Lost in Translation? The Limits of Converting Law to Code
Siddharth Aiyar is the second co-author of this article.
Reports suggest that India’s Ministry of Electronics and Information Technology (“MeitY”) is attempting to convert legal provisions directly into software code. The proposal may seem tempting, i.e., if a legal instrument can be enforced with the objectiveness of a computer, then enforcement lacunae emerging from human biases, such as corruption or delays, will no longer be a challenge. This brings up the underlying question: can law be converted to code?
Let’s look at some global capacity building and govtech initiatives in similar tangents. Global institutions including the World Bank have acknowledged in their reports since 2016 that while digital transformation in government institutions remains cost effective and helpful, many governments make the mistake of investing heavily in digital infrastructure while completely ignoring what they call “analog complements.” In fact, there have been enough cyber or logistic incidents in India, including the CoWin Data Leak, and the C&AG’s findings on UIDAI’s Aadhar de-duplication efforts, which clearly implicate the tendency of government institutions across various levels in India to be subjected to a tendency called “techno-solutionism”. In fact, the India AI Mission’s 2025 Competency Framework on AI Integration recognises the idea of ‘techno-solutionism’ and claims. They use the phrase “technological fixes for complex societal challenges”, implying that tech systems should not be infused in public governance to incorporate them as mere “fixes” for complex issues. However, techno-solutionism exists as a spiralled problem when it shields for the lack of accountability for acts of omission. Historically, Indian administrative and anti-corruption frameworks are designed to heavily penalize acts of commission, such as active malfeasance, bribery, or explicit rule-breaking. In contrast, acts of omission, such as failing to intervene, ignoring citizen distress, or administrative paralysis are rarely prosecuted, routinely dismissed as mere bureaucratic inefficiency. Therefore, it is important that we look at MeitY’s “law-to-code” approach in that sense.
Briefly, law-to-code encapsulates either or both: (1) converting existing laws into a machine-readable format, or (2) law being drafted as code, with legal provisions written in a formal language designed for machine interpretation. It is envisioned as a rule-based system, where machines use the rules embedded in the code to execute laws. At its core, any law-to-code system requires three components. First, legal rules must be converted into a machine-readable format. Secondly, a system must be capable of evaluating whether the facts of a case satisfy those rules. Thirdly, the system must be able to dictate consequences when those conditions are met. As researchers have observed, this effectively creates a three-part architecture consisting of encoded norms, factual inputs, and an inference engine capable of reasoning over both.
Interestingly, this is no new concept. 17th century philosopher Gottfried Leibniz, for instance, proposed the calculus ratiocinator – a theoretical mathematical function that operates using a universal language (characteristica universalis) to resolve complex disputes. In the 20th century, as technologies evolved, jurist Lee Loevinger proposed the methodology of “jurimetrics,” through which logic, statistics, and early mechanical computers would be applied to legal data and judicial decision-making. One of the most famous applications of jurimetrics was the conversion of the British Nationality Act 1981 into a computer logic program. The modern “Rules as Code“ movement, which has found support among governments and regulators across multiple jurisdictions, represents the most recent attempt to answer this question.
The effectiveness of law-to-code, however, depends as much on the nature of the law being encoded as it does on the efficacy of the code itself. Regulations that are predominantly deterministic in nature, including regulations enforced by the Reserve Bank of India (“RBI”), are already being automatically enforced. For instance, RBI’s Automated Data Flow (“ADF”) framework mandates regulated entities to automatically extract information from source systems—including core banking systems, digital wallets, and cash management platforms — and submit it directly to the RBI in prescribed machine-readable formats. Since the regulator’s intent is clear, the verification of compliance is possible through machines which apparently “read” the rules.
In fact, RBI’s ongoing transition into Element-Based Reporting (“EBR”) extends this logic, now requiring regulated entities to submit more granular “atomic data elements,” such as a specific loan amount for a counterparty, a customer’s risk rating, or a capital adequacy ratio. Additional security measures ensure better verification, but the rationale remains consistent with that of the ADF—just at a more granular level.
These models succeed because the degree of subjectivity required for adequate execution of the code is fairly low. That is, whether a particular transaction has been reported, whether data has been submitted in the correct format, or whether a reporting threshold has been crossed are questions that can generally be answered objectively, and therefore can be adequately codified. Nevertheless, difficulties emerge when the law is to be interpreted in a more subjective manner, as is the case in privacy jurisprudence.
The Puttaswamy test established by the Supreme Court of India requires that any limitation on a privacy satisfy three conditions: legality, legitimate aim, and proportionality, specifically, that the restriction be the least intrusive means available. This last requirement relies on a presupposition that a human decision-maker, possessed of contextual judgment, will assess whether the measure is calibrated to the facts of the case. However, a self-executing compliance system applies its rules uniformly and absolutely, incapable of distinguishing the routine case from the edge case that demands a different result. Issues like this have culminated in judicial recognition of the importance of human judgment in matters of subjective enforcement.
