POST-MARKET SURVEILLANCE AND LEGAL LIABILITY OF REGULATORY SANDBOX INNOVATIONS

1. INTRODUCTION

Regulatory sandboxes allow innovative products, services, and technologies to be tested under controlled conditions before wider deployment. Post-market surveillance (PMS) refers to the systematic collection, assessment, and use of information about an innovation's safety, performance, reliability, and effects after it enters actual use.

Surveillance is particularly important for artificial intelligence systems, digital healthcare platforms, financial technologies, medical devices, and automated decision-making tools. Risks may emerge only after deployment because of changing user behaviour, cybersecurity vulnerabilities, biased predictions, operational failures, or unexpected interactions.

The legal objective is to ensure that experimental success does not become a substitute for continuing accountability. Innovators must monitor foreseeable risks, report incidents, implement corrective measures, and compensate affected users where the applicable law establishes liability.

2. LEGAL FRAMEWORK IN INDIA

The Reserve Bank of India (RBI) Regulatory Sandbox Framework requires participants to address customer obligations and comply with relevant regulatory requirements after successful experimentation. It also makes clear that sandbox participation does not eliminate the participant's liability to customers.

The Securities and Exchange Board of India (SEBI) Regulatory Sandbox Framework requires testing reports, incident information, complaint-resolution details, and recordkeeping. Its framework illustrates the importance of documenting testing outcomes and maintaining accountability throughout the innovation lifecycle. <Cite refs={["turn280338search0","turn280338search1","turn280338search2"]}/>

Other applicable laws depend on the innovation concerned. These may include the Consumer Protection Act, 2019, the Information Technology Act, 2000, applicable data-protection legislation, sector-specific licensing requirements, and relevant product-safety rules. Medical devices and digital health products may additionally be subject to the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017, where applicable.

3. CORE POST-MARKET SURVEILLANCE OBLIGATIONS

A. CONTINUOUS RISK MONITORING

Innovators should define measurable safety and performance indicators, monitor complaints, identify abnormal system behaviour, and investigate emerging risks. AI-based systems may require monitoring for model drift, discriminatory outcomes, and changing error rates.

B. INCIDENT REPORTING

Serious incidents, cybersecurity breaches, financial losses, and product failures should be reported to the relevant authority where legally required. Delayed reporting may aggravate regulatory exposure.

C. CORRECTIVE AND PREVENTIVE ACTION

Where a material risk emerges, an entity should assess whether to issue warnings, suspend affected functions, patch software, recall a product, or discontinue the service. The response must be proportionate to the severity and likelihood of harm.

D. USER PROTECTION AND COMPENSATION

Participants should maintain accessible complaint mechanisms, preserve evidence, address refunds and contractual obligations, and provide compensation where required by law or an enforceable agreement. Informed consent or acceptance of experimental risk does not automatically waive every legal remedy.

E. RECORDKEEPING AND DATA GOVERNANCE

Audit logs, incident reports, model versions, security assessments, and corrective-action records should be preserved for the legally required period. Personal information must be handled according to applicable privacy and cybersecurity obligations.

4. RELEVANT CASE LAWS

The following decisions establish general principles relevant to post-market monitoring. They are not judgments specifically creating a universal PMS regime for regulatory sandboxes.

1. Donoghue v. Stevenson [1932] AC 562 — ANALOGOUS AUTHORITY

The House of Lords established the modern negligence principle requiring reasonable care toward persons foreseeably affected by one's conduct. This principle supports the need to identify and respond to foreseeable risks arising from deployed products.

2. Grant v. Australian Knitting Mills Ltd. [1936] AC 85 — ANALOGOUS AUTHORITY

The Privy Council addressed manufacturer responsibility for harm caused by a defective consumer product. The decision illustrates that product safety responsibilities can extend beyond the immediate contractual relationship between manufacturer and consumer.

3. M.C. Mehta v. Union of India, (1987) 1 SCC 395 — ANALOGOUS INDIAN AUTHORITY

In the Oleum Gas Leak litigation, the Supreme Court of India developed the principle of absolute liability for enterprises engaged in hazardous or inherently dangerous activities. Its application is context-specific, but the decision demonstrates the importance of enterprise responsibility for serious risks.

4. Indian Medical Association v. V.P. Shantha, (1995) 6 SCC 651 — ANALOGOUS INDIAN AUTHORITY

The Supreme Court clarified when medical services fall within consumer-protection law. The decision may assist where a sandbox-tested healthcare service causes harm and the statutory requirements for a consumer claim are satisfied.

5. Jacob Mathew v. State of Punjab, (2005) 6 SCC 1 — ANALOGOUS INDIAN AUTHORITY

The Supreme Court explained the principles governing medical negligence. Where an innovation is used in healthcare, monitoring failures or delayed intervention may create liability if the applicable standard of care is breached and the required causal connection is established.

6. Vellore Citizens' Welfare Forum v. Union of India, (1996) 5 SCC 647 — ANALOGOUS INDIAN AUTHORITY

The Supreme Court recognized the precautionary principle and polluter-pays principle in environmental protection. These principles are relevant by analogy when deployed technologies create potential environmental risks, subject to the applicable statutory framework.

5. PRACTICAL COMPLIANCE MEASURES

Organizations should establish a written surveillance plan before commercial deployment. It should identify responsible officers, reporting deadlines, risk thresholds, audit procedures, user-notification protocols, and escalation arrangements.

They should also maintain adequate insurance where appropriate, conduct periodic independent audits, review third-party suppliers, preserve evidence of corrective actions, and notify regulators of material changes when required. Sandbox exit should trigger a formal review of outstanding complaints, unresolved incidents, and continuing legal obligations.

6. CONCLUSION

Post-market surveillance is essential to ensure that regulatory sandbox innovations remain safe, reliable, and legally compliant after deployment. The RBI and SEBI frameworks demonstrate that successful experimentation does not eliminate customer obligations or the need for appropriate authorization. The cited judgments provide analogous principles concerning negligence, defective products, consumer remedies, and risk prevention. Effective surveillance therefore requires continuous monitoring, transparent reporting, timely corrective action, and accountability proportionate to the risks and duties established by applicable law.