INTRODUCTION: WHEN MACHINES BREAK THE LAW
The CEO of a fintech company based in Delhi on a warm April afternoon in 2023 called a senior executive in a panic, demanding that 2.5 crores to be transferred immediately to a foreign vendor. The tone, accent, and urgency of the voice were all uncannily similar. The business was defrauded in a matter of hours. The catch is that the CEO wasn’t on that call at all. The ideal crime had been committed by a deepfake AI-generated voice clone. Welcome to the automated, anonymous, and nearly imperceptible cybercrime of the future.
AI is far more than just an academic or policy issue, it is a lawsuit abuser. In different ways where AI can be used to infringe the law are outpacing our ability to control it such as, from deepfake coercion and phishing bots to AI-powered misinformation campaigns during elections. The results are no longer speculative; they are present, real, and dangerous.
This paper offers a daring but enriching look at the growing relationship between AI and cybercrime in India. It intends to:
a) Decode what AI means in a criminal law context1
b) Explore how AI is changing the nature, scale, and anonymity of cybercrimes2
c) Map out the upcoming AI-enabled offences using real-world case studies3
d) Identify loopholes in India’s present legal toolkit, such as the IT Act and BNS
e) Understand how other jurisdictions, such as the EU, USA, and UK, regulate AI crime4
f) Identify ethical and evidentiary problems specific to AI-driven criminal behaviour5
g) Provide specific legislative, technological, and institutional improvements for the Indian environment6
DECODING ARTIFICIAL INTELLIGENCE: THE LEGAL LENS
Artificial intelligence (AI) is more than a catchphrase; it is the invisible infrastructure that increasingly determines what we buy, who we trust, and how we live. But, in legal terms, what is artificial intelligence (AI)? Is it simply a computer program on steroids, or perhaps something akin to a non-human legal actor? The answer is not simply intellectual or academic; it’s critical understanding on how we prosecute crimes committed with or through AI.
A. What AI Really is
Artificial intelligence (AI) is defined legally and technically as a system that simulates human cognitive functions such as learning, decision-making, problem solving, and language comprehension. It evolves and performs tasks independently using technologies including machine learning, neural networks, and deep learning algorithms.7
Yet, AI is more than just its technical components. As King et al. contend, it must also be recognised as a type of “interactive, autonomous, and self-learning agency”.8 This is crucial in legal contexts because it distinguishes AI from simple automated tools such as calculators or CCTV cameras. An AI-powered chatbot that learns to commit fraud over time presents quite different legal issues than a static instrument. India’s own policy think tank, NITI Aayog, defines AI as a constellation of technologies that enable machines to act with higher levels of intelligence—understanding their environment, learning, and taking actions autonomously or semi-autonomously.9 This definition, while useful, still falls short of considering the legal consequences of these intelligent actions.
B. The Legal Dilemma: Agent or Instrument
One of the most difficult issues in AI regulation is whether AI should be considered a legal “agent” or only a “instrument” employed by a human actor. Who is responsible if an artificial intelligence system initiates a cyberattack on its own? The developer? What about the user? What about the AI itself? This legal grey area complicates not only criminal culpability, but also civil claims and regulatory enforcement.
According to Baker and Robinson, current legal notions like mens rea (criminal intent) and actus reus (criminal act) were created with human actors in mind. Applying them to an AI entity creates absurdities and loopholes until we rethink these ideas for non-human intelligence.10
Therefore, drawing from interdisciplinary perspectives, this paper adopts the following working definition:
“Artificial Intelligence (AI) is a spectrum of machine-based systems capable of simulating human cognitive functions such as learning, decision-making, perception, and reasoning by processing large volumes of data through advanced computational models. In legal terms, AI must be understood not merely as a tool, but as a dynamic actor whose autonomy, unpredictability, and capacity to cause harm necessitate a rethinking of traditional concepts of liability and agency”
This framework will serve as the conceptual foundation for investigating the manner in which Indian laws relate—or fails to relate—with the rapidly changing world of AI-enabled crimes.
THE NEW AGE CRIMINALS: TYPOLOGIES OF AI-ENABLED CYBERCRIME IN INDIA
AI has not only improved the tools of traditional cybercriminals, but it now resulted into a completely new breed of digital threats—fast, scalable, autonomous, and often invisible. Understanding the developing typologies of AI-enabled cybercrime is critical for effective legal intervention.
A. Deepfakes and Synthetic Media Manipulation
The deepfakes, are the most obvious and alarming kind of AI misuse, they refer to hyper-realistic audio or video content created by using deep learning techniques. These forgeries can successfully imitate a person’s face, voice, or actions, making them effective tools for cybercrime, including extortion, revenge pornography, political misinformation, identity theft, and corporate defamation. In recent years, there has been a considerable increase in reported incidences of cyberstalking, harassment, and online extortion using deepfake content, primarily targeting women, celebrities, and public leaders. The psychological and reputational harm inflicted by such AI-generated synthetic media is significant, yet legal recourse remains slow and insufficient under the current paradigm. 11
B. AI-Powered Phishing and Social Engineering
Traditional phishing includes sending out blanket emails with generic bait. However, artificial intelligence goes a step farther. It can use a target’s social media, communication patterns, and behaviour to create very convincing phishing messages. AI-generated “spear phishing” may replicate tone, syntax, and even urgency, tricking even the most cyber-aware humans.12
C. Voice Cloning and AI-Based Impersonation
Despite several alarming uses of artificial intelligence, voice cloning is one of the most dangerous due to its misleading power and simplicity of abuse. Voice cloning technology use deep learning and neural networks to exactly imitate a person’s speech, making it nearly indistinguishable from the actual speaker. Although this type of technology has positive applications, such as assisting the speech-impaired or developing virtual assistants, it has also found a bad side in cyber-enabled theft.
