International Journal of Engineering and Management Research

1.Introduction

In the past, the process of mergers and acquisitions relied on teams of professionals who manually read and reviewed contracts, financial statements, and regulatory documents before finalizing any transaction. However, as the use of artificial intelligence grows, this process is also changing very rapidly. Generative AI is no longer considered merely an experimental technology in business transactions, rather, it is now used at different stages of the deal process. Due diligence is one of these stages, and it is an area where the use of artificial intelligence is growing very rapidly (Grata, 2026).

Law firms and advisory firms have also started using artificial intelligence to review contracts, enabling them to identify important clauses within large volumes of documents. Nowadays, AI is also used to prepare due diligence checklists, generate red-flag reports and summarize large documents (Mayer Brown, 2025). Advisory firms have launched AI-based 'due diligence' services to assess a target company's financial position, tax compliance, and operational performance as a key part of the overall due diligence process (KPMG Switzerland, 2025). Furthermore, accounting professionals have emphasized that generative AI is transforming the approach to financial due diligence; it helps identify unusual patterns in financial statements and enables automated variance analysis (Open Ledger, 2025).

The benefits of using AI in M&A transactions have also gained widespread recognition. According to a 2025 McKinsey survey of dealmakers, organizations using generative AI reported an average cost reduction of approximately 20 percent. The survey also found that after adopting AI tools, about 40 percent of people took 30 to 50 percent less time to close a deal. However, the survey also revealed that only 30 percent of people were using generative AI at a medium or high level. This shows that even as AI technology is becoming more advanced, its adoption in the M&A industry is still evolving (McKinsey & Company, 2026).

1.1 The Problem: A Widening Gap Between Adoption and Accountability

An AI-generated report may appear impressive and reliable, but it could contain incorrect information, omit critical details (such as material risks), or draw flawed conclusions.

Many studies indicate that AI governance is often treated as a secondary (less important) issue rather than an integral part of the design and deployment of AI systems. Consequently, a gap often persists between the technical performance of AI systems and the legal regulations governing accountability for their actions (Never Compromise to Vulnerabilities, 2025).

These concerns are not merely hypothetical; they have already materialized. Courts have imposed fines on lawyers who submitted AI-generated legal documents containing fabricated case citations. Citing these instances, legal experts have warned M&A professionals against accepting AI-generated due diligence reports or findings without thorough verification. If an AI tool cannot clearly identify the specific documents or clauses underpinning its conclusions, those results cannot be relied upon for critical commercial decisions, especially given that errors in due diligence can lead to serious legal and financial consequences (Harvey.ai, 2026).

Legal experts also point out that liability for AI-related issues could fall on various parties—such as the AI ​​developer, the organization using the AI ​​system, or the end-user. This depends on the extent of control each party exercised and whether the harm could have been foreseen. However, there is currently no clear legal rule that automatically determines liability in every situation (Rework, 2026). Some experts suggest expanding the scope of product liability regulations to hold the entities controlling and operating AI systems accountable for defects that emerge after the system has been deployed. This perspective has already been recognized in the European Union through the 'New Product Liability Directive' (2024/2853); the directive includes software and AI systems within the definition of a 'product' for the purpose of 'strict liability'. This allows for the determination of liability even when a party retains control over the AI ​​system's learning and operational processes after its deployment (Taylor Wessing, 2025). However, this legal perspective has not yet been tested in the context of M&A due diligence, as the AI ​​system here does not produce a physical product but rather generates analytical insights that influence critical commercial and legal decisions.

In such situations, a crucial legal question arises as to who should be held liable for the losses incurred—under the Companies Act 2013, the SEBI Takeover Code, and general legal principles regarding professional negligence and contractual indemnity.

This creates a significant legal gap between Indian M&A (Merger and Acquisition) laws and AI governance. It has significant practical implications for all parties involved in M&A transactions. If a critical risk goes undetected during AI-assisted due diligence, the target company may face disputes. Meanwhile, the acquiring company could make investment decisions based on incomplete or erroneous reports generated by AI. Claims of professional negligence can be brought against lawyers, financial advisors, valuers, and other professionals involved in the due diligence process, even though the legal standards applicable to tasks performed with the aid of AI are not yet fully clear. Furthermore, SEBI has not yet clarified how AI-assisted due diligence will be viewed under existing legal regulations—such as those concerning disclosures, independent valuation, and professional responsibility. Therefore, given the steadily increasing use of AI in M&A transactions in India, an in-depth legal study of this subject is essential.

