EMERGING TECHNOLOGY RISK ASSESSMENT: A DETAILED STUDY OF INDIAN LAWS, INTERNATIONAL REGULATIONS AND JUDICIAL PRECEDENTS

1. INTRODUCTION

The rapid advancement of technology has transformed modern society, business organisations, government institutions and the global economy. Emerging technologies such as Artificial Intelligence (AI), Machine Learning (ML), Blockchain, Internet of Things (IoT), Cloud Computing, Big Data Analytics, Robotics, Quantum Computing, Autonomous Systems and Biometric Identification have created new opportunities for innovation and economic development.

However, the increasing dependence on these technologies has also introduced significant risks relating to cybersecurity, data privacy, financial stability, public safety, human rights, intellectual property, discrimination and national security.

Emerging Technology Risk Assessment refers to the systematic process of identifying, analysing, evaluating, monitoring and controlling risks associated with the development, deployment and use of new and rapidly evolving technologies.

It involves examining the possible negative consequences of technological innovation and developing suitable legal, technical, organisational and regulatory safeguards.

For example, the use of artificial intelligence in recruitment may create algorithmic discrimination, while facial recognition technology may result in privacy violations. Similarly, autonomous vehicles may create physical safety risks, and cloud computing may expose organisations to data breaches and service disruptions.

Therefore, emerging technology risk assessment has become an essential part of modern corporate governance, cybersecurity management, regulatory compliance and public policy.

In India, various laws, including the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Consumer Protection Act, 2019 and applicable sectoral regulations, provide legal safeguards against technological risks.

At the international level, the European Union Artificial Intelligence Act, General Data Protection Regulation (GDPR), Digital Operational Resilience Act (DORA), NIST Artificial Intelligence Risk Management Framework and international cybersecurity standards provide important guidance for managing emerging technological risks.

The purpose of this study is to examine the concept, nature, legal framework, judicial interpretation and future development of emerging technology risk assessment.

2. MEANING AND DEFINITION OF EMERGING TECHNOLOGY RISK ASSESSMENT

Emerging Technology Risk Assessment is a structured process through which an organisation identifies potential risks associated with a new technology, evaluates their likelihood and possible consequences, and adopts appropriate measures to prevent or minimise harm.

It is a preventive approach designed to ensure that technological innovation does not compromise individual rights, organisational security, public interest or national interests.

In simple terms, it means identifying what could go wrong when a new technology is introduced and determining how such risks can be controlled.

2.1 Objectives of Emerging Technology Risk Assessment

The major objectives are:

1. To identify potential risks before introducing new technologies.
2. To protect personal information and confidential data.
3. To prevent cyberattacks and unauthorised access.
4. To ensure the safety and reliability of technological systems.
5. To prevent discrimination and unfair automated decisions.
6. To ensure compliance with applicable laws and regulations.
7. To protect consumers and other stakeholders.
8. To minimise financial, operational and reputational losses.
9. To promote responsible technological innovation.
10. To protect national security and critical infrastructure.

2.2 Importance of Emerging Technology Risk Assessment

Emerging technology risk assessment is important because technological development frequently takes place faster than the development of legal and regulatory frameworks.

A technology that provides economic and social benefits may simultaneously create new vulnerabilities.

For example, artificial intelligence may improve medical diagnosis, but incorrect AI-generated recommendations may affect patient safety.

Similarly, facial recognition may improve security but may also result in unlawful surveillance or inaccurate identification.

Therefore, organisations must evaluate both the advantages and potential harms of new technologies before and after deployment.

3. MAJOR TYPES OF EMERGING TECHNOLOGIES AND ASSOCIATED RISKS

3.1 Artificial Intelligence and Machine Learning

Artificial Intelligence refers to computer systems capable of performing tasks that normally require human intelligence.

Machine Learning allows systems to identify patterns, analyse data and improve their performance through experience.

Applications include:

• Automated decision-making.
• Facial recognition.
• Medical diagnosis.
• Credit scoring.
• Predictive policing.
• Recruitment and employee evaluation.
• Chatbots and generative AI.

Major risks:

1. Algorithmic bias and discrimination.
2. Incorrect or misleading outputs.
3. Lack of transparency.
4. Privacy violations.
5. Manipulation through AI-generated content.
6. Excessive dependence on automated decisions.
7. Intellectual property infringement.
8. Cybersecurity vulnerabilities.

For example, an AI recruitment system trained on biased historical employment data may unfairly reject qualified candidates belonging to particular social groups.

Therefore, AI systems require appropriate testing, transparency, human oversight and continuous monitoring.

