Artificial Intelligence is transforming India's financial sector - from robo-advisory platforms to automated compliance systems. The question in the headline is, in one sense, already out of date: SEBI has already introduced binding AI-specific obligations, and more detailed rules are at an advanced consultation stage. Fintechs, Investment Advisers, and Research Analysts should not assume AI sits outside the regulatory perimeter - because for SEBI-regulated entities, it explicitly does not. This article sets out exactly where the law stands in 2026 and what businesses should do next.
AI Adoption Is Growing Faster Than Regulation - But Regulation Has Caught Up More Than Most Assume
AI is no longer experimental in financial services. Fintechs and SEBI-regulated intermediaries increasingly use it for customer onboarding, portfolio analytics, fraud detection, investment research, customer support, and compliance monitoring.
What's changed since 2024 is that Indian regulators have moved from watching this trend to actively legislating around it - through targeted amendments rather than one overarching statute.
Does India Have a Dedicated AI Law?
No - there is still no horizontal AI Act comparable to the EU AI Act. But describing AI as "unregulated" in Indian financial services would now be inaccurate. Specific, binding rules already apply:
SEBI Regulation 16C. On February 6, 2025, SEBI notified the SEBI (Intermediaries) (Amendment) Regulations, 2025, inserting a new chapter on the use of Artificial Intelligence, effective February 10, 2025. Under Regulation 16C, any SEBI-regulated entity using AI or machine learning tools - whether built in-house or procured from a vendor - is solely responsible for: the privacy, security, and integrity of investor and stakeholder data processed through those tools; the accuracy and integrity of AI-generated output; and compliance with all applicable laws. This is a binding rule already in force, not a proposal.
SEBI's June 2025 Consultation Paper. Beyond Regulation 16C, SEBI has floated more detailed guidelines for responsible AI/ML usage in the securities market, proposing a board-approved AI governance framework, model explainability requirements, defined fallback procedures, continuous monitoring, independent audits, and human-in-the-loop review for material research or analyst outputs. This remains at the consultation/proposal stage and is worth tracking closely, since it will likely shape the next round of binding obligations for IAs, RAs, and other intermediaries.
The 2019 AI/ML reporting framework. SEBI's original circular from January 2019 already requires market intermediaries to periodically report their AI/ML applications to the exchanges; this reporting regime has since been harmonised across NSE, BSE, MSE, MCX, and NCDEX so that a single filing is shared across exchanges.
RBI's FREE-AI Framework. In August 2025, the RBI published its Framework for Responsible and Ethical Enablement of AI (FREE-AI), setting out roughly two dozen recommendations for AI use in financial services. This is advisory rather than binding, but it signals RBI's direction for banks and NBFCs.
DPDP Rules. The Digital Personal Data Protection Rules were notified in November 2025 and are being phased in through 2027, giving practical, enforceable shape to the data protection obligations that already apply to any AI system processing personal data.
MeitY's synthetic content advisory. Separately, MeitY has issued advisories on labelling AI-generated content and embedding metadata to address deepfake risks - guidance rather than binding law, but relevant to any AI-generated marketing or client communication.
Together, this is best described as a fast-hardening patchwork of sector-specific binding rules and advisory frameworks - not a single AI law, but very much not a regulatory vacuum either.
Why SEBI-Regulated Entities Should Prepare Now
Whether you are an:
• Investment Adviser
• Research Analyst
• Portfolio Manager
• Stock Broker
• Fintech Platform
AI-generated outputs can directly affect investor decisions - and under Regulation 16C, your firm carries sole responsibility for those outputs regardless of whether the underlying model was built in-house or licensed from a vendor.
Examples of higher-risk use cases include:
• AI-generated research reports and analyst notes
• Automated suitability assessments
• Client risk profiling
• Investment recommendations
• Marketing content
• Customer grievance handling
Without proper oversight, these tools can expose businesses to compliance, operational, and reputational risk - and, under the current rules, that exposure sits squarely with the regulated entity, not the AI vendor.
