On 3 June 2026, the Supreme Court of India released the "Draft Regulations for Use of Artificial Intelligence in Courts, 2026" — a landmark framework that represents the most significant institutional step yet toward governing AI in India's justice delivery system. The draft, prepared under the aegis of the Supreme Court's Artificial Intelligence Committee, is grounded in five core principles: human primacy, transparency, accountability, data protection, and judicial independence . The Regulations aim to establish an institutional framework for responsible AI adoption across the Supreme Court, High Courts, tribunals, and statutory adjudicatory commissions .

For AI service providers and vendors, these Regulations create a comprehensive compliance architecture that fundamentally reshapes the obligations, liabilities, and operational requirements for those supplying AI systems to India's judiciary. This article provides a detailed analysis of the breach reporting obligations and vendor liability framework, offering practical guidance for AI service providers navigating this evolving regulatory landscape.

The Regulatory Architecture — Five Pillars of Compliance

1.1 Human Primacy: The Non-Negotiable Foundation

The single most important principle running through the draft Regulations is human primacy and judicial independence. The draft categorically declares that AI must remain "strictly subservient" to human judgment and judicial authority . The Regulations expressly provide that the authority to determine questions of law, fact, and justice shall remain exclusively with judicial officers .

For AI service providers, this principle translates into a fundamental design requirement: every AI system deployed in court processes must be built to augment, not replace human decision-making. The draft introduces the concept of the "Human-in-the-Loop" (HITL) oversight, under which AI outputs shall mandatorily be made subject to human review, supervision, and verification, with final authority and accountability resting on the human decision-maker .

1.2 Transparency: No Black Boxes in the Courtroom

The Regulations prohibit the use of opaque or "black box" AI systems in judicial processes, particularly where fundamental rights or personal liberty may be affected. Regulation 3 defines terms including "hallucination" and "Black Box", and Regulation 7(3) requires heightened vetting for opaque systems .

Every court must maintain an updated public AI Register documenting approved systems, audit findings, usage conditions, and AI-related incidents . This transparency obligation extends to AI service providers, who must ensure their systems are explainable and auditable.

1.3 Accountability: The Sole Liability Regime

Regulation 8 of the draft expressly states that liability for every decision assisted by AI will rest solely on the officer . This is a strict/no-fault liability regime that places the full burden of responsibility on the human officer, not the AI system. The regulation precludes an individual from invoking three defences: AI-generated outputs, black-box opacity, and algorithmic hallucination .

Regulation 43(6) extends this same standard to litigants and lawyers, who are similarly precluded from invoking these technological limitations as a defence .

1.4 Data Protection and Sovereignty

The Regulations establish the principle of "public data sovereignty" — meaning that the procurer or vendor of a technology cannot claim intellectual property rights over models after feeding them public judicial data . Private software vendors are explicitly barred from using sensitive judicial data to train or fine-tune proprietary algorithms .

AI services must ensure data residency within India through on-premises or sovereign cloud deployment, and vendors cannot retrain models on court data without express approval .

1.5 Judicial Independence: The Ultimate Guardrail

The Regulations draw firm, non-negotiable lines: no AI system shall perform the function of adjudication or sentencing . AI cannot be used to determine judicial outcomes, pass sentences, or perform adjudicatory functions. The draft also bars AI-based risk scoring, including assessment of flight risk, recidivism prediction, bail eligibility determinations, and evaluation of witness credibility .

Breach Reporting Obligations — The AI Incident Database Framework

2.1 The AI Incident Database Mandate

Regulation 39 of the draft proposes the establishment of an AI Incident Database. Every court must maintain an internal AI Incident Database to track errors, system malfunctions, cybersecurity breaches, and other technology-related failures .

What Must Be Recorded:

· Cases involving bias

· System malfunctions

· Cybersecurity breaches

· AI hallucinations

· Any technology-related failures that impact judicial processes

The database is designed to enable systematic learning from failures, track recurring errors across courts, and provide transparency regarding AI incidents . A senior government official familiar with the framework noted that the database serves to track errors, bias, and security failures over time .

2.2 Mandatory Breach Reporting for AI Service Providers

The Regulations require any data breach, security incident, or AI incident to be reported to the Appropriate Authority without delay . This means that in addition to reporting breaches under other laws in India — including the Digital Personal Data Protection Act, 2023 and CERT-In requirements — AI service providers and vendors will also have the onus to report breaches without delay .

Key Reporting Obligations:

Obligation Description Timeline

Data Breach Reporting Report any data breach to the Appropriate Authority Without delay

AI Incident Reporting Report AI system failures, hallucinations, and bias cases Without delay

Security Incident Reporting Report cybersecurity breaches Without delay

Tool Failure Notification Notify the AI Secretariat of AI tool failure or suspension 24 hours

The draft Regulations specify a 24-hour mandatory notification for AI tool failure or suspension .

2.3 The AI Register and Transparency Reporting

Every court must maintain an updated public AI Register documenting approved systems, audit findings, usage conditions, and AI-related incidents . Additionally, every High Court must submit an annual transparency report on AI adoption, summarising AI systems in use, audit outcomes, AI incidents logged during the reporting period, and compliance measures .

