SEBI's regulation of AI and machine learning in the securities market

SEBI's first formal step on AI in the securities market came in 2019, through three near-identical circulars titled "Reporting for Artificial Intelligence (AI) and Machine Learning (ML) applications and systems offered and used by" the relevant class of entity. The first, dated 4 January 2019 (SEBI/HO/MIRSD/DOS2/CIR/P/2019/10), covered market intermediaries such as stock brokers and depository participants.¹ The second, dated 31 January 2019 (SEBI/HO/MRD/DOP1/CIR/P/2019/24), covered market infrastructure institutions (MIIs), meaning stock exchanges, depositories and clearing corporations.² The third, dated 9 May 2019 (SEBI/HO/IMD/DF5/CIR/P/2019/63), covered mutual funds, asset management companies, trustee companies and boards of trustees.³

SEBI's later Board memorandum explains their scope. Any application, software or system offered to investors by an MII or intermediary to facilitate investing and trading, to disseminate investment strategies and advice, or to carry out compliance activities fell within the circulars where AI/ML was "portrayed as a part of the public product offering or under usage for compliance or management purposes". The aim of the reporting was to understand how the technologies were being adopted and to ensure preparedness for AI/ML issues that might arise. The provisions were later folded into SEBI's master circulars for each class of entity.⁴

Bar & Bench's 2026 commentary describes the mutual fund circular as requiring funds to explain how AI had been implemented and what safeguards were in place to prevent abnormal behaviour.⁸ The commentary also notes that the reporting is an information-gathering step: it does not say how SEBI would act if dissatisfied with a disclosure and sets no threshold for the adequacy of a model's logic.⁸

In the memorandum placed before its Board, SEBI summarised what the 2019 returns revealed about AI/ML use:⁴

SEBI concluded that AI/ML tools play an increasingly important part both in core operations (surveillance, risk management, KYC, cybersecurity) and in functions that touch investors directly (order execution, customer segmentation and service). While acknowledging benefits such as efficiency, accuracy and better customer experience, it said there was a need to "assign responsibility" to regulated persons that use such tools in order to protect investors, and that mandating responsibility was expected to bring "more seriousness" to their deployment.⁴

The change in approach was therefore from disclosure of what AI exists to accountability for what AI does.

On 13 November 2024 SEBI published a consultation paper titled "Proposed amendments with respect to assigning responsibility for the use of artificial intelligence tools by Market Infrastructure Institutions, Registered Intermediaries and other persons regulated by SEBI".⁵ The proposal was split in two: amendments to the SEBI (Intermediaries) Regulations, 2008 for registered intermediaries and other regulated persons, and amendments to the Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018 and the SEBI (Depositories and Participants) Regulations, 2018 for MIIs.⁴

The draft imposed a mandate on any person regulated by SEBI that uses AI tools, "either designed by it or procured from third-party technology service providers, irrespective of the scale and scenario of adoption", that it would be solely responsible:⁴

• for the privacy, security and integrity of investors' and stakeholders' data, including data it holds in a fiduciary capacity;
• for the output arising from the tools and techniques it relies upon; and
• for compliance with applicable laws.

The Board memorandum for the December 2024 meeting (the Board met on 18 December 2024) recommended inserting new regulations to this effect in all three sets of regulations, to be notified after due process.⁴ SEBI's regulations register records SEBI (Intermediaries) (Amendment) Regulations, 2025,⁶ and amendments to the Depositories and Participants Regulations and the SECC Regulations, all dated 10 February 2025. These match the three instruments named in the memorandum. The register entries list only titles and dates, so this entry does not quote the notified wording or give regulation numbers.

The practical effect is that a broker, adviser, exchange or fund cannot defend a failure by pointing to a vendor's model. Responsibility sits with the regulated entity regardless of whether the AI is its own or bought in, and regardless of how widely it is used.

On 20 June 2025 SEBI released a "Consultation Paper on guidelines for responsible usage of AI/ML in Indian Securities Markets", inviting public comments through its portal.⁷ The full text was not available to this entry's author; the description below relies on a published analysis.

