• • Proposed AI Governance Principles

The AI Governance Report proposes AI governance principles that are aligned with contemporaneous global and industry standards. These principles are as follows:

• • Transparency: Adequate information should be provided to enable users to understand the AI system they are dealing with.
  • Accountability: Developers and deployers of AI systems should take responsibility for the functioning and outcome of their systems.
  • Safety, reliability & robustness: AI systems should be made resilient to risks, errors, misuse, etc. and should be regularly monitored.
  • Privacy & Security: AI systems should comply with applicable data protection laws and maintain users’ privacy.
  • Fairness & non-discrimination: AI systems should be fair and inclusive to all and should not perpetuate biases and prejudices.
  • Human-centred values & ‘do not harm’: AI systems should be subject to human oversight and should operate in a manner that respects the rule of law and minimises adverse outcomes on society.
  • Inclusive & sustainable innovation: AI system should be used to benefit all and to deliver on SDGs.
  • Digital by design governance: Suitable digital technologies must be leveraged to govern, regulate and ensure compliance with applicable law by AI systems.
• Gap Analysis of Existing Frameworks
  • For the purposes of the AI Governance Report, the Subcommittee conducted a gap analysis to identify the areas that need to be examined in light of the existing laws to deal with the risks and harms of AI systems and enable effective compliance with existing laws:
    • Deepfakes and malicious content: As per the AI Governance Report, there are existing legal safeguards to protect from the misuse of malicious deepfakes such as the Information Technology Act, 2000 and Bharatiya Nyaya (Second) Sanhita etc. which are sufficient to detect, prevent, remove and prosecute the creation and distribution of malicious deepfakes. However, there is a need to identify technical measures to allow timely detection of deepfakes, and removal before serious harm is caused. For this, the Subcommittee suggests measures like assigning unique and immutable identifiers for different participants and watermarking throughout the lifecycle.
    • Cybersecurity: The AI Governance Report mentions that the CERT-In Rules and the CERT-In Directions, Information Technology (National Critical Information Infrastructure Protection Centre and Manner of Performing Functions and Duties) Rules, 2013, as well as the upcoming Digital Personal Data Protection Act, 2023 read with the sectoral laws constitute the cybersecurity laws in the country. However, there is a need to strengthen the application of this framework in the context of AI systems.
    • Intellectual Property: The Subcommittee reviewed two areas of copyright law, namely training models on copyrighted data and liability infringement and copyrightability of work generated by using foundation models. The report highlights the need for legal clarity regarding the use of copyrighted work in AI training and the generation of content. It also seeks suggestions on the guardrails that are required to address issues such as the use of copyrighted material without taking due approval, infringement of rights, the scope of such rights, the amount of human intervention necessary to qualify the developer of AI-generated content as the author etc.
    • AI-led bias and discrimination: The report highlights the need to understand whether the current laws are equipped to deal with the harms of bias and discrimination.
    • Other areas: The AI Governance Report also highlights areas, namely training of AI models on copyrighted materials, antitrust, definition of AI and safe harbour, that require policy position and technological developments before proposing government mechanisms for the same.
  • Additionally, the report stressed the need for transparency and responsibility across AI ecosystem and proposed an ecosystem view to understand the development and deployment of AI systems particularly in sensitive use cases.
  • The AI Governance Report also highlighted the fragmented approach undertaken by regulators and departments to deal with the harms of AI and stated that while this is also required given the specialisation of sectors, a holistic approach is the need of the hour.
• Recommendations:
  • Whole-of-Government Approach: Establish an Inter-Ministerial AI Coordination Committee/ Governance Group (“Committee/Group”) to implement a ‘whole of government approach’ to unify efforts of various AI governance authorities and institutions at the national level. The AI Governance Report proposes to include both government officials and non-government representatives, including experts from industry and academia.
  • Technical Secretariat: Set up a Technical Secretariat within the MeitY to support the Committee/Group by serving as a technical advisory body combining expertise from multiple disciplines by mapping India’s AI ecosystem, monitoring AI developments and working with the industry on innovative solutions for AI governance, identifying regulatory gaps and capacity-building needs.
  • AI Incident Database: Establish an AI incident database to monitor real-world AI problems and their impacts to mitigate and avoid recurring outcomes.
  • Industry engagement: Engage with the industry to adopt voluntary transparency commitments, focusing on, inter alia, disclosure of intended purposes, regular transparency reporting, processes to test and monitor data quality, model robustness and outcomes, validating data quality and governance measures, processes to ensure peer review by third party qualified experts, etc. in a manner that complements the existing legal framework.
  • Suitability of technological measures: Examine the appropriateness and viability of the technical measures to strengthen compliance and enforcement tools across AI ecosystem and related risks.
  • Formation of a sub-group to propose legislation: Form a Sub-Group to work with MeitY on strengthening the legal framework for digital industries under the proposed Digital India Act (DIA) and enhance its effectiveness in managing AI and digital technology risks.