As enterprises move beyond AI-assisted tools to autonomous AI agents capable of executing business decisions and workflows, legal experts are calling for stronger governance frameworks, tighter vendor contracts and clear human accountability to address the risks arising from their deployment.
While autonomous AI agents can execute tasks such as approving transactions, placing vendor orders and processing financial decisions with limited human intervention, their growing role in enterprise operations is raising questions around liability, data protection, intellectual property rights and regulatory compliance.
A new global study by Tata Consultancy Services (TCS), covering 1,333 senior business and technology leaders across 25 countries and 12 industries, highlights the gap between enterprises’ expectations from AI and their readiness to grant it greater autonomy.
According to the TCS Enterprise AI Study, 84% of executives identify productivity improvement as the leading source of value from AI investments. However, only 10% of global enterprises allow AI agents to execute decisions without human approval across multiple functions or business areas. Just 9% report having AI agents capable of securely orchestrating workflows across enterprise applications.
AI deployment does not dilute enterprise accountability
Malak Bhatt, Chamber Head at Chambers of Malak Bhatt, said autonomous AI agents do not dilute accountability, as AI does not have legal personality under Indian law. Contractual, tortious and regulatory liability would ordinarily rest with the enterprise deploying the technology.
Companies must therefore establish a clear inventory of where AI agents are being deployed, define approval thresholds, ensure human oversight for consequential decisions and maintain audit trails that can reconstruct the basis of decisions, Bhatt said.
He added that vendor agreements would need to address data usage and training rights, model performance warranties, incident reporting, audit access and indemnities, particularly in cases involving intellectual property infringement and personal data breaches.
“Compliance must be designed in rather than added later,” Bhatt said, pointing to the operationalisation of the Digital Personal Data Protection framework and evolving expectations of sectoral regulators, including the Reserve Bank of India and the Securities and Exchange Board of India.
He said boards and general counsel were increasingly seeking legal advice on AI indemnities, vendor contracts and accountability frameworks.
Autonomous agents bring contractual and regulatory risks
Dinesh Jotwani, Partner and Founder at Jotwani Associates, said autonomous AI agents were moving beyond routine applications such as drafting emails and responding to customer queries to undertaking actions such as transferring money, placing orders and approving loans.
However, India does not yet have a single consolidated legislation governing AI, leaving autonomous AI operations to be addressed through multiple existing legal frameworks, including the Indian Contract Act, 1872, the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Consumer Protection Act, 2019, he said.
One of the central legal concerns is that AI cannot independently assume contractual responsibility. If an AI agent mistakenly places an order for excess inventory, the deploying business cannot shift the liability to the technology, Jotwani said.
He also flagged data protection risks, noting that enterprises could face regulatory consequences if AI agents access or process personal information without meeting applicable legal requirements.
Similarly, businesses could face consumer protection and product liability claims arising from erroneous AI-generated recommendations or decisions, including unfair loan rejections.
Companies revisit vendor contracts and indemnity provisions
Jotwani said companies were increasingly introducing spending limits for AI agents, restricting access to sensitive information and requiring human approval for high-risk decisions, including contract termination and major commercial transactions.
Maintaining tamper-proof records of prompts, actions and decisions was another important safeguard, he said.
The growing deployment of autonomous AI was also prompting companies to revisit their standard vendor and procurement agreements, with indemnity provisions emerging as a key area of focus.
Businesses were seeking contractual protection against losses arising from incorrect or unlawful AI-generated recommendations, software failures and other damages attributable to AI systems.
Jotwani said companies were also establishing internal AI governance committees to review use cases, identify potential bias and monitor compliance with emerging regulatory requirements.
Security, risk and governance emerge as key adoption barriers
The TCS study identifies security, risk and governance as the leading considerations shaping enterprise AI development and deployment, ahead of cost, speed and ease of implementation.
TCS also found that 90% of respondents considered model independence an important factor in AI investment decisions, while 34% identified AI sovereignty-related requirements, including control over data location, model choice and compliance, as a high or very high organisational risk.
The study further found that 39% of enterprises were still assessing whether their AI initiatives generated sufficient value relative to token and computing costs. Meanwhile, only 7% of global respondents reported having organisation-wide provider-switching continuity plans.
Amit Kapur, Chief AI and Services Transformation Officer at TCS, said, “Productivity is clearly where enterprises are seeing the greatest value from AI today, with 84% of executives ranking it as the leading source of value from their AI investments though 10% have also indicated that they have seen an uplift in revenue.”
He added, “What seems to be holding organisations back – and rightly so – are concerns around security, governance, and resilience.”
Deploying AI responsibly, with appropriate guardrails and enterprise controls, would be a key focus in the next stage of enterprise AI adoption, he said.
Legal teams must be involved early in AI adoption
Saloni Agara Dwarakanath, AVP and Head of Legal, India, at Apex Group Ltd, said the transition from AI as a productivity tool to autonomous agents required organisations to fundamentally rethink governance and accountability.
She said AI governance frameworks should involve legal, IT, information security, compliance and business teams, with clearly defined permitted use cases, risk thresholds, approval mechanisms and ownership structures.
A risk-based approach was necessary, as not every AI application warranted the same level of scrutiny, she added.
Dwarakanath emphasised that greater autonomy in AI-driven processes could not translate into diluted organisational accountability. Decisions with material legal, financial, regulatory or employee implications must have appropriate human oversight, escalation mechanisms and the ability to intervene or override outcomes.
She also flagged the need for stronger third-party risk assessments, particularly around data ownership, confidentiality, intellectual property rights, model training, cybersecurity, data retention and audit rights.
Employees, meanwhile, must have clear guidelines on sharing confidential, personal, commercially sensitive or privileged information with AI platforms, she said.
Dwarakanath said legal teams should be involved early in the AI adoption process, not merely as approval checkpoints but as business partners helping identify risks and enable responsible deployment.
“AI may increasingly influence or execute decisions, but ownership of the consequences must remain human,” she said.
