Introduction
Artificial Intelligence has emerged as one of the most influential technological developments in contemporary corporate activity. Businesses across different sectors are increasingly incorporating AI-based systems into their operational and strategic decision-making processes. Financial institutions utilise algorithmic models to evaluate creditworthiness and detect fraudulent transactions; manufacturing companies employ predictive systems to optimise production; corporations use automated recruitment tools to screen candidates; and management teams increasingly depend upon AI-generated reports for investment decisions, risk assessment and business forecasting.
The growing influence of AI is gradually changing the relationship between corporate management and technological systems. Traditionally, corporate decisions were made by directors and senior executives after considering professional advice, financial information, commercial circumstances and legal obligations. AI systems now perform several of these functions by processing extensive datasets, identifying patterns and generating recommendations or, in certain circumstances, making decisions with limited human intervention.
This transformation creates a significant challenge for established principles of corporate law. Directors are not merely appointed to approve commercial decisions; they are entrusted with the responsibility of managing corporate affairs in the best interests of the company. Their legal obligations include acting in good faith, exercising independent judgment and applying reasonable care, skill and diligence. These responsibilities assume that directors retain sufficient control over the decision-making process to evaluate its consequences.
However, when directors rely extensively upon algorithmic recommendations, an important question arises: can a director be considered to have exercised independent judgment when the substantive reasoning behind a corporate decision originates from an AI system?
Consider a company that employs an AI-based recruitment platform to shortlist candidates. The system systematically rejects applicants from a particular geographical or educational background because its training data reflects historical hiring patterns. If the board approves the recruitment system without examining its methodology, should the resulting discrimination be treated merely as a technological failure, or could it constitute a failure of corporate oversight?
Similarly, suppose a financial institution relies upon an algorithmic credit assessment system that systematically disadvantages a particular category of borrowers. If the board was aware of the possibility of discriminatory outcomes but failed to implement appropriate monitoring mechanisms, the question of directors’ liability becomes relevant.
These examples demonstrate that AI-related corporate risks are not exclusively technological. They are also legal, ethical, financial and governance-related risks.
In India, Section 166 of the Companies Act, 2013 provides the principal statutory framework governing directors’ duties.1 It requires directors to act in good faith, promote the objects of the company, protect the interests of relevant stakeholders and exercise reasonable care, skill, diligence and independent judgment. Although the provision does not expressly refer to artificial intelligence, its language is sufficiently broad to address emerging forms of corporate decision-making.
The difficulty lies not in the absence of general fiduciary principles but in determining how those principles should operate when decisions are increasingly influenced by systems that directors may neither develop nor fully understand.
This paper examines, through a doctrinal and comparative study of Indian law and of the approaches adopted in the United Kingdom, the United States and the European Union, whether existing fiduciary principles can adequately address algorithmic decision-making. It argues that AI should be treated as an instrument of corporate decision-making rather than an independent bearer of corporate responsibility. The ultimate responsibility for governance must remain with identifiable human decision-makers and the corporate structures established by law.
Understanding artificial intelligence in corporate decision-making
Artificial Intelligence refers broadly to computational systems capable of performing tasks that ordinarily require human cognitive abilities, including learning, prediction, classification, language processing and decision-making.
Within corporate organisations, AI may operate through several technological mechanisms, including machine learning, deep learning, natural language processing, predictive analytics and generative AI.
Its applications are particularly significant in the following areas.
A. Financial and investment decisions
AI systems analyse financial information, market trends, transaction histories and economic indicators to generate investment recommendations, assess creditworthiness and identify financial irregularities. Such systems can influence decisions concerning corporate expenditure, lending and capital allocation.
B. Human resource management
Organisations increasingly use algorithmic tools for recruitment, employee performance evaluation, workforce planning, attendance monitoring and compensation analysis. These systems can influence employment opportunities and workplace conditions.
C. Contractual and legal management
AI-powered systems assist legal departments in reviewing commercial agreements, identifying contractual risks, analysing regulatory requirements and monitoring contractual obligations. However, automated legal assessments may overlook contextual considerations and jurisdiction-specific legal requirements.
D. Risk management and regulatory compliance
AI systems can identify unusual transactions, monitor regulatory developments, detect possible compliance violations and generate risk alerts. These functions are particularly relevant for companies operating in highly regulated industries.
E. Strategic corporate decisions
Boards and senior management may rely upon AI-generated forecasts while deciding business expansion, mergers, acquisitions, restructuring, supply-chain management and long-term investments. The significance of these applications is that AI increasingly participates in decisions affecting shareholders, employees, creditors, consumers and other stakeholders.
