Doctrine of ‘Lifting the AI Veil’ | Borrowing an Old Company Law Trick to Solve a New Accountability Problem
Introduction
Company law solved a version of this problem more than a century ago, and artificial intelligence regulation is now quietly borrowing the solution. When something goes wrong inside a company, the law generally cannot reach past the corporate entity to punish the people who ran it, because the company is treated as a legal person entirely separate from its shareholders and directors. Courts developed an exception for exactly the cases where that separation becomes a shield for wrongdoing, and lawyers now call it lifting, or piercing, the corporate veil. A growing body of legal scholarship argues that AI systems present a strikingly similar problem, and needs a strikingly similar fix. That emerging idea has come to be called lifting the AI veil.
Where the original doctrine comes from
The doctrine of lifting the corporate veil traces directly to the House of Lords decision in Salomon v. Salomon & Co. Ltd. in 1897. Aron Salomon, a leather and boot manufacturer, incorporated his existing business, sold it to the new company, and structured share ownership so that he and his family held nearly all the shares. When the company later failed, creditors argued Salomon should be held personally liable, since the company was effectively just him operating under a different name. The House of Lords disagreed, holding decisively that once validly incorporated, a company is a person in law entirely distinct from its subscribers, with its own rights and liabilities. That ruling established what remains company law's foundational principle: separate legal personality.
Separate personality is not, however, unconditional. Courts across common law jurisdictions, including India, carved out an exception for cases where the corporate form is used as a facade for fraud, to evade a statutory obligation, or to circumvent a legal duty that would otherwise apply to the individuals behind it. In such cases, a court will "lift the veil," looking past the company's separate legal identity to attribute liability directly to the directors or shareholders actually in control. India's Supreme Court, in Life Insurance Corporation of India v. Escorts Ltd., reaffirmed that this remains an exception applied only in narrow, exceptional circumstances, generally where a statute contemplates it, or fraud or improper conduct needs to be prevented. The doctrine has since found application well beyond fraud alone, including in tax matters, as seen in cases like State of U.P. v. Renusagar Power Co., where courts treated closely related corporate entities as one for the purpose of a specific statutory benefit.
Why AI creates the same structural problem
Scholarship examining AI liability has increasingly pointed to a near identical structural gap. As AI systems take on functions once reserved for human decision makers, board level analytics, automated lending decisions, algorithmic hiring, even proposed "robo-director" advisory roles, a familiar question resurfaces: who answers for the outcome when the AI system, rather than a named individual, produced the decision. A 2025 academic paper titled Lifting the AI Veil in Company Law argues explicitly that AI liability should be approached through an extension of existing doctrines, including directors' duty of care and precisely the piercing of the veil doctrine traditionally reserved for shareholders, rather than inventing an entirely new liability regime from scratch.
The concern driving this argument is not abstract. Commentary in outlets like MIT Technology Review has warned that granting AI systems anything resembling legal personhood risks handing companies a genuinely dangerous new shield, allowing a company to argue that a harmful outcome was the AI's autonomous decision, disconnected from any human actor's intent or negligence, much as a company might once have argued a harmful outcome was simply "the company's" doing and not any individual's. Critics of AI personhood proposals, writing in journals examining AI as legal persons, make the parallel explicit: while corporate veil piercing exists precisely to stop the corporate form being misused as a liability shield, the justification for extending similar legal personhood to AI is considerably weaker, since corporate personhood serves a clear economic purpose, enabling investment and risk pooling, that AI personhood does not obviously replicate.
How regulators have actually responded
The European Union's experience is instructive precisely because it shows the doctrine's underlying logic being adopted through legislation rather than judicial precedent. The European Commission originally proposed a dedicated AI Liability Directive in September 2022, intended to ease the burden of proof on claimants harmed by AI systems, including a rebuttable presumption of causality where a claimant could show an AI system breached EU AI Act obligations. That proposal was formally withdrawn in 2025, with the withdrawal notice published in the Official Journal on 6 October 2025, after member states failed to reach agreement. In its place, the revised EU Product Liability Directive now does much of the same underlying work through a different legal mechanism, explicitly treating AI software as a "product" for the purposes of manufacturer liability, meaning AI providers face strict liability for defective AI products without claimants needing to prove fault, applicable to AI products placed on the EU market from 9 December 2026 onward. Functionally, this achieves something close to piercing the AI veil by statute: instead of allowing a company to attribute harm to an autonomous algorithmic process and stop the inquiry there, liability is anchored back to the entity that built, trained, or deployed the system.