3.2 Internet of Things (IoT)

The Internet of Things refers to interconnected physical devices that collect and exchange data through the internet.

Examples include:

• Smart homes.
• Smart vehicles.
• Wearable health devices.
• Industrial sensors.
• Smart electricity meters.
• Connected surveillance systems.

Major risks:

1. Unauthorised access to connected devices.
2. Collection of excessive personal information.
3. Weak authentication mechanisms.
4. Device manipulation.
5. Network vulnerabilities.
6. Physical safety threats.

For example, an attacker gaining access to an internet-connected medical device may interfere with its operation and potentially endanger a patient's life.

3.3 Blockchain Technology

Blockchain is a distributed digital ledger technology that records transactions across a network.

It is used in cryptocurrencies, smart contracts, supply chain management, digital identity and financial services.

Major risks:

1. Smart contract vulnerabilities.
2. Cryptocurrency fraud.
3. Private key theft.
4. Irreversible fraudulent transactions.
5. Regulatory uncertainty.
6. Money laundering.
7. Privacy concerns.
8. Operational and governance failures.

Blockchain technology requires careful risk assessment because errors in smart contracts may result in substantial financial losses.

3.4 Cloud Computing

Cloud computing enables organisations to store, process and access information through remote servers and internet-based infrastructure.

Major risks include:

• Data breaches.
• Unauthorised access.
• Cloud service outages.
• Vendor dependency.
• Misconfigured storage systems.
• Data localisation and cross-border transfer issues.
• Loss of control over sensitive information.

Organisations must evaluate the security arrangements of cloud service providers and establish appropriate contractual and technical safeguards.

3.5 Big Data Analytics

Big Data Analytics involves examining large volumes of information to identify patterns, trends and relationships.

It is widely used in banking, healthcare, marketing, insurance and government administration.

Major risks include:

• Excessive data collection.
• Re-identification of supposedly anonymised information.
• Privacy violations.
• Inaccurate predictions.
• Discriminatory profiling.
• Unauthorised sharing of information.

3.6 Robotics and Autonomous Systems

Robotics involves machines designed to perform tasks automatically or with limited human intervention.

Applications include industrial manufacturing, healthcare, logistics and autonomous transportation.

Major risks include:

• Physical injuries.
• Mechanical failure.
• Software malfunction.
• Unpredictable autonomous behaviour.
• Product liability.
• Workplace safety concerns.

3.7 Quantum Computing

Quantum computing uses principles of quantum mechanics to perform certain computational tasks.

Although it offers significant technological opportunities, it may create risks for existing cryptographic systems.

Potential risks include:

• Weakening of certain traditional public-key cryptographic systems.
• Threats to confidential communications.
• Risks to long-term data security.
• Challenges in digital authentication.
• Increased national security concerns.

Organisations must begin evaluating post-quantum cryptographic solutions to protect sensitive information.

3.8 Generative Artificial Intelligence and Deepfakes

Generative AI can create text, images, videos and audio using advanced machine-learning models.

Deepfakes involve artificially generated or manipulated media that may imitate real people.

Major risks include:

• Identity theft.
• Financial fraud.
• False information.
• Defamation.
• Non-consensual synthetic imagery.
• Election-related manipulation.
• Copyright infringement.

Risk assessment must include mechanisms for identifying synthetic content, protecting individuals and preventing misuse.

4. FRAMEWORK AND PROCESS OF EMERGING TECHNOLOGY RISK ASSESSMENT

A proper risk assessment must follow a systematic procedure.

4.1 Identification of Risks

The first step is identifying all possible risks associated with the technology.

This includes examining:

• Technical vulnerabilities.
• Legal obligations.
• Privacy concerns.
• Cybersecurity threats.
• Financial exposure.
• Ethical concerns.
• Human rights implications.
• Environmental and physical safety risks.

4.2 Risk Analysis

After identifying the risks, the organisation must analyse their likelihood and potential consequences.

For example, an organisation introducing facial recognition technology must examine the possibility of inaccurate identification, unauthorised surveillance and biometric data breaches.

4.3 Risk Evaluation

The identified risks must be classified according to their seriousness.

A risk may be classified as:

1. Low risk.
2. Moderate risk.
3. High risk.
4. Critical risk.

The classification depends on the probability of occurrence and the potential severity of harm.

4.4 Risk Mitigation

Risk mitigation means adopting measures to reduce the probability or impact of identified risks.

Examples include:

• Data encryption.
• Multi-factor authentication.
• Security audits.
• Access restrictions.
• Human supervision.
• Algorithmic testing.
• Backup systems.
• Incident-response procedures.