Nevertheless, the use of AI does not necessarily imply that the system possesses legal personality, fiduciary obligations or independent legal accountability. The corporation and its directors remain subject to applicable legal duties, even when technological systems perform substantial parts of the decision-making process.
The distinction between an AI system recommending a decision and independently executing it is therefore fundamental to determining the degree of human supervision required.
The concept of fiduciary duties in corporate governance
Fiduciary duties arise from a relationship of trust, confidence and responsibility in which one person is required to act in the interests of another. In corporate law, directors occupy a fiduciary position because they exercise powers and manage resources entrusted to them for the benefit of the company.
These obligations ensure that corporate authority is exercised responsibly and that directors do not misuse their position for personal advantage.
In the Indian legal framework, Section 166 of the Companies Act, 2013 expressly recognises directors’ statutory duties.
A. Duty to act in good faith
Section 166(2) requires directors to act in good faith to promote the objects of the company for the benefit of its members as a whole and in the best interests of the company, its employees, shareholders, community and environmental protection.2
In the context of AI, this duty requires directors to consider the broader consequences of technological deployment rather than focusing exclusively on short-term financial benefits.
For example, an AI-based employee monitoring system may reduce administrative expenditure but could create privacy violations or unfair workplace practices. A board that evaluates only the financial advantages without considering foreseeable legal and stakeholder consequences may fail to discharge its broader governance responsibilities.
B. Duty of care, skill and diligence
Section 166(3) requires directors to exercise their duties with due and reasonable care, skill and diligence.3
This duty assumes particular significance in the context of algorithmic decision-making. Directors are not expected to become software engineers or personally understand every technical detail of an AI system. However, they must possess sufficient knowledge to identify material risks and seek appropriate professional assistance.
A reasonable director should understand the intended purpose of an AI system, its principal limitations, the nature of information it processes and the consequences of its potential failure. The standard of care should therefore evolve with the nature and complexity of the company’s technological operations.
C. Duty to exercise independent judgment
Independent judgment is essential to the legitimacy of corporate decision-making.
AI-generated recommendations may influence directors, but they cannot replace the exercise of independent judgment required by law.
A board that routinely approves AI-generated recommendations without meaningful examination risks converting its decision-making function into a mechanical approval process.
The duty does not prohibit technological assistance. Rather, it requires directors to retain genuine authority to question, reject, modify or override algorithmic recommendations.
D. Duty to avoid conflicts of interest
Section 166(4) prohibits directors from placing themselves in situations involving direct or indirect conflicts of interest.4
AI procurement and deployment may generate new conflict-related risks. For example, a director may influence the selection of an AI vendor in which the director has a financial interest. Similarly, undisclosed relationships between directors and technology providers may compromise the objectivity of procurement decisions.
Consequently, traditional conflict-of-interest principles remain applicable to AI-related transactions.
E. Duty not to obtain undue gain
Section 166(5) prohibits directors from obtaining undue gain or advantage for themselves or their relatives, partners or associates.5
This provision may become relevant where directors exploit confidential corporate information through AI tools, obtain improper benefits from technology vendors or influence algorithmic procurement decisions for personal advantage.
Taken together, these provisions demonstrate that Indian company law already provides a foundation for regulating directors’ conduct in AI-assisted environments. The challenge is to interpret and apply these duties in light of technological developments.
The legal challenges of algorithmic decision-making
The integration of AI into corporate governance creates several legal difficulties that cannot be resolved merely by applying conventional management practices.
A. Algorithmic opacity and the problem of explainability
One of the most significant challenges associated with AI is algorithmic opacity, commonly described as the black-box problem. Certain machine-learning models generate predictions through complex computational processes that are difficult for ordinary users, and sometimes even their developers, to explain.
This creates a serious difficulty for corporate directors. If a board approves a substantial business transaction based upon an AI-generated recommendation, it should be capable of understanding the material assumptions, risks and limitations underlying that recommendation.
For example, an AI system may recommend terminating a commercial relationship because its predictive model identifies a high probability of financial default. However, the recommendation may be based on incomplete financial information or inaccurate historical data.
If directors approve the recommendation without seeking clarification, their reliance on the algorithm may raise questions concerning the discharge of their duty of care.
The law should not require directors to understand every mathematical operation within an algorithm. Instead, it should require sufficient functional understanding to assess whether the system is suitable for its intended purpose and whether its outputs can reasonably be relied upon.