What the Next Layer of Rules Is Likely to Focus On
Based on SEBI's June 2025 Consultation Paper and RBI's FREE-AI recommendations, future binding requirements are likely to formalise:
Human oversight. Meaningful human review of AI-assisted recommendations and analyses, particularly for material research or advice.
Data protection. Governance measures for AI systems that align with DPDP Act obligations and the newly notified DPDP Rules.
Transparency: Clear client-facing disclosure of where and how AI is used, so communications remain fair and not misleading.
Cybersecurity: Vendor due diligence and security controls specific to AI tools and the data they process.
Record-keeping: Documentation of AI governance approvals, monitoring activity, and audit trails - echoing the "independent audit" and "continuous monitoring" language already in SEBI's consultation paper.
Practical Steps Businesses Can Take Today
Given that Regulation 16C is already in force, this isn't a "wait and see" exercise. A practical AI compliance programme should include:
1. AI usage policy - a written internal policy identifying where AI is used and by whom.
2. AI risk assessment - mapped against Regulation 16C's data privacy, output-integrity, and legal-compliance obligations.
3. Vendor due diligence - including data handling, security practices, and contractual allocation of responsibility with third-party AI providers (noting that Regulation 16C keeps ultimate responsibility with your firm regardless of contract terms).
4. Human review procedures - sign-off before AI-generated research, advice, or marketing reaches a client.
5. Data privacy controls - aligned with the DPDP Act and its newly notified Rules.
6. Employee training on responsible AI use and its limits.
7. Cybersecurity monitoring specific to AI/ML systems.
8. Periodic compliance audits, anticipating that independent audit requirements are likely to become mandatory once SEBI's consultation paper is finalised.
These measures reduce legal risk today under Regulation 16C, and position your firm well ahead of whatever SEBI finalises from its consultation paper.
AI Governance Is Becoming a Competitive Advantage
Investors increasingly expect financial institutions to demonstrate responsible technology practices. Firms that build AI governance now - rather than reactively once new rules land - tend to see:
• Stronger investor confidence
• Better regulatory preparedness
• Improved operational controls
• Reduced compliance risk
• Enhanced brand reputation
Responsible AI adoption is no longer just an IT issue - it's a board-level governance priority, and for SEBI-regulated entities, it's already a binding legal one.
Conclusion
The honest answer to "will India introduce AI compliance rules" is: it already has, in part - Regulation 16C is in force today - and more detailed rules are actively being finalised. Investment Advisers, Research Analysts, fintechs, and financial institutions should treat AI governance as part of their existing compliance framework now, not something to defer until a comprehensive AI law arrives.
Businesses that prepare today, against the rules that already exist, will be far better positioned as SEBI's consultation paper and RBI's FREE-AI recommendations harden into binding obligations.
Frequently Asked Questions
Is AI legal in India's financial sector?
Yes. AI may be used in financial services, but SEBI-regulated entities are solely responsible under Regulation 16C for the data privacy, output integrity, and legal compliance of any AI/ML tools they use - whether built in-house or procured from a vendor.
Has SEBI issued AI-specific regulation?
Yes. SEBI inserted Regulation 16C into the Intermediaries Regulations in February 2025, and has separately issued a June 2025 Consultation Paper proposing more detailed responsible-AI governance requirements, including board-level oversight, explainability, and independent audits. A comprehensive, finalised framework covering all intermediaries is still pending.
Should fintech companies implement AI governance now?
Yes - for SEBI-regulated entities, Regulation 16C already makes this a legal necessity rather than a best practice. Establishing internal AI governance, documentation, and oversight now also prepares firms for the more detailed rules likely to follow from SEBI's consultation paper.
Preparing your business for AI regulation starts today.
KP RegTech assists fintech companies, Investment Advisers, Research Analysts, and other regulated entities in developing AI governance frameworks aligned with SEBI's Regulation 16C, reviewing AI-enabled business processes, strengthening data protection controls, and preparing for SEBI's forthcoming responsible-AI requirements. Whether you're deploying AI for advisory services, research, operations, or compliance, our team can help you build a defensible, audit-ready AI strategy. Get in touch to review your AI compliance readiness.