4.5 Monitoring and Review

Technology-related risks change over time.

Therefore, organisations must regularly monitor their systems, update security arrangements and conduct periodic risk assessments.

4.6 Documentation and Accountability

Organisations should maintain records of:

• Identified risks.
• Risk evaluation reports.
• Security audits.
• Compliance assessments.
• Mitigation measures.
• Incident reports.
• Management decisions.

Such documentation helps demonstrate accountability and supports regulatory inspections and legal proceedings.

5. IMPORTANT RISK ASSESSMENT MODELS AND INTERNATIONAL STANDARDS

5.1 NIST Artificial Intelligence Risk Management Framework

The National Institute of Standards and Technology (NIST) introduced its Artificial Intelligence Risk Management Framework in 2023.

It provides guidance for managing risks associated with AI systems.

The framework contains four principal functions:

1. Govern: Establish organisational policies, accountability and risk-management structures.

2. Map: Identify the context in which AI systems operate and understand their potential impacts.

3. Measure: Assess and evaluate AI-related risks through testing, monitoring and analysis.

4. Manage: Prioritise risks and implement suitable mitigation measures.

The framework is voluntary guidance rather than a generally applicable statute.

5.2 ISO/IEC 42001:2023

ISO/IEC 42001:2023 establishes requirements for an Artificial Intelligence Management System.

It assists organisations in:

• Establishing AI governance policies.
• Identifying AI-related risks.
• Assigning organisational responsibilities.
• Managing AI systems throughout their lifecycle.
• Monitoring AI performance.
• Improving accountability.

5.3 ISO/IEC 27001

ISO/IEC 27001 provides requirements for establishing and maintaining an Information Security Management System.

It focuses on protecting:

• Confidentiality.
• Integrity.
• Availability.

It is particularly relevant to organisations managing sensitive digital information.

5.4 ISO/IEC 23894:2023

ISO/IEC 23894 provides guidance on risk management relating to artificial intelligence.

It assists organisations in identifying, evaluating and managing AI-related risks throughout the lifecycle of AI systems.

5.5 NIST Cybersecurity Framework 2.0

NIST Cybersecurity Framework 2.0 provides guidance for managing cybersecurity risks.

Its six functions are:

1. Govern.
2. Identify.
3. Protect.
4. Detect.
5. Respond.
6. Recover.

It is applicable to organisations across different sectors.

6. INDIAN LEGAL FRAMEWORK GOVERNING EMERGING TECHNOLOGY RISK ASSESSMENT

India does not have one comprehensive statute governing every emerging technology. Instead, technological risks are addressed through several existing laws, regulatory directions and sector-specific requirements.

6.1 Constitution of India, 1950

The Constitution provides the fundamental legal foundation for protecting individuals against unlawful technological practices.

Important constitutional provisions include:

Article 14: Guarantees equality before the law and equal protection of the laws.

It is relevant to algorithmic discrimination and unfair automated decision-making.

Article 19(1)(a): Protects freedom of speech and expression.

It is relevant to online platforms, digital communication and content regulation.

Article 21: Protects life and personal liberty.

It includes the constitutionally recognised right to privacy, which is particularly important in the context of digital surveillance and personal data processing.

6.2 Information Technology Act, 2000

The Information Technology Act, 2000 is the principal legislation governing electronic transactions and several aspects of cybersecurity in India.

Important provisions include:

Section 43: Provides for compensation in specified circumstances involving unauthorised access, downloading, damage or disruption of computer resources.

Section 43A: Historically addressed compensation for failure by a body corporate to protect sensitive personal data or information. Its continuing operation must be read with subsequent data-protection legislation and applicable commencement notifications.

Section 66: Deals with computer-related offences involving dishonest or fraudulent acts.

Section 66C: Deals with identity theft.

Section 66D: Deals with cheating by personation using computer resources.

Section 66F: Deals with cyberterrorism.

Section 69: Provides powers relating to interception, monitoring or decryption subject to statutory conditions.

Section 70: Provides for protected systems.

Section 70A: Provides for the establishment of the National Critical Information Infrastructure Protection Centre.

Section 70B: Provides for the Indian Computer Emergency Response Team (CERT-In).

Section 72: Deals with breach of confidentiality and privacy.

Section 79: Provides conditional safe-harbour protection to intermediaries subject to statutory requirements.

The Act is important for assessing risks associated with cyberattacks, digital platforms, electronic transactions and unauthorised access to computer systems.