2. Aim and Scope of the Study

This research paper examines the issues of liability and accountability arising from the failure of AI-assisted due diligence tools to identify critical risks during regulated M&A (merger and acquisition) transactions in India. The primary objective of this study is to determine who should be held legally responsible when an AI-based due diligence tool fails to detect a significant risk, resulting in legal or financial loss for a party involved in the transaction. The objective is also to determine whether the existing Indian legal framework provides a clear and predictable answer to this issue, or if it creates uncertainty because liability could be distributed across different areas of law—such as contract law, tort law, and securities regulation.

This study is relevant for various groups involved in M&A (Merger and Acquisition) transactions. It is useful for M&A professionals who draft 'due diligence engagement letters' and negotiate contracts with AI service providers. It is also valuable for in-house legal teams and compliance officers who assess the legal risks associated with adopting AI tools within their organizations.

3.1 Duties of Directors and Officers under the Companies Act, 2013

Prior to the Companies Act, 2013, Indian company law contained no specific statutory provisions directly addressing the functions of directors. Instead, the duties of directors were based on common law principles regarding 'fiduciary duties' and the 'law of agency' (Lex Counsel, 2023). This situation changed with the enactment of the Companies Act, 2013; for the first time, this Act clearly codified the duties and responsibilities of directors within a single legal provision.

Section 166 of the Companies Act, 2013 outlines the duties and functions that every director must perform. Under Section 166(2), a director must act in good faith—without fraud or malice—to advance the company's objectives in a manner that benefits all its members. Additionally, directors are expected to consider the interests of employees, shareholders, the community, and the environment (ca2013.com, n.d.-a). Furthermore, under Section 166(3), every director is required to discharge their duties with due and reasonable care, skill, and diligence, and to exercise independent judgement when making decisions (ca2013.com, n.d.-a).

Legal liability may also arise for failure to fulfill the responsibilities prescribed under Section 166. Under Section 166(7), a director who contravenes the provisions of this section is liable to a fine ranging from one lakh rupees to five lakh rupees (ca2013.com, n.d.-a).

Two aspects of Section 166(3) are significant in the context of AI-assisted due diligence. First, the provision does not explicitly define "due and reasonable care." Indian legal experts argue that in the absence of a statutory definition, the "reasonable person" standard—derived from the law of torts—serves as the most appropriate benchmark for determining whether a director has fulfilled their obligations. This is because the duty of care under Section 166 is owed to the company as a whole, rather than to any single stakeholder (IndiaCorpLaw, 2023).

Secondly, according to the legal interpretation of Section 166, a director cannot discharge this responsibility merely by relying on expert opinions or the views of management; they must personally understand and evaluate the matter to arrive at a decision.

preclude a valuer from disclaiming this responsibility, except where the valuation relies on facts provided by the company or available in the public domain (Corporate Law Reporter, n.d.). Thus, a valuer cannot evade liability simply because an AI tool has presented an erroneous analysis, as the duty is personal. Whether AI-generated analysis used in a valuation counts as the valuer's own judgement—for which liability cannot be excluded—or as third-party information is a question that Indian law has not yet addressed.

However, a crucial legal question remains unanswered. If a registered valuer utilizes AI-generated analysis while preparing a valuation report, it is currently unclear whether that AI-generated output would be considered part of the valuer's own professional opinion—for which liability cannot be evaded—or treated as third-party information, akin to factual data provided by the company. Indian law has not yet addressed this issue, resulting in a significant gap regarding the legal liability of registered valuers who employ AI-based tools during the valuation process.

3.2 Warranty and Indemnity Provisions in Indian Share Purchase Agreements

Under Indian law, there is no general legal obligation on the seller to disclose every shortcoming or risk to the buyer during an M&A transaction. Consequently, Indian M&A practice relies heavily on contractual representations, warranties, and indemnity clauses to allocate risk. These provisions address the risk of issues that remain undetected during the due diligence process—whether conducted manually or with the aid of AI.

