Data Governance for Generative and Agentic AI : Technology, Law, Economics, and Security

Narayana Darapaneni; Padmaja K; Gnana Chaithra D

cs.AIOct 24, 2026

Data Governance for Generative and Agentic AI : Technology, Law, Economics, and Security

Authors: Narayana Darapaneni, Padmaja K, Gnana Chaithra D

Abstract

This book develops a unified governance framework for systems that retrieve, generate, infer, remember and act on information from large language models and retrieval augmented pipelines to autonomous multi agent systems. Eleven chapters and eight appendices integrate three disciplinary lenses-technology, law and economics-across the full lifecycle: data quality, lineage and provenance; global data protection law and intellectual property; the economics of data governance; digital trust, cybersecurity and zero-trust architecture; ethics and responsible AI; governing generative AI pipelines; governing agentic AI and multi-agent systems; data governance in elections and the public sphere; AI regulation across six jurisdictions; and the design of a governance control plane for 2030. Each chapter is anchored in Indian law and institutions while maintaining a comparative, cross jurisdictional perspective.

Figures & tables

	Governance	Management	Stewardship	Administration
Scope	Enterprise; society	Operational	Domain	System
Primary concern	Decision rights, policy, compliance	Lifecycle execution	Quality within domain	Database operations
Accountable party	Board, CDO, council	Data engineering	Domain stewards	DBAs
Relation to law	Direct	Indirect (implements)	Indirect (assures)	Minimal
Failure consequence	Penalty; loss of licence to operate	Data loss; outage	Quality degradation	System outage

Table 1.1: Data governance and its adjacent concepts. Source: authors’ synthesis from the DAMA-DMBOK knowledge areas ( DAMA International, 2017 ) .

	I. Database era	II. Compliance era	III. AI governance era
	1990s–2005	2005–2018	2018–present
Governed object	Records in databases	Records and processing activities	Information produced and acted on by computational systems
Scope	IT department	Enterprise	Enterprise, society, geopolitics
Accountable	DBA	CDO, compliance	Board, CDO, AI governance officer, regulators, courts
Key instruments	Directive 95/46/EC; HIPAA	GDPR; SOX; Basel II/III	EU AI Act; DPDP Act 2023; NIST AI RMF
Artefacts	Database policies, ER diagrams	Compliance frameworks, DPIAs	Model registries, decision–action lineage, agent policies

Table 1.2: Three phases in the evolution of data governance. Source: authors’ synthesis; instruments are cited in the text.

Panel of Figure 1 — Figure 1.1: (a) The classical data-asset lifecycle that governance frameworks assume. (b) The dynamic AI information lifecycle: Collect $\rightarrow$ Retrieve $\rightarrow$ Infer $\rightarrow$ Generate $\rightarrow$ Transform $\rightarrow$ Remember $\rightarrow$ Exchange $\rightarrow$ Act, closed by the return of consequences as new data. Authors’ synthesis.

State	Provenance	Accuracy	Legal basis and control	Retention and accountability
Collected	$\circ$ source system	$\circ$ against reality	$\circ$ consent or other basis; owner known	$\circ$ schedule; owner
Retrieved	$\bullet$ which store, which query, why ranked	$\bullet$ relevance and staleness, not only truth	$\bullet$ retrieval authorisation; jurisdiction of the store	$\circ$ transient; log of what was retrieved
Transformed	$\circ$ lineage	$\circ$ integrity of the pipeline	$\bullet$ embeddings can leak meaning without storing text	$\circ$ derived-data rules
Inferred	$\bullet$ model, inputs, parameters	$\bullet$ probabilistic; calibration, not correctness	$\bullet$ no basis of its own; may be personal data never supplied	$\bullet$ nobody decided to create it
Generated	$\bullet$ prompt, context, model version	$\bullet$ fluent and possibly false	$\bullet$ authorship unsettled; may reproduce protected content	$\bullet$ becomes a record only when relied on
Remembered	$\bullet$ which interaction, which agent	$\bullet$ drifts as it is updated	$\bullet$ purpose limitation strained; who may inspect	$\bullet$ usually no retention rule

Table 1.3: The seven dynamic information states and the governance questions each raises.

\circ

marks where classical controls apply with little change;

\bullet

marks where the state changes the answer. Authors’ synthesis.

Initiating failure	Cascade (pillars; layers)	Instance
Biometric templates built from images scraped without consent	Privacy $\rightarrow$ Ethics $\rightarrow$ Quality; layers 1 $\rightarrow$ 3	Clearview AI enforcement actions in the EU, UK and Canada
Alleged gender disparity in credit limits	Ethics $\rightarrow$ Quality $\rightarrow$ Privacy; layers 3 $\rightarrow$ 7	Apple Card inquiry, NYDFS 2019–2021
Quality checks bypassed to meet a deployment deadline	Quality $\rightarrow$ Security $\rightarrow$ Ethics; layers 1 $\rightarrow$ 7	Health-care decision-support recalls
Ransomware on hospital systems	Security $\rightarrow$ Privacy $\rightarrow$ Ethics; layer 1	AIIMS New Delhi, November 2022
Consent obtained through manipulative interface design	Ethics $\rightarrow$ Privacy $\rightarrow$ Quality; layer 1	CNIL v. Google, 2019 and 2022

Table 1.4: Documented cross-pillar failure cascades. Sources: ICO ( Information Commissioner’s Office, 2020 ) ; NYDFS ( New York State Department of Financial Services, 2021 ) ; CNIL decisions ( Commission Nationale de l’Informatique et des Libertés, 2019 ; Commission Nationale de l’Informatique et des Libertés, 2022 ) ; CERT-In and press reporting on the AIIMS incident.

	India	European Union	United States
Grounding	Read into Art. 21 with Arts 14 and 19 ( Puttaswamy , 2017)	Codified: Charter Art. 7 and Art. 8	Fourth Amendment; no express data-privacy right
Limitation test	Legality, legitimate aim, proportionality (plus safeguards per Kaul J.)	Proportionality under Art. 52(1)	Reasonable expectation of privacy; warrant
Reach	State; private actors recognised and reached by statute	State and private actors	State (constitutional); private by statute only
Comprehensive statute	DPDP Act, 2023; Rules, 2025	GDPR (2016; applicable 2018)	None federal; 20 state statutes
Supervisory authority	Data Protection Board; independence contested	Constitutionally required (Art. 8(3))	FTC as general enforcer
Position on inferred information	Informational self-determination recognised; no statutory rule on inference or profiling	Art. 8 covers all personal data; GDPR Art. 22 and SCHUFA reach automated decisions	Aggregation logic of Carpenter ; sectoral statutes (FCRA) on some inferences

Table 1.5: Constitutional foundations of data rights in three systems. Source: authors’ synthesis of the instruments and judgments cited in Sects. 1.5.1 – 1.5.4 .

Figure 1.7: Maximum monetary penalties by contravention under the Schedule to the DPDP Act, 2023 (INR crore). The s. 15 duty of the Data Principal carries a maximum of INR 10,000 and is omitted from the scale. Source: Schedule to Act No. 22 of 2023 ( Parliament of India, 2023 ) .

Figure 1.8: Phased commencement of the DPDP Rules, 2025, measured from Gazette publication on 14 November 2025, with the Supreme Court’s reference of the constitutional challenge to a larger bench. Source: commencement clause of the Rules ( Ministry of Electronics and Information Technology, 2025b ) ; the twelve- and eighteen-month dates are computed and should be confirmed against the Gazette text.

Category	Costs	Benefits	Measurement
Direct financial	CDO, DPO, stewards, engineers; evaluation and observability tooling	Lower breach cost and frequency; lower expected harm from autonomous error	Expected loss with and without controls; Eq. ( 1.3 ) by system
Regulatory	Compliance tooling and process; AI Act and SDF documentation	Avoided penalties; faster notification	Risk-adjusted penalty exposure
Operational	Process redesign, training	Higher data quality; less rework; fewer rollbacks of agent actions	Quality metrics; action reversal rate
Strategic	Opportunity cost of constraints; narrower agent authority	Partnerships, AI readiness, trust; credible signal to counterparties	Revenue attribution; certification status
Externalities	Cost of harm to non-customers if uninsured or unallocated	Reduced liability once rules allocate it	Incident cost borne by third parties

Table 1.6: A framework for the governance business case, with the terms that autonomous systems add (italicised). Source: authors’ synthesis.

Chapter	1	2	3	4	5	6	7	8	Lead lens
2 Quality, lineage, provenance	$\bullet$	$\bullet$	$\bullet$					$\circ$	Technical
3 Data protection law and IP	$\bullet$	$\circ$	$\bullet$	$\circ$			$\circ$		Legal
4 Economics of governance	$\bullet$		$\bullet$		$\circ$		$\bullet$	$\bullet$	Economic
5 Digital trust, cybersecurity	$\bullet$	$\bullet$	$\circ$			$\bullet$	$\circ$		Technical
6 Ethics and responsible AI			$\bullet$	$\circ$			$\bullet$		Ethics
7 Governing generative AI	$\circ$	$\bullet$	$\bullet$	$\bullet$			$\circ$		Technical

Table 1.7: Chapters mapped to the layers of the DMAA loop (Fig. 1.2 ) and to the three lenses.

\bullet

primary coverage;

\circ

secondary.

Panel of Figure 2 — Figure 2.1: Three views of data quality. Top: the consumer taxonomy of Wang and Strong (1996) . Middle: the six operational dimensions used in industry programmes. Bottom (dashed): dimensions that become load-bearing when the use is training or grounding a model. Arrows show which consumer-level concern each operational dimension makes measurable. Original synthesis by the authors.

Dimension	Definition	Metric	Example defect
Accuracy	Values correctly represent the real-world entity	Records matching a trusted reference / records compared	Address that fails postal validation
Completeness	Required values are present	Non-null required fields / required fields	Missing e-mail in a CRM record
Consistency	The same element agrees across systems or over time	Records agreeing across systems / records compared	Name spelt differently in billing and CRM
Timeliness	Data is available when needed and reflects current state	Age $=$ now $-$ last update, against a service level	Price feed 24 hours stale
Validity	Values conform to format, type and domain rules	Records passing all rules / records	Date field holding 2024-13-45
Uniqueness	One record per real-world entity	$1-$ duplicates / records	Two patient records for one patient

Table 2.1: The six operational data quality dimensions. Metrics are expressed as percentages of records or fields unless stated. Source: authors’ synthesis from DAMA-DMBOK ( DAMA International, 2017 ) .

Figure 2.2: Quality scorecard for the UCI Heart Disease (Cleveland) data. (a) Completeness, validity and uniqueness before and after mode imputation of ca and thal ; accuracy and consistency cannot be scored without an external reference. (b) Per-column completeness of the raw file, showing that all nulls sit in two columns. Source: Janosi et al. (1988) .

Dimension	Retrieved	Inferred	Generated
Accuracy	Relevance: retrieved passages are the ones the query needed (precision@ $k$ , recall@ $k$ )	Calibration and error rate on a labelled reference set; a population property	Faithfulness to the retrieved context; factual error rate against a reference where one exists
Completeness	Coverage: the corpus contains what the use requires; no silent gaps from indexing failures	Coverage of the input space by the training distribution (representativeness)	Answer completeness relative to the question and to the available context
Consistency	Same query, same corpus, same results; index and source do not diverge	Same input, same output across runs (determinism) and across model versions	Same question, equivalent answer across paraphrases and runs; agreement with retrieved context
Timeliness	Index freshness: lag between source change and re-indexing	Staleness of the model relative to the world it predicts (drift)	Currency of the context used; disclosure of the knowledge cut-off
Validity	Retrieved chunks are well-formed and within the authorised scope of the query	Outputs lie in the documented domain (a probability, a class label)	Output conforms to the required schema, policy and format
Uniqueness	No duplicate chunks inflating similarity scores	One prediction per entity per decision	No duplicated or self-contradicting statements within a response

Table 2.2: The six operational dimensions re-read for the dynamic information states. Authors’ synthesis; the evaluation literature drawn on is Es et al. (2024) for retrieval and groundedness metrics and Guo et al. (2017) for calibration.

	Scope	Typical owner	Failure example	Control
Quality	Fitness for a specific use	Data steward; business domain	Training set under-represents a group	Profiling, rules, monitoring, datasheets
Integrity	Correctness across the lifecycle	DBA; data engineer	Order references a non-existent customer	Constraints, checksums, ACID transactions
Consistency	Agreement across systems and time	Integration architect; MDM team	Customer name differs between CRM and billing	Master data management; golden record; reconciliation

Table 2.3: Quality, integrity and consistency as separately owned properties. Source: authors’ synthesis.

	DAMA-DMBOK 2	ISO 8000	ISO/IEC 25012
Scope	Enterprise data management (11 knowledge areas)	Quality management and master-data exchange	Data as a component of a software product
Quality model	Six operational dimensions plus extensions	Syntactic, semantic, pragmatic; conformance to requirements	Fifteen characteristics in three groups
Philosophy	Practitioner body of knowledge	Conformance (ISO 9000 lineage)	Product quality model (SQuaRE)
AI coverage	None (2017)	None	None (2008)
Assessment	CDMP certification of people	Conformity assessment of organisations and data	Used within SQuaRE evaluations
Access	Book purchase	Standards purchase	Standards purchase

Table 2.4: Three data quality frameworks compared. Source: authors’ synthesis of DAMA International (2017) ; International Organization for Standardization (2015) ; ISO/IEC (2008) .

Failure mode	Definition	Incidents
Single point of failure	A critical function depends on one source, facility or path	KFC (one depot); 737 MAX (one sensor feeding MCAS)
Missing asset or configuration inventory	The organisation cannot enumerate its own systems, data or configurations	Equifax (unpatched Struts, expired certificate); TSB (divergent data centres)
Unvalidated migration or deployment	Code, data or infrastructure changed without adequate testing or rollback	Knight Capital (one of eight servers); TSB (big-bang migration); KFC (new depot and IT system)
Single-source unvalidated data	Decisions taken on one data feed without cross-validation or fallback	737 MAX (angle-of-attack); Aadhaar authentication (one biometric channel)

Table 2.5: Four recurring failure modes across six documented incidents. Source: authors’ synthesis of the primary reports cited in Sects. 2.8.1 – 2.8.6 .