6.3 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a legal framework for processing digital personal data in India.

It is especially important for emerging technologies that depend on large volumes of personal information.

Important compliance areas include:

1. Lawful processing of personal data.
2. Notice and consent requirements, where applicable.
3. Purpose limitation.
4. Reasonable security safeguards.
5. Personal data breach notifications.
6. Data principal rights.
7. Grievance redressal.
8. Additional obligations applicable to designated Significant Data Fiduciaries.

Organisations using AI, biometric systems, cloud computing and big data analytics must assess their data-processing activities under the Act.

The Act and the Digital Personal Data Protection Rules, 2025 have phased commencement arrangements. Organisations must verify which provisions and obligations are in force on the relevant date.

6.4 Consumer Protection Act, 2019

The Consumer Protection Act, 2019 protects consumers against unfair trade practices, misleading advertisements and deficient services.

It is relevant to emerging technologies because consumers increasingly depend on automated digital services.

For example:

• Misleading AI-generated product advertisements.
• Unfair automated subscription systems.
• Defective smart devices.
• Misrepresentation of technological capabilities.
• Unfair digital platform practices.

6.5 Bharatiya Nyaya Sanhita, 2023

The Bharatiya Nyaya Sanhita, 2023 provides the general criminal law framework for various offences that may involve emerging technologies.

Relevant areas include:

• Cheating.
• Forgery.
• Criminal intimidation.
• Defamation.
• Criminal conspiracy.
• Offences involving fraudulent documents and electronic records.

The Bharatiya Nyaya Sanhita came into force on 1 July 2024.

6.6 Bharatiya Sakshya Adhiniyam, 2023

The Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility and proof of electronic and digital records in judicial proceedings.

It is relevant to:

• Digital contracts.
• Electronic communications.
• Computer-generated records.
• CCTV footage.
• Digital transaction logs.
• AI-generated evidence.
• Electronic authentication records.

It is particularly important when technological incidents lead to criminal or civil litigation.

6.7 Consumer Protection (E-Commerce) Rules, 2020

These Rules regulate specified aspects of electronic commerce and establish obligations for e-commerce entities.

They address matters such as:

• Consumer information.
• Transparency.
• Grievance redressal.
• Unfair trade practices.
• Disclosure requirements.

They are relevant to risks arising from digital marketplaces and online platforms.

6.8 CERT-In Directions, 2022

The Indian Computer Emergency Response Team issued directions under Section 70B of the Information Technology Act on 28 April 2022.

These directions establish important cybersecurity compliance requirements for specified entities.

Important requirements include:

• Reporting specified cyber incidents within six hours of noticing them or being brought to their notice.
• Maintaining specified ICT system logs for a rolling period of 180 days within Indian jurisdiction.
• Maintaining prescribed information relating to certain ICT services.
• Designating a point of contact for coordination with CERT-In.

These requirements are important for cybersecurity incident management and organisational accountability.

6.9 Telecommunications Act, 2023

The Telecommunications Act, 2023 modernises the legal framework governing telecommunications in India.

It addresses:

• Authorisation of telecommunications services.
• Spectrum management.
• Telecommunications infrastructure.
• User protection.
• Security-related requirements.
• Lawful interception under prescribed conditions.

It is relevant to risks involving connected devices, telecommunications networks and critical digital infrastructure.

6.10 Patents Act, 1970 and Copyright Act, 1957

Emerging technologies create important intellectual property risks.

The Patents Act, 1970 governs patent protection, while the Copyright Act, 1957 governs copyright protection.

Relevant issues include:

• Ownership of AI-generated works.
• Software copyright.
• Protection of technological inventions.
• Unauthorised use of copyrighted training material.
• Trade secrets.
• Software licensing.

The legal treatment of AI-generated works and inventorship requires careful examination under existing intellectual property law.

6.11 Sector-Specific Regulations

Certain sectors have additional technology-related obligations.

Reserve Bank of India: Regulates technology and cybersecurity risks in the banking and financial services sector through applicable directions and guidelines.

SEBI: Regulates technology-related risks in securities markets, including cybersecurity and operational resilience requirements for regulated entities.

IRDAI: Supervises technology-related risks in insurance operations and applicable information and cybersecurity arrangements.

National Critical Information Infrastructure Protection Centre: Supports the protection of critical information infrastructure.

These regulatory frameworks demonstrate that emerging technology risks require both general legal protection and sector-specific supervision.

7. SEVEN IMPORTANT CASE LAWS RELATING TO EMERGING TECHNOLOGY RISK ASSESSMENT

Judicial decisions are important because they explain how constitutional principles, privacy rights, cybersecurity obligations and evidentiary requirements apply to technological developments.