One of the famous scam in Bengaluru involved cloning the voice of a company’s in-house legal counsel. They called a junior associate and requested important legal documents via email, citing urgency and secrecy. The associate obliged, and the records were leaked, bringing reputational and legal damage to the firm.13
These events demonstrate the severe vulnerability of voice-based verification methods. Current Indian legal laws under the Information Technology Act of 2000, particularly Sections 66C and 66D, which deal with identity theft and defrauding by personation, do not specifically identify or address AI-generated impersonations, such as voice cloning. This legal ambiguity makes prosecution difficult, especially when the fraud is perpetrated online and incorporates sophisticated digital impersonation.
D. AI-Generated Fake News and Algorithmic Misinformation
Artificial intelligence, particularly Generative AI and bots, has transformed how disinformation is manufactured and spread. Unlike traditional misinformation campaigns, AI-generated content—including texts, videos, and images—can be mass-produced and changed in real time in response to user involvement, dramatically increasing its reach and influence. Beatrice Panattoni examines how generative AI contributes to content-related crimes by intentionally creating and disseminating misleading or harmful material, such as deepfakes and misinformation campaigns aimed at manipulating public perception or disrupting democratic processes.14 These type of manipulations can have serious consequences in pluralistic democracies like India, particularly during elections. AI-powered bot networks can simulate actual interaction on politically sensitive matters, swaying public opinion.
Current Indian legal frameworks, such as the IT Act of 2000, are insufficient to address the new wave of AI-generated misinformation. There is no particular provision addressing algorithmically created disinformation or the automated amplification of incorrect content by bots, leaving enforcement agencies unprepared to respond appropriately to such threats.15
E. Autonomous Malware and Hacking Bots
Traditional malware follows predefined instructions; however, AI-powered autonomous malware may learn from its surroundings and adjust its strategy in real time. This considerably increases the threat level because it can more easily penetrate security defences.
When exploited, AI may be used to exploit system vulnerabilities, allowing for unparalleled ransomware assaults, data theft, and espionage.16 In 2022, a ransomware outbreak at a Pune hospital demonstrated how AI-enhanced malware may evade antivirus systems and encrypt important health data in order to extract cryptocurrency payments. The current legal mechanisms under IT Act are inadequate, as they were designed for human-led cyber intrusions, not adaptive, self-evolving code. AI-driven malware, lacking clear geographic origins or identifiable human control, poses unique enforcement challenges.
F. AI in Predictive Targeting and Discrimination
AI-based profiling technologies, originally designed for data analytics and personalisation, are increasingly being used for discriminatory purposes. These technologies leverage massive datasets comprising personal traits such as caste, income, religion, or geography, which can be exploited by cybercriminals to target vulnerable groups.
As algorithmic systems frequently reproduce the intrinsic racism, classism, and sexism encoded in the datasets on which they are trained.17 The biases of human civilisation are embedded into digital architectures, resulting in what he refers to as “techno-racism,” in which AI systems judge or exclude based on discriminatory patterns. This can be seen in applications where AI is used to judge creditworthiness, hiring potential, or access to benefits, which commonly disadvantages already marginalised communities.
Similarly, unregulated predictive AI systems might readily turn into tools for automated exclusion.18 This involves scams targeting persons deemed as weak by AI algorithms, as well as systematic denial of service due to skewed profiling. In India, scammers have used technical profiling to defraud low-income groups with fraudulent loan and job offers.
Despite these challenges, the Indian legal system currently lacks measures addressing algorithmic discrimination. While data protection frameworks are being considered by legislators, there is no legal regulation to control profiling or rectify harms caused by AI-driven targeting, leaving significant gaps in digital rights protection.
LEGAL FRAMEWORK IN INDIA
India’s legal framework was designed at a time when cybercrime was primarily manual and human-directed. Today, artificial intelligence serves not only as a tool, but also as a semi-autonomous actor, challenging the basic underpinnings of purpose and agency in criminal law. The Information Technology Act of 2000, the Bharatiya Nyaya Sanhita (BNS) of 2023, and the Digital Personal Data Protection Act of 2023 all cover various aspects of digital wrongdoing, but none of them were designed to address the complex and increasing AI-related risks.
A. The Information Technology Act, 2000
The IT Act of 2000 is the Primary legislation governing cyber operations in India. Its provisions, while vast, are inadequate for the era of machine learning and autonomous systems.
Several provisions of the Information Technology Act, 2000 can be applied to AI-enabled crimes, though indirectly. Section 43 deals with unauthorised access and damage to computer systems or digital resources, making it applicable in cases where AI bots or automated scripts are used to infiltrate or disrupt networks.19 Section 66 penalises hacking and other computer-related offences, covering instances where AI tools are employed to breach cybersecurity protocols.20
Section 66C addresses identity theft and the misuse of digital credentials, which becomes particularly relevant when AI is used to clone voices or mimic biometric data.21 In conjunction, Section 66D targets cheating by personation through digital means, a provision that can be invoked when AI-generated impersonation or synthetic voice cloning is used to defraud individuals.22
Section 66E covers violations of privacy through electronic means and is especially pertinent in cases involving AI-generated deepfakes that intrude upon an individual’s personal space or reputation.23 Furthermore, Sections 67 and 67A criminalise the publication and transmission of obscene or sexually explicit material in electronic form, extending to AI-generated non-consensual pornography or explicit deepfake content.24
Finally, Section 69 authorises government agencies to intercept, monitor, or decrypt information for national security purposes. This could potentially aid in detecting or preventing AI-enabled espionage, terrorism, or coordinated cyber-attacks, though it also raises concerns about surveillance and privacy in an AI-driven environment.25
Considering these provisions, the Act does not address AI-related concepts such as machine autonomy, deep learning models, and predictive decision-making. As noted, the Act assumes human control and agency, which is increasingly lacking in AI-mediated cyber disasters.¹ 26The notion of a direct human actor is a fundamental restriction when considering crimes committed or facilitated by self-learning systems.