The Indian angle, and why it matters here
India has no AI specific liability statute at present, and no reported judicial decision has yet applied the corporate veil piercing doctrine by analogy to an AI system. But the underlying legal architecture is already familiar territory for Indian courts. India's jurisprudence on lifting the corporate veil, built through Escorts, Renusagar, and subsequent cases, already establishes the judicial comfort with looking past a formal legal structure to find the real, controlling actor when justice demands it. Indian courts have been consistently clear that this remains an exceptional remedy rather than a routine one, generally invoked where a statute contemplates it, where fraud or improper conduct needs to be prevented, or where a taxing or beneficial statute would otherwise be defeated by rigid adherence to corporate form. That same cautious, fact specific posture is likely to shape how any future Indian AI liability doctrine develops, applied sparingly rather than as a blanket rule.
As AI systems increasingly mediate lending decisions, insurance claims processing, and algorithmic hiring in Indian companies, the same reasoning that let Indian courts see through a corporate facade could plausibly extend to seeing through an "AI made the decision" defence, attributing responsibility to whichever human actor, developer, deployer, or governing board, exercised actual control over how that system was built and used. Given how central technology sector employment and AI deployment already are to India's economy, the absence of a clear domestic answer to this question is unlikely to remain untested for long.
The larger point
The doctrine of lifting the AI veil is less a wholly new legal invention and more a recognition that AI systems and corporations create the same essential problem: a formally separate entity that can, if left unchecked, absorb blame that properly belongs to the humans directing it. Company law solved this by refusing to let the corporate form become an alibi. AI law, whether through judicial doctrine, statute, or a hybrid of both as the EU's experience suggests, will likely need to reach the same conclusion, because the alternative is allowing genuine harm to disappear into a system nobody can be made to answer for.
References
- Bird & Bird, "Proposed EU AI liability rules withdrawn." https://www.twobirds.com/en/insights/2025/proposed-eu-ai-liability-rules-withdrawn
- LegalClarity, "AI Liability Directive: What It Was and Why It Was Withdrawn." https://legalclarity.org/ai-liability-directive-what-it-was-and-why-it-was-withdrawn/
- WCR Legal, "EU AI Liability Directive: Withdrawn, What Now Applies?" https://wcr.legal/eu-ai-liability-directive-withdrawn-pld/
- Verfassungsblog, "Anatomy of a Fall: On the Anticipated Withdrawal of the AI Liability Directive Proposal." https://verfassungsblog.de/anatomy-of-a-fall-aiact-aild-pld/
- MIT Technology Review, "Debates over AI consciousness are a trap." https://www.technologyreview.com/2026/08/20/1142571/ai-consciousness-debate-trap/
- ResearchGate, "Lifting the AI Veil in Company Law." https://www.researchgate.net/publication/393305638_Lifting_the_AI_veil_in_company_law
- Review of Law and Regulation, "Lifting the AI Veil in Company Law." https://rlr.iup.rs/wp-content/uploads/2025/07/04.pdf
- Bhatt & Joshi Associates, "Decoding the Jurisprudence on Lifting the Corporate Veil in Indian Court. https://bhattandjoshiassociates.com/decoding-the-jurisprudence-on-lifting-the-corporate-veil-in-indian-court/
- Mondaq, "Analysis Of Standard Of Proof For Lifting Of The Corporate Veil In Cases Of Fraud." https://www.mondaq.com/india/corporate-and-company-law/1259382/analysis-of-standard-of-proof-for-lifting-of-the-corporate-veil-in-cases-of-fraud
- Record Of Law, "Analysis of the theory of corporate veil lifting." https://recordoflaw.in/analysis-of-the-theory-of-corporate-veil-lifting/
- Suren Uppal Offices, "Lifting of Corporate Veil: Navigating Judicial Precedents." https://www.suolaw.com/lifting-of-corporate-veil-navigating-judicial-precedents/
Related Blogs
Introduction
In the ever-evolving world of technological innovation, a new chapter is being inscribed by the bold visionaries at Figure AI, a startup that is not merely capitalising on artificial intelligence rage but seeking to crest its very pinnacle. With the recent influx of a staggering $675 million in funding, this Sunnyvale, California-based enterprise has captured the imagination of industry giants and venture capitalists alike, all betting on a future where humanoid robots transcend the realm of science fiction to become an integral part of our daily lives.
