Cyber Security and Artificial Intelligence in Financial Systems: Confronting AI-Driven Threats to India’s Digital Infrastructure

The rapid integration of artificial intelligence (AI) into the financial systems, particularly in banking and payment infrastructure, has significantly intensified cybersecurity risks. While the existing legal framework provides a regulatory structure, it fails to address the AI driven risks. While the Digital Personal Data Protection Act, 2023 regulates data processing obligations and the Information Technology Act, 2000 provides a framework governing cyber offences, both the statutes operate within a technologically narrow paradigm which fails to take into account adversarial AI attacks, automated fraud, and algorithmic manipulation within financial ecosystems. This gap in the law creates ambiguity in assigning liability, where responsibility for AI-driven cyber incidents causing financial loss is unclear and often diffused across developers, financial institutions, and intermediaries without clear standards.

The paper seeks to investigate this contradiction through statutory interpretation, regulatory practices, and judicial precedents, particularly in the case of Shreya Singhal v. Union of India, where the Supreme Court of India underscored the necessity of precision in regulating technologically mediated conduct. It further examines how the regulatory approach of the Reserve Bank of India addresses cybersecurity risks in financial systems but fails to incorporate AI-specific accountability mechanisms, resulting in fragmented and ineffective governance. The paper adopts a doctrinal methodology that combines statutory interpretation, policy review, and comparative analysis to show that existing liability doctrines lack the essential structure to deal with autonomous AI driven cyber harms.

The analysis establishes that cybersecurity failures in financial systems arise not only from technological vulnerabilities but also from statutory design limitations, necessitating a risk-based, AI-specific regulatory framework aligning liability, institutional accountability, and adaptive governance.