B. Automation bias and loss of independent judgment
Automation bias refers to the tendency of individuals to place excessive confidence in recommendations generated by automated systems.
In corporate environments, directors may assume that algorithmic recommendations are more objective and reliable than human judgment because they are generated through extensive datasets and computational analysis.
However, AI systems are not necessarily neutral. Their outputs may reflect inaccurate data, defective assumptions or biases incorporated during training.
The excessive acceptance of algorithmic recommendations may undermine the independent judgment required under Section 166(3) of the Companies Act, 2013.6
The distinction between legitimate reliance and abdication of responsibility is therefore important. Directors may rely upon expert advice, technological tools and professional recommendations, but such reliance should not eliminate their responsibility to evaluate the information presented to them.
A board resolution stating that a particular decision was approved because an AI system recommended it should not automatically establish that the directors exercised independent judgment.
C. Algorithmic bias and discriminatory corporate decisions
AI systems learn from historical information. If the information contains discriminatory patterns, the system may reproduce or reinforce those patterns.
For example, recruitment algorithms may disadvantage women or candidates from particular socioeconomic backgrounds because historical hiring decisions disproportionately favoured other groups.
Similarly, lending algorithms may generate unfair credit assessments if their underlying datasets contain structural inequalities.
Such outcomes may expose companies to legal claims, regulatory intervention and reputational damage.
In India, these issues must be examined alongside constitutional principles of equality, applicable employment laws, data protection requirements and other sector-specific regulations.
The NITI Aayog report on Responsible AI for All identifies equality, inclusivity, non-discrimination, transparency, privacy and accountability as important principles for responsible AI management in India.7
These principles provide an important policy foundation for corporate boards when evaluating algorithmic systems. However, they should not be incorrectly treated as independently enforceable statutory duties in every private corporate transaction.
D. Accountability gap and delegation of responsibility
An accountability gap arises when several participants contribute to an AI-driven decision but responsibility for the resulting harm becomes difficult to identify.
For instance, an AI system may be developed by an external technology provider, supplied by a software vendor, configured by a consultant and deployed by the company’s management.
When the system generates an incorrect or harmful outcome, each participant may attempt to attribute responsibility to another.
The corporation may argue that the software was defective, while the vendor may claim that the company supplied incorrect data or used the software outside its intended purpose.
Directors cannot automatically escape their governance responsibilities by relying upon these contractual arrangements.
The board remains responsible for establishing appropriate systems of supervision, procurement, risk assessment and internal accountability. The allocation of technical responsibilities between vendors and companies may determine contractual liability, but it cannot by itself extinguish statutory obligations imposed upon directors.
E. Data protection and cybersecurity risks
AI systems frequently require extensive datasets containing financial information, employee records, customer information and commercially sensitive material.
Improper collection, processing, storage or disclosure of such information can expose corporations to regulatory penalties and litigation.
The Digital Personal Data Protection Act, 2023 introduces a statutory framework governing the processing of digital personal data in India.8 Its provisions concerning Data Fiduciaries, Significant Data Fiduciaries, security safeguards and accountability are relevant to corporate AI deployment.9
Importantly, the Act’s commencement is phased. The notification dated 13 November 2025 provides different commencement dates for different provisions.10 Accordingly, the applicability of individual obligations must be assessed against the relevant commencement schedule rather than assuming that the entire statutory framework became operational simultaneously.
Directors should consequently ensure that AI systems processing personal data are evaluated for lawful processing, appropriate safeguards, access controls and relevant regulatory requirements.
Cybersecurity presents an additional concern. An AI system connected to corporate databases may become vulnerable to data poisoning, unauthorised access, manipulation or model-related attacks. Such risks can compromise both commercial operations and stakeholder interests.
Directors’ liability for AI-assisted decisions under Indian law
The Companies Act, 2013 does not establish a separate statutory category of liability for directors who rely upon artificial intelligence. Nevertheless, its existing provisions provide a foundation for determining whether a director has discharged the applicable standard of responsibility.
A. Application of Section 166
Section 166 is particularly significant because it expressly recognises the obligations of good faith, reasonable care, skill, diligence and independent judgment.
When AI is used in corporate decision-making, these duties should be interpreted in the context of the risks associated with the particular technology.
For example, a director approving an AI-based accounting tool for routine internal calculations may reasonably require a different level of scrutiny from a director approving an algorithmic system responsible for major lending decisions or workforce restructuring.