In the case of Shri Krishnan v. Kurukshetra University, the Supreme Court of India held that mere silence cannot be construed as fraud. This principle aligns with the doctrine of caveat emptor (let the buyer beware), which expects the buyer to conduct due diligence before finalizing a transaction (Mondaq, 2020). Since due diligence has its limitations, parties often incorporate 'indemnity clauses' into Share Purchase Agreements (SPAs) to ensure the seller remains liable for specific risks.

Under Section 124 of the Indian Contract Act, 1872, a contract of indemnity is an agreement wherein one party promises to compensate the other for any loss caused by the conduct of the promisor or any other person (Lexology, 2019).

or relied upon an AI-assisted due diligence tool, and that tool failed to identify a material risk. There is no clear answer to this question within the current Indian legal framework.

In Indian M&A (Merger and Acquisition) practice, the use of 'sandbagging' and 'anti-sandbagging' clauses in Share Purchase Agreements (SPAs) has become common. A 'sandbagging' clause generally permits the buyer to claim indemnification even if they were aware of the incorrect information or misrepresentation prior to the completion of the deal. Conversely, an 'anti-sandbagging' clause precludes the buyer from making such a claim if they had actual knowledge of the inaccuracy before the deal closed (Lexology, 2022).

In this context, AI-assisted due diligence raises a novel legal question. Consider a scenario where an AI-generated due diligence report clearly highlights a critical issue, yet the reviewing lawyer or professional either overlooks that information or decides not to act upon it. In such a situation, it remains unclear whether the buyer can be deemed to possess "actual knowledge" of the issue for the purposes of an "anti-sandbagging clause." There is currently no clear guidance from Indian courts or standard transaction documents on how to resolve this issue, creating significant legal uncertainty regarding the use of AI in M&A transactions.

3.3 Professional Negligence under Indian Law

There is no specific legislation in India that exclusively governs the law of negligence. Instead, the principles of negligence have primarily evolved through 'common law'. One of the most widely accepted definitions was provided by Winfield. According to Winfield, negligence occurs when a person fails to exercise the care required by law and that negligence causes harm to another, even if there was no intention to cause such harm (Legal Service India, n.d.).

Under Indian law, three essential elements generally need to be proven for a claim of negligence. First, the defendant must owe a legal duty of care to the plaintiff. Second, there must be a breach of that duty; this breach is assessed based on the standard expected of a reasonable and competent person within the same profession. Third, the plaintiff must have suffered harm as a result of that breach (Legal Service India, n.d.).

For instance, if a chartered accountant, registered valuer, or legal advisor relies on AI-generated summaries of financial statements or contracts without independent verification—and the AI ​​provides incorrect or fabricated information leading to subsequent loss—Indian negligence law would likely ask whether a competent professional in similar circumstances would have detected the error. However, there is currently no clear legal guidance regarding the extent of independent verification required for AI-generated outputs. Nor is it specified whether the level of review for AI-generated work should differ from that applied to the work of a junior employee or trainee. This lack of clarity creates a significant legal gap, an issue increasingly being recognized in international discourse surrounding AI hallucinations and professional liability (EY Switzerland, 2025; Bloomberg Law, 2026).

3.4 Disclosure and Valuation Requirements under the SEBI Takeover Code

When a lapse occurs during AI-assisted due diligence in a regulated M&A transaction involving a listed company, another critical legal framework comes into play: the SEBI (Substantial Acquisition of Shares and Takeovers) Regulations, 2011 (SAST Regulations). To ensure transparency and protect the interests of public shareholders, these regulations impose obligations on the acquiring company (acquirer) to disclose detailed information and launch an open offer.

Under Regulation 29 of Chapter II of the SAST Regulations, if an acquirer—either individually or acting in concert—crosses the 5% threshold in the shares or voting rights of a listed company, they are required to notify both the target company and the recognized stock exchanges within two working days. Similar disclosure is also required when there is a further change of 2% or more in the acquirer's shareholding or voting rights (Bhatt and Joshi Associates, 2026).

The SAST regulations also outline the circumstances under which making an open offer becomes mandatory. Under Regulation 3, an open offer is required when an acquirer obtains 25% or more of the shares or voting rights of a listed company. In contrast, Regulation 4 focuses on the acquisition of control, mandating an open offer regardless of whether the 25% threshold has been crossed.

