EXPERT VIEW
ENGLAND AND INDIA
“If your business has EU exposure, map your AI systems against the EU AI Act’s risk tiers now. Do not wait for domestic legislation.”
On intellectual property, the government consulted on expanding text and data mining exceptions to permit AI training on copyright- protected works, then stepped back under creative industry pressure. The position remains unresolved, with no legislative clarity on whether training an AI model on copyright-protected content without a licence is lawful under UK law. Businesses operating across the UK, EU and other jurisdictions face a growing patchwork of obligations with no domestic anchor for their compliance. There is also an equivalence risk: the UK’s data adequacy status with the EU depends on ongoing alignment with EU data governance standards. If your business has EU exposure, map your AI systems against the EU AI Act’s risk tiers now. Do not wait for domestic legislation. Audit your AI vendor contracts, because liability allocation, data processing terms and IP indemnities are frequently underdeveloped in standard terms. Finally, build governance structures that can flex, because this landscape will keep evolving at a blistering pace.
has reserved judgment on whether training a model on copyrighted news content infringes the Copyright Act, 1957, the first substantive test of AI training data before an Indian court. Although neither decision is final, they mark the beginning of a judicial answer to questions the legislature is yet to address. For foreign businesses, two further points are worth noting. First, India places no AI-specific restriction on foreign investment and the DPDPA’s approach to cross-border data transfer is markedly more permissive than the EU’s adequacy-based model. Second, for multinationals running AI development, training or data annotation operations through Indian subsidiaries or delivery centres, the unresolved copyright position illustrated by the ANI Media litigation means that contracts governing the use of India-sourced or India-processed training data should expressly allocate IP risk, rather than assume the position is settled. The lesson from India is the same as in the UK: do not wait for dedicated AI legislation. Agreements should expressly address liability, data processing terms and IP indemnities under Indian law, consent practices should be tested against the DPDPA and governance should be built to accommodate change.
ABOUT US...
gunnercooke LLP is a UK-based corporate and commercial law firm founded in 2010 to deliver a more flexible and transparent approach to legal services. With legal professionals across offices in the UK, Europe and the US, the firm advises businesses and financial institutions on a range of legal and commercial matters.
T he extraterritorial logic described by Shilpen Savani has a clear Indian counterpart. To the extent that an AI service provider processes the personal data of individuals in India, the Digital Personal Data Protection Act, 2023 (DPDPA) applies wherever that processing relates to the offering of goods or services to individuals within India, regardless of where the provider is established. India’s approach to AI stands in deliberate contrast to its treatment of personal data. Like the UK, India has no dedicated AI statute and governs the technology through existing legislation. Two enactments carry the substantive burden: the Information Technology Act, 2000 (IT Act), which addresses the platform and content dimension, and the DPDPA, which governs personal data and is constructed around consent. The DPDPA permits non- consensual processing only within a closed list of ‘legitimate uses’, among them employment, state benefits, medical emergencies and public health and contains no open ‘legitimate interests’ ground. Critically for AI developers, none extends to the training of an AI model, so consent remains the operative basis even where the underlying data is publicly available. Entities processing personal The Indian perspective: N V Saisunder Partner – IPR, Media & Technology Law Eshwars Advocates
data at scale assume heightened obligations, including impact assessments, independent audits and reporting to the newly constituted Data Protection Board. Under the IT Act, the position turns on Section 79, which confers conditional ‘safe harbour’ on intermediaries, an immunity from liability for third-party content they host, provided they observe prescribed due-diligence obligations. Generative AI fits uneasily within that scheme, as a system that produces original, synthesised output is not merely hosting content created by others. Rather than enact a specific AI statute, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 brought synthetically generated information within intermediaries’ due diligence duties, requiring it to be labelled and tagged with metadata and putting safe harbour at risk where a platform knowingly permits unlawful synthetic content. However, this strategy regulates AI by treating the platforms that generate it as intermediaries, when it is contestable whether a generative AI system is an intermediary at all. In the absence of legislative clarity, the question has fallen to the courts and an AI jurisprudence is slowly beginning to take shape. In IndiaMart Intermesh Ltd v. OpenAI Inc (Calcutta High Court, May 2026), the Court considered this question at the interim stage, taking the prima facie view that ChatGPT is an ‘originator’ rather than an ‘intermediary’ under the IT Act, while leaving the point to be decided finally at trial and noting that a statute drafted before generative AI will ultimately require legislative, not merely administrative, intervention. In ANI Media Pvt Ltd v. OpenAI OpCo LLC, the Delhi High Court
“Contracts governing the use of India-sourced or India-processed training data should expressly allocate IP risk, rather than assume the position is settled.”
gunnercooke.com
Eshwars Advocates is a full-service commercial and intellectual property law firm with offices across India. Established in 2006, the firm advises domestic and international clients on corporate, technology, data protection, intellectual property and dispute resolution matters.
REGULATE, INNOVATE, OR BOTH? A SHARED ANSWER:
From London to Chennai, the regulatory picture shares the same essential shape: AI is transforming business faster than legislators can respond and businesses cannot afford to wait for the law to catch up. Although the UK and India have approached AI regulation from different starting points and have so far favoured adapting existing legal frameworks rather than introducing dedicated AI legislation, both face the same reality that the EU AI Act is increasingly operating as a global compliance benchmark for organisations
with European exposure. The common challenge is how to govern a fast-evolving technology that is already deeply embedded in commercial and employment relationships. For businesses operating across both jurisdictions, the message is clear: AI governance should not be viewed as a compliance exercise triggered by legislation. Build it now, build it proportionately and build it to be flexible. In AI regulation, as in AI itself, the ability to adapt is the most valuable capability of all.
eshwars.com LinkedIn
irglobal | 15
14 | irglobal
Made with FlippingBook - Online magazine maker