The following seven cases provide significant legal principles relevant to emerging technology risk assessment.

CASE LAW 1: SELVI v. STATE OF KARNATAKA (2010)

Citation: (2010) 7 SCC 263.

Court: Supreme Court of India.

Facts of the Case:

The case concerned the use of involuntary narco-analysis, polygraph examinations and brain electrical activation profile tests during criminal investigations.

The petitioners challenged the legality of subjecting individuals to these techniques without their voluntary consent.

Legal Issue:

Whether involuntary administration of scientific investigative techniques violated the fundamental rights guaranteed under Articles 20(3) and 21 of the Constitution.

Judgment:

The Supreme Court held that involuntary administration of narco-analysis, polygraph examinations and brain electrical activation profile tests violates constitutional protections.

The Court emphasised the importance of personal liberty, mental privacy and protection against compelled self-incrimination.

Importance for Emerging Technology Risk Assessment:

This judgment is relevant to emerging technologies involving:

• Brain-computer interfaces.
• Neurotechnology.
• Biometric identification.
• Behavioural surveillance.
• Cognitive monitoring.
• Advanced investigative technologies.

It establishes that scientific advancement cannot override fundamental constitutional rights.

Before introducing technologies capable of examining or influencing human mental processes, organisations and authorities must carefully assess privacy, consent, dignity and personal liberty risks.

Legal Principle:

Technological methods of investigation must respect constitutional protections against compelled self-incrimination and violations of personal liberty.

CASE LAW 2: JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA (2017)

Citation: (2017) 10 SCC 1.

Court: Supreme Court of India, Nine-Judge Constitution Bench.

Facts of the Case:

The case concerned whether the right to privacy was protected as a fundamental right under the Constitution of India.

The matter arose in the context of constitutional challenges involving the collection and use of personal information, including Aadhaar-related issues.

Legal Issue:

Whether the right to privacy forms part of the fundamental rights guaranteed under the Constitution.

Judgment:

The Supreme Court unanimously recognised the right to privacy as a fundamental right.

The Court held that privacy forms an essential component of personal liberty, dignity and autonomy.

It also recognised informational privacy as an important aspect of constitutional protection.

The Court explained that an invasion of privacy must satisfy three requirements:

1. Legality.
2. Legitimate state aim.
3. Proportionality.

Importance for Emerging Technology Risk Assessment:

This decision is fundamental to the assessment of risks involving:

• Artificial intelligence.
• Facial recognition.
• Biometric databases.
• Big data analytics.
• Digital surveillance.
• Behavioural profiling.
• Personal information processing.

Organisations and public authorities must evaluate whether technological systems collect or process personal information in a lawful, necessary and proportionate manner.

Legal Principle:

Privacy is a fundamental right, and technological practices involving personal information must respect constitutional requirements.

CASE LAW 3: JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA (2018) – AADHAAR JUDGMENT

Citation: (2019) 1 SCC 1; judgment delivered on 26 September 2018.

Court: Supreme Court of India, Constitution Bench.

Facts of the Case:

The case involved constitutional challenges to the Aadhaar scheme and the use of biometric and demographic information for identity authentication.

The petitioners raised concerns relating to privacy, surveillance, exclusion and the collection of personal information.

Legal Issue:

Whether the Aadhaar framework and mandatory use of Aadhaar for specified purposes were constitutionally valid.

Judgment:

The Supreme Court upheld the Aadhaar Act with important limitations and struck down or restricted certain provisions and applications of Aadhaar.

The Court examined the proportionality of identity-based authentication and the protection of personal information.

It also addressed issues relating to private entities' access to Aadhaar authentication under Section 57 and other provisions.

Importance for Emerging Technology Risk Assessment:

This judgment is important for assessing risks associated with:

• Biometric authentication.
• Digital identity systems.
• Facial recognition.
• Centralised databases.
• Identity verification technologies.
• Data aggregation and surveillance.

It demonstrates that large-scale technological identity systems require careful assessment of privacy, security, proportionality and exclusion risks.

Legal Principle:

Digital identity systems must operate within constitutional limits and should incorporate safeguards against misuse, excessive data collection and disproportionate restrictions on individual rights.

CASE LAW 4: SHREYA SINGHAL v. UNION OF INDIA (2015)

Citation: (2015) 5 SCC 1.

Court: Supreme Court of India.

Facts of the Case:

The case challenged Section 66A of the Information Technology Act, 2000, which criminalised certain forms of online communication.