These rules apply when the transaction is not conducted in the ordinary course of business or not on an 'arm's length basis' (i.e., a fair and independent basis) (ca2013.com, n.d.-b; UJA, 2026). Furthermore, under Section 177(4), the Audit Committee is required to verify whether a related-party transaction is being conducted on an 'arm's length basis' before making a recommendation to the Board (S Choudhary & Co., 2026). In discharging this responsibility, the Audit Committee will typically rely on valuation reports and information related to 'due diligence'; this may include reports generated with the assistance of AI tools.

Despite these changes, a significant limitation remains within SEBI's takeover code. Even after the 2025 amendments, SEBI's role in reviewing the 'draft letter of offer' remains limited. The regulator verifies whether the acquiring company has disclosed the information required under the SAST regulations. However, SEBI does not vouch for the accuracy or veracity of the information provided in the 'letter of offer,' nor does it assume responsibility for its contents (SEBI, 2017).

4. Sufficiency of the Existing Framework: The Indian Graded-Liability Proposal Compared with the Recent European Union Developments

This section examines whether the existing legal frameworks are sufficient to provide a clear and predictable answer to the central question raised in this research. In other words, it considers whether the current Indian legal framework can effectively establish accountability when an AI-supported due diligence tool fails to identify a critical risk during an M&A transaction, or whether legal uncertainties persist.

Section 1 analyzes three practical scenarios where AI-assisted due diligence might fail and examines how the existing Indian legal framework would apply in each case. Section 2 discusses the tiered liability model proposed in the India AI Governance Guidelines, 2025, and assesses whether this approach can address the legal gaps identified in the previous section. Section 3 compares the Indian approach with recent developments in the European

The second scenario concerns directors of a target company who approve a transaction based on AI-generated 'due diligence' reports prepared by management or external advisors, or who fail to recognize the need for proper valuation in a 'related-party transaction.' Section 166(3) of the Companies Act, 2013, clearly expects directors to exercise independent judgement; this obligation cannot be fulfilled by merely accepting the findings of reports produced by experts or AI without proper scrutiny (Barristery, 2026). Rulings in cases involving the MCX stock exchange and Zee Entertainment also demonstrate that independent directors are expected to exercise their own discretion and cannot blindly rely on management, professional advisors, or automated systems (Law Zone, 2026). However, the primary issue in this context relates to the available remedy rather than the legal liability itself. Although Section 166 establishes a clear legal obligation, its enforcement is primarily effected through financial penalties payable to the State. Furthermore, Indian law remains unclear on whether an external party—such as an acquirer who has suffered financial loss due to the directors' default—possesses a private right to bring a direct claim against those directors (Lex Counsel, 2023). Thus, while liability is clearly recognized, the legal remedy available to an affected third party remains uncertain.

The third scenario—arguably the most likely to arise in practice—involves an acquirer who completes an M&A transaction relying on AI-assisted due diligence, only to subsequently discover a significant liability that the AI ​​system failed to identify. As discussed in Part III, Indian courts—notably in GWL Properties Ltd. v. James Mackintosh & Co. Pvt. Ltd.—have generally held that the quality of the buyer's own due diligence does not preclude them from claiming compensation under a valid indemnity clause (IRCCL, 2021). Consequently, the buyer's contractual remedy against the seller generally remains available, even if the due diligence failure was caused by an AI tool rather than a human professional. However, the existing legal framework does not answer a different but equally important question. It is unclear whether the buyer's own professional advisors—who selected, configured, oversaw, or relied upon the AI ​​tool—can themselves be held liable to the buyer for failing to identify that critical risk. This question brings the analysis back to the same uncertainty discussed in the first case.

The level of liability also depends on the risk associated with the AI ​​application and the degree of caution or due diligence exercised by each participant (Mondak, 2026; Saikrishna & Associates, 2025). The guidelines also recommend transparency reporting, grievance redressal mechanisms, and oversight through audits or peer reviews. However, rather than establishing a separate AI regulator, they suggest that enforcement should continue through existing sectoral regulators (The AI ​​Track, 2025).

For the purposes of this research, three aspects of the tiered-liability model are particularly significant. At the same time, each of them also highlights a critical limitation.

