AI-Powered Cyberattacks: The Need for a New Legal Framework in India

Artificial intelligence has changed the economics of cybercrime. Tasks that once demanded technical skill, time and coordination, such as drafting convincing phishing messages, cloning a voice, probing a network for weaknesses or mutating malware to avoid detection, can now be automated, scaled and delivered at negligible cost. India, with one of the largest digital populations in the world and a fast-expanding digital public infrastructure, is acutely exposed. This paper examines whether the existing Indian legal architecture, principally the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 and the Digital Personal Data Protection Act, 2023, is adequate to address AI-powered cyberattacks. It argues that although current law can reach many of the resulting harms through technology-neutral provisions, it suffers from definitional gaps, an outdated model of attribution and intent, the absence of duties on those who build and deploy AI systems, and weak evidentiary and institutional machinery. Drawing on developments in the European Union, the United States, the United Kingdom and China, the paper proposes a calibrated, risk-based statutory framework that protects security without sacrificing innovation or constitutional freedoms.