A bank has an AI system in place to flag suspicious transactions and take the call to freeze accounts. While the workflow has a human sign-off in place, clearing around 400 cases a day has resulted in the approval system becoming a formality. So, when a wrongly-frozen account takes the system to court, the bank becomes unable to prove what the human actually reviewed. This, unfortunately, is no longer a hypothetical scenario.

On July 2, 2026, the Supreme Court of India quashed orders passed by the National Company Law Tribunal and the National Company Law Appellate Tribunal in the Pooja Ramesh Singh v. Jammu and Kashmir Bank Ltd. case. The orders had rested on citations generated by an AI tool and attributed to the Supreme Court itself. This directed the Bar Council of India to constitute a committee to prescribe disciplinary norms for advocates who file AI-generated citations.

This is a business story as much as a legal one. Despite two tribunals and several rounds of proceedings, the parties had to carry the cost of a machine error that no human caught before filing. No AI statute was required to reach that outcome. Ordinary law, applied by judges, did the work.

The regulators are moving faster than the legislature

For most Indian companies, the sharper edge is coming from sectoral regulators rather than from the bench.

In early June this year, the Reserve Bank of India gave banks and other regulated entities until June 30 to submit gap assessments on frontier-AI cyber risk. Instead of having the CISO to file the note, the RBI had asked the board to sign one.

Later, on June 24, the RBI publicly released a draft 'Guidance on Regulatory Principles for Model Risk Management' to establish a comprehensive enterprise-wide model governance framework for the financial sector. Here 'models' extend to third-party models, AI, and machine learning (ML) systems used by commercial banks, small finance banks, payments banks, NBFCs, and other financial institutions. So if a lending decision is influenced by a model licensed from a vendor, the model risk sits on the one putting the AI system to use and not the vendor who built it.

Meanwhile, India's legislative position is still a work-in-progress. On October 8, 2026, Union Minister Ashwini Vaishnaw had assured that the time has come for India to get an AI law. In a first step towards this, the government will be launching a consultation paper on regulating artificial intelligence.

However, any business that is treating a pending law as its compliance milestone has their sequencing backwards. Even when the statute arrives, it can only land on top of existing case laws and sectoral circulars, not in place of them. Regardless of what law comes into place, the Digital Personal Data Protection Act takes full effect on May 13, 2027. Businesses will be held accountable even if the data is being processed by an external vendor as the DPDPA will be applicable wherever an AI system handles personal data.

What does this ask of a business?

Behind all the legal vocabulary, the requirements across all the domains are the same—one needs to show their working.

For any consequential decision made by an AI system, organisations must be able to have the visibility regarding which model produced the output, what data it drew on, whether a retrieval step was involved, who reviewed it before it went out, and whether that record still exists six months later.

Multiple Indian firms have written a policy, appointed a committee, and deployed systems but can still not answer any of the above questions. This is clearly an architecture question before it is a policy-related one. Recording the model version, prompt, retrieved data and human sign-off for every AI decision is only cheap if it is thoughtfully designed for. It can, however, become close to impossible to reconstruct afterwards.

It is important for businesses to question an AI vendor before procuring a model. Does the system record which model version handled each request? Can that record be exported and retained? Where does inference physically happen? What happens to inputs after processing? Where in the workflow is a human required to act? Vendors that cannot answer plainly are transferring risk to the buyer.

Build the record now

There is not much point in waiting for an AI law. AI adoption is already in full swing, and when unprepared, the chain is only waiting to break. In the case of the tribunal matter, that chain broke at the review step. In an RBI-regulated entity, the chain is most likely to break earlier, at provenance, if nobody logged which version of which model scored the application.

The current strategy, albeit unglamorous, is to ensure that the record of every AI-assisted decision made can survive being read aloud. So while the law may still be pending, the question is not. When it does come, the answer will have to exist already.

(The article has been authored by Ramprakash Ramamoorthy, Director - AI Research, Zoho Corporation)

(Disclaimer: The views and opinions expressed in this article are those of the author and do not necessarily reflect the views of YourStory.)