What "Human in the Loop" Means Legally in India

A counsel note in a line ministry said the agent was compliant because it retained a human in the loop 'as required by DPDP'. The Act does not use the phrase. The 2025 Rules do not define it. The officer who would click Approve on the draft sanction was not the officer who held the power under the Delegation of Financial Powers Rules, 2024. The loop was a button. It was not a legal design.

This explainer is for DPOs, counsel and programme owners who keep finding HITL in vendor decks. The honest Indian picture, as of this writing, is a mix: the India AI Governance Guidelines (MeitY, 5 November 2025) talk about People First and human oversight as a sutra, not as an enacted section; administrative law still expects reasoned, authorised decisions; DFPRs and your local delegations still say who may approve expenditure and related acts. None of those is a synonym for a checkbox on a chat window.

The Guidelines are guidelines. They are not a statute and they are not a replacement for DPDP. DPDP remains the personal-data statute, commencing in phases. Do not collapse the three sources into one soothing sentence.

Not legal advice. Read the Act, the Rules, the DFPR booklet on doe.gov.in, the Guidelines PDF, and your own delegation orders.

Not a DPDP term

Search the Digital Personal Data Protection Act, 2023 for human in the loop. You will not find it. You will find fiduciaries, processors, purposes, consents, legitimate uses, security safeguards, and rights. An agent can have a human button and still lack a purpose, a processor contract, or an erasure path. An agent can lack a button and still be lawful for a narrow, well-instructed process — though government administrative reality will often still want a named officer.

If counsel wants a DPDP hook, they should write the actual hook: who is the fiduciary, what is the purpose, what is the processor instructed to do, what personal data the agent may see. Then, separately, write the approval design. Mixing the two is how a button gets mistaken for compliance.

The Guidelines sutra — People First, not a licence

MeitY released the India AI Governance Guidelines on 5 November 2025. PIB and the published PDF describe seven sutras, including People First and Innovation over Restraint, alongside Trust, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability. People First is commonly read to include human-centricity and oversight. That is a principle for designers and sector bodies. It is not a gazette that says every agent must have a particular UI.

Innovation over Restraint is the neighbouring sutra. It argues against precaution that freezes adoption. Using it to skip a DFPR-authorised officer is a misread. Using People First to demand a theatre button that a clerk clicks without reading is also a misread.

Treat the Guidelines as a briefing note you can cite for culture and design. Do not treat them as a defence when a sanction was issued by a model.

Three sources, three jobs. Write all three. Do not let HITL as a phrase do any of their jobs alone.

Source	What it actually gives you	What HITL-as-slogan pretends
DPDP Act and Rules	Roles, purpose, security, rights, transfers	That a human click is a lawful basis
India AI Governance Guidelines (Nov 2025)	Sutras, including People First / oversight and Innovation over Restraint	That a guideline is a licence or a DPDP substitute
Administrative law + DFPRs / local delegations	Who may decide, who must record reasons, who is the competent authority	That any employee click counts as the authority

Who may approve — the question DFPRs already knew

The Delegation of Financial Powers Rules, 2024, notified for the Union, define competent authority and allocate powers. States and autonomous bodies have their own delegations. A noting assistant that invites a junior to 'approve' a draft that commits money the junior cannot sanction is not human oversight. It is a mis-delegation dressed as UX.

Map each agent action to a power: send a citizen SMS (usually a process owner), draft a noting (usually anyone, if it remains a draft), issue a sanction (named authority), reject a benefit (often a reasoned order). The loop is correctly designed only when the human on the button is the human who may do that act, or a properly authorised subordinate.

The Central Secretariat Manual of Office Procedure still cares about who signs, who notes, and how a file moves. An agent that auto-moves a file to the next officer without a human decision has not added a loop. It has removed one.

How to write it in the file

Ban the phrase as a standalone compliance claim. Replace it with three sentences: DPDP roles and purpose for this workflow; the Guideline sutras you are choosing to operationalise (People First as a named approver, Understandable by Design as a seven-field trail); the delegation instrument that names the approver.

If a vendor's questionnaire asks 'do you require HITL? yes/no', attach those three sentences. A yes without them is how the Pune MSA got initialled.

• Never cite DPDP as the source of HITL.
• Cite the Guidelines as guidelines.
• Cite the delegation order by number for each material action.
• Log the approval in the seven-field trail.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Everyone uses the phrase. We should too.

Use it as a heading if you must. Under it, write the three sentences. The heading without the sentences is the problem, not the English language.

If DPDP does not require a human, we can fully automate sanctions.

DPDP may not be the barrier. Delegation and administrative law may be. A fully automated sanction that no competent authority owns is a different, usually fatal, problem. Ask counsel on the power, not only on the privacy statute.

People First means we must have a human on every token.

That is not what a sutra does. Oversight should sit on material actions, not on every cursor blink. A human who rubber-stamps a thousand tokens is not People First. They are a tired alibi.

DFPRs are about money, not about SMS.

Money is the sharpest case. Other acts still have competent authors: who may speak for the department, who may reject a citizen, who may change a record. Find the instrument. If there is none, you have found a hole in your design, not a free pass.

A ten-day HITL rewrite

Take every workflow the agent will touch. If you cannot name the power, you cannot name the loop.

1. Day 1–3: list actions. Mark material ones: money, benefits, external speech, record changes.
2. Day 4–6: counsel maps each material action to a delegation or process owner. DPO maps DPDP roles separately.
3. Day 7–8: configure the product so the button is that person, and the trail records it.
4. Day 9–10: rewrite any note that cites DPDP as the source of HITL. File the Guidelines as design context, not as a licence.

How this shows up in the file

Three sentences, one table of actions-to-powers, one sample trail record that shows the approver. If the vendor questionnaire still says HITL: yes, staple this page to it.

If you cannot name the competent authority for a send, turn the send off.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How this survives CAG, RTI or the Board

“What "Human in the Loop" Means Legally in India” is not a workshop slide. A P6 Compliance/DPO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

DPDP does not define human in the loop. Do not write it as if it were a section. Combine the 2025 governance sutras, administrative-law duties, and the person who actually holds the DFPR power. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “human in the loop India law” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “What "Human in the Loop" Means Legally in India” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “human in the loop India law” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.