Biased output, privacy violation, unauthorised data sharing due to AI can have serious ramifications for India Inc

Economic Times

02-07-2025

Mumbai: As India Inc rushes to adopt AI, internal auditors are sounding the alarm over a perceived lack of robust controls, ethical safeguards, and governance frameworks.These auditors are warning that many companies may be inadvertently exposing themselves to serious risks such as biased outputs, privacy violations, unauthorised data sharing, and opaque decision-making by AI models, potentially causing legal and financial liabilities, and operational setbacks.Auditors are worried that boards and top management are largely unaware of the scale of AI experimentation taking place at the ground level in Indian companies.A Microsoft study showed that India's rapid adoption of Artificial Intelligence (AI), with 65% of surveyed Indians having used AI, is more than double the global average of 31%.
"Most organisations are using AI with the best intentions-whether for efficiency, productivity, faster time to market, staying ahead of the curve, or market defence. But, in their pursuit of these goals, governance may not have received as much attention," said Ritesh Tiwari, partner and national leader for governance, risk & compliance services at KPMG in India.
Auditors said the biggest concern currently is the lack of adequate board-level engagement on the issue. "Ethical usage of AI has to be a boardroom topic. Without the top-down commitment, it's a ticking time bomb. One wrong deployment, one biased output-and the reputational damage could be massive," said Tiwari. "We do tests for bias where mandated, but in many companies, it's not yet part of their risk culture. That's something we're pushing to change."Globally, there have been several high-profile instances of AI failures, from Amazon's recruiting tool showing bias against women to Microsoft's Tay chatbot generating offensive content, Facebook's Cambridge Analytica data scandal, and McDonald's Drive-Thru AI mishaps. As Indian organisations become increasingly aware of the risks associated with AI deployments, they are also strengthening their oversight and governance mechanisms to manage these challenges."Organisations have now started to ask that internal audits specifically cover the AI adoption lifecycle, looking at everything from pre-development planning to post-deployment performance," said Sunil Bhadu, partner and India GRC leader at PwC India. "The focus is typically on the governance framework and policies, design compliance with industry standards, workflow integrity, and robust working processes to ensure that these models aren't hallucinating or generating misleading results."Internal auditors emphasise that Indian firms have to realise the value of building trustworthy AI by design. "With global incidents highlighting the risks, mature organisations are proactively seeking guidance on managing AI-related risks. They're turning to recent frameworks like the EU AI Act, the NIST AI Risk Management Framework, and Deloitte's own Trustworthy AI model, asking, can our systems be reviewed and benchmarked against these frameworks to ensure responsible development and deployment?" said Anthony Crasto, president, assurance at Deloitte South Asia.Another crucial factor in internal audits of AI models is cybersecurity and privacy, given AI systems often process sensitive personal and business data, using complex codebases, and can be vulnerable to adversarial attacks or prompt injection if not properly secured.
"From a security and privacy lens, we're also testing the algorithm logic, reviewing adherence to secure coding principles and business objectives, and data protection norms, and carrying out vulnerability assessments, etc. Data privacy is a growing area of concern," said Crasto. On their part, auditors are doing closer scrutiny of aspects like training, testing, and validation of these models, since flaws at the foundational stages could lead to biased, unreliable, or even unsafe outputs once deployed. "We ask the companies: Is there a documented AI policy? Is it aligned with global frameworks? We assess the policy's treatment of privacy, security, responsibility, human-in-the-loop accountability, transparency, model bias and explainability," said Crasto.