First of all, a 'role-based approach' is well-suited for AI-assisted due diligence in M&A transactions. Distinct responsibilities can be assigned to the various parties involved—such as the AI ​​tool developer, the advisory firm utilizing the tool during the due diligence process, and the acquiring or target company relying on the AI-generated insights—based on their respective roles.

Secondly, these guidelines link liability to the level of care exercised by each participant. This approach broadly aligns with the existing standard of a "reasonably competent professional" outlined in Part III. Therefore, rather than altering the prevailing law regarding professional negligence, this graded-liability model appears to build upon it by providing additional guidance on how responsibility can be distributed among various AI actors.

Thirdly, and most importantly, these guidelines are merely policy-related recommendations and are not legally binding. Legal experts have repeatedly stated that the 'graded-liability model' (a model involving varying levels of responsibility) cannot be directly implemented unless backed by legislation or amendments to existing laws, such as the Information Technology Act, 2000 (The AI ​​Track, 2025; Anevagi, 2025). The guidelines themselves acknowledge this limitation, recommending that future legal reforms clearly define the roles and responsibilities of developers, deployers, and users under the Information Technology Act. This clearly indicates that the 'graded-liability model' has not yet become an enforceable legal standard (Anevagi, 2025).

Even before the revised Directive was finalized, legal experts had identified significant challenges in applying product liability rules to AI systems. Writing in the “Computer Law & Security Review” Buiten, de Streel, and Peitz (2023) argued that applying traditional product liability becomes difficult when AI systems continue to learn or behave autonomously after deployment. In such situations, it becomes extremely hard to determine whether a problem stems from a defect in the product or from the way the system was used after deployment (Buiten et al., 2023).

Another issue discussed in legal literature is whether AI systems should be classified as "products" or "services." This distinction is significant because products generally fall under the scope of "strict liability," whereas services are typically governed by "fault-based principles" (such as professional negligence). Legal experts have noted that courts have traditionally distinguished professionals—such as accountants, financial advisors, and other service providers—from manufacturers, as these professionals offer expert advice rather than physical products. Since AI-assisted "due diligence" also involves professional analysis and advice, it is not always clear whether it should be treated as a product or a professional service for liability purposes (Lawfare, 2024).

For the purposes of this research, the revised 'Product Liability Directive' has two significant limitations.

Firstly, the Directive primarily protects natural persons. It provides compensation for death, personal injury, damage to consumer property, and the destruction or corruption of personal data used for non-professional purposes (Regulations.ai, 2026). However, the scenario examined in this research differs; here, the loss was incurred by a company that had acquired another business based on AI-assisted 'due diligence'. This loss is purely economic and arose within a commercial business-to-business transaction. Such commercial losses do not fall under the categories of harm covered by the revised Directive.

Secondly, the Directive is premised on the concept of a defective product that fails to provide the level of safety a person is reasonably entitled to expect (Lexology, 2025). This standard applies when a defective product causes physical injury, property damage, or data security issues.

Furthermore, the 'AI Liability Directive'—originally proposed to address issues such as fault, causation, and AI-related liability across various scenarios—was withdrawn before becoming law, and no alternative legal instrument has been introduced to replace it so far (Taylor Wessing, 2025; Basil Puglisi, 2026).

Therefore, even though India and the European Union have adopted different approaches, there is currently no liability framework in any legal system specifically designed for AI-assisted due diligence in regulated M&A transactions.

Of the two approaches, the 'graded-liability model' (a tiered approach to assigning responsibility) suggested in the 'India AI Governance Guidelines' appears to be a more suitable starting point for future legal reforms in India. Unlike the European approach, it is not predicated on the concept of product safety. Instead, it can be integrated with the existing Indian legal framework—encompassing laws regarding professional negligence, director liabilities under the Companies Act, 2013, and disclosure and valuation obligations under the SEBI Takeover Code (as outlined in Part III). This implies that the existing legal framework need not be overhauled; rather, it can be strengthened by introducing clear rules that determine how liability is apportioned when AI systems are utilized during the 'due diligence' process.