The level of scrutiny should depend upon the potential consequences of the decision, the complexity of the system and the degree of control exercised by the board. AI-related fiduciary responsibility should be risk-sensitive rather than uniform.
B. Section 166(7) and statutory consequences
Section 166(7) provides that a director contravening the section is punishable with a fine of not less than ₹1 lakh, which may extend to ₹5 lakh.11
The provision is important because it demonstrates that directors’ statutory duties are not merely voluntary corporate governance standards.
However, the existence of an AI-related loss does not automatically establish a contravention of Section 166. The relevant legal elements, including the director’s conduct and the applicable statutory obligation, must be established.
A company should not impose personal liability upon directors merely because an algorithm produced an inaccurate result. Equally, directors should not be permitted to avoid scrutiny where the failure resulted from deliberate disregard of known risks or a serious failure to exercise their statutory responsibilities.
C. Role of board committees
The Companies Act, 2013 provides for board committees such as the Audit Committee under Section 177,12 while the Risk Management Committee is required, for the top 1,000 listed entities and high value debt listed entities, by Regulation 21 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.13
These committees can play an important role in supervising AI-related risks.
The Audit Committee may examine internal controls, financial reporting systems and the reliability of AI-supported financial processes. A Risk Management Committee may evaluate algorithmic risks, cybersecurity exposure, operational failures and regulatory developments.
For companies subject to these SEBI requirements, the regulatory framework concerning risk management and technology-related governance should also be considered.14
AI governance should therefore be integrated into existing corporate governance structures rather than treated as an isolated technological issue.
D. Judicial recognition of fiduciary accountability
Indian judicial decisions have consistently recognised that directors occupy a position of trust and must exercise their powers for proper corporate purposes.
In Dale and Carrington Investment (P) Ltd. v. P.K. Prathapan, the Supreme Court of India recognised the fiduciary position of directors and examined the misuse of corporate powers for an improper personal purpose.15
Although the case did not concern artificial intelligence, its underlying principle is relevant: directors cannot use the corporate decision-making structure to avoid accountability for the improper exercise of their authority.
Similarly, the Supreme Court’s decision in Tata Consultancy Services Ltd. v. Cyrus Investments Pvt. Ltd. provides important context concerning corporate governance, board powers and the distinction between legitimate corporate decisions and legally actionable conduct.16
These decisions do not directly establish AI-specific liability. Nevertheless, they reinforce the proposition that technological delegation cannot displace the fundamental responsibilities attached to corporate office.
Comparative jurisdictional analysis
The development of AI governance requires consideration of international approaches because algorithmic systems frequently operate across national borders and corporate groups.
A. United Kingdom: independent judgment and reasonable care
The United Kingdom provides a particularly useful comparative framework through the Companies Act 2006.17
Sections 171–177 establish the general duties of directors.18 Section 172 requires directors to promote the success of the company while considering matters such as long-term consequences, employees, business relationships, community and environmental impact.19
Section 173 expressly requires directors to exercise independent judgment, while Section 174 establishes the duty to exercise reasonable care, skill and diligence.20
These provisions are particularly relevant to AI-assisted corporate decisions.
Where directors rely upon an algorithmic recommendation, they must still independently consider whether the recommendation serves the company’s interests and whether adequate precautions have been taken.
The UK framework demonstrates that technological assistance and independent judgment are not mutually exclusive. Directors can use AI to improve the quality of information available to them, but they cannot transfer their statutory responsibilities to software.
The UK approach offers a useful model for interpreting India’s Section 166 because both frameworks recognise independent judgment and reasonable diligence as fundamental director obligations.
B. United States: the Caremark doctrine and board oversight
The United States, particularly the State of Delaware, provides important judicial guidance concerning directors’ responsibilities to supervise corporate activities.
In In re Caremark International Inc. Derivative Litigation, the Delaware Court of Chancery examined whether directors could be held liable for failing to establish adequate information and reporting systems.21
The decision recognised that directors must make a good-faith effort to establish reasonable information and reporting mechanisms to enable the board to discharge its oversight responsibilities.22
The principles associated with Caremark are particularly relevant to AI governance. If a corporation deploys an AI system for a mission-critical activity, the board should establish systems through which material risks and failures can be reported to it.
In Stone v. Ritter, the Delaware Supreme Court connected oversight liability with the duty of loyalty and the requirement of good faith.23
Further, in Marchand v. Barnhill, the Delaware Supreme Court considered the adequacy of board-level monitoring in relation to food safety, a critical operational concern for the company.24
The judgment emphasised the importance of board-level oversight of mission-critical risks.