According to commentary in IndiaCorpLaw, the paper proposes a principles-based framework for market infrastructure institutions, market intermediaries and mutual funds, resting on six pillars: ethics, accountability, transparency, auditability, data privacy and fairness. Regulated entities would adopt a board-approved AI governance framework covering internal controls, algorithmic audits and model explainability. Periodic audits and model validations would look for bias and operational irregularities, firms would keep documentation for supervisors, and AI systems that perform critical market functions would be subject to human monitoring. The commentary also describes an emphasis on data integrity and privacy aligned with the Digital Personal Data Protection Act, 2023.⁹

The same analysis criticised the draft for not saying whether liability for AI malfunction falls on the developer, the deploying entity or the approving board, and linked the gap to directors' duties under sections 134(5) and 166(3) of the Companies Act, 2013. It also faulted the absence of a defined standard of care for boards, the lack of a specification of human-in-the-loop or human-on-the-loop models (manual oversight being impractical for latency-sensitive trading), and the application of the same requirements to high-risk systems such as investment advice and low-risk ones such as customer chatbots. It contrasted this with the EU AI Act's tiered obligations and Singapore's FEAT principles, and recommended proportionate regulation, audit cycles, adverse-event reporting and a permanent AI/ML advisory council.⁹

Cyber advisory (May 2026). On 5 May 2026 SEBI issued an "Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection" (HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026).¹⁰ MediaNama reported that the circular named Anthropic's Claude Mythos as an example of a model that can find and exploit vulnerabilities at speed and scale. According to that report it directs regulated entities to patch immediately, run continuous vulnerability assessment and penetration testing with both conventional and AI-based tools under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), hold vendors accountable, treat AI capability as an explicit scenario in periodic risk assessments and prepare a long-term plan for AI-driven detection. SEBI also formed a task force called cyber-suraksha.ai to examine AI-driven cyber risk, share threat intelligence and review vendor security.¹¹

The chairman's stance (September 2026). Speaking at Global Fintech Fest 2026, SEBI Chairman Tuhin Kanta Pandey said that SEBI uses AI for cybersecurity compliance, social-media monitoring and surveillance, but that an AI alert is not a regulatory finding and that enforcement and adjudication cannot be delegated to an opaque system. He said human-in-the-loop oversight is not enough on its own because people over-trust machines, listed safeguards including explainability, validation, bias controls, drift monitoring, cybersecurity, a stop mechanism, auditable usage and change logs, and said agentic AI needs stricter rules defining access, autonomy, permissible actions and reversibility. He also stressed that outsourcing technology does not transfer regulatory responsibility.¹²

SEBI's October 2026 common advertisement code, which treats AI-generated virtual influencers as celebrities requiring prior approval, is covered in a separate entry.

Commentators have raised several concerns about SEBI's approach. Bar & Bench's 2026 column observes that the 2019 reporting regime is an information-gathering step: it is unclear how SEBI would act if dissatisfied with a disclosure, no threshold exists for the adequacy of an AI system's logic, and it is unclear on what basis AI can be held accountable for the advice or investments it encourages.⁸

Of the June 2025 draft, IndiaCorpLaw's critique focused on undefined liability, the missing standard of care for boards, undefined human oversight and the lack of risk-based differentiation.⁹ The Bar & Bench column by Nakul Dewan argued that regulators need a proactive approach as AI spreads across investment advisory and compliance, and recommended clearly defined human oversight for consequential decisions, explainability standards, periodically tested circuit-breakers and liability that applies whether AI is built in-house or procured externally. It did not call for a ban, noting AI's efficiency and fraud-detection benefits.⁸

SEBI's own use of AI also features in the debate. Its chairman has described AI as a supervisory technology while insisting on human accountability for enforcement decisions, and has warned that common models and shared cloud infrastructure could become shared points of failure, so that cloud, AI and hosted-service providers might in time form part of critical market infrastructure.¹²

As of 15 October 2026:

• The 2019 reporting requirements, now incorporated in master circulars, and the 2025 amendments assigning responsibility for AI tools are in force. SEBI has since re-codified several of its regulations (for example, new Stock Brokers and Mutual Funds Regulations in 2026), and this entry does not trace how the AI-responsibility provisions were carried into those texts.
• The June 2025 consultation has not, on the sources reviewed, produced final guidelines. Searches of SEBI's website listings on legal documents, reports and press releases for "artificial intelligence" and "AI/ML" returned only the 2019 circulars, the November 2024 and June 2025 consultation papers, the May 2026 advisory and unrelated items.
• A Bar & Bench column of 22 August 2026 reported that SEBI's chairman had said guidelines for the responsible use of AI and ML were being prepared at a FICCI conference earlier that year. As reported, the framework would be tiered by the risk of each use case and would include human oversight, stronger data controls and kill-switches to halt abnormally behaving AI systems. The column treated the framework as still forthcoming, without a timeline.⁸

The details of any final framework, and whether it will be a circular or an amendment to regulations, therefore remain to be seen.