The Proposed Digital India Act and AI Governance: Modernizing India's Cyber Law Architecture

Modernizing India's Cyber Legal Architecture: Digital India Act and AI Governance

The rapid evolution of generative AI, algorithmic bias, deepfakes, dark patterns, and platform monopolies has highlighted the structural inadequacy of the Information Technology (IT) Act, 2000. The Government of India is overhauling the cyber regulatory framework through the Digital India Act (DIA), complementing the Digital Personal Data Protection (DPDP) Act, 2023.

Limitations of the Existing IT Act, 2000

1. Pre-Smartphone Era Design: Enacted primarily to foster e-commerce and give legal recognition to electronic records. It lacks provisions tailored to modern algorithmic feeds, cloud computing, and social media dynamics.
2. Blanket Safe Harbor (Section 79): Intermediaries have traditionally enjoyed legal immunity for third-party content provided they observe due diligence. In the era of algorithmic curation and monetized amplification, blanket safe harbor is deemed obsolete.
3. Absence of AI and Emerging Tech Guardrails: No statutory mechanism to evaluate high-risk artificial intelligence models, synthetic media, or quantum cryptographic vulnerabilities.

Core Pillars of the Proposed Digital India Act (DIA)

1. Open and Safe Internet (Digital Citizen Rights)

• Codifying algorithmic accountability and transparency.
• Outlawing dark patterns (manipulative user interfaces that coerce consent).
• Enhanced safeguards against cyberbullying, non-consensual deepfakes, and automated disinformation campaigns.

2. Differentiated Regulatory Framework

Instead of treating all online platforms identically, the DIA proposes risk-based classification:

• E-commerce platforms
• Social media intermediaries
• Search engines and ad-tech networks
• High-risk Artificial Intelligence (AI) systems

3. Re-evaluating "Safe Harbor"

• Intermediaries that actively recommend, curate, algorithmically promote, or modify user-generated content will face stricter accountability rather than enjoying automatic safe harbor immunity.

4. Risk-Based Governance of Artificial Intelligence

• Drawing inspiration from global models (e.g., EU AI Act), AI applications are categorized by risk:

- Unacceptable Risk: Social scoring, subliminal behavioral manipulation (strictly prohibited).

- High Risk: AI used in biometric identification, critical infrastructure, judicial decisions, credit scoring (requires audits, explainability, human-in-the-loop oversight).

- Limited/Minimal Risk: Chatbots, spam filters (requires clear synthetic media watermarking and transparency labels).

Strategic Balance for India

As the host of the GPAI summit and home to a burgeoning startup ecosystem, India’s AI governance model seeks to avoid over-regulation that stifles domestic innovation, while ensuring constitutional rights to privacy, dignity, and informational self-determination under Article 21 (K.S. Puttaswamy judgment).