Function	Tool	Type	Distinctive capability
Validation	Great Expectations	OSS, Python	Expectations as tests; generated documentation; CI/CD integration
Validation	Soda Core	OSS, YAML/SQL	SodaCL checks executed in the warehouse; low entry barrier
Validation	Deequ	OSS, Scala/Spark	Constraint suites and metrics at Spark scale
Lineage standard	OpenLineage	OSS specification	Vendor-neutral Job/Run/Dataset event model with facets
Lineage store	Marquez	OSS	Reference OpenLineage backend and UI
Metadata platform	Apache Atlas	OSS	Graph metadata; Ranger policy integration

Table 2.6: Tools landscape for quality, lineage and provenance, by function. OSS = open source. Source: authors’ synthesis from project documentation at the information date.

Year	Instrument	Jurisdiction	Significance
1890	Warren and Brandeis, “The Right to Privacy”	United States	“Right to be let alone”; technology-driven harm
1980	OECD Privacy Guidelines (rev. 2013)	International	Eight principles; global template
1981	Convention 108 (108+ in 2018)	Council of Europe	First binding treaty; open to non-members
1995	Directive 95/46/EC	EU	First Union-wide law; minimum harmonisation
2016/2018	GDPR	EU/EEA	Directly applicable; extraterritorial; benchmark
2018/2020	CCPA, amended by CPRA	California	First comprehensive US state law

Table 3.1: Milestones in the development of data-protection law. Source: instruments cited in the text.

Entity	Amount	Authority	Year	Ground; status
Meta Platforms Ireland	€1.2 bn	Irish DPC (EDPB binding decision)	2023	EU–US transfers on SCCs after Schrems II ; under appeal
Amazon Europe Core	€746 m	Luxembourg CNPD	2021	Advertising on legitimate interests without valid basis; fine annulled 12 Mar 2026 on procedure, violations confirmed, remitted
TikTok	€530 m	Irish DPC	2025	Transfers of EEA data to China; transparency
Google	€325 m	CNIL (France)	2025	Advertisements in Gmail and cookie consent
LinkedIn Ireland	€310 m	Irish DPC	2024	Behavioural advertising without valid basis
Uber	€290 m	Dutch AP	2024	Driver data transferred to the US without safeguards

Table 3.2: Selected large GDPR fines, by amount at issue. Source: the supervisory-authority decisions cited; status as at the information date.

Panel of Figure 3 — Figure 3.1: Enforcement under the DPDP Act, 2023: triggers, the Board’s inquiry, outcomes and appeal, with the fiduciary’s duties and timelines under the Rules, 2025. Original flowchart by the authors from the provisions cited in Sect. 3.3.6 .

Statute	Year	Sector	Content relevant to AI
FCRA	1970	Consumer reports	Accuracy, access, dispute rights; adverse-action notices for automated credit decisions
FERPA	1974	Education	Student-record confidentiality; consent for disclosure
HIPAA	1996	Health	Privacy, Security and Breach Notification Rules for protected health information; de-identification standard
COPPA	1998	Children under 13	Verifiable parental consent; FTC rule amended January 2025, effective June 2025, compliance by April 2026, adding biometric identifiers and separate consent for targeted advertising
GLBA	1999	Financial services	Privacy and Safeguards Rules; pretexting
FTC Act s. 5	1914	General commerce	Unfair or deceptive practices; the general enforcement tool, including for AI claims

Table 3.3: Principal US federal privacy statutes. Source: the statutes cited.

Jurisdiction	Law	In force	Maximum penalty	Distinctive feature
EU/EEA	GDPR	2018	€20 m or 4% of worldwide turnover	Six lawful bases; independent DPAs; extraterritorial
India	DPDP Act; Rules	2023; phased to 2027	INR 250 crore per contravention	Consent-centric; closed legitimate uses; child = under 18
China	PIPL	2021	RMB 50 m or 5% of turnover	Separate consent; CAC transfer routes; security-law overlay
United States	Sectoral; 20 state laws	2018–	Varies	No federal comprehensive law; FTC s. 5
Brazil	LGPD	2020	2% of revenue, R$50 m cap	EU adequacy (Jan 2026); ANPD
Japan	APPI	2003; 2022	JPY 100 m (corporate)	Mutual EU adequacy; PPC

Table 3.4: Comparative overview of major data-protection regimes. Source: the statutes cited in Sects. 3.2 – 3.5 .

Jurisdiction	Requirement	Scope
Russia	Personal data of Russian citizens must be recorded and stored in databases located in Russia (Federal Law 242-FZ)	All personal data of citizens
China	Localisation for CIIOs and above-threshold handlers; CAC routes for other transfers	Critical infrastructure; large handlers
India	RBI: payment-system data stored only in India; DPDP: SDF categories may be restricted (none notified)	Payments (binding); others pending
EU/EEA	No localisation; export conditions under Chapter V	All exports
Indonesia	Public electronic-system operators must process and store in Indonesia; private operators may store abroad subject to access conditions (GR 71/2019)	Public sector; financial-services rules

Table 3.5: Data-localisation requirements commonly encountered. Source: instruments cited in the text.

State	GDPR	DPDP Act and Rules	Open question
Collected	Full reach: principles (Art. 5), bases (Art. 6), rights (Arts 12–22)	Full reach: consent (s. 6), legitimate uses (s. 7), duties (s. 8), rights (ss. 11–14)	—
Retrieved	Reach through purpose limitation and access; retrieval of personal data for a new purpose needs a compatible purpose (Art. 6(4))	Reach through purpose limitation (s. 4) and the consent given; no compatibility test, so a new purpose needs consent or a s. 7 use	Whether retrieval for grounding is within the original purpose
Transformed	Full reach; pseudonymised data remains personal (Rec. 26); anonymised data is outside	Full reach; no statutory anonymisation standard	Threshold of anonymisation for embeddings
Inferred	Personal data ( Nowak ); accuracy (Art. 5(1)(d)); rectification; Art. 22 and SCHUFA	Personal data (s. 2(t)); accuracy when used in a decision (s. 8(3)); correction (s. 12); no Art. 22 analogue; Rule 13 due diligence for SDFs	Standard of accuracy for a probabilistic value
Generated	Personal data; accuracy applies to outputs (EDPB taskforce 2024); complaints pending; defamation route weak ( Walters )	Personal data; accuracy if used in a decision; s. 79 IT Act safe harbour doubtful for the model operator	Whether filtering satisfies accuracy; operator’s liability for fabricated statements
Remembered	Storage limitation (Art. 5(1)(e)); erasure (Art. 17); records of processing (Art. 30)	Erasure when purpose served (s. 8(7)); Rule 8 retention; logging one year (Rule 6)	What an agent’s memory is for storage-limitation purposes (Chapter 7 )

Table 3.6: How far the GDPR and the DPDP Act reach the dynamic information states of Table 1.3 . Authors’ synthesis of the provisions and decisions cited in Sects. 3.2 , 3.3 and 3.7 .

Case	Right	Court; year	Holding
Thaler v. Perlmutter , 130 F.4th 1039; cert. denied No. 25-449	Copyright	D.C. Cir. 2025; SCOTUS 2026	Human authorship required; autonomous AI output unregistrable
Thaler v. Vidal , 43 F.4th 1207	Patent	Fed. Cir. 2022; cert. denied 2023	Inventor must be a natural person
Thaler v. Comptroller-General [2023] UKSC 49	Patent	UK Supreme Court 2023	Inventor must be a person; machine-as-tool left open
Thaler v. Commissioner of Patents [2022] FCAFC 62	Patent	Full Federal Court of Australia 2022	Inventor must be a natural person (reversing first instance)
India: Copyright Act s. 2(d)(vi); Patents Act s. 2(1)(y)	Both	Statute	Person who causes the work to be created; true and first inventor

Table 3.7: Decisions establishing the human-only rule. Source: the judgments cited.

Property	Oil	Sunlight	Data	Governance implication
Rivalry	Rival	Non-rival	Non-rival	Licence use, do not sell custody; value comes from breadth of use
Excludability	High	None	Partial (copies leak)	Technical gating is temporary; rights must follow the copy
Marginal cost	Positive	Zero	Near-zero reproduction; high first copy	Price cannot equal marginal cost; recover fixed cost through access terms
Value aggregation	Additive	Additive	Super-additive (complementarity)	Linkage is where value and risk both concentrate; govern joins
Depreciation	None (informational)	None	Decays; can turn negative	Time-limited rights; retention as an economic as well as legal choice
Externality	Local (spill)	None	Cross-individual (inference)	Regulate what can be inferred, not only what is collected

Table 4.1: Economic properties of oil, sunlight and data, and the governance design each property implies. Source: authors’ synthesis of Jones and Tonetti (2020) ; Shapiro and Varian (1999) ; Valavi et al. (2020) ; Bergemann et al. (2022) .

Object	Rivalry	Excludability	Externality	Governance regime
Open government data	Non-rival	Non-excludable	Positive	Public provision; open licence
Proprietary enterprise data	Non-rival	Excludable	Low	Private governance; contract
Personal data (browsing, location)	Non-rival	Partial	Negative (inference)	Regulation (DPDP Act, GDPR)
Social-network data	Non-rival	Partial	Strongly negative	Collective governance; data trusts
AI training corpora	Non-rival	Variable	Mixed; runs to creators	Copyright; AI Act Art. 53; provenance
Real-time financial data	Non-rival, time-sensitive	High	Low	Market; exchange rules

Table 4.2: A taxonomy of data goods, extended to the objects of the Data–Model–Agent–Action loop. Rows above the rule follow the conventional taxonomy; rows below are the authors’ synthesis.

Parameter	Value	Basis
Asset	50 million histories, 3 years	Company records
Base value, income approach	INR 120 crore	Five-year DCF of attributable revenue at 12 per cent
Base value, cost approach	INR 18 crore	Infrastructure and staff cost to rebuild
Quality score $Q$	0.88	Weighted six-dimension score (Chapter 2 )
Risk score $R$	0.20	Regulatory 0.10 (consent documentation incomplete); obsolescence 0.08; concentration 0.02
Governance premium $g$	$+$ 5 per cent	Audited controls, DPO appointed, documented purposes

Table 4.3: DAVF worked example: UPI transaction histories of an Indian fintech. Parameters are illustrative; authors’ synthesis.

Figure 4.1: Sensitivity of the DAVF value to quality

Q

and risk

R

for the worked example of Table 4.3 . The lines for different

R

never cross: reducing governance risk dominates improving quality over the plausible range.

Generator	Awareness	Bargaining power	Governance problem
Individual, passive	Low	Near zero	Consent failure; asymmetric information; inference externality
Individual, active (content, labels)	High	Moderate	Fair compensation; attribution; copyright in contributions
Firm, operational	High	High	Internal governance; trade secrets; data silos
Device (IoT, vehicle, wearable)	None	Depends on owner	Ownership ambiguity; consent at scale impossible
Government	High	Sovereign	Open data versus privacy; quality assurance; self-regulation (Sect. 4.10 )
Platform	High	Very high	Market power; portability; two-sided pricing

Table 4.4: A typology of data generators by awareness and bargaining power. Source: authors’ synthesis.

Friction	Mechanism	Institutional response
Quality asymmetry	Seller knows fitness for use; buyer does not	Datasheets, certification, provenance warranties
Non-standardisation	Heterogeneous schemas and formats raise integration cost	ISO 8000; ONDC and Account Aggregator protocols; FHIR in health
Legal fragmentation	Rules differ by jurisdiction and sector	Adequacy, SCCs, mutual recognition; sector overlays
Trust deficit	No reputation mechanism; enforcement uncertain	Third-party audit; fiduciary intermediaries; data trusts
Pricing difficulty	No valuation methodology; thin markets	DAVF; auctions; licence templates
Externality wedge	Cross-individual inference	Regulation of inference; differential privacy; federated computation

Table 4.5: Six frictions in data markets and their institutional responses. Source: authors’ synthesis.

Panel of Figure 4 — Figure 4.2: Where the seven market failures of Table 4.6 bite in the Data–Model–Agent–Action loop of Fig. 1.2 . The failure that autonomous systems add, the externality of action, appears at layers 6–7 and is developed in Sect. 4.8 . Original diagram by the authors.

#	Failure	Theoretical basis	Loop layer	Policy instrument	DPDP provision
1	Information asymmetry	Akerlof (1970) ; Nelson (1970)	1 (source data)	Disclosure; certification; warranties	s. 5 notice; s. 10 SDF audit
2	Externalities of inference	Bergemann et al. (2022) ; Acemoglu et al. (2022)	1–3	Purpose limitation; minimisation; differential privacy	s. 4, s. 6(1) purpose; s. 8(7) erasure
3	Market power	Rochet and Tirole (2003)	2–3 (retrieval, model)	Interoperability; portability; antitrust	CCI enforcement; ONDC (outside the Act)
4	Missing markets	Incomplete-markets theory	4–5 (memory, planning)	Market creation; regulatory substitutes	s. 6 consent as the substitute for a privacy price
5	Moral hazard	Principal–agent theory ( Jensen and Meckling, 1976 )	6–7 (tools, action)	Minimum standards; liability; penalties	s. 8(5) safeguards; s. 33 and Schedule
6	Adverse selection in AI	Stiglitz and Weiss (1981)	3 (model)	Algorithmic audit; explainability; impact assessment	s. 10; Rule 13 algorithmic due diligence

Table 4.6: Seven market failures in data governance: mechanism, loop layer, instrument and the DPDP provision that answers each. Source: authors’ synthesis; theoretical bases as cited.

Assignment	Who decides	Governance archetype	Characteristic risk
Data controller	The firm	US sectoral model; “legitimate interests” under GDPR Art. 6(1)(f)	Exploitation of unforeseen uses; externality uncorrected
Data subject	The individual	DPDP consent (s. 6); GDPR consent	Consent fatigue; transaction cost; refusal by default
Fiduciary intermediary	A regulated third party	Account Aggregator; DPDP consent manager (Rule 4)	Agency problem; capture; concentration of the intermediary

Table 4.7: Residual control rights over unforeseen data uses: three assignments and their characteristic risks. Source: authors’ synthesis after Grossman and Hart (1986) ; Hart and Moore (1990) .