However, making the 'graded-liability model' (a model based on levels of responsibility) effective will require further legal or regulatory measures. As acknowledged in the 'India AI Governance Guidelines' themselves, there is a need to clearly determine the extent of "reasonable" reliance that can be placed on professional work generated by AI, as well as the level of independent human verification expected before relying on such work. Currently, neither Indian case law nor the European Union's 'Product Liability Directive' provides clear legal standards to address these questions. This research highlights this gap as a key issue.

5.Discussion, Recommendations, and A Future Framework

This section consolidates the insights from Parts II through IV into concrete recommendations. These recommendations are addressed to three distinct groups:

The issue is that it was originally drafted for trading and portfolio management activities and has not yet been explicitly linked to 'due diligence certification' in any circular or guidance note.

5.2 Recommendations

(A) Contractual Risk Allocation

First, the 'due diligence' engagement letter between the acquiring company (or target company) and their professional advisors should include a clause explicitly detailing the use of AI. This should specify which AI tools were employed, the types of documents or analyses for which they were used, and the steps taken to verify the accuracy of the tool's output before relying on it. This is not a novel concept; existing Share Purchase Agreement (SPA) practices already mandate similar levels of detailed disclosure regarding information completeness. Adopting this approach for the due diligence process would create a documentary record enabling a retrospective assessment of whether a qualified professional exercised proper oversight. Industry discourse on generative AI due diligence tools has identified the absence of such audit trails as a significant practical challenge (Ur AI, 2026); the proposed measure offers a straightforward and cost-effective solution to address this gap.

Secondly, when drafting an SPA (Share Purchase Agreement), the 'due diligence' conducted with the aid of AI should be explicitly factored into the 'sandbagging' and 'anti-sandbagging' provisions commonly used in Indian M&A practice. If an AI-assisted due diligence report reveals an issue that was not conveyed to—or was overlooked by—the human due diligence team, current Indian drafting practices do not clarify whether the buyer should be deemed to have "knowledge" of that fact for the purposes of an anti-sandbagging clause (Lexology, 2022). "Buyer's knowledge" in the SPA should be defined based on information actually conveyed to and reviewed by a human member of the deal team, rather than the entire output of the AI ​​tool; this ensures that an issue flagged by the AI ​​but not escalated does not inadvertently invalidate a legitimate 'indemnity claim'.

Thirdly, acquiring companies and their advisors should ensure, as a condition for commencing work, that the advisor's 'professional indemnity' or 'errors-and-omissions' insurance policy explicitly extends to work produced with the aid of AI.

Fifth and most importantly, MeitY and SEBI should collaboratively formulate sector-specific guidance to implement the concept of 'graded liability' within the 'India AI Governance Guidelines,' rather than leaving this concept to evolve solely through future litigation. The guidelines themselves suggest that any legal enforcement under the 'Information Technology Act, 2000' must clearly delineate the liabilities of developers, deployers, and users (Anevagi, 2025). This study proposes adopting a 'materiality-based test' for such clarifications: liability should arise when there is a lapse in AI-assisted 'due diligence,' and an erroneous or 'hallucinated' output proves material to a transaction's outcome without having been independently verified prior to disclosure; conversely, liability should not arise when an AI error occurs in the context of an outcome that is otherwise correct and independently substantiated. This test is directly grounded in the 'graded liability' concept already proposed in the guidelines, translating 'risk' and the 'level of due diligence performed' into a practical standard that courts, SEBI’s SAT bench, or the NCLT can apply consistently.

(C) Professional Standards

Sixth, the Institute of Chartered Accountants of India (ICAI), the Institute of Company Secretaries of India (ICSI), and Registered Valuer Organizations recognized under the Companies (Registered Valuers and Valuation) Rules, 2017, should issue specific practice standards outlining minimum requirements for independent verification and sampling in AI-driven financial due diligence and valuation tasks. These standards should mirror the disciplinary frameworks already in place for auditor conduct by the ICAI (IIM Ahmedabad, n.d.). This would not be a novel initiative: the ICAI’s revised Code of Ethics, effective April 1, 2026, already incorporates guidance on "contemporary challenges, including AI" (ICAI, 2025), and the International Valuation Standards Council has released a discussion paper on AI in valuation, applicable from January 31, 2025. This paper emphasizes that regardless of the technology employed, professional judgement and a spirit of skepticism remain essential (IVSC, 2025). The suggestion here is simply that Indian professional bodies should not limit this general awareness to the level of ethical principles but should translate it into a specific standard focused on due diligence.