The significance of these decisions for AI governance is substantial. Where algorithmic systems are central to a company’s operations, the board should not remain unaware of their material risks merely because their technical management has been delegated to executives or external vendors.
For example, a financial institution relying heavily upon automated credit assessment should establish regular reporting concerning model performance, discriminatory outcomes, data integrity and regulatory compliance.
However, the Caremark doctrine should not be interpreted as imposing strict liability upon directors whenever an AI system fails. The American approach sets a demanding threshold for oversight liability and distinguishes genuine governance failures from ordinary business mistakes.25
C. European Union: risk-based AI regulation
The European Union has adopted a more specific legislative approach through Regulation (EU) 2024/1689, commonly known as the Artificial Intelligence Act.26
The regulation establishes a risk-based framework that categorises AI systems according to the nature and seriousness of their potential impact.
Certain AI practices are prohibited, while high-risk AI systems are subject to additional requirements concerning risk management, data governance, documentation, transparency and human oversight.27
Article 26 is particularly relevant because it imposes obligations upon deployers of high-risk AI systems.28
It requires appropriate technical and organisational measures, competent human oversight, monitoring of system operation and attention to the quality and representativeness of input data.29
It also addresses record-keeping, serious incidents and the use of high-risk systems in employment contexts.30
The significance of the EU framework is that it moves beyond general ethical principles and introduces operational responsibilities for entities deploying high-risk AI systems.
For corporate boards, this demonstrates the importance of identifying AI systems according to their actual risk rather than adopting a uniform approach to every technological application.
The EU framework provides an important comparative model for India, particularly in relation to human supervision, accountability and risk-based governance.
The EU approach does not replace directors’ fiduciary duties. Instead, regulatory compliance and corporate fiduciary responsibility operate as complementary obligations.
The Indian regulatory landscape: existing framework and emerging gaps
India’s approach to AI regulation has developed through existing sectoral laws, data protection legislation, regulatory circulars and policy initiatives.
Unlike the European Union, India does not presently have a comprehensive horizontal AI statute imposing a uniform set of obligations upon every company deploying artificial intelligence.
This does not mean that AI-based corporate activities operate outside the law. Several existing legal frameworks remain relevant.
A. Companies Act, 2013
Section 166 provides the foundation for directors’ accountability. Sections 177 and 178 also establish important governance mechanisms through audit and nomination and remuneration committees.31
These provisions can be utilised to incorporate AI-related risk supervision into existing board structures.
B. Digital Personal Data Protection Act, 2023
The DPDP Act is relevant where AI systems process digital personal data.
The concept of a Data Fiduciary under Section 2(i) covers a person who determines the purpose and means of processing personal data, alone or in conjunction with others.32
A corporate entity deploying AI may therefore have responsibilities under the data protection framework depending upon its role in processing information.
It is important to distinguish the company’s obligations as a Data Fiduciary from the personal fiduciary duties of its directors. These are different legal relationships, even though the same corporate conduct may engage both frameworks.
C. SEBI’s AI and machine learning reporting framework
The Securities and Exchange Board of India issued Circular No. SEBI/HO/MIRSD/DOS2/CIR/P/2019/10 dated 4 January 2019 concerning reporting of AI and Machine Learning applications and systems offered and used by market intermediaries.33
This initiative recognised the growing importance of AI and machine learning in Indian financial markets and sought to improve regulatory understanding of their adoption.
The circular demonstrates that sectoral regulators can address AI-related risks through reporting and supervision requirements even without a comprehensive AI statute.
D. NITI Aayog’s Responsible AI framework
NITI Aayog’s 2021 approach document, Responsible AI for All, identifies several guiding principles for responsible AI development and deployment.34
These include safety and reliability, equality, inclusivity and non-discrimination, privacy and security, transparency, accountability and the protection and reinforcement of positive human values.
Although the document is a policy framework rather than a standalone statute, it provides useful guidance for corporate governance.
The central regulatory gap is therefore not a complete absence of legal principles but the lack of a sufficiently integrated framework specifically addressing board-level accountability for algorithmic decisions.
India would benefit from connecting existing corporate law, data protection and sectoral regulatory requirements through a coherent AI governance mechanism.
Rethinking the standard of directors’ liability
The traditional standard of directors’ liability must be interpreted carefully in the context of algorithmic decision-making.
An overly strict approach could discourage competent professionals from accepting board positions and prevent companies from adopting beneficial technologies.