The petitioners argued that the provision was vague, excessive and violated freedom of speech and expression.

Legal Issue:

Whether Section 66A of the Information Technology Act violated Article 19(1)(a) of the Constitution.

Judgment:

The Supreme Court struck down Section 66A as unconstitutional.

The Court held that the provision was vague and overbroad and imposed unreasonable restrictions on freedom of expression.

It also examined the interpretation of Section 79 concerning intermediary liability.

Importance for Emerging Technology Risk Assessment:

The judgment is relevant to:

• Social media platforms.
• AI-generated content.
• Automated content moderation.
• Digital communication.
• Online censorship.
• Platform governance.
• Freedom of expression.

It establishes that technology regulation must not impose arbitrary or disproportionate restrictions on constitutional freedoms.

Legal Principle:

Digital technology regulation must respect freedom of expression and satisfy constitutional requirements of legality and reasonableness.

CASE LAW 5: ANVAR P.V. v. P.K. BASHEER (2014)

Citation: (2014) 10 SCC 473.

Court: Supreme Court of India.

Facts of the Case:

The dispute concerned the admissibility of electronic records in judicial proceedings.

The Court considered the legal requirements for proving electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Legal Issue:

Whether secondary electronic evidence could be admitted without satisfying the statutory requirements prescribed under Section 65B.

Judgment:

The Supreme Court clarified that secondary electronic evidence must comply with the requirements of Section 65B, including the prescribed certification requirements.

The Court recognised the importance of special statutory rules governing electronic evidence.

Importance for Emerging Technology Risk Assessment:

This judgment is relevant to:

• Cybercrime investigations.
• Digital forensic evidence.
• Electronic communications.
• AI-generated records.
• Cloud-based records.
• Computer logs.
• Digital transaction records.

It demonstrates that organisations must maintain reliable electronic records and preserve their authenticity.

The current legal framework governing electronic evidence is contained in the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act from 1 July 2024.

Legal Principle:

Electronic evidence must satisfy the applicable statutory requirements concerning authenticity and admissibility.

CASE LAW 6: ARJUN PANDITRAO KHOTKAR v. KAILASH KUSHANRAO GORANTYAL (2020)

Citation: (2020) 7 SCC 1.

Court: Supreme Court of India.

Facts of the Case:

The case involved the admissibility of video recordings and other electronic records in an election-related dispute.

The Court examined the requirement of certification under Section 65B of the Indian Evidence Act.

Legal Issue:

Whether certification under Section 65B(4) was mandatory for admitting secondary electronic evidence.

Judgment:

The Supreme Court reaffirmed the principles laid down in Anvar P.V. v. P.K. Basheer.

It held that a certificate under Section 65B(4) is mandatory for secondary electronic evidence, subject to the distinction between original electronic records and copies.

The Court also explained that assistance from the court may be sought where the relevant device or record is controlled by another person or authority.

Importance for Emerging Technology Risk Assessment:

This judgment highlights the importance of:

• Digital evidence preservation.
• Cybersecurity incident documentation.
• Electronic audit trails.
• Digital forensic investigations.
• Authentication of computer-generated information.
• Proper record management.

Organisations must ensure that evidence relating to cyber incidents is preserved in a manner that satisfies applicable legal requirements.

Legal Principle:

Electronic records must be properly authenticated and proved in accordance with the applicable evidence law.

CASE LAW 7: INTERNET AND MOBILE ASSOCIATION OF INDIA v. RESERVE BANK OF INDIA (2020)

Citation: (2020) 10 SCC 274.

Court: Supreme Court of India.

Facts of the Case:

The Reserve Bank of India issued a circular dated 6 April 2018 restricting regulated financial institutions from providing banking services to individuals and businesses dealing in virtual currencies.

The Internet and Mobile Association of India challenged the circular before the Supreme Court.

Legal Issue:

Whether the RBI's restriction on banking services connected with virtual currencies was proportionate and legally sustainable.

Judgment:

The Supreme Court set aside the RBI circular.

The Court recognised the regulatory authority of the RBI but held that the exercise of regulatory power must satisfy constitutional standards, including proportionality.

It found the impugned restriction disproportionate in the circumstances.

Importance for Emerging Technology Risk Assessment:

The decision is relevant to:

• Cryptocurrency.
• Blockchain technology.
• Digital assets.
• Virtual currency exchanges.
• Financial technology innovation.
• Regulatory risk assessment.

It demonstrates that emerging technologies require evidence-based and proportionate regulation.