Principle	Behavioural foundation	DPDP mapping	Gap
Privacy-protective defaults	Endowment effect; loss aversion	s. 6(1) affirmative action	No interface-design standard; dark patterns unaddressed
Layered, just-in-time disclosure	Bounded rationality; rational inattention	s. 5 notice; Rule 3 stand-alone notice	No requirement of contextual timing
Standardised consent vocabulary	Cognitive load; information asymmetry	Rule 4 consent managers (interoperable artefacts)	No visual or machine-readable vocabulary specified
Periodic refresh	Hyperbolic discounting	s. 6(4) withdrawal as easy as grant	No mandatory re-consent interval
Structural backstops	All behavioural failures	s. 4 purpose; s. 8(5) safeguards; s. 8(7) erasure	s. 17 exemptions remove the backstops for exempt processing

Table 4.8: An optimal consent architecture: behavioural foundations, DPDP implementation and gaps. Source: authors’ synthesis.

Interest	Primary objective	Outcome in the Act and Rules	Assessment
Central Government	Data access; regulatory control	s. 17 exemptions; Board appointed by Government (s. 19); s. 36 power to call for information	Strong win
Large technology firms	Predictability; manageable cost	Short statute; fixed-cap penalties; no portability; no legitimate-interests basis (a cost)	Moderate win
Start-ups and SMEs	Low cost; level field	Phased commencement to 2027; uniform standards; SDF tier spares them	Partial loss
Civil society	Independent authority; narrow exemptions; journalistic exemption	Consent architecture won; institutions and exemptions lost; RTI amendment (s. 44(3)) contested	Mixed
Data principals	Effective protection	Formal rights (ss. 11–14); behavioural effectiveness uncertain	Formal win, substantive open

Table 4.9: Interest-group analysis of the DPDP Act, 2023. Source: authors’ assessment of the statute against the positions taken in consultations on the 2018, 2019 and 2022 drafts.

Figure 4.3: Left: expected cost per action of running an agent at autonomy

a

(Eq. 4.2 ) for three ratios of harm to review cost; dots mark the optimum. Right: cumulative residual loss along a chain of

k

delegating agents when each hop loses a share

\varepsilon

of the principal’s intent,

1-(1-\varepsilon)^{k}

. Conceptual model with declared parameters; authors’ synthesis., agency_chain.csv .

	India (DPI)	Estonia (X-Road)	UK (Open Banking) / Singapore (MyInfo)
Core infrastructure	Aadhaar, UPI, Account Aggregator, ONDC	National eID and X-Road data-exchange layer	CMA-mandated APIs / government identity and data vault
Primary value channel	Financial inclusion; credit to the unserved	Administrative efficiency; “once-only” principle	Credit access and switching / service efficiency
Governance locus	State-built rails; regulated intermediaries	State-run exchange; strict logging	Regulator-mandated access; private rails / state vault
Key metric	241.6 bn UPI transactions (FY2025–26)	Near-universal online public services	Billions of API calls / hundreds of services

Table 4.10: Four data-infrastructure models and their principal value channel. Shares are as reported by each jurisdiction and are not on a common basis. Source: authors’ synthesis.

#	Trap	Mechanism	Escape
1	Compliance theatre	Process substitutes for outcome; audits pass while harm continues	Outcome-based rules; measured harm as the audit object
2	Localisation	Sovereignty pursued without a cost–benefit test; access barriers raised for all	Risk-based security standards; localise by data class, not by default
3	Consent	Hollow consent treated as sufficient; backstops neglected	The architecture of Table 4.8 ; structural duties independent of consent
4	Surveillance	Protective infrastructure repurposed for control	Judicial authorisation; transparency; purpose limitation binding the state
5	Small firm	Uniform costs regressive across firm size	Graduated obligations (SDF tier); shared compliance infrastructure
6	Measurement	Input metrics replace outcomes	Mandated outcome metrics (Chapter 11 )

Table 4.11: Eight governance traps and their escapes. Source: authors’ synthesis.

Objective pair	Compatible?	Characteristic risk
Production and consumption	Yes; India excels here	Under-protection of principals; s. 17 exemptions make it lawful
Production and protection	Partially	Under-use; bureaucratic friction; open data withheld
Consumption and protection	Partially	Under-collection; governance cost; capacity diverted to compliance
All three	Structurally constrained	The regulator regulates its own appetite

Table 4.12: The government data trilemma. Source: authors’ synthesis.

Figure 4.4: Left: the compliance boundary

k=\rho(F+L)

for the Schedule’s INR 250 crore maximum and an illustrative INR 100 crore reputational loss; the fiduciary complies above the line. Right: cumulative probability of detecting a deficient control over successive audits in the inspection game, for

m

controls sampled from

n=20

with detection rate

d=0.8

. Illustrative parameters declared; authors’ synthesis., inspection_detection.csv .

Model	Players	Key result	Governance lever
Compliance game	Regulator; fiduciary	Comply iff $k<\rho(F+L)$	Detection probability $\rho$ more than penalty $F$
Inspection game	Auditor; fiduciary	Detection over $c$ cycles: $1-(1-dm/n)^{c}$	Detection rate $d$ ; risk-weighted sampling
Coordination game	Firm; firm	Two equilibria; statute removes the bad one	Mandatory minimum standards; certification
Evolutionary dynamics	Population of firms	Convergence past a tipping share of compliant firms	Enforce first against the most visible (SDF-first)
Delegation game (Sect. 4.8 )	Principal; artificial agent	Interior optimum in autonomy only when $h<c_{r}$ and $\beta>0$	Placement of the approval gate by harm-to-review ratio

Table 4.13: Game-theoretic models of data governance and the lever each identifies. Source: authors’ synthesis.

Question	Method	Identifying assumption; outcome	Data
Effect on firm profitability	Difference-in-differences across commencement phases	Parallel pre-trends between Indian and comparator firms; operating margin, ROA	CMIE Prowess; Orbis
Effect of SDF designation	Regression discontinuity at the notified threshold	Firms near the threshold comparable; breach frequency, product launches	CERT-In; patent and app-store filings
Credit-access channel	Instrumental variable (demonetisation shock)	Shock affects credit only through digital-transaction history; credit growth, defaults	Credit bureau; RBI
Country-level FDI effect	Synthetic control	Donor pool reproduces pre-period India; FDI in data-intensive sectors	DPIIT; UNCTAD
Privacy-preference distribution	Discrete-choice experiment; structural estimation	Stated choices reveal valuations; WTA/WTP by stratum	Primary survey, stratified by state, income, language, gender
Consent-interface design	Randomised controlled trial	Random assignment of interface; consent rate, comprehension	Primary experiment with a fiduciary partner

Table 4.14: A research design for evaluating the DPDP Act, 2023. Source: authors’ synthesis.

Stage	Actor	Surplus captured	Why
Generation	Individuals; devices	Near zero	No bargaining power; marginal contribution small given others’ data
Collection	Platforms; government	Low to moderate	Terms of service; statutory authority
Curation	Data engineers	Moderate, as wages	Labour compensation
Integration	Platforms; intermediaries	High	Control of linkage infrastructure (market power)
Analysis	ML teams	High	Algorithmic capability; model as asset (Sect. 4.2.4 )
Application	Product owners	Very high	Control of the customer relationship

Table 4.15: Value capture along the data value chain. Source: authors’ synthesis.

Figure 4.5: Data-dividend arithmetic: monthly payment per resident from a levy on digital-economy gross value added, for levy rates from 0.25 to 2 per cent, against PM-KISAN’s per-household transfer. Inputs declared (share from Ministry of Electronics and Information Technology and ICRIER (2025) ; GVA and population to be verified).

Trade-off	Pole A	Pole B	DPDP position
Access versus privacy	Maximum use	Maximum protection	Consent-centric; no legitimate-interests basis (privacy-leaning for private actors; access-leaning for the state)
Efficiency versus equity	Aggregate welfare	Least-advantaged welfare	Uniform duties with an SDF tier; no distributional mandate
Innovation versus protection	Minimal constraint	Comprehensive constraint	Moderate, fixed-cap penalties; phased commencement; sandbox absent
Centralisation versus decentralisation	Single authority	Sectoral authorities	Central Board with sectoral overlays (RBI, SEBI, IRDAI)
Sovereignty versus interoperability	Localisation	Free flows	Permissive by default, restrictable by notification (s. 16); payment data localised by the RBI
Autonomy versus oversight (added)	Full delegation	Full review	Not addressed; Sect. 4.8.3 supplies the trade-off the Act will need

Table 4.16: Five fundamental trade-offs in data governance and the DPDP Act’s position on each. Source: authors’ synthesis.

Dataset	Source	Use in this chapter
UPI product statistics	NPCI; PIB	Sect. 4.1.6 , 4.9.1
Estimation and Measurement of India’s Digital Economy	MeitY–ICRIER (2025)	Digital share; data-dividend arithmetic
National Accounts (GVA)	MoSPI	Data-dividend arithmetic
Global Findex	World Bank	Financial-inclusion outcomes (capstone)
GDPR Enforcement Tracker	CMS	Compliance-game calibration (lab)
Competition Commission orders	CCI	Market-power failure; inspection-game calibration

Table 4.17: Data sources for Chapter 4 . Access verified at the information date.

Vector	Mechanism	Governance response	Where in this book
Breach	Confidentiality lost through intrusion, leak or supply chain	Zero trust; encryption; detection; breach duties (DPDP s. 8(6); GDPR Arts 33–34)	Sects 5.3 – 5.5 , 5.8
Opacity	Decisions taken without explanation	Explainability; lineage; audit rights	Chapters 2 , 6
Misuse	Purpose exceeded; inference beyond consent	Purpose limitation enforced in the access policy; action control	Sects 5.6 , 5.7 ; Chapter 3
Unavailability	Operations halted by ransomware or failure	Segmentation; immutable backups; degraded-mode procedures	Sects 5.9 , 5.10
Fabrication	Synthetic media, identities and records	Content provenance (C2PA); out-of-band verification; evidence rules	Sect. 5.5.2 ; Chapters 2 , 9

Table 5.1: Five trust-erosion vectors and the governance response to each. Source: authors’ synthesis.

Dimension	Perimeter model	Zero trust model
Basis of trust	Network location	Verified identity, device posture, context, per request
Unit of decision	Connection (VPN session)	Each access to each resource
Internal traffic	Implicitly trusted; often unencrypted	Authenticated and encrypted (mTLS) like external traffic
Lateral movement	Free once inside	Blocked at every resource boundary
Policy	Static ACLs and group membership	Dynamic policy from identity, device, risk and resource sensitivity
Observability	Logs at the boundary	Telemetry on every decision; policy improves from it

Table 5.2: Perimeter and zero-trust paradigms compared on the assumptions that matter for governing data. Source: authors’ synthesis of Rose et al. (2020) ; Ward and Beyer (2014) .

#	Tenet	Data-governance reading	For an agent as subject (Sect. 5.6 )
1	All data sources and services are resources	Safeguards apply to every store, not only “critical” ones	Tools, memories and model endpoints are resources too
2	All communication secured regardless of location	East–west traffic encrypted and authenticated (mTLS)	Agent-to-tool and agent-to-agent channels authenticated; message provenance
3	Access per session, per resource	Purpose can be asked at each access	Per-action authorisation; a task-bound session, not a standing grant
4	Dynamic policy from identity, asset state, context	Reasonable safeguards acquire content	Authority (Eq. 1.2 ), instruction provenance, value and reversibility become policy inputs
5	Monitor posture of all assets	Continuous rather than annual assurance	Agent configuration, model version and memory integrity monitored
6	Dynamic, strictly enforced authentication and authorisation	Re-evaluation during the session	Re-evaluation at every tool call; revocation mid-task

Table 5.3: The seven tenets of SP 800-207, their data-governance reading, and what each requires when the subject is an AI agent. Source: tenets from Rose et al. (2020) ; readings are the authors’ synthesis.

Function	What it covers	ISO 27001 / CIS counterpart	Duty discharged
Govern	Risk strategy, roles, policy, oversight, supply-chain risk management	ISO clauses 4–6, 9–10; CIS 17	DPDP s. 8(1) fiduciary accountability; s. 10 SDF audit and DPIA (Rule 13); GDPR Art. 5(2), Art. 24
Identify	Asset, data and supplier inventories; vulnerability and risk assessment	ISO A.5.9–5.12; CIS 1–2, 7	Records of processing (GDPR Art. 30); knowing what personal data is held (DPDP s. 8(7) erasure presupposes it)
Protect	Identity and access, awareness, data security, platform hardening	ISO A.5.15–5.18, A.8; CIS 3–6, 12	DPDP s. 8(5) and Rule 6 safeguards (encryption or masking, access control, logging, backups); GDPR Art. 32
Detect	Continuous monitoring; adverse-event analysis	ISO A.8.15–8.16; CIS 8, 13	CERT-In six-hour reporting presupposes detection; GDPR Art. 33 72-hour clock starts at awareness
Respond	Incident management, analysis, mitigation, communication	ISO A.5.24–5.28; CIS 17	DPDP s. 8(6) and Rule 7 notification to Board and principals; CERT-In Directions; sector reporting
Recover	Restoration planning and execution; communication	ISO A.5.29–5.30; CIS 11	Availability as a safeguard; RBI and SEBI resilience and recovery-time expectations

Table 5.4: CSF 2.0 functions mapped to the other frameworks and to the data-protection duties each discharges. Source: authors’ synthesis of National Institute of Standards and Technology (2024c) ; International Organization for Standardization (2022) ; Center for Internet Security (2024) , the DPDP Act and Rules, and the GDPR.