2.4 The Compliance Burden on AI Service Providers

For AI service providers, these obligations create a continuous compliance cycle:

1. Pre-Deployment: Complete Technical and Ethical Impact Assessment; Controlled Environment Testing; prior approval from the Appropriate Authority .

2. During Deployment: Maintain audit trails; report AI incidents without delay; ensure data residency within India .

3. Post-Deployment: Participate in periodic audits (at intervals not exceeding one year); contribute to the AI Register; comply with transparency reporting requirements .

Vendor Liability — The Emerging Framework

3.1 The Current Liability Architecture

The draft Regulations recognise vendor liability but leave it largely within a contractual framework. Chapter VI anticipates engagement with private entities, and Regulation 46(4)(f) and (l) requires agreements with AI developers to contain clauses attributing liability for harm or an AI incident .

Key Contractual Requirements for Vendors:

· Mandatory indemnity clauses protecting the Court from liability for harms caused by defects in vendor-supplied AI Systems .

· Clear contractual allocation of liability between the Court and the vendor in the event of AI-related incidents, data breaches, or harm to litigants or third parties .

· Liability for system failures where AI systems produce output materially inconsistent with performance specifications .

3.2 The Gap: Vendor Immunity and Joint Liability

A critical gap in the draft Regulations is that vendors appear to bear primary liability for defects and incidents without a corresponding regime for joint and several liability . Legal analysts have noted that the draft leaves approving institutions and private vendors largely outside the liability chain, creating an accountability void .

Proposed Fixes from Legal Experts:

· Protect officers acting in good faith from punitive measures

· Impose joint liability on the AI Secretariat and approving authority

· Subject vendors to joint and several liability alongside officers

· Address vendor immunity under Chapter VI of the regulations

· Reassess the grievance mechanism under Regulation 52

3.3 Constitutional Concerns

The sole liability regime under Regulation 8 raises significant constitutional concerns under Article 14 (Right to Equality) and Article 21 (Due Process) of the Constitution of India .

Article 14 Concerns: The Supreme Court, in E.P. Royappa v. State of Tamil Nadu (1974) 4 SCC 3, held that "there cannot be harmony between arbitrariness and equality". If an officer is held responsible for an inevitable "Algorithmic deficiency," and where all reasonable precautions have been taken, then "imposing liability without any fault appears 'ex facie' arbitrary" .

Article 21 Concerns: Article 21 demands not just procedure established by law, but the strict requirement of "due process of law". Holding individuals liable for risks entirely beyond their control may violate due process protections .

3.4 Comparative Perspectives: EU AI Act and Global Standards

The European Union's AI Act provides a useful comparative framework. Article 73 of the EU AI Act creates an obligation for providers of high-risk AI systems to report serious incidents to the market surveillance authority of the member state where the incident occurred or where the affected user is located .

The EU AI Act defines a narrower category of "serious incident" compared to India's draft regulations, and requires providers of high-risk AI systems to report specified incidents to the relevant market-surveillance authorities . India's draft regulations may benefit from distinguishing near-misses from realised incidents through proportionate reporting and escalation requirements .

As EU AI Act enforcement begins, the civil disclosure regime treats the AI Act compliance file — logs, technical documentation, evidence of human oversight — as the decisive procedural asset .

3.5 The Producer Liability Question

A significant emerging legal question is whether AI service providers — as producers of legal AI tools — may face producer liability under common-law systems. Legal scholars have examined the potential producer liability of legal AI manufacturers under the common-law systems of the United States, Canada, and England, drawing upon product liability frameworks .

Lawyers have been sanctioned for fabricated authorities, firms have faced malpractice exposure, and courts have emphasised duties of competence, candour, and verification . This suggests that AI service providers may not be immune from liability for negligence or products liability .

Practical Compliance Guide for AI Service Providers

4.1 Pre-Deployment Compliance Checklist

Obtain Prior Written Approval:

· Every AI system must be approved in writing by the relevant High Court or Supreme Court AI Committee .

Conduct Technical and Ethical Impact Assessments:

· Comprehensive evaluation of data sourcing

· Cybersecurity baseline assessment

· Explainability assessment

· Risk of hallucinations evaluation .

Controlled Environment Testing:

· High-risk systems must undergo time-limited testing in isolated setups .

Data Residency Compliance:

· Ensure data residency within India through on-premises or sovereign cloud deployment .

4.2 Operational Compliance Requirements

Maintain AI Registers:

· Every court must maintain an updated public AI Register documenting approved systems, audit findings, usage conditions, and AI-related incidents .

Document AI Incidents:

· Internal AI Incident Database to track errors, system malfunctions, cybersecurity breaches, and other technology-related failures .

Implement Fall-Back Protocols:

· Every High Court must maintain verified manual fall-back protocols in case of technical failure .

Periodic Audits:

· Systems must undergo periodic audits at intervals not exceeding one year .

4.3 Data Protection Compliance

Data Residency:

· Ensure data residency within India through on-premises or sovereign cloud deployment .

No Unauthorized Training:

· Cannot retrain models on court data without express approval .

