INDIA Trends and Developments Contributed by: Sandra Lisa Philip, Shri Gayathri and Prashanth Shivadass, Shivadass & Shivadass
in the future. For businesses, this creates a mixed landscape. On one hand, companies have the free - dom to design AI governance frameworks that align with their specific use cases and risk profiles. On the other hand, the absence of clarity makes it difficult to assess long-term compliance exposure. Businesses must therefore operate with the understanding that today’s voluntary guidelines may form the basis of tomorrow’s regulatory benchmarks. Managing AI Risks in an Interim Governance Landscape The absence of a concrete AI regulation shifts the onus onto organisations for navigating an interim governance landscape where risk management must be driven internally. For many businesses, this has shifted the focus from formal compliance to internal operational structures. AI systems are increasingly embedded across customer-facing functions, inter - nal decision-making and core commercial processes, making it essential to evaluate not just whether AI is used but also how it is used and monitored over time. Contractual and technical safeguards play a critical role here. Businesses must ensure that agreements with technology providers and service vendors address data protection responsibilities, security standards and limitations on data reuse. As already mentioned, internal policies also play a central role in this phase. Businesses are increasingly expected to articulate their own standards for respon - sible AI use. Clear internal guidance on acceptable applications, human oversight and escalation mecha - nisms helps to ensure that AI systems support busi - ness objectives without creating unmanaged privacy or ethical risks. These measures allow organisations to operate responsibly while remaining adaptable to future legal developments in AI. Corporate AI Guidelines Given that Indian businesses are increasingly relying on generative AI across functions such as content creation, analytics, customer engagement and internal productivity, the privacy and governance risks asso - ciated with these systems have become particularly pronounced. Generative AI is associated with risks such as violations of the user’s privacy, concerns
about infringement of the user’s rights, loss of trade secrets and breach of privacy clauses. It is therefore imperative that every company come up with an AI policy internally. This policy must clearly delineate permitted uses of AI and expressly prohibit impermissible applications. Informed and responsible use of AI must be encouraged in order to increase effi - ciency, innovation, etc, and the risks associated with AI should be explained in the policy. A list of approved AI tools must be circulated and a formal process for approving additional tools must be established. The privacy policy for AI tools is to be thoroughly produced before approving the usage of such tools. The policy should: • specify whether and to what extent user conversa - tions may be used to train or improve AI models; • clarify that prompts should not be shared with non-service providers or third parties without the consent of the user; • clarify whether user prompts can be shared with its service providers, law enforcement agencies, research partners, third parties and affiliates; • lay down the level of transparency and accessibility of information regarding how AI models are trained; • identify the categories and sources of data used to train AI models; and • address whether and how users’ personal infor - mation can be removed or excluded from training datasets. Most privacy risks are best managed through deliber - ate design choices. Wherever possible, organisations can limit exposure by removing direct identifiers, using anonymised or pseudonymised datasets and adopt - ing training methods that do not require raw data to leave secure environments. Clear communication with users about how their data is used, combined with consent processes that are genuinely understandable rather than buried in documentation, plays a critical role in building trust. These measures must be rein - forced through strong internal governance such as the policy guideline itself, routine audits of AI systems and strict controls on data sharing, particularly when working with external technology vendors.
154 CHAMBERS.COM
Powered by FlippingBook