Regulators must assess technological risks carefully before imposing restrictions that may significantly affect legitimate business activities.

Legal Principle:

Regulatory measures addressing emerging technologies must be reasonable, proportionate and supported by a legitimate regulatory objective.

8. INTERNATIONAL REGULATORY FRAMEWORK GOVERNING EMERGING TECHNOLOGY RISK ASSESSMENT

Emerging technologies operate across international borders. Consequently, international regulatory frameworks are necessary to promote cybersecurity, privacy, accountability and responsible innovation.

8.1 EUROPEAN UNION ARTIFICIAL INTELLIGENCE ACT, 2024

The European Union Artificial Intelligence Act, Regulation (EU) 2024/1689, establishes a comprehensive risk-based regulatory framework for artificial intelligence.

It classifies AI systems according to the level of risk they may create.

The major categories include:

1. Unacceptable Risk:

Certain AI practices that threaten fundamental rights are prohibited.

2. High Risk:

Certain AI systems used in areas such as employment, education, critical infrastructure and other sensitive fields are subject to enhanced regulatory requirements.

3. Limited Risk:

Certain systems are subject to transparency obligations.

4. Minimal or Low Risk:

Most ordinary AI applications are not subject to the same extensive requirements as high-risk systems.

Important compliance requirements include:

• Risk management.
• Data governance.
• Technical documentation.
• Record keeping.
• Human oversight.
• Accuracy and robustness.
• Cybersecurity.
• Transparency.

As of 30 October 2026, the AI Act's implementation is progressive. General provisions and prohibited-practice rules have applied since February 2025, while general-purpose AI obligations began applying in August 2025. The principal transparency and enforcement provisions apply from August 2026. Under the amended timetable, specified Annex III high-risk requirements apply from December 2027 and certain product-related high-risk requirements from August 2028.

8.2 GENERAL DATA PROTECTION REGULATION (GDPR), 2016

The GDPR is a major European Union data-protection regulation.

It governs the processing of personal data within its territorial scope.

Important principles include:

• Lawfulness.
• Fairness.
• Transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality.
• Accountability.

Article 22 addresses certain decisions based solely on automated processing, including profiling, subject to the conditions and exceptions in the Regulation.

Article 35 provides for Data Protection Impact Assessments in specified circumstances involving high-risk processing.

The GDPR is particularly important for AI, big data analytics, biometric technologies and cloud computing.

8.3 DIGITAL OPERATIONAL RESILIENCE ACT (DORA), 2022

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, establishes requirements for managing information and communication technology risks in the financial sector.

It became applicable on 17 January 2025.

Its major objectives include:

• ICT risk management.
• Incident reporting.
• Digital operational resilience testing.
• Third-party technology risk management.
• Information-sharing arrangements.
• Business continuity.

DORA is particularly important for financial institutions dependent on cloud computing, outsourced technology services and digital infrastructure.

8.4 NETWORK AND INFORMATION SECURITY DIRECTIVE 2 (NIS2)

The NIS2 Directive, Directive (EU) 2022/2555, establishes cybersecurity requirements for specified essential and important entities in the European Union.

It addresses:

• Cybersecurity risk management.
• Incident handling.
• Business continuity.
• Supply chain security.
• Vulnerability management.
• Management accountability.
• Reporting obligations.

It is particularly important for critical infrastructure and essential digital services.

8.5 EU CYBER RESILIENCE ACT

The Cyber Resilience Act, Regulation (EU) 2024/2847, establishes cybersecurity requirements for products with digital elements within its scope.

It addresses:

• Secure product design.
• Vulnerability handling.
• Security updates.
• Product documentation.
• Reporting of specified actively exploited vulnerabilities and severe incidents.
• Manufacturer responsibilities.

Its implementation includes transitional and phased application dates.

8.6 UNITED STATES REGULATORY FRAMEWORK

The United States uses several federal laws, regulatory requirements and technical standards to manage emerging technology risks.

Important frameworks include:

Federal Trade Commission Act, 1914: Provides the basis for action against unfair or deceptive business practices.

Children's Online Privacy Protection Act, 1998: Regulates the online collection of personal information from children within its scope.

Gramm-Leach-Bliley Act, 1999: Addresses the protection and disclosure of specified non-public personal financial information held by covered financial institutions.

Health Insurance Portability and Accountability Act, 1996: Establishes privacy and security requirements for protected health information held by covered entities and business associates.

Computer Fraud and Abuse Act, 1986: Addresses specified forms of unauthorised access to protected computer systems.

NIST AI Risk Management Framework: Provides voluntary guidance for identifying and managing AI-related risks.