Actor	Motive	Characteristic method	Controls that matter most
Criminal (ransomware-as-a-service)	Money	Credential abuse, phishing, exploitation of exposed services; encryption and data theft for double extortion	Phishing-resistant MFA; patching exposed services; immutable backups; segmentation
State-sponsored	Espionage; pre-positioning	Supply chain; zero-days; long dwell; identity-layer attacks	Supply-chain assurance; identity hardening; detection of anomalous token and DNS use
Insider	Grievance, money, error	Misuse of legitimate access; data exfiltration	Least privilege; access certification; DLP; monitoring
Hacktivist	Ideology	Defacement, denial of service, leaks	Availability controls; exposure minimisation
Automated / AI-assisted	Whatever the operator’s is	Generated phishing at scale; automated vulnerability discovery; agents that chain tools	The controls of Sect. 5.6 applied to one’s own agents; behavioural detection

Table 5.5: Threat actors by motive, capability and the controls that matter most against each. Source: authors’ synthesis.

Attack	Mechanism	Data-governance impact	Mitigation (and its limit)
Evasion	Perturbed input misclassified with confidence	Fraud, intrusion and content classifiers bypassed	Adversarial training; ensembles; input checks (no certified defence at scale)
Poisoning / backdoor	Training data corrupted; trigger-conditioned behaviour	AI-driven decisions systematically wrong for a class	Training-data provenance (Chapter 2 ); pipeline anomaly detection (cannot inspect a billion-parameter model)
Model inversion	Training data reconstructed from outputs	Personal data recoverable from the model; erasure incomplete	Differential privacy in training; output perturbation; API access control
Membership inference	Presence of a record in training inferred	Reveals an individual’s inclusion in a sensitive dataset	Differential privacy; regularisation; confidence-score limits
Model stealing	Surrogate trained from query–response pairs	IP loss; white-box attacks on the surrogate transfer	Rate limiting; watermarking; query monitoring
Prompt injection (direct, indirect)	Instructions in input or retrieved content followed as if authorised	Exfiltration, policy bypass, unauthorised action	Instruction hierarchy, filtering, privilege separation (reduce, do not remove); hence action control

Table 5.6: Adversarial machine learning, with the data-governance impact of each attack and the available mitigation. Source: taxonomy after Vassilev et al. (2025) ; OWASP LLM Top 10 (2025) for injection; impacts and mitigations are the authors’ synthesis.

Panel of Figure 5 — Figure 5.1: SP 800-207’s logical components recast for an agent as subject. The policy enforcement point sits on the tool call; the policy engine evaluates authority, instruction provenance, value, reversibility, egress and budget; the decision is three-way; and every decision is written to the lineage record. Authors’ synthesis after Rose et al. (2020) .

Figure 5.2: Decision surface of Code 5.1 for seven action classes and six action values, with the instruction originating from the principal (left) or from retrieved content (right); all other conditions valid. Thresholds from declared parameters.

Component	Function	Duty discharged	India overlay
Phishing-resistant MFA (FIDO2, passkeys)	Origin-bound authentication	DPDP s. 8(5); GDPR Art. 32	RBI two-factor mandate for digital banking; Aadhaar authentication under the Aadhaar Act as read in Puttaswamy (2018)
Attribute- and policy-based authorisation	Context-dependent, purpose-aware decisions	Purpose limitation (DPDP s. 4, s. 6(1)); minimisation (GDPR Art. 5(1)(c))	Consent artefacts (Account Aggregator) as attributes
Privileged access management	Vaulting, session recording, just-in-time elevation	High-risk access safeguards	RBI IT-governance direction (2023); SEBI CSCRF
Workload identity (SPIFFE)	Attested, short-lived identities for services and agents	Accountability for automated processing	Microservice adoption in fintech and e-governance
Delegation tokens (RFC 8693; MCP authorisation)	On-behalf-of authority with scope and expiry	Attribution of agent action to a principal	Emerging; no sector rule yet
Identity governance (IGA)	Lifecycle, certification, segregation of duties	Purpose limitation over time; erasure by deprovisioning	CERT-In access-control and audit expectations; IRDAI guidelines

Table 5.7: Identity and access components, the duty each discharges and the India-specific overlay. Source: authors’ synthesis; sector rules as cited in Sect. 5.8.4 .

Instrument	Clock	Recipient; trigger
CERT-In Directions (2022)	6 hours	CERT-In; on noticing a listed cyber incident
DPDP Act s. 8(6); Rule 7	Without delay; detail within 72 hours	Board and affected principals; personal-data breach
RBI (banks, NBFCs, payment systems)	2–6 hours by severity	RBI; cyber incident at a regulated entity
SEBI CSCRF	6 hours	SEBI and CERT-In; regulated entity
IRDAI guidelines (2023)	6 hours	IRDAI and CERT-In; insurer or intermediary
Telecom Cyber Security Rules (2024)	6 hours (initial); detail within 24 hours	DoT; telecom entity

Table 5.8: Reporting clocks that one Indian incident can start. Source: instruments cited in the text.

Incident	Layer of defect	Layer of harm	Interrupting control (other layer)
SolarWinds (2020)	Vendor build pipeline	Confidentiality of communications in $\approx$ 100 organisations	Least privilege for monitoring software; egress allow-lists; token-signing key custody
Colonial Pipeline (2021)	One VPN password without MFA	Fuel supply to 17 states; six-day shutdown	IT/OT segmentation with verified boundary; phishing-resistant MFA on remote access
AIIMS Delhi (2022)	Unpatched servers; flat clinical–administrative network; no immutable backup	Patient care at a national hospital for two weeks	Segmentation; offline immutable backups; degraded-mode procedures
Marks & Spencer (2025)	Help-desk identity verification	Forty-six days without online orders; customer data accessed	Verification protocol for privileged resets; separation of help-desk and provisioning authority
MOVEit (2023); Change Healthcare (2024)	Zero-day in a widely deployed product; concentration in one processor	$\approx$ 90 m (MOVEit) and $\approx$ 190 m (Change Healthcare) individuals; US health payments for weeks	SBOM-driven exposure mapping; concentration-risk limits; immutable backups

Table 5.9: Five incidents as cross-layer cascades: where the defect was, where the harm appeared, and the control at a third layer that would have interrupted it. Source: authors’ synthesis of the primary reports cited in Sects 5.9.1 – 5.9.5 .

Tradition	Core demand	What it asks of a data system	Where it runs out
Deontology (Kant)	Persons as ends; universalisable maxims	Rights-based constraints: human review, no manipulated consent, design for the affected	Cannot trade one good for another
Consequentialism (Bentham, Mill)	Best outcome in aggregate	The right objective function; outcome measurement; risk tiers	Specification, aggregation and measurement problems
Virtue ethics (Aristotle, Vallor)	Character and practical wisdom	Institutional culture; judgement over checklists; resistance to deskilling	Little action guidance at scale
Care ethics (Gilligan, Tronto)	Responsibility within asymmetric relations	Attentiveness to the vulnerable; duties beyond consent; feedback that changes behaviour	Boundaries of care; risk of paternalism
Pragmatism (Dewey)	Inquiry and revision	Sandboxes (AI Act Art. 57; RBI 2019); monitoring; commitments to act on evidence	Can defer commitment indefinitely
Capability (Sen, Nussbaum)	Substantive freedoms	Impact on what people can do and be; conversion factors	Which capabilities, and who decides

Table 6.1: Eight ethical traditions, what each asks of a data system, and where each runs out. The governance readings are the authors’.

Principle	GDPR	EU AI Act	DPDP Act / India	OECD (2024)
Fairness	Art. 5(1)(a); Art. 9; Art. 22	Art. 10(2)(f)–(g) bias examination and mitigation; Art. 10(5) special-category processing permitted for bias detection; Art. 5(1)(c) social scoring banned for public and private actors	No fairness provision; Constitution Arts. 14–15; Rule 13 due diligence of significant fiduciaries	1.2 rule of law, human rights, democratic values incl. fairness and privacy
Transparency	Arts. 13–15; Recital 71	Art. 13 (deployers); Art. 50 (disclosure, marking); Art. 86 (explanation of individual decision)	s. 5 notice; s. 11 right to information; RTI Act (state only)	1.3 transparency and explainability
Accountability	Art. 5(2); Art. 24; Arts. 77–84	Art. 16 providers; Art. 26 deployers; Art. 43 conformity; Art. 72 post-market monitoring	s. 8 fiduciary duties; s. 10 significant fiduciaries; Board (Ch. V)	1.5 accountability
Privacy	Arts. 5–11; Arts. 12–23; Arts. 44–49	Art. 10 data governance; Art. 27 fundamental-rights impact assessment	ss. 4–7 grounds; ss. 11–14 rights; s. 17 exemptions; Puttaswamy	1.4 robustness, security and safety

Table 6.2: The four principles and their statutory homes. Article and section references are to the texts in force at the information date; OECD numbering follows the May 2024 revision.

Source	Loop layer	State corrupted	Documented case	Control (chapter)
Historical	1 data	collected	Amazon hiring tool (2018)	Re-weighting; output constraint; trained review (6.4, 6.8)
Representation	1 data	collected	Gender Shades (2018); low-resource Indian languages	Stratified collection; disaggregated evaluation (2, 6.5)
Measurement	1–3 feature, label	transformed, inferred	Cost as need (2019); re-arrest as recidivism	Proxy validation across groups by domain experts (2.2, 6.3)
Aggregation	3 model	inferred	HbA1c across ancestries; agro-advisories across zones	Subgroup analysis; stratified models (6.4)
Labelling	1, 8 annotation	collected, feedback	AAE toxicity labels (2019); Sama/ChatGPT labelling (2023)	Diverse annotators; agreement by demographic; labour standards (7)
Learning	3 model	inferred	Compression degrades minority accuracy (2020)	Group-weighted loss; minimax objectives (6.4)

Table 6.3: Nine sources of bias located in the DMAA loop, with the information state each corrupts and the control that answers it. The first seven follow Suresh and Guttag (2021) ; the last two are the authors’ extension to the loop.

Figure 6.1: Error rates and positive predictive value by group for a calibrated score when base rates differ (50 against 30 per cent). Left: at every common threshold the group with the higher base rate has the higher false-positive rate and the lower false-negative rate. Right: calibration holds; the PPV curves nearly coincide. Synthetic population with declared parameters. Illustrative, not empirical.

Axis	Proxies	Legal frame	Governance gap
Caste	Surname; pin code; institution; occupation; network	Arts. 14, 15(1), 16, 17; PoA Act 1989; Navtej (2018)	No disaggregated performance data; no audit method that avoids collecting caste
Gender	Digital-behaviour footprint; formal credit record; name	Arts. 14, 15(1), 15(3); Vishakha (1997)	Representation gap from the digital divide; DPDP silent
Language	Language and script of interaction; code-mixing	Arts. 29–30; Official Languages Act 1963	No performance floor across languages; low-resource tiers unserved
Geography	Pin code; district; connectivity; device class	Art. 14; Directive Principles Arts. 38–39	Training data concentrated in metros; rural deployment untested
Intersections	Combinations of the above	Art. 15(1) multi-ground; Puttaswamy dignity	Single-axis metrics miss compound disadvantage; no intersectional audit practice

Table 6.4: India’s axes of algorithmic disadvantage: proxies through which each enters a model without being an input, the constitutional and statutory frame, and the governance gap. Authors’ synthesis.

Method	Serves	Audience	Limit
Interpretable models (sparse linear, rule lists, GAMs)	Full auditability; anomaly discovery	Regulator, auditor, affected person	Capacity for complex signals; the accuracy claim must be tested, not assumed
LIME	Local account of one decision	Developer; adjudicator	Unstable; fairwashing
SHAP	Local and global attribution with axioms	Auditor (global); adjudicator (local)	Correlation not cause; manipulable; costly beyond trees
Counterfactual / recourse	What would change the decision	Affected person	Reveals how to game; need not reflect internals
Concept sensitivity	Reliance on a named concept (a proxy)	Regulator; fairness auditor	Needs the concept defined; coverage not guaranteed
Attention, saliency	Visual intuition for text and images	Developer	Not importance; fails sanity checks

Table 6.5: Explanation methods against the governance use each serves and its limit. The audience column is the authors’.

Layer	Content	Audience	Exemplar
1 System documentation	Architecture, data, metrics, limits	Regulator; auditor	AI Act Art. 11; Canada’s Directive; model card
2 Decision-level explanation	Why this result for this person	Affected person; adjudicator	GDPR Art. 15(1)(h) as read in Dun & Bradstreet ; AI Act Art. 86; counterfactual recourse
3 Outcome-level transparency	Aggregate outputs, disaggregated	Public; policy-maker	NYC Local Law 144 audits; AI Act Art. 72 monitoring
4 Process-level accountability	How the system was governed	Board; regulator	NIST AI RMF; AI Act quality management (Art. 17)
5 Action-level explanation	Why the agent acted: instruction source, retrieved sources, permission, reversibility	Affected person; reviewer; Board	Decision–action lineage record (Code 5.1; Ch. 8)

Table 6.6: Five layers of explanation, the audience of each and the instrument that exemplifies it. Layer 5 is the authors’ addition for systems that act.

Instrument	Function	Exemplars	Limit
Impact assessment	Pre-deployment identification of harms and chosen trade-offs	Canada’s Directive (2019, am. 2023); AI Act Art. 27 FRIA; DPDP Rule 13 DPIA	Becomes a checklist; rarely revisited
Documentation	Disaggregated performance; provenance; logs	Model cards; datasheets; AI Act Arts. 11–12	Voluntary outside the Union; completeness unenforced
Internal audit	Lifecycle evaluation with full access	SMACTR (2020); enterprise review boards	No independence
External audit	Independent evaluation	Gender Shades; NYC Local Law 144	Access; no standard method or qualification
Conformity assessment	Legal pre-market verification	AI Act Art. 43, Annexes VI–VII	Mostly self-assessment; notified-body capacity
Redress	Individual and collective remedy	GDPR Art. 22(3); AI Act Arts. 85–86; DPDP ss. 13, 27; CPC O. I r. 8	Evidential burden; distributed harm

Table 6.7: Accountability instruments, what each does, and its limit.