B. Bharatiya Nyaya Sanhita (BNS), 2023
The BNS comes with more modern structure, however it is silent on AI-specific liabilities. While it modernises certain cybercrime and impersonation charges, there is no section specifically addressing AI-generated or AI-assisted illegal actions. The generality of its language ignores complicated technological agents such as autonomous systems. This omission makes it impossible to apply traditional legal ideas such as criminal intent and causation to situations involving sophisticated algorithms.27
The following are pertinent BNS provisions that may be used in crimes involving artificial intelligence. These clauses, however, were written with typical human offenders in mind and lack the nuanced understanding required to meet the growing nature of AI technologies, even while they are useful in identifying and punishing specific offences. It is challenging to apply traditional criminal law concepts like purpose, knowledge, and causation because the majority of rules do not take into consideration the autonomous or semi-autonomous behaviour of AI systems. Because there are no interpretive standards tailored to AI, there is uncertainty on who should be held accountable—the system, the creator, or the user.
Several provisions of the Bharatiya Nyaya Sanhita (BNS), 2023, while not designed specifically for artificial intelligence, can be extended to cover AI-enabled crimes. For instance, Section 77, which deals with voyeurism, becomes relevant when AI tools are used to create or enhance private images or videos without consent. Deep learning algorithms that generate or manipulate voyeuristic content fall squarely under this provision.28
Section 294 criminalises the publication or transmission of obscene material, and it becomes especially pertinent when AI is used to produce and circulate pornographic content via digital platforms. This section is also applicable in cases involving AI-generated deepfake pornography or sexually explicit content that impersonates real individuals.29 The law, though framed with human actors in mind, can be interpreted to include the unconsented dissemination of such content through AI-generated media.30
Section 319, which criminalises cheating by personation using computer resources, is crucial in dealing with digital impersonation through AI. It applies when AI chatbots, deepfake videos, or cloned digital profiles are used to impersonate individuals or entities for fraudulent gain.31In related scenarios, identity theft and impersonation—such as when AI is used to create synthetic identities or simulate real voices and facial features—are punishable under extended interpretations of the same provision. 32
Further, Sections 308 and 351 of the BNS address criminal intimidation, blackmail, and threats. These become applicable when AI-generated content—such as deepfakes, synthetic messages, or altered data—is used to coerce, threaten, or extort individuals. The manipulative use of data or realistic synthetic media for intimidation is a growing concern under this framework.⁶ 33
Misinformation and societal harm caused by AI are tackled under Section 353, which penalises statements conducing to public mischief. This section becomes relevant when AI-generated misinformation, especially in the form of political propaganda, deepfake videos, or inciting fake news, is used to provoke unrest, hatred, or violence in society.34
Finally, Section 356 of the BNS addresses defamation. When AI-generated false information, fake news, or synthetically altered media harms an individual’s reputation, it can be prosecuted under this provision. AI-generated synthetic articles, photos, or videos targeting individuals with reputational damage fall within its ambit.35
These laws are insufficient to handle the dynamic and independent character of artificial intelligence, even though they can aid in combating crimes made possible by AI. India urgently needs a specific legal framework for AI to bridge the gaps created by conventional criminal law.
C. The Digital Personal Data Protection (DPDP) Act, 2023
India’s first data privacy-specific legislation. It offers a framework that regulates how both public and commercial organisations gather, store, process, and distribute personal data. Although it is a significant step in the direction of data governance, it is still not very applicable to crimes involving artificial intelligence or data misuse by intelligent systems.
India’s first comprehensive data privacy law, the Digital Personal Data Protection (DPDP) Act, 2023, regulates how both public and commercial organisations gather, store, handle, and transfer personal data. Although it represents a major advancement in digital governance, its ability to control crimes motivated by artificial intelligence and algorithmic data misuse is still restricted.