On the other hand, an excessively lenient approach could allow directors to avoid responsibility by attributing corporate failures to software providers or automated systems.
A balanced approach requires distinguishing between reasonable technological reliance and irresponsible delegation.
A. Reasonable reliance on AI
Directors should be permitted to rely upon AI systems where the technology has been selected through a reasonable process, its limitations are understood, and appropriate monitoring mechanisms exist.
The mere fact that an AI recommendation subsequently proves incorrect should not automatically establish negligence or breach of fiduciary duty.
Business decisions frequently involve uncertainty. AI does not eliminate that uncertainty.
B. Negligent reliance on algorithmic outputs
Liability becomes more relevant where directors disregard obvious warning signs, fail to establish appropriate safeguards or continue using systems despite known material defects.
For example, if a board receives repeated reports that an AI-based financial monitoring system is generating inaccurate results but takes no corrective action, its failure may raise questions concerning the discharge of oversight obligations.
C. Deliberate abdication of corporate judgment
A more serious problem arises where directors intentionally surrender their decision-making authority to an algorithm.
The law recognises delegation as a necessary feature of modern corporate management. However, delegation of operational functions is different from abandoning the responsibility to supervise corporate affairs.
An algorithm cannot become an independent substitute for the board merely because it is technologically sophisticated.
The directors must remain capable of questioning, modifying and rejecting algorithmic recommendations.
D. The need for a risk-based standard
The appropriate standard should depend upon several factors:
• The significance of the decision for the company and its stakeholders.
• The potential for financial, legal, operational or reputational harm.
• The level of autonomy exercised by the AI system.
• The quality and reliability of the underlying data.
• The availability of human intervention.
• The directors’ knowledge of the system’s limitations.
• The existence of prior warnings or reported failures.
A director approving a low-risk productivity application should not automatically be subjected to the same level of scrutiny as a director approving an autonomous system responsible for major financial, employment or safety-related decisions.
This risk-based approach would preserve commercial flexibility while maintaining meaningful corporate accountability.
Proposed framework for strengthening AI-related corporate governance in India
The existing statutory framework should be supplemented through practical board-level governance measures. The following recommendations are proposed.
A. Mandatory board-level AI governance policy
Companies deploying material AI systems should adopt a written AI governance policy approved by the board.
The policy should identify the purposes for which AI may be used, the systems permitted within the organisation, the responsibilities of relevant departments and the procedure for reporting material failures.
It should also specify the circumstances in which human approval is mandatory.
B. Establishment of an AI risk oversight mechanism
Companies should consider establishing an AI risk oversight mechanism within their existing governance structure.
For larger companies, this responsibility may be assigned to an appropriate board committee, depending upon the company’s statutory and regulatory requirements.35
The committee should periodically review the company’s AI inventory, high-risk applications, cybersecurity exposure, compliance status and incident reports.
A separate AI committee need not be mandatory for every company. A proportionate approach would avoid unnecessary administrative burdens on smaller enterprises.
C. Human-in-the-loop decision-making
Human oversight should remain essential for decisions that may materially affect legal rights, employment opportunities, financial interests or public safety.
The person responsible for reviewing an AI recommendation must possess adequate knowledge, authority and access to relevant information.
Human intervention should be meaningful rather than merely formal.
A process in which an employee automatically approves every algorithmic recommendation without examining it should not be regarded as effective oversight.
D. Independent algorithmic audits
Companies should conduct periodic algorithmic audits, particularly where AI systems are used in high-impact corporate functions.
Such audits should examine:
• Accuracy and reliability of outputs.
• Quality and representativeness of training data.
• Potential discriminatory effects.
• Cybersecurity vulnerabilities.
• Compliance with applicable laws.
• Model performance over time.
• Availability of meaningful human intervention.
Independent technical experts may assist the board in assessing risks that fall outside its internal expertise.
E. Documentation and audit trails
Every material AI-assisted corporate decision should be supported by appropriate records.
The documentation should identify the system used, the purpose of deployment, relevant inputs, material recommendations, human review and final decision.
Where a director rejects or overrides an algorithmic recommendation, the reasons may also be recorded for significant decisions.
Such documentation would improve internal accountability and assist courts and regulators in determining whether the board exercised reasonable diligence.
F. AI literacy and board training
Directors should receive periodic training concerning AI technologies and their associated legal risks.
The objective should not be to convert directors into technical specialists. Rather, training should enable them to understand basic AI concepts, recognise algorithmic limitations, identify material risks and ask appropriate questions.