The narrative of Figure AI's ascent is punctuated by the names of tech luminaries and corporate giants. Jeff Bezos, through his firm Explore Investments LLC, has infused a hefty $100 million into the venture. Microsoft, not to be outdone, has contributed a cool $95 million. Nvidia and an Amazon-affiliated fund have each bestowed $50 million upon Figure AI's ambitious endeavours. This surge of capital is a testament to the potential seen in the company's mission to develop general-purpose humanoid robots that promise to revolutionise industries and redefine human labour.
The Catalyst for Change
This investment craze can be traced back to the emergence of OpenAI's ChatGPT, a chatbot that caught the public eye in November 2022. Its success has not only ushered in a new era for AI but has also sparked a race among investors eager to stake their claim in startups determined to outshine their more established counterparts. OpenAI itself, once mulling over the acquisition of Figure AI, has now joined the ranks of its benefactors with a $5 million investment.
The roster of backers reads like a who's who of the tech and venture capital world. Intel's venture capital arm, LG Innotek, Samsung's investment group, Parkway Venture Capital, Align Ventures, ARK Venture Fund, Aliya Capital Partners, and Tamarack—all have invested their lot with Figure AI, signalling a broad consensus on the startup's potential to disrupt and innovate.
Yet, when probed for insights, these major players—Amazon, Nvidia, Microsoft, and Intel—have maintained a Sphinx-like silence, while Figure AI and other entities mentioned in the report have refrained from immediate responses to inquiries. This veil of secrecy only adds to the intrigue surrounding the company's prospects and the transformative impact its technology may have on society.
Need For AI Robots
Figure AI's robots are not mere assemblages of metal and circuitry; they are envisioned as versatile beings capable of navigating a multitude of environments and executing a diverse array of tasks. From working at aisles of warehouses to the bustling corridors of retail spaces, these humanoid automatons are being designed to fill the void of millions of jobs projected to remain vacant due to a shrinking human labour force.
The company's long-term mission statement is as audacious as it is altruistic: 'to develop general-purpose humanoids that make a positive impact on humanity and create a better life for future generations.' This noble pursuit is not just about engineering efficiency; it is about reshaping the very fabric of work, liberating humans from hazardous and menial tasks, and propelling us towards a future where our lives are enriched with purpose and fulfilment.
Conclusion
As we stand on the cusp of a new digital world, the strides of Figure AI serve as a beacon, illuminating the path towards machine and human symbiosis. The investment frenzy that has enveloped the company is a clarion call to all dreamers, pragmatists and innovators alike that the age of humanoid helpers is upon us, and the possibilities are as endless as our collective imagination.
Figure AI is forging a future where robots walk among us, not as novelties or overlords but as partners in forging a world where technology and humanity work together to unlock untold potential. The story of Figure AI is not just one of investment and innovation; it is a narrative of hope, a testament to the indomitable spirit of human ingenuity, and a preview of the wondrous epoch that lies just beyond the horizon.
References
- https://cybernews.com/tech/openai-bezos-nvidia-fund-robot-startup-figure-ai/
- https://www.thedailystar.net/business/news/bezos-nvidia-join-openai-funding-humanoid-robot-startup-3551476
- https://www.bloomberg.com/news/articles/2024-02-23/bezos-nvidia-join-openai-microsoft-in-funding-humanoid-robot-startup-figure-ai
- https://economictimes.indiatimes.com/tech/technology/bezos-nvidia-join-openai-in-funding-humanoid-robot-startup-report/articleshow/107967102.cms?from=mdr
.webp)
Introduction
On September 27, 2024, the Indian government took a significant step toward enhancing national security by amending business allocation rules through an extraordinary gazette notification. This amendment, which assigns specific roles to different Union Ministries and Departments regarding telecom network security, cybersecurity, and cybercrime, aims to clarify and streamline efforts in these critical areas. With India's evolving cybersecurity landscape, the need for a structured regulatory framework is pressing, as threats grow in complexity. Recent developments, such as the July 2024 global cyber outage and increasing cyber crimes like SMS scams, highlight the urgency of such reforms. Under Article 77 clause (3), the President amended the Government of India (Allocation of Business) Rules, 1961, to designate clearer responsibilities, reinforcing India's readiness to tackle emerging digital threats.