IP Ownership:

· Courts retain IP ownership over tools developed using court data .

DPDP Act Compliance:

· Mandatory compliance with the Digital Personal Data Protection Act, 2023 and heightened safeguards for sensitive judicial data .

4.4 Vendor-Specific Compliance

Strict Procurement Contracts:

· Vendors are subject to strict data-protection contracts

· Barred from using sensitive judicial data to train proprietary algorithms

· Cannot claim exclusive IP rights over tools built on public judicial resources .

Mandatory Indemnity Clauses:

· Agreements must include clauses protecting the Court from liability for harms caused by defects in vendor-supplied AI Systems .

Liability Allocation:

· Clear contractual allocation of liability between the Court and the vendor in the event of AI-related incidents, data breaches, or harm to litigants or third parties .

4.5 Grievance Redressal

For AI Developers:

· Respond to complaints about AI system errors or harm

· Maintain auditable records of system performance and incidents

For Enterprises Using AI in Court Filings:

· Maintain auditable records of the creation and origin of AI-generated material

· Document the AI system used, generation process, and source documents relied upon

· Ensure full responsibility for any inaccurate AI-generated content .

The Road Ahead — Future Directions and Strategic Considerations

5.1 The Public Consultation Process

The draft Regulations were open for public consultation until 20 June 2026 . Stakeholders, including AI service providers, legal professionals, and civil society organisations, have submitted comments and suggestions. The final version of the Regulations is expected to incorporate feedback and address the gaps identified by legal experts.

5.2 The Enforcement Timeline

Once notified, the Draft Regulations will apply to the Supreme Court, High Courts, District Courts, subordinate courts, tribunals, and statutory commissions performing adjudicatory functions . The Chief Justice of India will notify the enforcement date for the Supreme Court, and the Chief Justice of each respective High Court will notify the enforcement date for courts under their jurisdiction .

5.3 Strategic Recommendations for AI Service Providers

1. Engage in the Regulatory Process:

· Participate in public consultations

· Provide feedback on technical feasibility and operational burdens

· Build relationships with MeitY and the Supreme Court AI Committee

2. Build for Compliance:

· Design AI systems with explainability, auditability, and data residency as core requirements

· Implement robust incident tracking and reporting systems

· Ensure contractual frameworks align with the new liability regime

3. Monitor Regulatory Evolution:

· Track further amendments to the Draft Regulations

· Monitor the establishment of the AI Incident Database

· Stay informed of potential dedicated AI legislation

4. Prepare for Joint Liability:

· Anticipate the possibility of joint and several liability alongside officers

· Review indemnity and liability provisions in procurement contracts

· Consider insurance products that cover AI-related incidents

5.4 The Global Context

India's Draft AI Regulations for Courts represent one of the most comprehensive attempts globally to govern AI in judicial systems. The framework's emphasis on human primacy, transparency, and accountability aligns with international standards, including the EU AI Act and UNESCO's Guidelines on AI and the Judiciary.

The Regulations also reflect India's broader AI governance framework, including the India AI Governance Guidelines released in November 2025, which provide a comprehensive national framework for the safe, responsible, and inclusive development and deployment of AI . A national AI Incident Database will record, classify, and analyse safety failures, biased outcomes, and security breaches nationwide .

Conclusion: Navigating the New Compliance Landscape

The Supreme Court's Draft AI Regulations for Courts, 2026, represent a watershed moment in India's AI governance journey. For AI service providers and vendors, the Regulations create a comprehensive compliance architecture that demands proactive engagement, robust technical safeguards, and a commitment to the highest standards of transparency and accountability.

The breach reporting obligations — including the AI Incident Database, mandatory reporting of data breaches and AI incidents without delay, and the 24-hour notification requirement for tool failures — establish a continuous compliance cycle that extends from pre-deployment through post-deployment.

The vendor liability framework, while still evolving, signals a clear intent to hold AI service providers accountable for the performance and safety of their systems. The draft's recognition of vendor liability, combined with the constitutional concerns raised by legal experts, suggests that the final version of the Regulations will likely incorporate mechanisms for joint and several liability and address the vendor immunity gap.

As the Regulations move toward finalisation, AI service providers must act decisively. The time for preparation is now. Those who embrace compliance as a competitive advantage — who build systems that are explainable, auditable, and aligned with India's data sovereignty principles — will be best positioned to serve the judiciary in the years ahead.

The Regulations are grounded in principles that are both timeless and timely: human primacy, transparency, accountability, data protection, and judicial independence. For AI service providers, these principles are not merely regulatory requirements. They are the foundation of trust upon which the future of judicial AI depends.

The Supreme Court has spoken: AI can assist, but it cannot decide. And when AI errs, the vendor bear

s responsibility. The era of AI accountability in India's courts has begun.

#legal

#compliance

#safety

#policies

#AIRegulations

#AIIncidentDatabase

#VendorLiability

#HumanPrimacy

#AICompliance

#SupremeCourtAI

#BreachReporting

#LegalTech Broad

#DrSannjay

#AIGovernance

Strengthening Breach Reporting and Vendor Accountability in the Digital Age

Global AI Governance