An AI vendor's indemnity moves the money, not the responsibility: contracts, diligence and disclosure

Contracts for AI tools are usually drafted as if a warranty and an indemnity settle who answers for the tool. In India they settle who pays, and only up to the cap. Responsibility sits elsewhere. The Securities and Exchange Board of India has already notified regulation 16C of its Intermediaries Regulations, 2008, under which a regulated person using AI or machine learning tools is solely responsible for investor data, for the output of the tools and for compliance, whether it built the tool or bought it. The Digital Personal Data Protection Act, 2023 will say something similar about personal data from 13 May 2027, irrespective of any agreement to the contrary. The Reserve Bank's FREE-AI report is a committee report, and SEBI's guidelines on AI use are, as far as we could trace, still a June 2025 consultation. So the drafting task is to price and cap a loss the buyer cannot hand over, and the diligence task is to find out what a target really owns.

Did SEBI actually notify the "solely responsible" rule?

Yes, for the Intermediaries Regulations. We read the notification. It is F. No. SEBI/LAD-NRO/GN/2025/226, made at Mumbai on 6 February 2025 and published in the Gazette of India Extraordinary on 10 February 2025. It inserts a new Chapter IIIB, "Usage of artificial intelligence", containing regulation 16C, and it comes into force on Gazette publication.

Regulation 16C(1) says that any person regulated by the Board who uses artificial intelligence and machine learning tools and techniques, "either designed by it or procured from third-party technology service providers", irrespective of the scale and scenario of adoption, "shall be solely responsible" for three things: the privacy, security and integrity of investors' and stakeholders' data, including data held in a fiduciary capacity; the output arising from the tools it relies on or deals with; and compliance with applicable laws. Sub-regulation (2) lets the Board act for a violation, including under Chapter V.

Two limits. The explanation reaches tools offered to investors and tools used internally for investing, trading, advice or compliance, so it is wide. But we read only the Intermediaries amendment. Secondary reports describe matching provisions in other SEBI regulations, such as the Depositories and Participants Regulations, and we have not read those in primary form. And "solely" is the operative word for a contract: a vendor cannot be made the answerable party, only the paying one.

Is the SEBI AI consultation or the RBI FREE-AI report binding?

Neither, on what we could confirm. The Reserve Bank released the FREE-AI committee report on 13 August 2025. Its press release says the committee was set up on 26 December 2024 and that the report has 26 recommendations under six pillars, guided by seven principles it calls sutras. The release does not say the report binds regulated entities, and we found no direction or master direction that adopts it. We read the press release, not the report.

SEBI's consultation paper on guidelines for responsible use of AI and machine learning in the securities market is dated 20 June 2025 by a secondary source, which describes principles on fairness, accountability, transparency and safety, plus disclosure and record-keeping duties. We could not open the paper on sebi.gov.in. Secondary reports from August 2026 still speak of guidelines to be rolled out, so we treat the paper as unfinalised. Regulation 16C is the binding text; the rest is direction of travel.

Is an AI incident disclosable under the listing regulations?

We cannot give a confident answer from primary text, and we say so rather than guess. The consolidated Listing Obligations and Disclosure Requirements Regulations on sebi.gov.in loaded only as far as regulation 21 for us, so we did not read regulation 30, its materiality test in sub-regulation (4) or Schedule III in the current text.

What we did read is a SEBI Board memorandum of April 2023. It records the general timeline for disclosure of events as twenty-four hours, and proposed twelve hours for events arising within the listed entity. On cyber security incidents, the memorandum proposed disclosure through the quarterly corporate governance report, with an enabling provision under regulation 27, and noted that immediate disclosure might make the entity vulnerable to further attacks. It did not tie cyber incidents to the regulation 30(4) test. Whether that proposal was adopted as drafted, and whether a Schedule III item on cyber incidents or data breaches now exists, we have not verified. A listed company should read the current text of regulation 30 and Schedule III before relying on any summary, ours included.

The practical point survives the uncertainty. If a model failure or a breach in an AI pipeline is material to the company, the disclosure analysis is the same as for any other event, and the contract should let the company get facts from the vendor fast enough to run it.

What should an AI contract say, and what can it not do?

Four clauses carry most of the weight.

Warranties. A vendor warranty that the model is accurate is rarely given and rarely useful. Ask instead for narrower statements that can be tested: the vendor has the right to license the model and the training data it used, the tool does not embed third-party open-source components on terms that conflict with the buyer's use, and the vendor will tell the buyer of material changes to the model.

Indemnity. A contract of indemnity under section 124 of the Contract Act is a promise to make good a loss. It is a private allocation of money between the parties. It is not a transfer of regulatory responsibility. We did not retrieve the text of section 124 for this note.

Limitation of liability. The cap decides how much of the loss moves at all. Vendors usually cap at fees paid over twelve months. Ask for a higher or uncapped limit for data breach and for infringement of third-party rights, and for the cap to sit apart from the general one.