Such a trend could occur even in the absence of mandatory regulatory rules, much like how warranty and indemnity insurance became a standard part of Indian M&A practice before being mandated by any regulator. Second, once SEBI transforms its consultation paper on the responsible use of AI/ML in the Indian securities market into mandatory guidelines, a follow-up study could examine whether these guidelines apply to due diligence certifications under Merchant Banker and SAST regulations (either explicitly or by clear implication), or if the gap identified in Section 1 persists even after the guidelines are finalized. Third, a comparative study could investigate how other common law jurisdictions—specifically Singapore and the United Kingdom, which, like India, have not yet adopted EU-style horizontal AI legislation—address professional liability regarding AI-assisted financial and legal due diligence. This would reveal whether the graded-liability model proposed in this paper is a solution unique to India or if it could be widely adopted in jurisdictions that prioritize regulation through existing sector-specific laws rather than enacting separate AI legislation.

6. Conclusion

This paper aims to determine who should be held legally liable when an AI-assisted 'due diligence' tool fails to detect a significant risk in a regulated M&A (merger and acquisition) deal in India, and whether the existing legal framework provides a clear and predictable answer to this question. Based on the analysis in Parts III and IV, the answer is affirmative, albeit with certain conditions. Indian law is not silent on this matter: directors, registered valuers, professional advisors, and transacting parties are subject to obligations and contractual rules that can, in principle, establish liability for due diligence failures, regardless of whether the failure stemmed from an AI tool. What Indian law currently lacks are sector-specific, defined rules regarding the extent of independent verification of AI-generated professional work required to constitute 'reasonable care.' This question remained unresolved even after comparing the non-binding 'graded-liability model' of the 'India AI Governance Guidelines' (discussed in Part IV) with the European Union's binding—yet structurally unenforceable—'product liability system.' SEBI’s Regulation 16C also addresses this only partially; while it generally places full responsibility for AI outputs on regulated intermediaries, it has not yet been specifically linked

[6] Bloomberg Law. (2026, March). AI's due diligence applications need rigorous human oversight. https://news.bloomberglaw.com/legal-exchange-insights-and-commentary/ais-due-diligence-applications-need-rigorous-human-oversight

[7] Buiten, M. C., De Streel, A., & Peitz, M. (2023). The law and economics of AI liability. Computer Law & Security Review, 48, 105794. https://doi.org/10.1016/j.clsr.2023.105794

[8] BW Legal World. (2025). A guide to the future: India's AI governance guidelines. https://www.bwlegalworld.com/article/a-guide-to-the-future-india-s-ai-governance-guidelines-578968

[9] ca2013.com. (n.d.-a). Section 166: Duties of directors. Companies Act Integrated Ready Reckoner. https://ca2013.com/166-duties-of-directors/

[10] ca2013.com. (n.d.-b). Section 188: Related party transactions. Companies Act Integrated Ready Reckoner. https://ca2013.com/188-related-party-transactions/

[11] Chambers and Partners. (2026). SEBI's framework on Artificial Intelligence (AI) tools: A push towards accountable AI. https://chambers.com/articles/sebi-s-framework-on-artificial-intelligence-ai-tools-a-push-towards-accountable-ai

[12] Corporate Law Reporter. (n.d.). Section 247 of companies act, 2013 — Valuation by registered valuers. https://corporatelawreporter.com/companies_act/section-247-of-companies-act-2013-valuation-by-registered-valuers/

[13] EY Switzerland. (2025, August). How AI will impact due diligence in M&A transactions. https://www.ey.com/en_ch/insights/strategy-transactions/how-ai-will-impact-due-diligence-in-m-and-a-transactions

[14] Finseclaw. (2025, July 19). Lens on AI in the securities market. https://www.finseclaw.com/article/lens-on-ai-in-securities-market

[15] GC AI. (2026). AI hallucination legal cases: A sanctions tracker. https://gc.ai/blog/ai-hallucination-legal-cases

[26] International Research Council on Contemporary Law & Legislation [IRCCL]. (2021, October 24). To due diligence or not to: The effect of due diligence on indemnity clauses. https://www.irccl.in/post/to-due-diligence-or-not-to-the-effect-of-due-diligence-on-indemnity-clauses

