — proof of electronic records;
5. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 — privacy;
6. K.S. Puttaswamy (Aadhaar) v. Union of India, (2019) 1 SCC 1 — proportionality and technological processing;
7. Internet and Mobile Association of India v. RBI, (2020) 10 SCC 274 — proportionality in digital regulation; and
8. State of Maharashtra v. Praful B. Desai, (2003) 4 SCC 601 — application of law to technological processes.

The most important principle is:

An incorrect AI cybersecurity prediction does not, by itself, establish legal liability.

The claimant ordinarily needs to connect the AI system's failure to a legally recognised duty, breach, causation and recoverable harm. At the same time, a vendor or organisation cannot necessarily avoid responsibility merely by saying that “the AI made the decision.” Where humans designed, marketed, deployed, supervised or relied upon the system, ordinary principles of contractual, statutory, tortious and constitutional responsibility can still apply.