In order to regulate AI systems that gather or handle user data, Section 3 of the Act specifies key terminology such “personal data,” “data fiduciary,” and “consent.” It does not, however, distinguish between data processed by automated AI agents and data processed by human actors.36Data fiduciaries are required by Section 7 to preserve personal data, which is especially crucial when training AI models that include sensitive data scraping or analysis from public or semi-public sources. However, the Act does not mandate that automated choices made by these AI systems be traceable or explainable.37
Particular safeguards for children’s data are outlined in Section 9, which is essential in a time when AI-powered products are being utilised more and more in digital entertainment and education. The best way to monitor or audit compliance with AI systems that target children is unclear, though.38 Additionally, sanctions for unauthorised data processing or breaches are introduced in Sections 21 and 22. Although the Act does not outline how responsibility is to be allocated in cases where harm is caused by autonomous or semi-autonomous AI tools, they may conceivably apply to AI systems involved in illegal profiling or surveillance.39
The flaws of the Act are especially noticeable in a number of areas. Because algorithmic accountability is not necessary, automated decision-making is uncontrolled with regard to justice and transparency. Furthermore, even in cases when AI systems have a substantial influence on people’s rights, it does not require regular audits or evaluations of these systems. The Act’s failure to address the creation and misuse of inferred data—information that AI systems obtain through profiling, predictive modelling, or behavioural analysis—is another significant worry. Despite not being exchanged directly, this type of data may be extremely sensitive and vulnerable to abuse.40
Another unclear subject is liability. It is unclear who is legally responsible for AI systems that function freely or semi-autonomously—developers, data handlers, users, or all of them. Regulating new AI-driven ills like social ranking, discrimination, and spying is made more difficult by this ambiguity. Additionally, research indicates that the Act falls short in preventing algorithmic bias and mass profiling, especially against vulnerable and marginalised groups.41
India urgently requires an AI-specific legal framework to supplement the DPDP Act in order to solve these shortcomings. Enforceable rights against automated decision-making, mandatory human supervision for important AI applications, moral guidelines for AI development and implementation, and strong accountability procedures for algorithmic damages should all be part of this. Despite being fundamental, the DPDP Act is unable to satisfy the regulatory requirements of the AI era unless such legislation is passed.
Notwithstanding the Act’s progressive language, it does not:
a) Address Algorithmic Decision-Making: AI-powered automated decision-making procedures do not specifically call for algorithmic accountability, transparency, or justice.
b) Require AI Audits: The Act does not require entities to provide an explanation of the reasoning behind or results of AI-led decisions that have an impact on people, nor does it require routine audits of AI systems.
c) Take into Account Inferred Data Misuse: AI technologies frequently employ inference to produce insights by forecasting future weaknesses, preferences, or behaviour. Although such inferred data may be more sensitive than information that is expressly disclosed, the Act neither defines nor regulates it.
d) Establish Liability for Autonomous Systems: The law is ambiguous over who is liable when AI systems behave without direct human input—developers, deployers, or the AI itself.
Furthermore, the Act falls short in tackling social scoring, mass spying, and profiling using AI-powered data, according to results.42 For marginalised communities, who can be disproportionately impacted by discriminatory or opaque algorithmic techniques, this is particularly concerning.43India need an AI-specific legislative framework to supplement the DPDP Act in order to close this regulatory vacuum.
i. Rights against automated choices should be part of this.
ii. Critical applications require human oversight.
iii. Standards for the creation of ethical AI.
iv. Algorithmic harm enforcement methods.
Despite being a crucial basis, the DPDP Act is insufficient for the era of autonomous digital intelligence until such a framework is implemented.
KEY INDIAN AND INTERNATIONAL LEGAL DEVELOPMENTS ON AI AND DIGITAL CONTENT
A combination of Indian and foreign case precedents, each emphasising a different facet of criminal culpability in AI-driven acts, provides the best understanding of the changing environment of cyber law in the age of artificial intelligence.
A. Indian Precedents and Pivotal Cases
Although the ruling in Justice K.S. Puttaswamy v. Union of India44 mainly upheld the constitutional right to privacy, it also has consequences for criminal liability under Sections 354C45of the Indian Penal Code (IPC) and 66E46 and 7247 of the Information Technology Act, 2000 (IT Act). Unauthorised use of AI-powered monitoring may lead to the imprisonment of public or private entities involved.
In the same way, Swami Ramdev v. Facebook Inc.48 shows that criminal defamation charges under Section 499 IPC49 may be brought against defamatory content created and distributed by AI. Both the human deployer and, in certain situations, the responsible platform officers may be held liable if it is proven that they had the purpose to damage reputation.In Marico Ltd. v. Abhijeet Bhansali50, the issue of deceptive commercial claims underscores the danger of AI-generated endorsements leading to prosecutions under Section 420 IPC51 (cheating) and sector-specific legislation, especially where product quality is overstated.
Despite being constitutional in nature, the Anuradha Bhasin v. Union of India52 verdict subtly addresses AI-enabled dangers like cyberterrorism under Section 66F53 of IT Act, especially when shutdowns are implemented in response to AI-coordinated attacks.
The Delhi High Court’s decision in Aaradhya Bachchan v. Bollywood Time54 is significant for its application of strict liability under the Protection of Children from Sexual Offences (POCSO) Act55 and Section 67B56 IT Act to AI-generated child deepfakes, rendering the creator or distributor liable regardless of intent.
An elderly man from Yamuna Vihar, Delhi, was tricked into sending ₹50,000 after he received a WhatsApp message claiming his cousin’s child had been abducted. This terrifying incidence highlights the growing sophistication of cybercrime. The criminals used AI-generated voice cloning to make a fervent cry for assistance in a child’s voice. The victim sent the money through Paytm in response to emotional anguish, only to learn later that the appeal was completely made up and the child was safe.57
In State of Maharashtra v. Rakesh Sharma58, the accused was charged with obscenity under IPC Sections 292–29459 and AI-generated explicit content under Sections 66Eand 67A60 of the IT Act. This case highlighted the idea that AI is merely a tool and that human actors are ultimately responsible.
Depending on the type of reputational harm produced, using someone else’s likeness without permission, as in Priya Sen v. InstaPost AI Page61, can result in charges under Section 66C62 of the IT Act and IPC Section 49963 (defamation).
Last but not least, Ritika Kapoor v. DeepVision AI Labs64 is a significant precedent for derivative liability, in which AI developers were held liable for negligently facilitating offences under Section 8565 of the IT Act (offences committed by enterprises) and related IPC prohibitions.