8.7 OECD PRINCIPLES ON ARTIFICIAL INTELLIGENCE

The Organisation for Economic Co-operation and Development (OECD) developed principles for responsible AI.

They promote:

• Inclusive growth.
• Human-centred values.
• Transparency.
• Robustness and safety.
• Accountability.

These principles encourage governments and organisations to adopt trustworthy and responsible AI systems.

8.8 UNESCO RECOMMENDATION ON THE ETHICS OF ARTIFICIAL INTELLIGENCE, 2021

UNESCO adopted its Recommendation on the Ethics of Artificial Intelligence in November 2021.

It provides international guidance on ethical AI development and deployment.

Its main concerns include:

• Human rights.
• Human dignity.
• Environmental protection.
• Fairness.
• Transparency.
• Accountability.
• Gender equality.
• Protection of vulnerable communities.

It emphasises that AI systems should be developed and used in a manner consistent with human rights and public welfare.

9. MAJOR CHALLENGES IN EMERGING TECHNOLOGY RISK ASSESSMENT

Despite the availability of several laws and regulatory standards, organisations face significant difficulties.

9.1 Rapid Technological Development

Technology evolves rapidly, whereas legislation and regulatory institutions may require considerable time to respond.

This creates regulatory uncertainty.

9.2 Lack of Uniform Legal Standards

Different countries adopt different approaches to AI regulation, cybersecurity, data protection and digital surveillance.

This creates difficulties for organisations operating internationally.

9.3 Cybersecurity Threats

Cyberattacks are becoming increasingly sophisticated.

Threats include:

• Ransomware.
• Phishing.
• Malware.
• Identity theft.
• Data breaches.
• Supply chain attacks.
• AI-assisted cyberattacks.

9.4 Privacy and Surveillance Risks

Advanced technologies can collect, analyse and process enormous quantities of personal information.

Without proper safeguards, they may result in unlawful surveillance and misuse of personal data.

9.5 Algorithmic Bias

AI systems may produce discriminatory outcomes because of biased datasets, defective models or inappropriate design.

9.6 Lack of Transparency

Some advanced technological systems operate through complex processes that are difficult for ordinary users and even system operators to understand.

This creates accountability problems.

9.7 Third-Party and Supply Chain Risks

Organisations increasingly depend on external software providers, cloud service providers and technology vendors.

A security failure in one third-party system can affect multiple organisations.

9.8 Financial and Operational Risks

Technological failure may result in financial losses, service interruptions, regulatory penalties and reputational damage.

9.9 Ethical and Human Rights Concerns

Emerging technologies may affect equality, autonomy, dignity, freedom of expression and other fundamental rights.

9.10 Difficulty in Predicting Future Risks

Some emerging technologies may create consequences that cannot be fully understood at the time of their introduction.

Therefore, risk assessment must be continuous rather than limited to the initial development stage.

10. MEASURES AND RECOMMENDATIONS FOR EFFECTIVE EMERGING TECHNOLOGY RISK ASSESSMENT

The following measures can strengthen technological risk management in India and internationally.

10.1 Development of a Comprehensive Regulatory Framework

India should continue developing clear and coordinated regulatory approaches for AI, autonomous systems, biometric technologies and other emerging technologies.

10.2 Mandatory Risk Assessments for High-Impact Technologies

Technologies capable of affecting human rights, public safety, critical infrastructure or financial stability should undergo rigorous risk assessment.

10.3 Strong Data Protection Mechanisms

Organisations should implement:

• Data encryption.
• Access controls.
• Data minimisation.
• Secure storage.
• Privacy assessments.
• Appropriate breach-response systems.

10.4 Regular Cybersecurity Audits

Organisations should conduct periodic security audits, penetration testing and vulnerability assessments.

10.5 Human Oversight of AI Systems

Important decisions affecting employment, credit, healthcare and access to essential services should have appropriate human oversight.

10.6 Algorithmic Transparency and Accountability

Organisations should maintain appropriate documentation of:

• AI training data.
• Model design.
• Testing procedures.
• Decision-making processes.
• Known limitations.
• Risk mitigation measures.

10.7 Responsible Innovation

Innovation should be encouraged through regulatory sandboxes and controlled testing environments.

Such mechanisms allow new technologies to be evaluated before large-scale deployment.

10.8 Protection of Critical Infrastructure

Special attention should be given to cybersecurity in:

• Banking.
• Telecommunications.
• Healthcare.
• Electricity.
• Transportation.
• Government networks.
• Defence infrastructure.