Companies should also ensure that technical expertise is available to the board whenever necessary.
G. Vendor due diligence and contractual safeguards
Before engaging external AI service providers, companies should undertake appropriate legal and technical due diligence.
Vendor agreements should address data ownership, confidentiality, cybersecurity, audit rights, incident reporting, system maintenance, intellectual property and liability allocation.
The company should also retain appropriate rights to investigate material system failures and discontinue the use of defective technology.
H. Periodic review and risk classification
AI governance should not be treated as a one-time approval exercise.
Systems may change because of updated datasets, new software versions, changes in business operations or modifications in the intended purpose.
Companies should therefore periodically reassess the risk classification and suitability of deployed AI systems.
A material change in the system’s function should trigger a fresh governance assessment.
Critical analysis: can artificial intelligence become a substitute for directors?
The central issue in this research is not whether artificial intelligence can make better decisions than human directors in particular circumstances. In many areas, AI may process information faster and identify patterns that human decision-makers would otherwise overlook.
The more fundamental issue is whether corporate decision-making can be legally separated from human responsibility.
Corporate law recognises that directors exercise powers on behalf of the company and are accountable for the manner in which those powers are discharged. Even when decisions are informed by professional advice, management recommendations or technological tools, the legal responsibility attached to the office of director remains.
Allowing AI to assume the role of an independent corporate decision-maker would create serious conceptual difficulties.
First, an AI system does not ordinarily possess the legal status of a director. It cannot be appointed to a company’s board under the existing statutory framework merely because it performs decision-making functions.36
Second, fiduciary duties involve normative judgments concerning loyalty, good faith, conflicts of interest and the interests of stakeholders. These obligations cannot be reduced entirely to computational accuracy.
Third, corporate accountability requires an identifiable legal person against whom remedies and sanctions can be pursued. Treating an algorithm as the primary bearer of responsibility could create an accountability vacuum.
Fourth, technological efficiency cannot justify the exclusion of human judgment from decisions involving fundamental legal interests.
Nevertheless, the solution should not be to prohibit AI from participating in corporate governance. Such a prohibition would be unrealistic and commercially counterproductive.
Instead, AI should be recognised as a decision-support mechanism whose permissible autonomy depends upon the nature and consequences of the decision.
The board should retain ultimate governance responsibility, while management, technical personnel and external service providers should remain accountable for the functions assigned to them under applicable law and contractual arrangements.
The most appropriate model is therefore one of shared operational responsibility combined with non-transferable board-level oversight.
Conclusion
Artificial Intelligence is fundamentally changing the manner in which companies collect information, evaluate risks and make commercial decisions. Its increasing presence within corporate governance challenges traditional assumptions concerning the exercise of independent judgment and the discharge of fiduciary obligations.
However, technological advancement does not create a legal exemption for directors.
Section 166 of the Companies Act, 2013 already provides a substantial foundation for examining directors’ responsibilities in AI-assisted corporate environments. Its requirements of good faith, reasonable care, skill, diligence and independent judgment remain applicable irrespective of whether a corporate decision is informed by human analysis or algorithmic recommendations.
The comparative examination of the United Kingdom, United States and European Union demonstrates that effective AI governance requires a combination of established fiduciary principles, regulatory safeguards and practical oversight mechanisms.
The United Kingdom illustrates the continuing relevance of independent judgment and reasonable diligence. The United States provides valuable guidance through its board oversight jurisprudence, particularly the Caremark doctrine. The European Union demonstrates the advantages of a risk-based legislative framework incorporating human oversight, monitoring and accountability.
For India, the principal challenge is to translate existing corporate governance obligations into practical standards capable of addressing algorithmic risks. The Companies Act, data protection legislation, sectoral regulatory requirements and responsible AI policy principles should operate together to establish a coherent governance framework.
This paper proposes that directors should be assessed according to whether they exercised reasonable and informed oversight, rather than whether the AI system ultimately produced a correct result. Liability should arise from legally relevant failures such as deliberate disregard of known risks, inadequate supervision, absence of reasonable controls or abdication of independent judgment, subject to the applicable statutory and judicial standards.
Ultimately, AI may assist directors in making corporate decisions, but it cannot assume the legal and fiduciary responsibilities attached to the office of director.
The future of corporate governance should therefore not be based upon replacing human accountability with algorithmic efficiency. It should be based upon combining technological innovation with transparent decision-making, meaningful human supervision and enforceable corporate responsibility.