Model	Human role	Suits	Fails by
In the loop	Approves each decision	High-stakes individual decisions (bail, diagnosis, credit above a value)	Automation bias; rubber-stamping under throughput
On the loop	Monitors; intervenes on exceptions	Operational queues (fraud alerts, moderation)	Vigilance decay; alert fatigue
Over the loop	Sets objectives; reviews aggregates	Deployment approval; periodic audit	Late detection of drift and individual harm
Layered	Combines the three by stakes	Credit with value thresholds; welfare systems	Unclear escalation paths
Meaningful control	Tracking and tracing satisfied	Systems affecting rights, safety, food	Conditions hard to verify in practice
Oversight of an agent	Approval gate on classes of action; review queue; action record	Long-horizon tasks with tools	Per-action approval impossible; anomaly $\neq$ harm; records of predictions, not actions

Table 6.8: Human oversight models, the setting each suits and the way each fails. The agent row is the authors’ addition.

Panel of Figure 6 — Figure 6.2: Responsibility across the four stages of the chain from prediction to execution: the question each raises (row 1), who answers it (row 2, blue) and the evidence that lets them (row 3, green). Authors’ synthesis; the stage distinction is Chapter 1 ’s.

Stage	Answerable for	Who answers	Instrument (chapter)
Prediction	Accuracy; fairness as a prediction; validity of the proxy	Model owner; deploying fiduciary	Model card; disaggregated metrics; proxy validation (2, 6)
Recommendation	Grounds: attributes used, instruction source, retrieved support	Planner’s owner; the principal who set the objective	Reasoning trace; instruction provenance; retrieval lineage (2, 5, 7)
Decision	Quality of adoption: judgement or reflex; override in fact	The adopter, and whoever delegated the authority	Decision record; oversight design; approval gate (4, 6, 8)
Execution	Authority; reversibility; effect in the world	The fiduciary, through the enforcement point	Lineage record (Code 5.1); rollback; circuit breaker (5, 8)

Table 6.9: The responsibility matrix for a chain that an agent occupies. Authors’ synthesis; instruments are cross-referred to the chapter that builds them.

Figure 6.3: Audit of a synthetic loan-servicing agent’s action log: share of adverse actions by decile of true risk, for accounts the agent inferred to be held by women and by men. At equal risk the inferred attribute shifts the agent’s proposals. from declared parameters; the disparity is a planted defect, and the figure shows that the test recovers it.

Panel of Figure 7 — Figure 7.1: One request through the pipeline, the information state at each stage and the control this chapter assigns. Authors’ synthesis; stages follow the architecture of current retrieval-augmented systems.

Family	Access	Jurisdiction	What the deployer controls, and does not
GPT (OpenAI); Claude (Anthropic); Gemini (Google)	Proprietary API	United States	Controls the prompt, the context and the guardrails around the call; does not control weights, training data, model updates or what the provider logs. Contractual no-training and retention terms are the governance instrument
Llama (Meta); Mistral; Qwen (Alibaba)	Open weights under licence	US; France (EU); China	Controls everything after download, including the removal of alignment; inherits licence restrictions and acceptable-use terms; must manage provenance, patches and residency itself
Indian models (Sarvam, Krutrim, AI4Bharat lines; IndiaAI-funded models)	API and open weights	India	Indic-language coverage; subject to the DPDP Act and the India AI Governance Guidelines; training-data provenance for Indian languages is the open question

Table 7.1: The foundation-model landscape read for governance, at the information date. Versions change quarterly; the governance characteristics change slowly.

Risk	Enters at; state	Documented instance	Control (section)
Fabrication (hallucination)	Generation; generated	Mata v. Avianca (S.D.N.Y. 2023): six invented citations in a filed brief	Grounding check; citation verification; review before reliance (7.4, 7.5.6)
Bias amplification	Model; retrieval and ranking; inferred, retrieved	Low-resource Indian languages under-served (Ch. 6)	Disaggregated evaluation; corpus coverage audit (6, 7.5)
Reproduction of protected content	Generation from memorised training data; generated	Lyrics reproduced ( GEMA v. OpenAI , 2025); image outputs in Getty	Output filtering for known works; provenance of training data (Ch. 3; 7.9)
Leakage of personal data	Training corpus; retrieved document; memory; log; collected, remembered	Training-data extraction (2021, 2023); Samsung source-code submissions (April 2023)	Four-door control: corpus sanitisation, access control, memory policy, trace minimisation (7.5–7.7)
Misuse and dual use	Query; collected	Voice-clone fraud; disinformation at scale (Ch. 9)	Usage policy; classifiers; rate limits; marking (Art. 50)
Unbounded consumption	Loop; every stage	Runaway tool chains in agentic deployments (Ch. 8)	Token budgets; routing; caching; circuit breakers (7.8; Ch. 4 §4.8)

Table 7.2: Six risk classes located at the stage where each enters and the state it corrupts. The placement is the authors’.

ID	Vulnerability	Primary controls	EU AI Act	India
LLM01	Prompt injection	Instruction hierarchy; input and output validation; dual-LLM quarantine; review before consequential action	Art. 15; Art. 9	DPDP s. 8(5); IT Act s. 43A (until omitted)
LLM02	Sensitive information disclosure	Corpus sanitisation; DP-SGD; output PII filter; memorisation testing; memory policy	Art. 10; Art. 15	DPDP ss. 4–6, 8(3), 12
LLM03	Supply chain	Model provenance and signing; safe serialisation (no pickle); dependency audit; vendor assessment	Art. 17; Art. 15	DPDP s. 8; CERT-In Directions
LLM04	Data and model poisoning	Training-data provenance; anomaly detection; secure fine-tuning; red-teaming	Art. 10; Art. 9	DPDP s. 8(3)
LLM05	Improper output handling	Treat output as untrusted input: sanitise, type-check, sandbox	Art. 15; Art. 14	IT Act ss. 43, 66
LLM06	Excessive agency	Least privilege; action-level approval; policy on the tool call (Code 5.1); budgets; action log	Art. 14; Art. 9	DPDP s. 8; Ch. 5, 8

Table 7.3: The OWASP Top 10 for LLM applications (2025) as a control matrix. The full reference with attack scenarios is Appendix C.

Dimension	What is new	Control
C: training corpus	In the weights; extractable	Sanitisation; DP-SGD; extraction testing
C: system prompt and I/O	Prompt readable; I/O on provider infrastructure	Nothing critical in the prompt; contract terms; private deployment for sensitive data
C: the model as channel	Output leaks what input, corpus or memory held	Output filter; memory policy; trace minimisation
I: model	Backdoors invisible to inspection	Behavioural evaluation; signing; provenance
I: output	Fabrication is a normal failure, not an attack	Grounding; citation check; review before reliance
I: provenance	Chain runs training $\to$ prompt $\to$ retrieval $\to$ output	Lineage (Ch. 2); Art. 53 summary; C2PA

Table 7.4: The CIA triad for generated information: nine dimensions where a generative pipeline needs a control classical security did not have.

Figure 7.2: Residual attack success as layers are added, for six request classes and benign traffic, under the independence assumption. Each layer’s detection rate is a declared parameter. Illustrative, not empirical.

Pattern	Strength	Cost	Regulated data
Metadata filtering	Enforced at query time; native support	Policy changes rewrite metadata at scale; complex policies hard to express	Adequate with metadata-integrity assurance
Namespace separation	Physical isolation; no cross-boundary retrieval	Duplication; combinatorial growth; cross-namespace merging	Strong for the most sensitive classes
Post-retrieval filtering	Simple; decoupled from the store	Over-retrieval: the store serves what the user may not see	Insufficient alone

Table 7.5: Three patterns for document-level access control in retrieval systems.

Figure 7.3: Attributing a wrong answer to retrieval or to generation from two trace-derived scores. Synthetic probes with a planted cause. The decision rule of Sect. 7.5.4 recovers the planted cause on 91 per cent of probes.

State object	Scope	Retention	Inspectable by	Erasure reaches it
Session context	Current conversation; no carry-over by default	Session end	Principal; auditor	Purge on session end
Conversation history	Prior turns of the same principal; minimised	30 days	Principal; auditor	Keyed by principal
Long-term memory	Explicit, principal-visible facts only; no inferred or protected attributes	180 days, renewed by use	Principal (viewer); auditor	Keyed; propagates to summaries
Semantic cache	Query–answer pairs; partitioned by access class; no personal data	7 days or corpus change	Auditor	Invalidated on erasure of any cited document
Provider prompt / KV cache	Provider-side; must not persist beyond the request window	Minutes	No (contract; attestation)	n/a: must not persist
Retrieval corpus	Documents with classification, owner, ingestion provenance	Document schedule	Owner; auditor	Document, chunks, embeddings, cache within the erasure SLA

Table 7.6: Eight state objects in a generative pipeline and the four questions a memory policy answers for each. Authors’ synthesis; the policy for the running example is a YAML configuration file.

	Programmable flows (NeMo Guardrails; Colang)	Validator pipelines (Guardrails AI)	Model classifiers (Llama Guard; Purple Llama)	Cloud-managed (Azure AI Content Safety; Bedrock Guardrails)
Acts at	Input, output, multi-turn flow	Input, output	Input, output (single turn)	Input, output at the endpoint
Auditability	Readable policies; deterministic paths	Per-validator log; versioning	Label with little explanation	Provider logs; internal model opaque
Data residency	Self-hosted	Self-hosted	Self-hosted (GPU)	Content leaves to the provider’s region
Indic languages	As the underlying model	Validator-dependent	Thin coverage	Broad classification; quality varies
Governance fit	Policy-as-code with escalation flows	Composable business rules	Consistent semantic safety for self-hosted models	Low overhead where data may leave

Table 7.7: Four guardrail architectures compared on what a governor must know. Versions and latencies are indicative at the information date.

Panel of Figure 8 — Figure 8.1: The autonomy spectrum as a governance variable: six levels, the rights of Eq. ( 1.2 ) each exercises without a human at the moment of action, the oversight mode and the governed event. Authors’ synthesis.

Framework	Model of the agent	Native governance primitives	What the deployer must add
OpenAI Agents SDK	Agent, handoff, guardrail; a run loop	Input/output guardrails; tracing; handoff as an object	Attenuation at handoff; action-level enforcement; lineage record
LangGraph	Nodes and edges over a state object	Checkpoints; interrupt before/after a node; replay	Authority model; provenance on state; budgets beyond steps
CrewAI	Roles, goals, backstories in crews	Role scoping; sequential or hierarchical process	Backstory as untrusted input; enforcement point; identity
AutoGen / AG2	Conversational agents in group chats	Conversation policies; sandboxed code execution	Trace correlation across free-form chats; attenuation
Claude Agent SDK	Tool use over MCP with permissions	Permission model; capability scoping; MCP trust	Lineage record; cross-agent attenuation

Table 8.1: Agent frameworks read for the governance primitive each supplies natively, at the information date.

Vector	Traditional software	LLM application	Agent system
Input	SQL injection, XSS (mature defences)	Prompt injection (open)	Indirect injection through tools and memory; cross-agent injection
Authorisation	OAuth, RBAC, ABAC (mature)	API keys; user-level access	Multi-level delegation; confused deputy; apparent authority through chains
Data exposure	Breaches; log leakage	Training-data extraction; context leakage	Cross-session memory leakage; tool-output exfiltration; inter-agent bleed
Supply chain	Dependency CVEs	Model and fine-tuning supply chain	Tool servers (MCP); agent frameworks; plugin ecosystems
Availability	Floods; exhaustion	Token exhaustion	Runaway loops; recursive delegation; unbounded tool calls
Integrity	Tampering; man-in-the-middle	Output manipulation; fabrication	Goal drift; specification gaming; cascading error along chains

Table 8.2: How the attack surface grows from traditional software through the language-model application to the agent system.

Threat	Exploits	Mechanism	Countermeasure (invariant)
Indirect injection kill chain	Tool use; retrieval; propagation across agents	Data read as instruction; laundered through legitimate outputs	Provenance of instruction source; quarantine of untrusted content; review before consequential action (I5, I3)
Tool misuse / confused deputy	Ambient authority in the hierarchy	Legitimate credentials used for an unauthorised request	Task-bound capability; authority stack; enforcement on the call (I2, I3)
Memory poisoning	Persistent memory	Adversarial content stored as trusted context; activates later	Memory policy: provenance, scope, isolation, audit (I5)
Cascading trust failure	Multi-agent graph	Transitive trust propagates a compromise	Non-transitive trust; breakers; independent verification at critical nodes (I4, I6)
Goal drift / specification gaming	Multi-step reasoning	Literal metric satisfied against intent	Outcome monitoring; specification refinement; gates on action class (I1)
Runaway process	Loops without limits	Each step generates the next	Step, spend and time budgets; breaker; anomaly alert (I6)

Table 8.3: Six threat categories for agent systems: the addition each exploits, its mechanism and the countermeasure, with the invariant the countermeasure restores. The invariant column is the authors’.

Primitive	Mechanism	Addresses	Built in
Agent identity	Workload identity; capability manifest; owner; version; trust class	Impersonation; spoofed delegation; attribution	Sect. 5.6.1 ; Sect. 8.5.1
Least privilege	Capability scoping per task; attenuation at delegation	Tool misuse; confused deputy; lateral movement	Sect. 8.5 ; Code 8.1
Approval gates	Review at action classes and values set by the autonomy level	Unauthorised and irreversible actions; drift	Sect. 4.8.3 ; Sect. 5.6 ; Sect. 6.8
Egress control	Network allow-list; tool-parameter validation; output inspection	Exfiltration; unauthorised communication	Sect. 5.6.3 ; Sect. 7.4
Budgets and breakers	Limits on tokens, cost, time, steps, scope; halt with state preserved	Runaway processes; cascades	Sect. 7.8 ; Sect. 8.5.5
Observability	Spans correlated across agents; lineage record	Cascades; forensics; audit	Sect. 7.7 ; Sect. 8.5.3

Table 8.4: Six governance primitives for multi-agent systems, the threat each addresses and where the book builds it.

Figure 8.3: Probability that the final action of a delegation chain lies outside the original authority, by chain length and governance regime, under declared per-hop parameters. Illustrative, not empirical.