B. International Cases
In Eva Glawischnig-Piesczek v. Facebook Ireland Limited,66 the principles extend to possible criminal culpability for cross-border dissemination of hateful or defamatory content under EU state legislation, even though the case is essentially a civil defamation dispute.
Glukhin v. Russia67 at the European Court of Human Rights shows how, in cases where illegal AI surveillance violates criminal restrictions on data exploitation, state criminal culpability may be triggered under specific legal frameworks.
The UK case Bridges v. South Wales Police68 demonstrates that, even though it was decided in a civil rights context, illegal AI-driven biometric processing can result in criminal penalties under the UK Data Protection Act 2018 for deliberate exploitation of personal data.
In the United States, Lehrman & Sage v. Lovo, Inc.69 shows the increasing awareness that illegal AI voice copying, especially for fraudulent purposes, might result in prosecution under federal laws like wire fraud (18 U.S.C. sec- 1343)70 & identity theft (18 U.S.C. sec-1028)71, in addition to state-level offences.
Collectively, these cases reveal that AI’s integration into the digital sphere not only complicates evidentiary standards and jurisdictional reach but also demands robust adaptation of criminal liability frameworks to hold human actors—developers, deployers, and platforms—responsible for offences facilitated by AI.
C. Key Gaps and the Need for Reform
India is currently lacking in several areas when it comes to combating cybercrimes with AI:
1. Lack of a statutory definition of artificial intelligence: In contrast to the EU AI Act, 2024, which clearly defines AI in functional terms, Indian statutes like the Information Technology Act, 2000 (IT Act) do not provide a legal definition of AI.72
2. Unclear liability attribution for AI-related crimes – The law is vague about how developers, deployers, and consumers should share accountability when AI does harm.73
3. Absence of specialised organisations for AI compliance and oversight: At the moment, India lacks an independent statutory authority to control the use of AI.74
4. Lack of forensic guidelines for algorithm-generated evidence: The Indian Evidence Act of 1872 contains no procedures for confirming artificial intelligence (AI) or synthetic evidence.75
5. Lack of ethical requirements for AI developers: India lacks a legally binding code pertaining to fairness, transparency, and bias reduction in AI systems, in contrast to the OECD AI Principle.76
Without these safeguards, India is less equipped to handle the dangers of algorithmic deceit, bias amplification, and autonomous decision-making, which leads to serious gaps in criminal enforcement and legal certainty.
LEARNING FROM THE WORLD: COMPARATIVE LEGAL APPROACHES
Dealing with AI-enabled crime can be like chasing a shapeshifter; what begins as a data breach could turn into a deepfake smear campaign or algorithmic manipulation. A comparative analysis of international legal frameworks, based on research, policy, and actual case law, provides a strategic reform roadmap as India navigates this changing danger scenario.
A. European Union: The Risk-Based Gold Standard
The first comprehensive law created to proactively manage AI threats is the Artificial Intelligence Act (2024) of the European Union.77. It divides AI into four categories, each of which carries an own set of regulatory requirements: unacceptable risk, high risk, restricted risk, and minimum risk.78 AI systems that facilitate manipulative targeting, social scoring, or biometric surveillance are completely prohibited; high-risk systems, such as facial recognition or predictive policing, need human supervision and conformance evaluations and documentation; limited-risk systems need transparency; and minimal-risk systems are mainly unregulated. Beginning in February 2025, these rules were enforced, and offenders faced fines of up to €35 million, or 7% of global revenue.79 Together with the GDPR’s rights safeguards, this framework may help India develop its own tiered AI regulations, possibly with the help of a Data Protection Board established by the Digital Personal Data Protection Act of 2023.
B. United States: Litigation and Voluntary Standards as Regulation
Instead of a single AI statute, the U.S.’s regulatory framework for AI is a disjointed system of agency oversight and law enforcement. While the National Institute of Standards and Technology (NIST) unveiled a voluntary AI Risk Management Framework (AI RMF) in January 2023 to assist organisations in managing AI risks and promoting reliable design and deployment, the Federal Trade Commission has brought charges for algorithmic deception and privacy violations.80 Transparency, equity, accountability, and resilience are prioritised in the framework, which provides flexible governance options as opposed to legally obligatory requirements.81 This adaptable, decentralised architecture fosters innovation but lacks preemptive clarity; India may take a cue from this and add enforceable central AI laws to it.
C. United Kingdom: Ethics-First Regulation with Institutional Support
Instead of using prescriptive legislation, the UK addresses AI governance through ethical foresight. The new AI Safety Institute and the Centre for Data Ethics and Innovation (CDEI) promote policies based on explainability, equity, and openness.82 Stakeholder discussions, algorithmic audits, and non-binding ethical norms are all part of their job, which influences private compliance as well as public expectations.883 These frameworks incorporate justice into AI by design, even though they are not legally binding. This methodology may be in line with India’s constitutional principles of equality and dignity.
D. China: State- Centered Control and Watermarking
China’s AI governance approach places a strong emphasis on algorithmic control, national security, and official supervision. Under the Cybersecurity Law and Personal Information Protection Law (PIPL), recent initiatives include requiring watermarking of AI-generated information, approving synthetic media platforms, and requiring recommendation systems to be transparent.84 This top-down strategy is effective at maintaining institutional control, but it raises questions about human rights. However, India’s policy might be informed by procedural instruments like watermarking and AI registration systems, which could be modified to safeguard free speech and civil liberties.