Damages. Section 73 gives compensation for loss that arose naturally in the usual course of things or that the parties knew, when they contracted, to be likely. A vendor that does not know the buyer is a regulated intermediary may argue that regulatory consequences were not in contemplation, so say it in the contract. Section 74 allows reasonable compensation not exceeding a named sum where a sum is named for breach, so a stated figure for a breach is a ceiling the court tests for reasonableness, not a guaranteed number.

What does the DPDP Act add, and from when?

Section 8(1) says a data fiduciary shall, "irrespective of any agreement to the contrary", be responsible for complying with the Act for processing undertaken by it or on its behalf by a data processor. Section 8(5) requires reasonable security safeguards, including for processing by a processor. The commencement notification, G.S.R. 843(E) of 13 November 2025, puts sections 7 to 10 among those that come into force eighteen months from publication, which is 13 May 2027 on the date it was made. The notification does not print a publication date, and its e-stamp suggests the electronic copy may be dated 14 November, which would move each derived date by a day.

Until then the older regime, section 43A of the Information Technology Act and the 2011 rules under it, applies to personal data security. We did not read those in primary form for this note, so we rely on the DPDP commencement notification only for the date.

What does the arithmetic look like?

Assumptions, all ours. A SEBI-registered intermediary buys a model from a vendor to screen client communications. The contract caps vendor liability at twelve months of fees, INR 1.5 crore, and the indemnity sits inside that cap. A model fault lets a data leak through, and the intermediary's loss, including client remediation and the cost of responding to the regulator, is INR 12 crore.

The most the intermediary can recover is INR 1.5 crore. The shortfall is INR 10.5 crore. Regulation 16C makes the intermediary, as the regulated person, solely responsible for the data and for the output, and on its words the vendor's cap changes nothing about that. A separate data-breach limit at, say, three times fees would raise recovery to INR 4.5 crore and leave INR 7.5 crore with the buyer. The cap is a pricing decision, and the buyer should take it knowing the loss it keeps.

What does diligence on a target's models and data look for?

Start with the chain of title, not the model. Ask what data trained or tuned each model, where it came from, and on what terms. Licensed datasets carry field-of-use and sublicensing limits that may not survive a change of control. Scraped data needs an honest account of how it was obtained and whether the source's terms allowed it.

Check open-source model licences against the target's use. Some permit commercial use, others limit it by field or scale, and the obligations can attach to derivative models. Read the licence, not the model card.

For personal data, ask for consent and notice records and map each to the purpose the model now serves. Notice given for one purpose does not obviously cover model training. Under the DPDP Act this becomes a live compliance question from 13 May 2027, so a deal closing before that date should price the work of fixing it.

Finally, ask who is responsible if the tool misbehaves. If the target is a regulated person, regulation 16C puts that on the target already.

Where practitioners differ

Whether a data fiduciary can recover a regulatory penalty from its processor under an indemnity. Section 8(1) fixes responsibility but is silent on recoupment, and some drafters write penalties into the indemnity while others doubt that a penalty can be shifted at all. There is no judgment we know of.

Whether "solely responsible" in regulation 16C leaves any room for a reasonableness defence where the failure sits entirely in a vendor's model. The words read as absolute. How the Board will apply them is untested.

Whether training data supplied by the target but never retained is within a vendor's warranty on data rights. Vendors say the warranty covers the data they supply; buyers say it should reach anything the model learned from.

What changes by sector

Financial services. Regulation 16C already applies to SEBI-regulated persons, and the RBI's FREE-AI report is the direction for banks and lenders, though we found it is not a binding direction. Expect the contract to carry audit and incident-notice rights.

Healthcare and pharma. The DPDP Act creates no separate sensitive-data category, so the clinical setting changes the risk but not the legal ground. Vendor limits on liability for faulty output matter more where output informs clinical decisions.

Technology and services. A services business is often both buyer and vendor. Its upstream indemnity should match what it gives downstream, or it sits in the gap between the two caps.

Manufacturing. Most industrial models use machine data that is not personal data, so the contract risk is output quality and intellectual property in the trained model, not privacy.

What this note does not claim

We read the SEBI Intermediaries amendment of 6 February 2025, the DPDP Act sections 8(1), 8(2) and 8(5), the DPDP commencement notification G.S.R. 843(E), sections 73 and 74 of the Contract Act, the RBI press release of 13 August 2025 and the SEBI Board memorandum of April 2023. We did not read the FREE-AI report itself, the SEBI consultation paper of June 2025, or the current text of regulation 30 and Schedule III of the LODR Regulations, so we do not state what they require. We did not read the other SEBI regulations carrying provisions like regulation 16C, section 124 of the Contract Act, section 43A of the IT Act or the 2011 rules. We do not say whether any court has considered an AI indemnity. The figures in the worked example are assumptions, not a prediction of any outcome.