Layer	Activities	Owner	When
Identity and registration	Identity; manifest; owner; version; trust class; inventory	Platform and security	Before deployment; on change
Pre-deployment assessment	Capability, boundary, risk and alignment testing; risk tier sets gates	Governance body	Before each deployment or major update
Runtime controls	Input validation; action authorisation against the stack; output inspection; breakers	Automated; on-call	Every action
Post-deployment audit	Lineage review; escalation, false-positive, tool-diversity and outcome metrics	Audit; ethics function	Risk-tiered: weekly to quarterly
Improvement	Control tuning; policy and threat-model updates	Cross-functional	On findings

Table 8.5: The agent governance lifecycle in five layers.

Doctrine	Union	United States	India	Governance consequence
Product liability	Directive 2024/2853: software and AI are products; strict liability; presumption of defect on non-disclosure	Product vs service unsettled; negligence for services; state statutes emerging	CPA 2019 ss. 82–87; “product” not read to include software; s. 84 defect untested for agents	Keep defect documentation: testing, lineage, incident records
Agency	Deployer bound for acts within configured scope; AI Act deployer duties	Restatement (Third) of Agency by analogy; scope is fact-intensive	Contract Act ss. 182, 226–228, 237; deployer as principal	Authority stack = scope of authority; record it
Vicarious liability	Employer principles; value-chain roles	Respondeat superior where control shown	Course-of-employment test ( Shyama Devi ); control by configuration	Retain and document control; terminate capability
Contract	Deployer bound within scope; e-commerce rules	UETA s. 14 electronic agents	IT Act s. 10A; Contract Act free consent	Value ceilings; counter-party lists; gates; monitoring
Data protection	GDPR controller/processor; AI Act Art. 26	FTC; state privacy statutes	DPDP fiduciary/processor; Rule 13 due diligence	Agent processing is the fiduciary’s; DPIA for agent flows
Tort	Fault-based; AI Liability Directive withdrawn (Feb 2025)	Negligence; duty of care evolving	Negligence; IT Act s. 43	Governance framework as evidence of care

Table 8.6: Liability for an autonomous agent’s act across three jurisdictions, with the governance consequence of each doctrine.

Dimension	MCP	A2A	Governance reading
Interface	Agent to tool; client–server	Agent to agent; peers with Agent Cards and tasks	Complementary; constraints must cross both
Discovery	Server capability advertisement	Card registry; capability-based search	Allow-lists; human approval of new tools
Transport and auth	Streamable HTTP; OAuth 2.1 authorisation	HTTPS; OAuth 2.0 or keys	Residency of servers; delegated credentials (Ch. 5)
Trust model	Client trusts server within one application	Federated trust across organisations	Attestation absent in both
State	Stateless calls; optional subscriptions	Task lifecycle with states	A2A states enable task-level gates
Gaps	Attestation; output sanitisation; scoping	Attestation; consent and authority propagation; liability	Enforce around the protocol: stack, token, PEP

Table 8.7: MCP and A2A compared as governance surfaces.

Phase	Techniques	Output	Tests
Capability probing	Undeclared tools; parameter ranges; emergent compositions	Declared vs actual envelope	I2 (manifest truth)
Boundary testing	Authority, data, resource, time limits; direct and indirect	Pass/fail per boundary	I3, I6
Multi-step chains	Plant; trigger; observe; trace propagation across agents	Step-by-step traces	I4, I5
Tool-call fuzzing	Malformed, extreme, injected, concurrent parameters	Tool vulnerability catalogue	I3
Control validation	Filter encoding; evasion; breaker thresholds; reviewer manipulation; attenuation bypass	Control effectiveness and bypasses	All; the record explains every finding

Table 8.8: Five phases of red teaming for agent systems, with the invariant each phase tests. The invariant column and the two additions are the authors’.

Panel of Figure 9 — Figure 9.1: An election read as the public Data–Model–Agent–Action loop: the information state each stage produces and the control that reaches it. The loop closes through the voter file and the platform log. Authors’ synthesis.

Layer	Key datasets	Custodian	Loop stage	Control that reaches it
Registration	Rolls; EPIC; Aadhaar seeding records; BLO verification	ECI, CEOs, EROs	Data	RPA 1950 ss. 16–23; Registration Rules 1960; Puttaswamy; DPDP (state processing)
Delimitation	Census tables; GIS boundaries; administrative units	Delimitation Commission; Census; Survey of India	Data	Arts. 81–82, 170; Delimitation Act 2002; 84th and 87th Amendments
Campaign operations	Voter files; canvassing; party apps; targeting models; ad spend	Parties; consultants; platforms	Model, Agent	Candidate ceilings (r. 90); MCC; platform ad policies; no data-protection control settled
Voting	EVM counts; VVPAT slips; turnout series; booth metadata	ECI; BEL; ECIL	Action	Conduct of Elections Rules 1961; SC orders 2013, 2019, 2024
Post-election audit	Results by booth; expenditure returns; petitions	ECI; ROs; High Courts	New data	RPA 1951 ss. 77–78, 80–116; RTI Act
Public sphere	Posts; coverage; fact-checks; synthetic media	Platforms; media; civil society	Generated	IT Act s. 79 and Rules 2021/2026; ECI–platform voluntary code; DSA (EU)

Table 9.1: The electoral data ecosystem by layer, with the loop stage each layer occupies. The stage column and the “control that reaches it” column are the authors’.

Figure 9.2: Eleven exit polls for the 2024 Lok Sabha election: published range and midpoint for the NDA, against the result. Common error 73 seats; dispersion across polls 22 seats; herding ratio 3.4. One of eleven ranges contained the result. Source: published polls of 1 June 2024 as recorded in ECI results of 4 June 2024.

Method	Where the error enters	Governance concern	What disclosure would show
Probability-sample survey (Lokniti–CSDS post-poll)	Non-response; social-desirability on caste and community questions	Cost limits sample; methodology opaque to readers	Sampling frame; response rate; question wording
Telephone or online with model weighting (CVoter and others)	Weighting model; frame excludes the unconnected	Model failure is invisible until the count	Weights; calibration targets; raw-to-published change
MRP ( Park et al., 2004 ; Lauderdale et al., 2020 )	Post-stratification needs current small-area demographics (India’s census is 2011)	Model assumptions; caste not enumerated	Model specification; cell counts; validation on past results
Bayesian aggregation (US forecasters)	Prior and pooling; correlated poll errors	Probabilities misread as certainties	Prior; correlation assumptions; calibration record
Exit poll	Non-response at the booth; phase effects; herding	Publication timing (s. 126A); consensus pressure	Raw figures; adjustments; the booths sampled

Table 9.2: Forecasting methods and the governance concern each raises. The disclosure column is the authors’.

Figure 9.3: The public-sphere feedback loop, computed. A seat-maximising campaign over five cycles, with and without learning from its own contacts. Left: Gini of spend across constituencies and the share of constituencies below the contact floor. Right: number of constituencies contacted at all. With learning, contact data is a durable asset that sends the campaign back to the same seats; without it, the allocation tracks the drifting margins. Declared parameters; illustrative.

Dimension	Broadcast	Targeted	Governance consequence
Economic character	Public good: non-rival, non-excludable	Private good priced by persuadability	Universal provision is not an equilibrium; it must be required or subsidised
Message	One message, publicly observable	Many messages, each seen by its recipient	Promises fragment; mutual accountability lost
Distribution	Even across voters	Concentrated in marginal seats; 48 per cent below floor in the model	Informational inequality by constituency arithmetic
Across cycles	Stable	Concentrates with learning (Fig. 9.3 )	Data is a durable asset; incumbency in data compounds
Transparency	Spend and content observable; equal-time rules	Spend and criteria visible only to platform and campaign	Expenditure law cannot see it; ad libraries partial
Control that reaches it	Broadcasting codes; MCC; ceilings	DSA Art. 39 repository; Reg. 2024/900 targeting limits (EU); none in India	Disclosure of criteria is the feasible lever

Table 9.3: Broadcast and targeted political communication compared. The economic-character and loop rows are the authors’.

Figure 9.4: The liar’s dividend as an inference. Credibility of an unsigned political recording that passes a detector, as the share of synthetic recordings in circulation rises, for two detector sensitivities (false-positive rate 5 per cent) and three levels of provenance coverage among genuine recordings. Equation ( 9.1 ); declared parameters.

Countermeasure	Moves	Limit	Maturity (2026)
Neural detectors	$s$ (down over time)	Lag the generator; false positives on genuine phone footage	Deployed by platforms; accuracy decays with each model generation
Frequency-domain forensics	$s$	Expert; does not scale	Forensic laboratories; litigation evidence
Metadata forensics	$s$	Stripped by channels	Established; weak against purpose-built fakes
C2PA provenance at capture	$c$	Manifest removable; needs device and platform adoption	Camera makers, editing tools, some platforms; coverage low
Labelling with penalty (AI Act Art. 50; IT Rules 2026)	$\pi$	Enforcement against cross-border producers; satire exception	EU from Aug 2026 (marking Dec 2026 for systems on the market); India from 20 Feb 2026
Takedown clock (ECI advisory; Rules 2026)	$\pi$	Reactive; the clip has travelled	Advisory 2024; statutory three-hour clock from Feb 2026

Table 9.4: Countermeasures to synthetic political media, the variable of Eq. ( 9.1 ) each moves and maturity at the information date. The variable column is the authors’.

Dimension	US § 230	EU DSA + Reg. 2024/900	India s. 79 + Rules
Liability model	Near-absolute immunity for hosting and removal	Conditional exemption; tiered duties by size; 6 per cent fines	Conditional safe harbour; actual knowledge = court or government order ( Shreya Singhal )
Who decides unlawfulness	Platform (voluntarily); courts for speakers	Platform under process duties; DSCs and Commission supervise	Government (s. 69A) or court; GACs for user grievances
Election-specific duty	None (FEC disclaimers on paid ads)	Art. 34 civic-discourse risk; Art. 39 ad repository with targeting; Reg. 2024/900 targeting ban on special-category data	None in statute; ECI voluntary code; 2026 Rules on synthetic content
Generated content	No duty	Art. 50 AI Act labelling (Aug 2026); DSA risk mitigation	2026 Rules: labelling, declaration, takedown windows
Encryption and tracing	No mandate	No general mandate	r. 4(2) first-originator tracing; contested
Cost allocation (authors’ reading)	Nobody; governed to the platform’s interest	Platform, with penalty; design left to firm	Decision to state, execution to platform; over-removal on order, under-moderation otherwise

Table 9.5: Three platform regimes as allocations of the cost of governing generated political content.

Dimension	Gap	Reform direction	Rests on
Consent and purpose	Roll supplied to parties by rule; elector cannot object to political use	Roll use limited to contact and verification; profiling beyond it requires consent; parties as fiduciaries for the rest	P9.4
Data sharing	No processor agreements between campaigns and vendors	Mandatory processor contracts; vendor register filed with the ECI	P9.2
Professional standards	No code for political data consultants	Registration and a code enforced through the MCC	P9.5
Expenditure and data	Returns do not see data operations or in-kind data	Disclosure of data expenditure and of the file held; valuation guidance	P9.5
Retention across cycles	Files compound without limit	Purge of targeting data after the cycle; retention limit on contact data	P9.2, P9.5
Targeting transparency	Criteria invisible to the targeted	Disclosure of targeting criteria on political advertising; repository	P9.2

Table 9.6: Governance gaps in campaign data operations and the direction of reform, with the proposition each reform rests on.

Case	What happened	Lesson	For India
Brazil	Secure machines, public bulletins, no paper trail after 2020; 2022 result contested without evidence	Legitimacy needs a verification the non-expert can perform	Keep VVPAT; fix its sampling (risk-limiting audit)
Kenya	Biometric system built 2013–17; 2017 annulment over server access; DPA 2019 after the fact	The rule must precede the database or be litigated into it	Settle party-as-fiduciary and roll-seeding rules before the 2026 census and delimitation
Romania	Undeclared platform campaign; round annulled Dec 2024; DSA proceedings	An ungoverned generated-information loop can decide an election with no fabrication and no declared spend	Statutory, not voluntary, platform duties during the MCC period

Table 9.7: Three cases and the proposition each isolates. Romania added for the 2024 precedent.

Term	Within Art. 324 / Model Code	Needs Parliament	Prop.
Parties as fiduciaries	Register of voter files, sources and vendors	Political opinion as a confined category; s. 17(2)(a) not for parties	P9.4, P9.5
Synthetic media	Signed manifests on all party recordings; 3-hour takedown	Undisclosed synthesis as corrupt practice (s. 123); manifest preservation duty	P9.3
Algorithmic advertising	Repository with targeting criteria; disclosure to the targeted	Targeting ban on inferred special-category data; data in expenditure returns	P9.2, P9.5
Cross-border	—	Platform risk duty during the MCC period, enforced by the Commission	P9.3
Open data	Tiered access; use agreements; booth suppression rule	Electoral-accountability carve-out from RTI s. 8(1)(j) as amended	P9.4
Forecasting	Disclosure standard for published polls as a condition of the s. 126A window	—	P9.1

Table 9.8: The brief’s roadmap: measures within existing authority and measures needing legislation, by term of reference and by proposition.

Layer	MedScan AI	State produced
Source data	2.5 m radiographs from three jurisdictions; labels from radiologists; demographic fields	Collected (special-category health data)
Retrieval / context	Prior films, notes and lab results fetched per patient at inference	Retrieved; context window
Model / inference	Classifier output: probability of TB, pneumonia, malignancy; confidence; saliency map	Inferred (a diagnosis-grade inference about an identifiable person)
Generated output	Structured report; draft referral letter in the physician’s name; patient message	Generated
Memory	Per-patient findings across visits; model updates from site data under a change plan	Remembered
Agent	Orchestrator that chains retrieval, inference, drafting and scheduling; delegated credentials to the hospital system	Delegated authority

Table 10.1: The running case: MedScan AI’s loop by layer, with the information state each layer produces. The regime sections of this chapter end with a verdict in these terms.

Panel of Figure 10 — Figure 10.1: The AI Act’s applicability as enacted (Art. 113) and as amended by the Digital Omnibus on AI, in force from 27 July 2026.