E. South Korea: Proactive AI Crime Enforcement
South Korea has implemented a comprehensive institutional and legal framework to address AI misuse, particularly deepfake sexual abuse. The Special Act on the Punishment of Sexual Crimes85 now criminalizes not only the creation and distribution of sexually explicit deepfake material (with penalties raised to up to seven years in prison) but also the possession and viewing of such content, punishable by up to three years in jail or a fine up to 30 million won. These reforms are enforced through specialized AI crime units and national AI surveillance systems capable of targeting both creators and facilitators.86 India could benefit significantly from such a multifaceted policy-institutional model—especially in equipping CERT-In and cybercrime cells with AI forensic technologies and expedited takedown mechanisms.
F. Comparative Takeaways for India
The following international models offer helpful resources for revising India’s AI-legal framework:
i. EU risk-based model-inspired tiered legal frameworks are able to distinguish between AI applications that are dangerous and those that are benign.
ii. Knowledge and accountability can be concentrated by specialised oversight groups that resemble the UK’s CDEI or South Korea’s AI units.
iii. By utilising American adaptability, training initiatives for courts and law enforcement can enhance AI forensics and evidence management.
iv. China’s watermarking and AI registries are examples of technology-based solutions that increase traceability without infringing on rights.
v. Prior to deployment, ethics-by-design standards, which are based on UK legislation, ensure that government AI complies with democratic ideals.
None of these systems function perfectly in India. Instead, they act as both a mirror and a foundation for building a robust, welcoming, and rights-abiding AI governance framework in India.
INDIA’S REACTIVE APPROACH TO REFORM
This research paper’s title, “Hacked by Future,” is more than just a catchphrase. It reflects a very serious concern: that India might be exposed to the risks of artificial intelligence if we don’t take action quickly enough. India continues to rely on the outdated Information Technology Act of 2000, even as nations around the world are working to establish new legislation to address AI, such as the European Union’s AI Act or the expanding debates in the US. When individuals were still learning how to use email, that rule was created, not when machines were producing fake videos, writing articles, or cloning human voices.
Regretfully, this delay is nothing new. India has a lengthy history of enacting legislation in the wake of natural disasters. Following the Bhopal Gas Tragedy87, we implemented stronger environmental regulations. Following the Nirbhaya case88, we strengthened our criminal legislation. We take action after suffering—when someone has died or something has been damaged. AI, however, may deny us another chance. Crimes produced by AI happen more quickly than we do. They are frequently undetectable, automated, and proliferate at a never-before-seen level—from algorithms that rig entire elections to phoney videos that damage reputations.
We won’t simply be catching up if we wait much longer; we’ll be powerless. The law should be a tool to protect people before harm is done, not just to punish someone after the damage. If we don’t adapt, the future will actually hack us—not because AI is bad, but rather because we weren’t ready.
CONCLUSION AND WAY FORWARD
Artificial intelligence is changing the landscape of criminal activity as it becomes more and more ingrained in everyday life, from surveillance to entertainment, from education to banking. Predictive scams, algorithmic manipulation, voice cloning, and deepfakes are only the beginning of this quickly growing problem. In order to determine if India is institutionally and legally prepared to handle crimes enabled by artificial intelligence, this research has examined the country’s current legal system, its judiciary involvement, and comparative international models. The response is depressing. Even if some of India’s laws have been progressive, they are still based on the ideas of human agency, linear causality, and empirical proof. They have trouble with autonomous systems, anonymised AI actors, and synthetic media. Despite their usefulness, the IT Act, BNS, and Data Protection laws lack the accuracy and procedural flexibility needed to combat illicit activity brought on by AI.
The worldwide study unequivocally shows that no nation has discovered a panacea. However, the combined efforts—the UK’s ethics-first strategy, China’s enforceability, the U.S.’s litigation-driven flexibility, the EU’s tiered legislation, and South Korea’s AI-specific prosecution model—all provide building blocks that India can adopt. India needs to stop enforcing reactive patchwork immediately. The way forward necessitates:
• Passing a thorough AI-specific law that is in line with international norms and based on constitutional principles;
• Creating specialised regulatory bodies for AI and AI crime monitoring units;
• Including algorithmic audits and AI forensics in cybercrime investigations;
• Teaching law enforcement and judges how to handle synthetic evidence and algorithmic liability;
• Encouraging moral design principles and reducing bias via cooperation in public-private policy.
Ultimately, the question is not whether AI will change the nature of crime—it already has. The real question is whether Indian law can evolve fast enough to uphold justice in this brave new digital world.
*****
Footnotes
1. D.J. Baker & P.H. Robinson, Artificial Intelligence and the Law: Cybercrime and Criminal Liability (Routledge 2021).
2. Taís Fernanda Blauth, Oskar Josef Gstrein & Andrej Zwitter, Artificial Intelligence Crime: An Overview of Malicious Use and Abuse of AI, 10 IEEE Access 77110 (2022), DOI: https://doi.org/10.1109/ACCESS.2022.3191790 ,last seen on 20th February 2026.
3. Sufiya Ahmed & Sunidhi Singh, AI-Generated Crimes: A Critical Analysis of Law in India, 6(5) Indian Journal of Law and Legal Research 2284, 2285 (2023)file:///C:/Users/acer/Desktop/New%20folder/AI%20Generated%20crimes.pdf (last accessed on 20th Feb 2026).
4. Taís Fernanda Blauth, Oskar Josef Gstrein & Andrej Zwitter, Artificial Intelligence Crime: An Overview of Malicious Use and Abuse of AI, 10 IEEE Access 77110 (2022), DOI: https://doi.org/10.1109/ACCESS.2022.3191790 ,last seen on 20th February 2026.