*****
Footnotes
1. The Companies Act, 2013, No. 18, Acts of Parliament, 2013, § 166 (India).
2. Companies Act, 2013, supra note 1, § 166(2).
3. Companies Act, 2013, supra note 1, § 166(3).
4. Companies Act, 2013, supra note 1, § 166(4).
5. Companies Act, 2013, supra note 1, § 166(5).
6. Id. § 166(3).
7. NITI Aayog, Responsible AI #AIForAll: Approach Document for India, Part 1: Principles for Responsible AI (Feb. 2021), https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf.
8. The Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
9. Id. §§ 8, 10.
10. Ministry of Electronics and Information Technology, Notification G.S.R. 843(E) (Nov. 13, 2025), Gazette of India, Extraordinary, pt. II sec. 3(i), No. 757 (bringing into force on 13 November 2025 sections 1(2), 2, 18 to 26, 35, 38 to 43 and 44(1) and (3); section 6(9) and section 27(1)(d) one year after publication; and sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 (except clause (d) of sub-section (1)), 28 to 34, 36, 37 and 44(2) eighteen months after publication).
11. Companies Act, 2013, supra note 1, § 166(7).
12. Id. § 177(4)(vii) (the Audit Committee’s terms of reference include “evaluation of internal financial controls and risk management systems”).
13. The Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015, No. SEBI/LAD-NRO/GN/2015-16/013, reg. 21(1), (5) (India) [hereinafter SEBI Listing Regulations] (Risk Management Committee required for the top 1,000 listed entities and for high value debt listed entities).
14. Id. reg. 21(4) (the functions delegated to the Risk Management Committee “shall specifically cover cyber security”).
15. Dale & Carrington Investment (P) Ltd. v. P.K. Prathapan, (2005) 1 SCC 212 (directors “act on behalf of a company in a fiduciary capacity and their acts and deeds have to be exercised for the benefit of the company”).
16. Tata Consultancy Services Ltd. v. Cyrus Investments Pvt. Ltd., (2021) 9 SCC 449, ¶ 16.23 (failed business decisions and the removal of a person from directorship “can never be projected as acts oppressive or prejudicial to the interests of the minorities”).
17. Companies Act 2006, c. 46 (UK).
18. Id. §§ 171–177; see also id. § 170 (scope and nature of the general duties).
19. Id. § 172(1).
20. Id. §§ 173–174.
21. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).
22. Id. at 970 (a director’s obligation “includes a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists”).
23. Stone v. Ritter, 911 A.2d 362 (Del. 2006).
24. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).
25. Caremark, 698 A.2d at 971 (only “a sustained or systematic failure of the board to exercise oversight” will establish the lack of good faith that is a necessary condition to liability).
26. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), 2024 O.J. (L 1689) 1.
27. Id. arts. 5, 9–14.
28. Id. art. 26; see also European Commission, AI Act Service Desk, Article 26: Obligations of Deployers of High-Risk AI Systems, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26. Chapter III, Sections 1 to 3 of the Regulation, which include Article 26, apply from 2 December 2027 to high-risk systems classified under Article 6(2) and Annex III and from 2 August 2028 to those classified under Article 6(1) and Annex I: Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 Amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as Regards the Simplification of the Implementation of Harmonised Rules on Artificial Intelligence (Digital Omnibus on AI), 2026 O.J. (L 1744) (amending art. 113).
29. Regulation (EU) 2024/1689, supra note 26, art. 26(1), (2), (4), (5).
30. Id. art. 26(5)–(7).
31. Companies Act, 2013, supra note 1, §§ 177–178.
32. Digital Personal Data Protection Act, 2023, supra note 8, § 2(i).
33. Securities and Exchange Board of India, Circular No. SEBI/HO/MIRSD/DOS2/CIR/P/2019/10, Reporting for Artificial Intelligence (AI) and Machine Learning (ML) Applications and Systems Offered and Used by Market Intermediaries (Jan. 4, 2019), https://www.sebi.gov.in/legal/circulars/jan-2019/reporting-for-artificial-intelligence-ai-and-machine-learning-ml-applications-and-systems-offered-and-used-by-market-intermediaries_41546.html.
34. NITI Aayog, supra note 7.
35. See Companies Act, 2013, supra note 1, § 177(4)(vii); SEBI Listing Regulations, supra note 13, reg. 21(5).
36. Companies Act, 2013, supra note 1, § 149(1) (every company “shall have a Board of Directors consisting of individuals as directors”).