Tier	Scope	Duties	Penalty (Art. 99/101)	Applies from
Prohibited (Art. 5)	Eight practices incl. manipulation, social scoring, emotion recognition at work, untargeted face scraping, RBI with exceptions	None permitted	EUR 35 m / 7 %	2 Feb 2025
High-risk, Annex I (Art. 6(1))	Safety components or products under harmonisation law needing third-party assessment (MDR, IVDR, machinery, vehicles…)	Arts. 8–15; provider QMS (Art. 17); conformity via sectoral body (Art. 43(3)); registration	EUR 15 m / 3 %	2 Aug 2028 (Omnibus; enacted: 2 Aug 2027)
High-risk, Annex III (Art. 6(2))	Biometrics, infrastructure, education, employment, essential services, law enforcement, migration, justice	Arts. 8–15; Art. 26 deployer; Art. 27 FRIA; Art. 6(3)–(4) carve-out with documentation	EUR 15 m / 3 %	2 Dec 2027 (Omnibus; enacted: 2 Aug 2026)
Transparency (Art. 50)	Interaction with persons; synthetic content; emotion/biometric categorisation; deepfakes	Inform; machine-readable marking; disclose	EUR 15 m / 3 %	2 Aug 2026 (marking for systems already on the market: 2 Dec 2026)
GPAI (Arts. 51–54)	All general-purpose models	Documentation; downstream information; copyright policy; training summary	EUR 15 m / 3 %	2 Aug 2025 (models on market earlier: Aug 2027)
GPAI with systemic risk (Art. 55)	$\geq 10^{25}$ FLOP or designated	Evaluation; adversarial testing; incident reporting; cybersecurity; Code of Practice	EUR 15 m / 3 %	2 Aug 2025

Table 10.2: The AI Act’s tiers applied, with the articles that govern each and the applicability date as enacted. Corrected and dated to the information date.

Element	Instrument / institution	Status	What it reaches / leaves
Principles	NITI Aayog 2018 strategy; 2021 Responsible AI principles (seven); MeitY India AI Governance Guidelines, Nov 2025 (seven sutras)	Non-binding	Normative; no duty on any layer
Institutions	AI Governance Group; Technology and Policy Expert Committee; AI Safety Institute (Jan 2025); proposed incident database	Proposed / constituted	Coordination; evaluation; incident recording (feedback)
Mission	IndiaAI Mission, 7 Mar 2024, INR 10,371.92 crore; seven pillars; 34,000+ GPUs	Funded	Compute, datasets, safety tooling; no duties
Data statute	DPDP Act 2023; Rules 13 Nov 2025 (phased); Board	Enacted; phased to 2027	Source data, retention, erasure; s. 8(3) accuracy; Rule 13 SDF diligence; s. 17(2) exemption
Advisories and rules	MeitY advisories Mar 2024; IT Rules 2021 as amended 2026 (synthetic content)	Advisory / statutory	Generated output (labelling, takedown) for intermediaries
Sectoral	RBI FREE-AI (Aug 2025); SEBI AI/ML guidance; IRDAI; CDSCO MDR 2017; ICMR 2023	Varies	Model and action within the sector (Sect. 10.9 )

Table 10.3: India’s AI governance architecture at the information date. Updated with NITI Aayog principles, MeitY Guidelines (Nov 2025), DPDP Rules 2025, AISI and IT Rules 2026.

Instrument	Authority	Requirements	Status
EO 14110 (Oct 2023)	Presidential; DPA	Reporting above compute thresholds; agency directives; NIST tasks	Revoked 20 Jan 2025 (EO 14148)
EO 14179; AI Action Plan (Jan / Jul 2025)	Presidential	Deregulatory review; procurement; exports; data centres	In force
Dec 2025 order on state laws	Presidential	Litigation task force; funding conditions	In force; contested
NIST AI RMF 1.0; AI 600-1 (2023 / 2024)	Standards	Govern–Map–Measure–Manage; twelve GenAI risks	Voluntary; de facto reference
FDA device framework; PCCP (Dec 2024)	FD&C Act	Premarket pathways; change control plans for retraining	Binding for devices
Colorado SB 24-205 $\to$ SB 26-189	State	Disclosure for consequential decisions (impact assessment and discrimination duties removed)	Effective 1 Jan 2027

Table 10.4: US instruments at the information date. Updated with the 2025–2026 sequence (revocation, Action Plan, Colorado, California SB 53, Texas).

Dimension	EU (rights-based)	US (innovation-first)	China (state-directed)	India (principle-guided)
Instrument	Reg. 2024/1689; GDPR; DSA; PLD 2024	Sectoral statutes; NIST RMF; state acts; executive orders	CAC provisions 2022–2025; PIPL; DSL	DPDP Act and Rules; Guidelines 2025; IT Rules; sectoral circulars
Philosophy	Fundamental rights; risk tiers; precaution	Innovation; existing authorities; voluntary standards	Security and control; content conformity	Developmental pragmatism; innovation over restraint
Enforcement	AI Office; national authorities; up to 7 %	Sectoral agencies; state attorneys-general; FTC	CAC; filing; assessment; takedown	Board (data); sectoral regulators; courts
Innovation cost	High for providers; standards lag	Low; policy instability	Pre-release assessment; domestic market protected	Low; services sector aligns to EU/US
Individual recourse	Strongest (Arts. 85–86 AI Act; GDPR Art. 22)	Sectoral; state-level; weak federally	Subordinated	Data rights only; no ADM right
International influence	Brussels effect; CoE Convention	Industry leadership; NIST reference	Digital Silk Road; standards bodies	GPAI chair 2024; AI Impact Summit 2026; Global South

Table 10.5: Four governance models compared, with the computed agentic reach of Sect. 10.8 added. Canonical for the book (Chapters 4 and 9 cross-refer).

Figure 10.3: The regime-reach matrix: what each regime reaches at each layer of the Data–Model–Agent–Action loop, scored 0–3 by the authors from the instruments at the information date (basis for every cell in the scoring table). Mean reach across regimes: classical layers 1.9, agentic layers 1.0; the agent layer 0.3, with 4 of 6 regimes at zero.

Layer	EU AI Act	DPDP + Rules	NIST RMF + GenAI	China (CAC)	US fed. + state
Source data	Art. 10; Art. 53(1)(d) (3)	Ss. 4–8; Rules (3)	MAP/MEASURE provenance (2)	GenAI Art. 7; PIPL (3)	Sectoral only (1)
Retrieval	Arts. 9, 15 indirectly (1)	Purpose and retention (2)	Value-chain actions (2)	— (1)	— (0)
Model	Arts. 9–15, 51–55; Art. 5 (3)	S. 8(3); Rule 13 (1)	Core of RMF (3)	Filing; assessment (3)	FDA; ECOA; LL144; SB 53 (2)
Output	Art. 50 marking (2)	None (0)	Integrity; provenance (3)	Deep Synthesis; Labelling 2025 (3)	FCC; state deepfake acts (1)
Memory	Art. 12 logs; Art. 72 (1)	S. 8(7); s. 12 erasure (2)	Privacy mentions (1)	Logs for authorities (1)	— (0)
Agent	None (0)	None (0)	Mention only (1)	Framework 2.0 names it (0)	UETA s. 14 only (0)

Table 10.6: The regime-reach matrix in words: the basis of each score of Fig. 10.3 , Authors’ synthesis.

Sector	Instruments	India	Reaches / leaves
Health	FD&C Act; FDA PCCP (Dec 2024) and AI device guidance; MDR + AI Act Art. 6(1), 43(3)	Medical Devices Rules 2017 (CDSCO); ICMR 2023 guidelines; NMC silent	Model, feedback (change control); action only where the device acts; no category for a device that schedules
Finance	ECOA/Reg. B reasons; MiFID II Art. 17; model-risk guidance	RBI Digital Lending Directions 2025; FREE-AI report Aug 2025; SEBI 2012/2025; IRDAI	Model, output, action (the decision is the regulated act); not delegation across firms
Legal	Rule 11; standing orders; ABA Op. 512; AI Act Annex III (justice)	Advocates Act; BCI Rules; SUPACE/SUVAS; Kerala HC AI policy (Jul 2025)	Action through personal responsibility; nothing on an agent that files

Table 10.7: Sectoral regimes at the information date, with the layer each reaches. Updated with FDA PCCP, RBI Directions 2025 and FREE-AI, SEBI 2025 and Kerala HC 2025.

Case	Holding that governs AI	Lineage	Left open
Puttaswamy (2017) 10 SCC 1	Legality, legitimate aim, proportionality for any state processing	Aadhaar 2018; Pegasus 2021; electoral bonds 2024; DPDP Act as the “law”	Proportionality of a state AI deployment; s. 17(2)
Shreya Singhal (2015) 5 SCC 1	Actual knowledge = court/government order; vagueness invalidates	IT Rules 2021; 2026 synthetic-content Rules	Whether labelling and takedown windows survive Art. 19(2)
Schrems I, II; Latombe (2025)	Equivalent protection or no transfer; DPF upheld at first instance	DPF 2023; T-553/23; appeal	Stability of the DPF; India without adequacy
Google Spain (2014)	Search engine as controller; delisting; Art. 17 erasure	EDPB Opinion 28/2024 (model anonymity)	Erasure from weights; “reasonable means”
Loomis (Wis. 2016)	Disclosure of the algorithmic input; stated limits; independent human judgment	AI Act Arts. 14, 26(5); GDPR Art. 22	India has no statutory counterpart
NYT v. OpenAI; Bartz; Kadrey; Getty; GEMA; ANI	Fair use on lawful acquisition (US, two courts); memorised output infringes (Munich); no secondary infringement in weights (London)	Preservation orders; Bartz settlement; Delhi HC pending	Whether output, not training, is the act; India s. 14 and s. 52

Table 10.8: The cases: holding that governs AI, lineage since and the question left. Updated with the 2024–2026 lineage.

Instrument	Membership	Force	What it adds; layers addressed
CoE Framework Convention (2024)	CoE members and signatories incl. EU, UK, US	Treaty (binds on ratification; five needed for entry into force)	Human-rights principles for the AI lifecycle; domestic implementation; model and output
OECD Recommendation (2019; rev. May 2024)	47 adherents; G20 endorsement	Soft	Definition; five principles; AI Policy Observatory; data and model
GPAI (2020; in OECD since Jul 2024)	29 members; India chair 2024	Soft	Working-group reports; Global South agenda
G7 Hiroshima Principles and Code (Oct 2023); reporting framework (Feb 2025)	G7 + EU; company reports	Voluntary	Eleven commitments for advanced-model developers; provenance; red-teaming; model and output
UN GDC (Sep 2024); UNGA res. (Aug 2025)	All members	Soft; institutions created	Scientific Panel; Global Dialogue; capacity building
Summits: Bletchley, Seoul, Paris, New Delhi (2023–26)	Variable	Declarations; frontier commitments	Safety institutes network; voluntary frontier commitments

Table 10.9: International instruments at the information date: force, membership and the layers addressed. Updated with OECD 2024 revision, GPAI into OECD, Hiroshima reporting framework, UNGA 2025, CoE Convention and Delhi 2026.

Panel of Figure 11 — Figure 11.1: The governance control plane over the governed loop: seven functions attaching to eight governed objects, operated by four institutional layers across design, run and review time. Authors’ synthesis.

Object (layer)	States produced	Control built	Chapter
1 Source data	Collected	Quality dimensions; datasheets; provenance (C2PA); consent basis	2 , 3
2 Retrieval and context	Retrieved; transformed	Access control at the document; provenance of instruction; quarantine of untrusted content	7
3 Model and inference	Inferred	Evaluation on slices; calibration; inferential privacy; the law of inferred information	6 , 3
4 Memory and state	Remembered	Memory policy over eight state objects; erasure through the stack	7
5 Agent reasoning	Delegated authority	Authority stack; attenuation at handoff; six invariants	8
6 Tools and external systems	— (boundary)	Task-bound credential; egress control; MCP/A2A as governance surfaces	5 , 8

Table 11.1: The governed objects: the eight layers of the loop, the information states each produces and the control the book built for it.

Function	Council (design)	Officer and owners (design, review)	Engineering (run)	External (review)
Authority	Autonomy level per task class; value ceilings	Authority stacks; delegation tokens; attenuation rule	Issue, exchange and revoke tokens	Scope of authority as evidence (agency; AI Act Art. 26)
Enforcement	Three-valued decision policy	Policy objects (Rego); thresholds table	PEP on retrieval, tool, action; decision written	Decisions as record (Art. 12; DPDP grievance)
Lineage	Minimum fields; retention	Schema; instruction-source classes	Entry per stage and handoff	Reconstruction in audit, redress, litigation
Evaluation	Gates that may block release	Slices; benchmarks; red-team phases	Pipeline gates; re-evaluation on update	Conformity assessment; FRIA; bias audit
Observability	Reconstruction-time target	Trace schema; signals by stage	Trace emission; drift monitors	Transparency reports; researcher access
Budget and breaker	Breaker conditions; kill-switch authority	Budgets per task class; reversibility classes	Counters; halt with state; compensating calls	Serious-incident reporting (Art. 73; FREE-AI)

Table 11.2: The control plane as a structure: governance functions by institutional layer and time. Entries name the decision or artefact each layer owns for each function. Authors’ synthesis; the organisational RACI of Table 11.5 is derived from it.

Ch.	Function(s) built	Object(s)	Artefact the plane adopts
1	Vocabulary; the trilemma; the loop	All	Table 1.3 states; Eq. 1.2; Eq. 1.3 expected harm
2	Lineage (inference stage); evaluation (quality)	Source data; retrieval; model	Fig. 2.4; datasheets; C2PA manifests
3	Authority (legal basis); external reach	Source data; inferred and generated states	Transfer route; law of inferred information
4	Budget (price of delegation); adaptation (placement of review)	Decision and action	Eq. 4.2 and $a^{*}$ ; Gordon–Loeb bound; SWF weights
5	Enforcement; authority (identity)	Retrieval; tools; action	Code 5.1; action-thresholds table; NHI lifecycle
6	Evaluation (slices); authority (oversight by level); accountability	Model; action	Table 6.4 oversight modes; responsibility matrix

Table 11.3: What each pillar of the book adds to the control plane. Synthesised from the individual chapter treatments; the chapter numbers are the canonical locations.

