SEBI’s AI and ML guidelines for the securities market are still a draft, but the rules around them are not. Since 10 February 2025, any broker, depository participant or other person regulated by SEBI that uses artificial intelligence or machine learning has been legally answerable for what those tools do, whether it built them or bought them. A reporting duty dating back to 2019 also continues.
Trading members are filing their latest half-yearly AI/ML returns this week. What the June 2025 consultation paper adds is the detail: governance teams, testing, disclosure to clients and a lighter regime for back-office use. This explainer sets out which parts are binding today, which are proposals, and what an investor can reasonably ask a broker or fund house that advertises AI.
The binding part: regulation 16C
The Securities and Exchange Board of India (Intermediaries) (Amendment) Regulations, 2025 inserted a new Chapter IIIB, “Usage of Artificial Intelligence”, into the Intermediaries Regulations of 2008. SEBI’s consolidated text of the regulations records the chapter as in force from 10 February 2025.
Regulation 16C says that a person regulated by SEBI that uses AI and ML tools, “either designed by it or procured from third-party technology service providers, irrespective of the scale and scenario of adoption”, is solely responsible for three things:
- the privacy, security and integrity of investors’ and stakeholders’ data, including data it holds in a fiduciary capacity;
- the output arising from the tools it relies on;
- compliance with the laws in force.
If the rule is broken, SEBI may take the action it deems fit, including action under Chapter V of the regulations. The definition of AI and ML tools is wide. It covers any application or system offered to investors, or used internally, to facilitate investing and trading, disseminate investment strategies and advice, or carry out the firm’s activities, including compliance.
The practical effect is that “the vendor’s model got it wrong” is not a defence. A broker that uses a third-party chatbot or a bought-in surveillance model carries the same responsibility as one that wrote its own code. The proposal went to the SEBI Board in December 2024; the board memorandum shows that parallel amendments were proposed for stock exchanges, clearing corporations and depositories under their own regulations.
The reporting duty since 2019
Before setting rules, SEBI asked for an inventory. According to the same board memorandum, circulars of 4 January 2019 (stock brokers and depository participants), 31 January 2019 (exchanges, depositories and clearing corporations) and 9 May 2019 (mutual funds, asset management companies and trustees) required these entities to report the AI and ML systems they offer or use.
That reporting is still running. A Metropolitan Stock Exchange circular of 5 October 2026 tells every trading member that executed even one algorithmic trade between 1 April and 30 September 2026 to file its AI/ML report by 15 October 2026. Members that use algorithm software but no AI or ML must still file a nil return. Members also registered with NSE file once with NSE, which shares the submission with the other exchanges.
The memorandum summarises what the returns showed. Brokers and depository participants were using AI and ML for surveillance, order execution, KYC and anti-money laundering. Market infrastructure institutions used it for surveillance, risk management, data analysis, document review with generative AI, cyber security and chatbots. Mutual funds used it for surveillance, customer service by email, WhatsApp and chatbots, cyber security and customer segmentation.
The draft: five principles from June 2025
On 20 June 2025 SEBI published a consultation paper on guidelines for responsible usage of AI/ML in Indian securities markets, prepared from the recommendations of a SEBI working group. Comments closed on 11 July 2025. The paper itself groups its proposals under five headings.
Model governance. Firms would need an internal team with the skills to monitor and challenge their models, a designated senior manager responsible for oversight, and fallback plans if an AI application fails. Third-party AI services would be treated as provided by the firm itself. Logs would be kept in enough detail to reconstruct events in order, models would be independently audited by people who did not build them, and accuracy results and audit findings would be shared with SEBI periodically.
Investor protection and disclosure. Where AI directly affects clients, as in algorithmic trading, portfolio management or advisory services, firms would tell clients so, in language they can follow. The proposed disclosures include the product’s features, purpose, risks, limitations and accuracy results, any fees, and the quality of the data behind AI-driven decisions.
Testing. Models would be tested in an environment separate from live systems, under stressed and normal market conditions, and shadow-tested on live traffic before deployment. Input and output data would be stored for at least five years, with documentation that makes outcomes “explainable, traceable and repeatable”.
Fairness and bias. Models should not favour or discriminate against one group of clients, and firms would put controls in place to find and remove bias in their data.
Data privacy and cyber security. Firms would need a clear policy for AI data, comply with data protection law, and report glitches and data breaches to SEBI and other authorities.
An annexure lists control measures for risks specific to generative AI. Among them are watermarking and provenance tracking against deepfakes and fake financial news, periodic reporting of AI vendors so SEBI can watch for concentration on a few providers, monitoring of herding by exchanges, and circuit breakers and kill switches against runaway model behaviour.
A lighter regime for back-office AI
The paper proposes a tiered approach. The full set of principles would apply where AI is used in business operations that directly affect clients. For internal uses such as compliance, surveillance and cyber security tools, only a subset would apply: the governance team, ongoing monitoring, testing and data security provisions.
| Item | Status on 12 October 2026 | Who it covers |
|---|---|---|
| Regulation 16C: sole responsibility for data, output and legal compliance | In force since 10 February 2025 | Every person regulated by SEBI using AI or ML |
| AI/ML system reporting | In force since 2019; current half-year due 15 October 2026 at MSE | Brokers, DPs, market infrastructure institutions, mutual funds |
| Governance, disclosure, testing, fairness and data principles | Proposed in the June 2025 consultation paper | Market participants, tiered by use |
Sources: SEBI Intermediaries (Amendment) Regulations, 2025; SEBI board memorandum, December 2024; SEBI consultation paper, 20 June 2025; MSE circular MSE/MEM/19842/2026.
Until SEBI issues final guidelines, the consultation paper has no legal force. SEBI’s list of circulars, checked on 12 October 2026, contained no final AI/ML guidelines; the latest circulars were dated 7 October 2026.
What it means for investors
For a retail investor, the binding rule is the useful one. If a broker’s AI chatbot gives wrong information, an AI-driven KYC check mishandles your documents or a model leaks your data, the regulated firm is responsible under regulation 16C. It cannot point to its software supplier.
When a product is sold as “AI-powered”, it is fair to ask what the AI actually does, what data it uses and what its limits are. The draft would make those disclosures standard for advisory, portfolio management and algorithmic trading services; until then, a firm’s answer is voluntary. AI marketing is not investment advice and says nothing about future returns.
Be wary of any app or message that claims to be “SEBI-approved AI”. SEBI regulates the firm, not the tool. Before acting on a letter or notice that claims SEBI’s authority, use the regulator’s document verification check, and follow SEBI’s own announcements through its official WhatsApp channel. For the wider government approach to AI, see our explainer on India’s AI governance guidelines; for synthetic video and cloned voices, see deepfake labelling under the IT Rules.
Sources
SEBI: Securities and Exchange Board of India (Intermediaries) (Amendment) Regulations, 2025, published 10 February 2025; Intermediaries Regulations, 2008 as last amended on 5 December 2025 (consolidated text); board memorandum on assigning responsibility for the use of AI tools, December 2024; consultation paper on guidelines for responsible usage of AI/ML in Indian securities markets, 20 June 2025; list of circulars, viewed 12 October 2026. Metropolitan Stock Exchange of India: circular MSE/MEM/19842/2026, 5 October 2026. Documents consulted on 12 October 2026; links appear beside the relevant discussion.