5. Beatrice Panattoni, Generative AI and Criminal Law, Cambridge Forum on AI: Law and Governance (2024).
6. NITI Aayog, AI for All, 2022.
7. Russell, S. J., & Norvig, P. Artificial Intelligence: A Modern Approach, 4th ed. (Pearson, 2020). https://api.pageplace.de/preview/DT0400.9781292401171_A41586057/preview-9781292401171_A41586057.pdf (last seen on 20th February 2026).
8. Thomas C King, Nikita Aggarwal, Mariarosaria Taddeo and Luciano Floridi, Artificial Intelligence Crime: An Interdisciplinary Analysis of Foreseeable Threats and Solutions (2019) 25(2) Science and Engineering Ethics 1-18, available at: https://doi.org/10.1007/s11948-018-00283-7 (last visited 20th February 2026).
9. NITI Aayog, National Strategy for Artificial Intelligence #AIForAll (2018).
10. Gabriel Hallevy, “AI vs. IP,” in Dennis J. Baker & Paul H. Robinson (eds.), Artificial Intelligence and the Law: Cybercrime and Criminal Liability (Routledge, 2020) pp. 229–248.
11. Britt Paris and Joan Donovan, ‘Deepfakes and Cheap Fakes: The Manipulation of Audio and Visual Evidence’ (Data & Society Research Institute,2019) https://datasociety.net/library/deepfakes-and-cheap-fakes/ accessed 20th February 2026.
12. Taís Fernanda Blauth, Oskar Josef Gstrein and Andrej Zwitter, “Artificial Intelligence Crime: An Overview of Malicious Use and Abuse of AI” (2022) 10 IEEE Access 77110, DOI: https://doi.org/10.1109/ACCESS.2022.3191790 ,last seen on 20th February 2026.
13. Dr. Sufiya Ahmed and Sunidhi Singh, AI-Generated Crimes: A Critical Analysis of Law in India, (2023) 6(5) Indian Journal of Law and Legal Research 2284, 2285 file:///C:/Users/acer/Desktop/New%20folder/AI%20Generated%20crimes.pdf (accessed 15 August 2025).
14. Beatrice Panattoni, “Generative AI and Criminal Law” (2025) 1 Cambridge Forum on AI: Law and Governance e9, 1–14 doi:10.1017/cfl.2024.9 (last seen on 21st February 2026).
15. Sowmya N and Arathi Rajagopal, “Role of Artificial Intelligence in Detecting and Preventing Cyber Crimes in India” (2024) 4(1) International Journal of Advanced Research in Science, Communication and Technology, DOI: 10.48175/IJARSCT-22635 (last seen on 21st February 2026).
16. Ibid.
17. Arshin Adib-Moghaddam, Is Artificial Intelligence Racist? The Ethics of AI and the Future of Humanity (Bloomsbury Academic, 2023)
18. Mark Deem and Peter Warren, AI on Trial (Bloomsbury Professional, 2022)
19. The Information Technology Act, 2000, s. 43.
20. Ibid, s. 66.
21. Ibid, s. 66C.
22. Ibid, s. 66D.
23. Ibid, s. 66E.
24. Ibid, ss. 67–67A.
25. Ibid, s. 69
26. Antara Roy, Artificial Intelligence with Law in India (2024) 12(1) International Journal of Creative Research Thoughts (IJCRT) 80, available at: https://www.ijcrt.org/papers/IJCRT2401013.pdf (last visited 21st February 2026).
27. Dr. Nandini Raizada, A Critical Legal Analysis of the Use of Artificial Intelligence in India: Risk, Regulation and the Way Forward, International Journal of Law Management & Humanities, Vol. 6, Issue 2, 2023, pp. 359-369.
28. Bharatiya Nyaya Sanhita, 2023, s. 77.
29. Ibid, s. 294.
30. Ibid.
31. Ibid, s. 319.
32. Ibid.
33. Ibid, ss. 308, 351.
34. Ibid, s. 353.
35. Ibid, s. 356.
36. Digital Personal Data Protection Act, 2023, s. 3.
37. Ibid, s. 7
38. Ibid, s. 9
39. Ibid, ss. 21–22.
40. Sowmya N and Arathi Rajagopal, “Role of Artificial Intelligence in Detecting and Preventing Cyber Crimes in India” (2024) 4(1) International Journal of Advanced Research in Science, Communication and Technology, DOI: 10.48175/IJARSCT-22635 (last seen on 21st February 2026).
41. Dr. Nandini Raizada, A Critical Legal Analysis of the Use of Artificial Intelligence in India: Risk, Regulation and the Way Forward, International Journal of Law Management & Humanities, Vol. 6, Issue 2, 2023, pp. 359-369.
42. NITI Aayog, Responsible AI for All: Operationalizing Principles for Responsible AI (2021) https://www.niti.gov.in/sites/default/files/2022-11/Ai_for_All_2022_02112022_0.pdf (accessed 20th February 2026).
43. United Nations Human Rights Council, The Right to Privacy in the Digital Age, A/HRC/39/29 (3 August 2018) https://docs.un.org/en/A/HRC/39/29 (accessed 20th February 2026).
44. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1
45. Indian Penal Code, No. 45 of 1860, S. 354C (India).
46. Information Technology Act, No. 21 of 2000, S. 66E (India).
47. Information Technology Act, No. 21 of 2000, S. 72 (India).
48. Swami Ramdev & Anr. v. Facebook, Inc. & Ors., 2019 SCC OnLine Del 10701 (Del HC).
49. Indian Penal Code, No. 45 of 1860, S. 499 (India).
50. Marico Ltd. v. Abhijeet Bhansali, 2020 SCC OnLine Bom 20 (Bom HC).
51. Indian Penal Code, No. 45 of 1860, S. 420 (India).
52. Anuradha Bhasin v. Union of India, (2020) 3 SCC 637 (India).
53. Information Technology Act, No. 21 of 2000, S. 66F (India).
54. Aaradhya Bachchan v. Bollywood Time, 2023 SCC OnLine Del 2203 (Del HC).
55. Protection of Children from Sexual Offences Act, No. 32 of 2012 (India)
56. Information Technology Act, No. 21 of 2000, S. 67B (India).
57. NDTV, AI Scams Surge: Voice Cloning And Deepfake Threats Sweep India, Oct. 10 2024 (detailing the Delhi voice-cloning scam targeting a senior citizen) https://www.ndtv.com/ai/ai-scams-surge-voice-cloning-and-deepfake-threats-sweep-india-6759260 (last seen on 20th February 2026)
58. State of Maharashtra v. Rakesh Sharma FIR No. 45/2024, Mumbai Police (deepfake pornography targeting MLA)
59. Indian Penal Code, No. 45 of 1860, S. 292-294 (India).
60. Information Technology Act, No. 21 of 2000, S. 66E & S. 67A (India).
61. Priya Sen v. InstaPost AI Page, 2024 SCC OnLine Cal 1854 (Cal HC).
62. Information Technology Act, No. 21 of 2000, S. 66C (India).
63. Indian Penal Code, No. 45 of 1860, S.499
64. Ritika Kapoor v. DeepVision AI Labs, 2025 SCC OnLine Kar 994 (Kar HC).
65. Information Technology Act, No. 21 of 2000, S. 85
66. Eva Glawischnig-Piesczek v. Facebook Ireland Ltd.,Case C-18/18, EU:C:2019:821 (CJEU).
67. Glukhin v. Russia, App. No. 11519/20 (ECHR, 4 July 2023).
68. Bridges v. South Wales Police [2020] EWCA Civ 1058.
69. Lehrman & Sage v. Lovo, Inc., No. 1:24-cv-02036 (S.D.N.Y., 2025).
70. United States Code, 18 USC sec- 1343, Wire Fraud (2023).
71. United States Code, 18 USC sec- 1028, Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information (2023).
72. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 on Artificial Intelligence (AI Act), Official Journal of the European Union L 168, 26 June 2024, Article 3(1).
73. United Kingdom Law Commission and Scottish Law Commission, Autonomous Vehicles: A Joint Report (Law Com No 404, Scot Law Com No 258, 2022) 87.
74. NITI Aayog, National Strategy for Artificial Intelligence #AIForAll (2018).
75. Indian Evidence Act 1872, Section 65B.
76. Organisation for Economic Co-operation and Development (OECD), Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449, 2019).
77. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on Artificial Intelligence (AI Act), Official Journal of the European Union L 168, 12 July 2024.
78. Ibid., art. 5–11, chap. II–III.
79. Artificial Intelligence Act, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, arts. 5–7 (classifying AI systems into “unacceptable risk” [art. 5], including manipulative subliminal techniques, exploitation of vulnerabilities, social scoring, and certain biometric surveillance; “high-risk” [art. 6], requiring conformity assessments, risk management, documentation, and post-market monitoring; and “minimal risk” [art. 7], imposing no additional legal obligations but encouraging voluntary codes of conduct), available at https://artificialintelligenceact.eu/wp-content/uploads/2024/11/Future-of-Life-InstituteAI-Act-overview-30-May-2024.pdf (last visited 20th February 2026)
80. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (January 2023), available at https://doi.org/10.6028/NIST.AI.100-1 (last visited 20th February 2026).
81. Ibid.
82. GOV.UK, “Centre for Data Ethics and Innovation — About Us,” available at https://www.gov.uk/government/organisations/centre-for-data-ethics-and-innovation/about (accessed 20th February 2026).
83. GOV.UK, “CDEI Publishes Roadmap for AI Assurance Ecosystem,” available at https://www.gov.uk/government/publications/the-roadmap-to-an-effective-ai-assurance-ecosystem/the-roadmap-to-an-effective-ai-assurance-ecosystem (accessed 20th February 2026).
84. China’s AI Governance: A Tale of Three Digital Empires (by Charles C. Wang, Siyi Lin, Xia Wu & Yiman Li), Hastings International & Comparative Law Review Vol. 48, No. 2 (2021), available at https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1899&context=hastings_international_comparative_law_review (last visited 20th February 2026).
85. Special Act on the Punishment of Sexual Crimes, Act No. 10647, Jan. 26, 2011, as amended by Act No. 19820, Oct. 22, 2023 (S. Kor.), available at https://elaw.klri.re.kr/eng_service/lawView.do?hseq=40947&lang=ENG (last visited 20th February 2026).
86. Scott Nover, South Korea Banned Deepfakes. Is That a Realistic Solution for the US?, GZERO Media (Oct. 8, 2024), available at https://www.gzeromedia.com/gzero-ai/south-korea-banned-deepfakes-is-that-a-realistic-solution-for-the-us (last visited 20th February 2026).
87. Union Carbide Corporation v. Union of India, 1991 AIR 273, 1991 SCR (1) 38 (Bhopal Gas Tragedy case).
88. Mukesh & Anr. v. State (NCT of Delhi) & Ors., (2017) 6 SCC 1 (Nirbhaya gang rape case).