Key Highlights of the Gazette Notification
- Telecom Networks Security: A new entry ‘1A’ matters relating to the security of telecom networks" has been added under the Department of Telecommunications, highlighting an increased focus on securing the nation's telecom infrastructure.
- Cyber Security Responsibilities: Cyber security responsibilities have been added as a new entry under the Ministry of Electronics and Information Technology (MeitY), "5B. This assigns responsibility to MeitY for cybersecurity issues, concerning the Information Technology Act of 2000, giving the ministry the mandate to support other ministries or departments regarding cybersecurity matters.
- Oversight for Cyber Crime: Under the Ministry of Home Affairs, Department of Internal Security, a new entry "36A Matters relating to Cyber Crime" is introduced. This emphasises that the MHA will handle cybercrime issues, highlighting the government's attention toward enhancing internal security against cyber threats.
- Cyber Security Strategic Coordination: Any matter related to the "overall coordination and strategic direction for Cyber Security," has been given to the National Security Council Secretariat (NSCS). This consolidates the role of the NSCS in guiding cybersecurity strategies at the national level.
Impact on Policy and Governance
The amendments introduced through the notification are poised to significantly enhance the Indian government's cybersecurity framework by clarifying the roles of various ministries. The clear separation of responsibilities, telecom network security to the Department of Telecommunications, cybercrime to the Ministry of Home Affairs, and overall cyber strategy to the National Security Council Secretariat could seen as better coordination between ministries. This clarity is expected to reduce bureaucratic delays, allowing for quicker response times in addressing cyber threats, cybercrimes, and telecom vulnerabilities. Such efficient handling is crucial, especially in the evolving landscape of digital threats. These changes have been largely welcomed as it recognises the potential for improved regulatory oversight and faster policy implementation and a step forward in bolstering India’s cyber resilience.
Conclusion
The Government of India (Allocation of Business) Rules, 1961 amendments mark a critical step in strengthening India's cybersecurity framework. By setting out specific responsibilities for telecom network security, cybercrime, and overall cybersecurity strategy among key ministries, the government seeks to improve coordination and reduce bureaucratic delays. This policy shift is poised to enhance India’s digital resilience, providing a foundation for rapid responses to emerging cyber threats. However, success hinges on effective implementation, resource allocation, and collaboration across ministries. Addressing concerns like potential jurisdictional overlap and ensuring the inclusion of bodies like NCIIPC will be pivotal to ensuring comprehensive cyber protection. The complexity of cyber crimes and threats is evolving every day and the government's ability and preparedness to handle them with regulatory insight is a high priority.
References
- https://egazette.gov.in/(S(4r5oclueuwrjypfvr5b4vtzg))/ViewPDF.aspx
- https://www.ptinews.com/story/national/govt-specifies-roles-on-matters-related-to-security-of-telecom-network-cyber-security-and-cyber-crime/1856627
- https://www.thehindubusinessline.com/economy/centre-to-further-streamline-mechanism-to-deal-with-cyber-security-cyber-crime/article68694330.ece
- https://telecom.economictimes.indiatimes.com/news/policy/govt-specifies-roles-on-matters-related-to-security-of-telecom-network-cyber-security-and-cyber-crime/113754501
Introduction
Phishing as a Service (PhaaS) platform 'LabHost' has been a significant player in cybercrime targeting North American banks, particularly financial institutes in Canada. LabHost offers turnkey phishing kits, infrastructure for hosting pages, email content generation, and campaign overview services to cybercriminals in exchange for a monthly subscription. The platform's popularity surged after introducing custom phishing kits for Canadian banks in the first half of 2023.Fortra reports that LabHost has overtaken Frappo, cybercriminals' previous favorite PhaaS platform, and is now the primary driving force behind most phishing attacks targeting Canadian bank customers.
In the digital realm, where the barriers to entry for nefarious activities are crumbling, and the tools of the trade are being packaged and sold with the same customer service one might expect from a legitimate software company. This is the world of Phishing-as-a-Service (PhaaS), and at the forefront of this ominous trend is LabHost, a platform that has been instrumental in escalating attacks on North American banks, with a particular focus on Canadian financial institutions.
