AI Legal Ethics in India: A Bar Council Guide

Why AI Ethics Now Sits at the Centre of Indian Legal Practice

For most of the last decade, technology in Indian legal practice was a back-office question, handled by IT teams and rarely reaching the partners' table. That has changed. When a generative tool drafts a plaint, summarises a judgment or flags an indemnity clause, it is performing tasks that were once the exclusive province of a qualified advocate, and the output carries the firm's name into court and into client boardrooms. The ethical exposure has therefore migrated from the server room to the practice itself.

Two forces have accelerated this. First, clients, especially sophisticated general counsel at listed companies and financial institutions, now expect their external counsel to use AI to control cost and turnaround, while simultaneously expecting airtight confidentiality. Second, regulators and courts are paying attention. Indian courts have publicly cautioned litigants and counsel about relying on unverified AI output after instances of fabricated or misdescribed citations surfaced in filings. The reputational cost of being the firm that filed a hallucinated authority is severe and lasting.

The practical consequence is that AI governance is no longer optional infrastructure. It is a professional-responsibility issue that belongs on the risk register alongside conflicts management and client-money handling. Firms that treat it that way will adopt confidently; those that improvise will eventually be caught between a demanding client and an unforgiving disciplinary standard.

• AI now performs core legal tasks, so ethical accountability has shifted from IT teams to the advocates who sign the work
• Clients increasingly demand both AI-driven efficiency and absolute confidentiality in the same engagement
• Indian courts have already flagged unverified AI citations, making verification a live professional-conduct concern
• AI governance belongs on the firm risk register, not merely in the technology budget

AI Legal Ethics in India: What the Bar Council Framework Demands

The starting point for AI legal ethics in India is that the Bar Council of India, deriving its authority from the Advocates Act, 1961, sets the standards of professional conduct that bind every enrolled advocate. Nothing in those standards exempts AI-assisted work. An advocate who uses a machine to draft or research is still bound by the duties owed to the court, to the client and to the profession, and misconduct proceedings under the Advocates Act can follow a breach regardless of whether a tool was involved. The technology is a means; the responsibility is undelegable.

Three duties deserve particular attention when AI enters the workflow. The duty of competence requires that an advocate understand the tools relied upon well enough to supervise them, which means knowing that generative systems can produce confident but false output. The duty of candour to the court means that anything filed must be verified as accurate and genuine. And the duty of independent judgment means that the advocate, not the algorithm, must own the legal conclusion. AI can inform that judgment; it cannot substitute for it.

• Bar Council conduct standards apply in full to AI-assisted drafting, research and advice
• Competence now includes understanding the failure modes of the AI tools you rely on
• Candour to the court requires that every AI-produced filing be independently verified as genuine
• Only an enrolled advocate can own the final legal judgment; the tool cannot

Confidentiality, Privilege and the DPDP Act, 2023

Confidentiality is the obligation most directly threatened by careless AI adoption. Advocate-client communications enjoy protection under the privilege now carried into the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act, 1872. That privilege, and the broader professional duty of confidentiality, can be compromised the moment sensitive client material is pasted into a consumer-grade AI tool whose terms permit the provider to retain or train on submitted content. What looks like a convenient shortcut can amount to an unauthorised disclosure of privileged information.

Layered on top is the Digital Personal Data Protection Act, 2023. When client matters contain personal data, and most do, the firm or legal department processing that data through an AI system takes on data-fiduciary responsibilities: processing on a lawful basis, limiting use to the notified purpose, securing the data with reasonable safeguards, and being able to respond to the rights of the individuals concerned. Feeding personal data into an opaque third-party model without contractual and technical controls is precisely the kind of practice the Act is designed to discipline.

The defensible posture is to treat every AI tool as a potential disclosure point. That means preferring enterprise arrangements with contractual no-training and no-retention commitments, understanding where data is stored and processed, and drawing a clear line between tools cleared for privileged material and tools that are not. Where the sensitivity is high, on-tenant or private deployment that keeps data within the firm's control is materially safer than a public endpoint.