IDGA layer	In the plane	What the plane adds
1 Principles	Risk appetite; the trilemma weighting; what the council will not permit	A loop to attach them to; the states that change the principle’s application (Table 1.3 )
2 Policies and standards	Policy objects: authority stacks, thresholds table, memory policy, evaluation gates, breaker conditions	Policies as code the enforcement function reads, not documents the controls paraphrase
3 Processes	Handoff, review, incident, change and adaptation processes	Each process a governance event with a record; the handoff as a process
4 Technical controls	The mechanisms: PEP, records, gates, traces, breakers	Placement on the action and the handoff, not only on access
5 Measurement	Observability; the plane’s own dashboard	Reconstruction time and coverage as the measures, not only compliance counts

Table 11.4: The five-layer architecture (IDGA) mapped to the control plane. The IDGA is retained as the organisational layer; the plane is what it implements.

Function	Council	Officer	Eng.	External	Escalation trigger (Tier 3)
Authority	A	R	R	I	Any grant above the autonomy level set for the task class
Enforcement	I	A	R	I	PEP coverage below target; any bypass
Lineage	I	A	R	I	Any action without a record
Evaluation	A	R	R	C	A gate overridden; a slice unevaluated at release
Observability	I	A	R	I	Reconstruction time above target
Budget and breaker	A	R	R	I	Any breaker trip; any irreversible action without review

Table 11.5: RACI for the control plane’s functions by institutional layer (R responsible, A accountable, C consulted, I informed). Derived from Table 11.2 ; a streamlined version keyed to the plane’s seven functions.

Stage	Functions	Work	Exit test
1	Lineage; observability (schema)	Charter and council; inventory of systems that act; trace schema adopted; records written for one system	Eight questions answered for a sampled action from the record alone
2	Authority	Task classes and autonomy levels approved; stacks declared for every agent; tokens issued; attenuation rule coded	No agent holds a right its delegator lacks; every handoff recorded
3	Enforcement	PEP on retrieval, tool and action for the pilot system; thresholds table owned by the council; three-valued decisions written	Coverage at target; a planted out-of-scope action refused and recorded
4	Evaluation; observability (signals)	Slice evaluations as release gates; red-team phases incl. attenuation bypass; drift monitors; dashboard live	A gate blocks a release; reconstruction time at target
5	Budget and breaker; adaptation	Budgets per task class; breaker conditions; compensating calls; change record; review cadence	A breaker trip preserved state and was explained to the council within the cadence

Table 11.6: Building the plane in five stages, keyed to functions, with the test that ends each. The extended ten phases are given in the full version.

Figure 11.3: A control-plane dashboard from synthetic data: coverage, friction, outcome and cost over eight quarters for a fleet performing 120,000 actions a quarter. Generated from declared start and target values by illustrative.

Kind	Measure	Target (illustrative)	Source
Plane	Share of actions through an enforcement point	$\geq$ 98 %	PEP logs vs tool-call logs
Plane	Share of actions with a complete lineage record	$\geq$ 97 %	Record store
Plane	Median time to answer the eight questions for a sampled action	$<$ 1 hour	Trace queries
Plane	Attenuation refusals; breaker trips; gate overrides	Non-zero; explained; zero	Handoff and breaker records
Plane	Share of releases that passed every evaluation gate	100 %	Pipeline
Programme	Incidents per 100,000 actions; MTTD, MTTR	Falling; $<$ 24 h, $<$ 72 h	Incident system

Table 11.7: Plane measures and programme KPIs for the council’s dashboard. The programme KPIs are retained from the original analysis; the plane measures are the chapter’s.

Function	Provision	Policy object or record	Verification
Authority	DPDP ss. 4–7 (consent; legitimate uses); s. 16 transfers; s. 17 exemptions; sectoral licences	Legal basis per data source; transfer route; stacks for state agents traced to statute	Consent audit; transfer register; Puttaswamy assessment
Enforcement	s. 8(5) security safeguards; Rules 2025 safeguards; RBI/SEBI controls	PEP on access, retrieval, action; thresholds table	PEP coverage; bypass register
Lineage	s. 8(3) accuracy for decisions; s. 8(7) erasure; ss. 11–13 rights; Directions’ reasons for adverse action	Record per stage; erasure through the stack; reasons generated from the record	Request fulfilment; erasure audit
Evaluation	Rule 13 SDF diligence; FREE-AI bias testing; CDSCO validation; Puttaswamy proportionality	Slice evaluations incl. caste, language, geography; release gates	Evaluation reports; gate log
Observability	s. 8(6) breach intimation; sectoral reporting	Trace; breach detection; reconstruction	Intimation within time; reconstruction time
Budget and breaker	FREE-AI incident framework; IT Rules takedown clocks	Breaker conditions; halt with state; compensating actions	Incident reports; trip log

Table 11.8: The plane mapped to India’s instruments: which function discharges which provision.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Dimension	GDPR (EU, 2016/679)	DPDP Act (India, 2023) + Rules 2025	CCPA/CPRA (California)	LGPD (Brazil, 2018)	PIPL (China, 2021)	AI Act (EU, 2024)
In force	25 May 2018	Act 2023; Rules 13 Nov 2025, phased to 2027	2020; CPRA 2023	Sept 2020; penalties 2021	1 Nov 2021	1 Aug 2024; staged to 2028 (Omnibus 2026)
Scope	Controllers/processors; extraterritorial (Art. 3)	Digital personal data; processing in India or for goods/services in India (s. 3)	Businesses above thresholds; consumers	Processing in Brazil or of Brazilian data	In China; extraterritorial for Chinese persons	Providers, deployers, importers; by risk tier
Lawful bases	Six, Art. 6; consent one of them	Consent (s. 6) or legitimate uses (s. 7); no legitimate-interest basis	Notice; opt-out of sale/sharing	Ten, Art. 7	Consent or listed bases, Art. 13	n/a (duties, not bases)
Special categories	Art. 9: explicit consent or exception	None; children (s. 9) and SDF duties only	“Sensitive” PI; right to limit	Art. 11	“Sensitive” PI: separate consent, Art. 28	Art. 10(5) bias-detection processing; Art. 5 prohibitions
Rights	Access, rectification, erasure, portability, objection, ADM (Arts. 15–22)	Information, correction/erasure, grievance, nomination (ss. 11–14); no ADM right	Know, delete, correct, opt-out, limit	Arts. 17–22 incl. review of automated decisions	Arts. 44–50 incl. ADM explanation (Art. 24)	Explanation of individual decisions (Art. 86); complaints (Art. 85)
Automated decisions	Art. 22	None (s. 8(3) accuracy only)	Regulations on ADMT (2025)	Art. 20 review right	Art. 24	Art. 14 oversight; Art. 26(5) notice

Appendix

Table 140

ID	Vulnerability	What it is	Book’s control (chapter)
LLM01	Prompt injection	Instructions in input or retrieved content override the system’s	Provenance of instruction; dual-LLM quarantine; review before action (7, 8)
LLM02	Sensitive information disclosure	Training data or context leaks in output	Memorisation testing; output filter; memory policy (7)
LLM03	Supply chain	Compromised models, weights, dependencies	Model provenance and signing; vendor assessment (2, 5)
LLM04	Data and model poisoning	Corrupted training or retrieval data	Training-data provenance; corpus controls (2, 7)
LLM05	Improper output handling	Output executed or rendered untrusted	Output as untrusted input; sandboxing (7)
LLM06	Excessive agency	Too much permission, functionality or autonomy	Authority stack; PEP on the action; budgets (5, 8)

Appendix

Table 141

Item	Question	Evidence required
System and task classes	What does the system do, for whom, with what autonomy level per task class (Fig. 8.1 )?	Task-class register; autonomy level approved by the Council
Authority (I2)	What stack does each agent hold; who delegated it; is each layer a subset of the delegator’s?	Stack register; attenuation check output (Code 8.1) for every handoff type
Separation (I1)	Where does a model output become a decision, and a decision an action? Who adopts each?	Architecture record naming the adopting component and the enforcement point
Enforcement (I3)	Does every retrieval, tool call and action pass a PEP? What does it check (stack, provenance, value, egress, budget)?	PEP coverage measure; policy objects; three-valued decision log
Handoff (I4)	Which agents hand off to which; is each handoff recorded with requested, granted, trimmed, instruction source, token, budget?	Lineage entries (Code 8.2 form) for each handoff type
Provenance (I5)	Does every instruction carry its source class through summarisation? Is untrusted content quarantined?	Provenance header design; dual-LLM evidence; memory policy

Appendix

Table 142

Criterion (weight)	Threshold	Distinction
Use of the book’s vocabulary (20 %)	States, loop layers and authority named correctly	Terms used to find what the question hides (e.g. the generated state; the handoff)
Mechanism and evidence (30 %)	The control or provision identified	Its mechanism stated; computed or cited evidence; limits acknowledged
Three lenses (20 %)	Two lenses applied	All three, with the trade each makes explicit
Worked number or record (20 %)	A figure or record produced	Parameters declared; sensitivity shown; the record answers the eight questions
Judgement (10 %)	A defensible conclusion	The conclusion states what remains unsettled and who decides it

Appendix

Table 143

Case	Citation	Holding relevant to data and AI	Ch.
Kharak Singh v. State of U.P.	AIR 1963 SC 1295	Surveillance regulations without statutory basis struck; privacy first discussed	1
Gobind v. State of M.P.	(1975) 2 SCC 148	Privacy as implicit in Art. 21, subject to compelling state interest	1
R. Rajagopal v. State of T.N.	(1994) 6 SCC 632	Right to privacy includes control over publication of personal matters	1, 3
PUCL v. Union of India (telephone tapping)	(1997) 1 SCC 301	Procedural safeguards for interception under s. 5(2) Telegraph Act	5
Union of India v. ADR	(2002) 5 SCC 294	Voter’s right to information about candidates under Art. 19(1)(a)	9
PUCL v. Union of India (affidavits)	(2003) 4 SCC 399	s. 33B RPA struck; candidate disclosure affirmed	9

Appendix

Table 144

AI Governance

Artificial intelligence governance studies how laws, institutions, and technical controls shape AI development, deployment, accountability, and social effects.

See all 384 papers

Sep 17, 2026

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

The EU AI Act (Regulation 2024/1689) imposes technical obligations on high-risk AI providers, yet Articles 8-15 were drafted for predictive AI and leave seven technical gaps when applied to generative systems, spanning non-deterministic data governance, training-data provenance, continuous conformity, human oversight, open-ended robustness, emergent risk, and generative fairness. We deliver Governance-as-Code (GaC), a framework of 43 machine-checkable acceptance criteria across six compliance modules that run in a CI/CD pipeline and emit Article-indexed audit evidence, and we show the actual Rego policy code rather than merely describing it. Our central commitment is that the Act's open-textured standards ("appropriate levels," "possible biases") become declared, auditable numbers: robustness thresholds are derived from the provider's documented baseline and a state-of-the-art floor, and framing bias is collapsed into eight measurable proxies tested by counterfactual demographic probing. We also correct who owes what, since under Article 25 and Chapter V a downstream deployer relies on the upstream provider's Article 53 training-data summary and documents only the layers it controls, so GaC verifies that summary rather than demanding per-sample documentation the deployer never had. We validate on two enterprise deployments, a high-risk advisory chatbot and a limited-risk content generator, benchmarking against a manual expert audit rather than documentation artifacts that were never designed to enforce compliance. GaC reproduces all of the manual audit's findings, including three penalty-triggering violations, while cutting audit labor by roughly 75%.

Rudrendu Kumar Paul, Sourav Nandy

Boston University, Boston, MA, USA

Algorithmic Auditing AI Governance AI Regulatory Compliance

Ask PDF

Jul 8, 2026

Towards Agentic AI Governance: A Preliminary Assessment

Artificial intelligence is rapidly evolving from generative systems to agentic AI capable of autonomously planning and executing tasks. Widely characterized as the Year of Agentic AI, 2025 marked accelerated development and deployment, introducing new ethical and governance challenges. This paper presents a systematic review of the emerging literature on agentic AI governance. Our analysis identifies features that distinguish agentic AI from traditional systems and why it warrants targeted governance attention. We synthesize prevailing governance priorities, proposed mechanisms, and stakeholder roles shaping this evolving domain. As an initial scholarly effort, this review lays the preliminary groundwork for developing a structured roadmap to guide responsible and adaptive agentic AI governance.

Mubarak Raji, Masooda Bashir

School of Information Sciences, University of Illinois at Urbana-Champaign, IL, 61820 USA

AI Agent Governance Responsible AI Agentic AI

Ask PDF

Oct 12, 2026

Governing Copyright Responsibly in the Era of Generative AI

Large language models are trained on collections that may include scholarly works, while authors generally lack work-level information about whether and how their works were used. This paper asks how copyright governance frames and operationalises the protection of such authors, and what a responsible alternative would require. Forty legislative, judicial and soft-law instruments issued between 2019 and 2026 were coded deductively against a framework derived from Responsible Research and Innovation theory, yielding 1,337 category assignments across 835 segments. The European Union and the United States are the primary cases; the United Kingdom, China and international bodies serve as comparators. Normative orientation and the distribution of responsibility dominate the corpus, while reflexivity is the least represented category and reaches its minimum in the US sub-corpus. Both primary jurisdictions frame protection procedurally rather than as an entitlement, and no instrument in the corpus creates a general author-facing attribution duty for the use of works in AI training. From the coded gaps, the paper derives a six-instrument governance design and a capacity-based allocation of responsibility among developers, publishers, collecting societies, funders, institutions, regulators, and individual authors.

D. Kochetkov

Centre for Science and Technology Studies (CWTS), Leiden University, Leiden, the Netherlands · RUDN University, Moscow, Russia

AI Governance Responsible AI

Ask PDF

Abstract

AI Governance

Explore similar work

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

Towards Agentic AI Governance: A Preliminary Assessment

Governing Copyright Responsibly in the Era of Generative AI