LabHost is not a newcomer to the cybercrime scene, but its ascent to infamy was catalyzed by the introduction of custom phishing kits tailored for Canadian banks in the first half of 2023. The platform operates on a subscription model, offering turnkey solutions that include phishing kits, infrastructure for hosting malicious pages, email content generation, and campaign overview services. For a monthly fee, cybercriminals are handed the keys to a kingdom of deception and theft.
Emergence of Labhost
The rise of LabHost has been meticulously chronicled by various cyber security firms which reports that LabHost has dethroned the previously favored PhaaS platform, Frappo. LabHost has become the primary driving force behind the majority of phishing attacks targeting customers of Canadian banks. Despite suffering a disruptive outage in early October 2023, LabHost has rebounded with vigor, orchestrating several hundreds of attacks per month.
Their investigation into LabHost's operations reveals a tiered membership system: Standard, Premium, and World, with monthly fees of $179, $249, and $300, respectively. Each tier offers an escalating scope of targets, from Canadian banks to 70 institutions worldwide, excluding North America. The phishing templates provided by LabHost are not limited to financial entities; they also encompass online services like Spotify, postal delivery services like DHL, and regional telecommunication service providers.
LabRat
The true ingenuity of LabHost lies in its integration with 'LabRat,' a real-time phishing management tool that enables cybercriminals to monitor and control an active phishing attack. This tool is a linchpin in man-in-the-middle style attacks, designed to capture two-factor authentication codes, validate credentials, and bypass additional security measures. In essence, LabRat is the puppeteer's strings, allowing the phisher to manipulate the attack with precision and evade the safeguards that are the bulwarks of our digital fortresses.
LabSend
In the aftermath of its October disruption, LabHost unveiled 'LabSend,' an SMS spamming tool that embeds links to LabHost phishing pages in text messages. This tool orchestrates a symphony of automated smishing campaigns, randomizing portions of text messages to slip past the vigilant eyes of spam detection systems. Once the SMS lure is cast, LabSend responds to victims with customizable message templates, a Machiavellian touch to an already insidious scheme.
The Proliferation of PhaaS
The proliferation of PhaaS platforms like LabHost, 'Greatness,' and 'RobinBanks' has democratized cybercrime, lowering the threshold for entry and enabling even the most unskilled hackers to launch sophisticated attacks. These platforms are the catalysts for an exponential increase in the pool of threat actors, thereby magnifying the impact of cybersecurity on a global scale.
The ease with which these services can be accessed and utilized belies the complexity and skill traditionally required to execute successful phishing campaigns. Stephanie Carruthers, who leads an IBM X-Force phishing research project, notes that crafting a single phishing email can consume upwards of 16 hours, not accounting for the time and resources needed to establish the infrastructure for sending the email and harvesting credentials.
PhaaS platforms like LabHost have commoditized this process, offering a buffet of malevolent tools that can be customized and deployed with a few clicks. The implications are stark: the security measures that businesses and individuals have come to rely on, such as multi-factor authentication (MFA), are no longer impenetrable. PhaaS platforms have engineered ways to circumvent these defenses, rendering them vulnerable to exploitation.
Emerging Cyber Defense
In the face of this escalating threat, a multi-faceted defense strategy is imperative. Cybersecurity solutions like SpamTitan employ advanced AI and machine learning to identify and block phishing threats, while end-user training platforms like SafeTitan provide ongoing education to help individuals recognize and respond to phishing attempts. However, with phishing kits now capable of bypassing MFA,it is clear that more robust solutions, such as phishing-resistant MFA based on FIDO/WebAuthn authentication or Public Key Infrastructure (PKI), are necessary to thwart these advanced attacks.
Conclusion
The emergence of PhaaS platforms represents a significant shift in the landscape of cybercrime, one that requires a vigilant and sophisticated response. As we navigate this treacherous terrain, it is incumbent upon us to fortify our defenses, educate our users, and remain ever-watchful of the evolving tactics of cyber adversaries.
References
- https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/labhost-cybercrime-service-lets-anyone-phish-canadian-bank-users/amp/
- https://www.techtimes.com/articles/302130/20240228/phishing-platform-labhost-allows-cybercriminals-target-banks-canada.htm
- https://www.spamtitan.com/blog/phishing-as-a-service-threat/
- https://timesofindia.indiatimes.com/gadgets-news/five-government-provided-botnet-and-malware-cleaning-tools/articleshow/107951686.cms