That is not to say, however, that compliance with extant privacy laws cannot be automated at all. The Business Requirement Document (BRD) released by the National e-Governance Division (NeGD) for consent management may pique clear focus towards examining the relatively deterministic issue of consent validity. Put simply, it proposes the creation of a “Consent Management System” (CMS), a software which is “taught” or trained the rules of what constitutes valid consent. These rules would be applied to a “consent artifact”, i.e., a machine-readable record containing information such as the identity of the data principal, the purpose for which consent was granted, timestamps, and the status of that consent. When a data fiduciary wishes to initiate data processing, it is required to send an API call to the CMS which validates the consent on the basis of the encoded rules. Processing is allowed only if the CMS determines that the consent is valid. We may note that this fits neatly within the threefold architecture discussed earlier: (1) the rules are encoded into the CMS through which validity of consent is determined; (2) the consent artifact consists of the “facts” of the consent collected, and; (3) the CMS is capable of applying the rules to the facts—i.e., acts as the inference engine. Instead of attempting to automate privacy laws in its entirety, it merely codifies a limited aspect of privacy law and protocols that can be converted into a deterministic set of variables.
A more sophisticated version of such a system could rely on knowledge graphs which, as opposed to flat code, looks to organise data from various sources and map the relationships between these sources of data. This can be seen as somewhat of an extension from the EBR framework of the RBI. Advancing past simple machine-readable data, this approach engineers civic duties into self-executing code, rendering state action the automatic output of rigid, pre-compiled parameters. Such a representation of legal obligations is highly relevant, since legal obligations, rights, exemptions and liabilities, all derive meaning from their relationship with one another. A consent obligation under the the Digital Personal Data Protection Act, 2023 (“DPDP Act”), for instance, is connected not only to the act of processing data, but also to purposes of processing, categories of personal data, statutory exemptions, withdrawal mechanisms, and the obligations of data fiduciaries. Reducing these relationships into a collection of standalone rules may risk losing much of the legal context necessary for meaningful compliance.
However, while this approach would be advantageous in the context of deterministic regulatory environments as discussed in the case of the RBI, they do not eliminate the core limitation of law-to-code. Bhumika Billa in her account of law as an information system synopsises that implementing law as code runs the risk of (1) “plasticizing the law,” where legal terms are locked in time when the code was written, and; (2) increasing opacity as technical experts hold interpretive power, and may be readily subject to lesser oversight. Prathik Karthikeyan conceptualizes this phenomenon as a “jurisprudential compression tax.” Because law is inherently analog and contextual, translating it into binary, executable code requires a form of “lossy compression.” In this translation process, the essential elements of human equity, intentional ambiguity, and judicial discretion are permanently discarded to make the logic compile. The resulting “tax” paid by society for this technical efficiency is a rigid system utterly incapable of handling edge cases or democratic nuance.
If MeitY seems to attempt a workable law-to-code framework as reported, it would therefore require a hybrid architecture. At one level, machine-readable representations of legal obligations could automate the verification of objective legal conditions: determining facts capable of objective assessment and, where appropriate, implementing operational consequences such as blocking unauthorised processing or flagging potential non-compliance.
Beyond this point, a constitutional firewall must exist. Questions involving proportionality, reasonableness, public interest, or the allocation of liability cannot be delegated to code, which means that adjudicatory processes conferred to higher judiciary must be encouraged, irrespective of the existence of the Data Protection Board, unless interoperable standards approved by the DPB pass the judicial test. A system whose reasoning is inaccessible forecloses meaningful contestation, which Article 14 of the Indian Constitution does not permit. The firewall, in other words, only holds if what happens on the machine side of it remains explainable to the humans on the other.
In summary, if a knowledge-graph based model, for instance, offers us the best possible representation of law-to-code, it should limit applicability to execution of purely deterministic regulations. The model must also be able to segregate the objective determination of a legal breach from the discretionary allocation of liability. While such systems are expected to be able to grasp from enabled human review of decisions and contestability claims made, structural transparency around the automated or augmented decisions made by law-to-code systems can inculcate a practice approach to achieve schematic explainability in these convertible systems. Yet, it remains a long road in mathematically compiling nuances of not just the DPDP Act, but any case where states attempt to convert legal obligations into machine-enforceable systems.
About the Authors
Abhivardhan is the Managing Partner of Indic Pacific and President, Indian Society of Artificial Intelligence and Law. Siddharth Aiyar, the distinguished second author of this article, is a CIPP/E certified graduate from NLU Odisha and am currently working as a Trainee Associate in the Tech and Data Protection vertical at Arnava Legal.
Comments