The Law Hasn’t Caught Up to Legal AI: Khaitan & Co’s Madhav Khosla on Why

Lawyering has always involved pattern recognition. At its most basic, legal advice applies rules to facts, often drawing on patterns from precedent, regulatory practice, and a lawyer’s own experience. But that is the simpler part of the job. The real value of legal judgment lies where the patterns do not fit neatly, where facts are ambiguous, multiple rules interact, or one line of authority pulls against another. That is where AI can become a ‘square-pegs-round-holes’ problem if used uncritically. The key is not merely human supervision but choosing the right use-cases. AI is useful for structured pattern-spotting; however, legal judgment remains essential when dealing with uncertainty. Indian law is still developing the tools to police that distinction.

Indian law does not yet have mechanisms to differentiate AI-generated legal advice from a human’s legal judgment, or a clear regulatory framework indicating the contexts in which AI use is permissible or desirable. Though the issue is now squarely on the table, including before the Supreme Court, which has recently asked the Bar Council of India to constitute an expert committee to examine AI use in court proceedings.

India does not yet have a privilege rule written specifically for AI, so the answer has to come from existing principles of legal privilege. The real question is whether privileged material is being disclosed to a third party in a way that destroys confidentiality. If a law firm uses a secure internal or enterprise AI tool, where data is not used for training, and is not accessible to outsiders, privilege should not automatically be lost. Otherwise, cloud storage and email would create the same problem. But lawyers need disciplined safeguards: do not enter client material into generic tools, no training of AI tools on client data without safeguards and consent, and clear access controls. For individuals, the position is starker. An AI tool is not your lawyer, and what you upload to it is not privileged.

That concern is very real, especially if AI is treated as a substitute for legal judgment rather than an aid to it. Indian precedent is not just a database of rules; it reflects facts, social contexts, judicial attitudes, inconsistencies, and sometimes outdated assumptions. In theory, because judgments record facts and reasoning, AI should be able to recognize how legal principles evolve over time. In practice, that cannot be assumed. Responsibility has to sit at two levels: lawyers must remain the human check against blind reliance in live matters, and developers must structure training and evaluation to account for bias, historicity, overruling, and doctrinal change.

Precedent is not static; AI systems cannot be trained on the assumption that it is, or that all case law is created equal. Training AI models on Indian case law must account for not just historicity, but also the hierarchy of courts, bench strength, and be able to correctly trace how the law evolves over a series of cases on the same subject, or how the law differs from one jurisdiction to the other. This is easier said than done and will require considerable time and effort.

I would reframe the issue slightly. The absence of AI-specific regulation does not mean AI use by lawyers is unregulated. Lawyers already owe fiduciary duties to clients, duties of competence and confidentiality, and duties to the court.

If a lawyer uses AI carelessly, for example, by relying on inaccurate outputs, blindly accepting AI-generated output without checking facts or citations, exposing privileged material, or misleading a court, existing rules on negligence, malpractice, and professional misconduct will still apply. The real risk is uncertainty. India’s legal profession is not a monolith, and clear regulatory guidance as we have seen in the US, UK, and Singapore would help standardize responsible use. This is important not only to give lawyers clear guidance on what is and what is not permissible, but also to prevent valuable judicial time being spent debating whether a particular use of AI was responsible or not, based on the existing, more general, principles.

It is also worth noting that the existence of rules is not enough. Despite rules of professional conduct being in place, in both the US and the UK courts have seen a number of high-profile cases where lawyers have relied on AI-generated content, without cross-checking for accuracy, including fictitious precedents. Putting effective enforcement mechanisms in place would therefore be just as important as the rules themselves.

The honest position is that enterprises do not need to stop building, but they do need to build flexibility into their processes, so that there is room to pivot in response to developments in regulatory grey areas. Some principles are already clear: anonymized data is the lowest-risk route, though often less commercially useful; and personal data use must be grounded in consent, notice, purpose limitation, security, and deletion rights.

The difficult questions arise where AI does not map neatly onto conventional privacy concepts. For example, what does the right to seek deletion of personal data mean in the context of AI model training, if personal data has influenced a trained model. Destroying an entire model may be disproportionate; ignoring the deletion request may defeat the right itself. In my view, “proceed with caution” is certainly a defensible position considering current circumstances.

These issues need to be separated. AI-drafted contracts largely raise familiar contract law questions: did the parties understand, accept, sign, exchange correspondence on, or act upon the terms? Although adding AI agents into the equation can complicate these questions, existing agency and authority principles will still apply. All in all, existing contract law doctrines are reasonably well placed to answer many of these questions.

AI-generated evidence is more complicated. The Bharatiya Sakshya Adhiniyam modernizes electronic evidence, but questions of authenticity, provenance, and evidentiary value will become more complex as the standard of synthetic content continues to improve and become more prevalent.

Algorithmic decision-making is the most open area, with several unanswered questions. Disputes will, for now, be framed through existing principles of contract, tort, discrimination, consumer protection, or constitutional law. Indian courts have, however, consistently taken the view that unless a party can demonstrate that a practice violates an existing law or legal right, courts will not interfere with how tech platforms conduct their business. Going forward, the regulatory framework is likely to include algorithmic transparency and explainability obligations.