• Pasting privileged material into consumer AI tools can amount to an unauthorised disclosure
• Client personal data processed through AI triggers data-fiduciary duties under the DPDP Act, 2023
• Prefer enterprise tools with contractual no-training, no-retention and defined data-location terms
• Maintain a clear list of which tools are cleared for privileged content and which are not

The Hallucination Problem and the Duty to the Court

The single most publicised AI risk in legal practice is the fabricated citation. Generative models produce fluent text by predicting plausible language, and they will, on occasion, invent a case name, misattribute a holding or cite a section number that does not say what the model claims. In an advisory memo this is embarrassing; in a filing it is a potential breach of the duty of candour to the court and an invitation to sanction and reputational damage. Indian courts have already had occasion to caution against reliance on unverified AI-generated authorities.

The answer is not to abandon AI research but to institutionalise verification. Every authority an AI surfaces must be pulled from an authoritative source, read in the original, and confirmed to stand for the proposition claimed before it goes anywhere near a court or a client. This is not a limitation of the technology so much as a restatement of what diligent lawyering always required; AI simply raises the volume of output that must pass through the same discipline.

• Generative models can fabricate case names, holdings and section references convincingly
• An unverified citation in a filing risks breaching the duty of candour to the court
• Make source-checking of every AI authority a standing, documented rule
• Prefer retrieval-grounded research tools that cite back to original sources

Building an AI Governance Policy for Your Firm or Legal Department

Ethical AI use does not happen by exhortation; it happens through a written policy that partners and juniors alike can follow. A workable governance framework answers a short list of questions clearly: which tools are approved, for which kinds of work, what data may and may not be entered, who verifies output, and how the firm records that verification. The goal is to make the responsible path the easy path, so that an associate under deadline pressure does not have to invent a rule at midnight.

Governance should be proportionate to sensitivity. Low-risk internal uses, such as summarising a public judgment for a study note, can operate under light controls. High-risk uses, such as diligence on a live transaction containing counterparties' personal and financial data, warrant approved tools, contractual protections and mandatory human review. Mapping use cases onto risk tiers prevents both reckless adoption and blanket prohibition, the two failure modes that leave firms either exposed or uncompetitive.

Finally, governance must be reviewed. The technology, the vendors' terms and the regulatory position under the DPDP Act, 2023 are all evolving, and a policy written once and forgotten will drift out of compliance. Assign ownership, typically a partner or a senior member of the in-house team, and revisit the framework on a defined cadence.

• Write down which tools are approved, for what work, and with what data restrictions
• Tier use cases by sensitivity and apply proportionate controls to each tier
• Require documented human verification for anything reaching a client or court
• Assign clear ownership and review the policy on a fixed cadence as the law evolves

Client Consent, Billing Transparency and Vendor Diligence

Ethical adoption extends beyond the firm's internal controls to how it deals with clients and vendors. On the client side, transparency is prudent. Sophisticated general counsel increasingly ask whether and how their external counsel uses AI, and engagement terms are a sensible place to address the use of AI, the handling of the client's data and the safeguards in place. Where AI materially changes the effort behind a task, billing practices should reflect the reality of the work actually done, so that efficiency gains are shared honestly rather than obscured.

On the vendor side, the firm cannot outsource its ethical duties to a technology provider, but it can and must choose providers that make compliance possible. Vendor diligence should examine data-handling and retention terms, the location of processing, security posture, whether client content is used to train models, and the contractual remedies available if something goes wrong. A provider that will not commit contractually to no-training and confidentiality is not a suitable home for privileged material, however capable the product.

These are the relationships where trust is either reinforced or quietly eroded. Handled well, AI becomes something the firm can discuss openly with clients as evidence of modern, cost-conscious practice. Handled carelessly, it becomes the confidentiality incident nobody wants to explain.

• Address AI use, data handling and safeguards in engagement terms with clients
• Keep billing honest about the work actually performed when AI changes the effort
• Diligence vendors on retention, training use, processing location and security
• Refuse to route privileged material through any tool lacking contractual confidentiality commitments