[27] International Valuation Standards Council [IVSC]. (2025). Navigating the rise of AI in valuation: Opportunities, risks, and standards. https://ivsc.org/navigating-the-rise-of-ai-in-valuation-opportunities-risks-and-standards/

[28] Internet Lawyer Blog. (2025, September). Who's liable when AI gets it wrong? Understanding legal responsibility in the age of artificial intelligence. https://www.internetlawyer-blog.com/whos-liable-when-ai-gets-it-wrong-understanding-legal-responsibility-in-the-age-of-artificial-intelligence/

[29] iPleaders. (2021, August 28). An analysis on professional negligence. https://blog.ipleaders.in/an-analysis-on-professional-negligence/

[30] S. & K. Advocates [ksandk.com]. (2024, January 13). A comprehensive review of representations, warranties, indemnities and insurance in India's M&A transactions. https://ksandk.com/mergers-acquisition/indemnities-and-insurance-in-indias-ma-transactions/

[31] KPMG Switzerland. (2025, November). AI in deals. https://kpmg.com/ch/en/insights/deals/ai-in-deals.html

[32] Law Zone. (2026, July). Duties of directors under Section 166 of the Companies Act, 2013 — Complete guide. https://www.lawzone.in/2026/07/duties-of-directors-under-section-166.html

[33] Lawfare. (2024, September 25). Products liability for artificial intelligence. https://www.lawfaremedia.org/article/products-liability-for-artificial-intelligence

[34] Legal Fund. (n.d.). Professional negligence disputes. https://legalfund.in/services/professional-negligence-disputes/

[35] Legal Service India. (n.d.). Medical negligence: A specific tort. https://www.legalservicesindia.com/article/1898/Medical-Negligence:-A-Specific-Tort.html

[45] Mondaq. (2024, November 12). A critical study of medical negligence in India, regulations and case laws. https://www.mondaq.com/india/professional-negligence/1543108/a-critical-study-of-medical-negligence-in-india-regulations-and-case-laws

[46] Mondaq. (2026, February 18). India's AI Governance Guidelines. https://www.mondaq.com/india/new-technology/1746072/indias-ai-governance-guidelines

[47] Never compromise to vulnerabilities: A comprehensive survey on AI governance. (2025). arXiv. https://arxiv.org/abs/2508.08789

[48] Open Ledger. (2025, May). AI in M&A accounting: Transforming financial due diligence in 2025. https://www.openledger.com/future-of-ai-in-accounting/ai-in-m-a-accounting-transforming-financial-due-diligence-in-2025

[49] Patrons Legal. (2024, December 23). A guide to SEBI's Substantial Acquisition of Shares and Takeovers Regulations, 2011. https://patronslegal.com/blogs/a-guide-to-sebis-substantial-acquisition-of-shares-and-takeovers-regulations-2011/

[50] PricewaterhouseCoopers [PwC]. (2011, October). M&A tax & regulatory services: Takeover code. https://www.pwc.in/assets/pdfs/services/m-a-takeover-book-final-lowres.pdf

[51] Regulations.ai. (2025). India AI regulation overview. https://regulations.ai/regulations/india-summary

[52] Regulations.ai. (2026, June 13). Directive (EU) 2024/2853 on liability for defective products (revising product liability to cover software and AI). https://regulations.ai/regulations/RAI-EU-NA-E2LDPXX-2024

[53] Rework. (2026, February). What is AI liability? Who's responsible when AI systems fail. https://resources.rework.com/libraries/ai-terms/ai-liability

[54] S Choudhary & Co. (2026, March 10). Related party transactions under Section 188 of the Companies Act, 2013. https://sushilchoudhary.com/related-party-transactions-under-section-188-of-the-companies-act-2013/

[64] Anevagi. (2025, November 5). MeitY issues India AI governance guidelines 2025. https://www.anevagi.com/article/meitY-issues-india-AI-governance-guidelines-2025.php

[65] AI Vortex. (2026, April 11). AI malpractice insurance for law firms: What exists in 2026. https://www.aivortex.io/legal/ai-governance/ai-insurance-liability-law-firms/

[66] White & Case LLP. (2026, April 24). AI watch: Global regulatory tracker — India. https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-india