Governing the AI elephant

AI is changing too fast for rigid, specific regulations to stay useful for long, but Sebi and RBI papers offer some guardrails for India Inc

Artificial intelligence (AI) is now important for almost every business. But it matters most in financial services. Banks are using AI to check credit, catch fraud, and help customers. Stock exchanges and brokers are using it for surveillance and compliance. Fund managers are using it for research and investing.

 

Financial companies have huge amounts of data that make them ideal for AI. But it also means AI mistakes can be very costly. If an algorithm is deciding who gets a loan or how a trade is handled, the questions that it raises are: Does the technology work? How can I make it work for me? And who is responsible when it fails?

 

Government’s Chief Economic Adviser V  Anantha Nageswaran spoke about this at an Assocham event on August 7. He warned that India’s financial sector needs to tackle AI safety risks now, instead of waiting and watching. This warning makes sense as AI is moving faster than the rules meant to govern it.

 

Two regulators are already acting: The Reserve Bank of India (RBI) and the Securities and Exchange Board of India (Sebi). Neither is making a full AI law yet, but are laying the groundwork. The insurance regulator has  in June 2026 set up a seven-member group to look at AI adoption, establish an ethical governance framework, and evaluate frontier AI risks in the insurance sector.  

 

In August 2025, the RBI released a report called FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence), the bedrock of which is trust. It is suggesting that banks and other regulated firms should have a board-approved AI policy. This policy should cover the whole life of an AI system — from building and testing it, to using it, watching it, and eventually retiring it. The report also stresses explainability, fairness, cybersecurity, and protecting customers.

 

This report is only a set of recommendations, not a binding law, so banks can’t be forced to follow it yet. But banks already have to follow existing RBI rules on things like risk, cybersecurity, and consumer protection — and these rules still apply when AI is involved. FREE-AI is showing where the RBI’s thinking is headed, and banks are paying attention by adopting it — after being nudged no doubt.

 

Sebi is taking a similar approach. In June 2025, it released a discussion paper on responsible use of AI and machine learning in stock markets. It is proposing ideas around model oversight, ongoing testing, telling investors when AI is used, fairness, data privacy, cybersecurity, and monitoring outside vendors.

 

The paper is suggesting that firms using AI in ways that affect customers directly should disclose this, along with the risks and limits of the tool. For AI used only internally — like compliance or fraud monitoring — the paper is proposing lighter rules. A caveat. This is still just a proposal. Sebi collected public feedback on it, but it isn’t a final rule yet.

 

Recognising the risks, in May 2026, Sebi issued a formal advisory about AI tools used to find security weaknesses. This one isn’t just a proposal — it’s operational guidance. It covers checking for vulnerabilities, patching systems, watching vendors, and monitoring security. It reflects a real concern: AI can help defend against cyberattacks, but it can also make it easier for attackers to find weak points.

 

But the regulators are clear that a bank can’t blame its AI vendor if customers are being treated unfairly, or a brokerage can’t dodge responsibility just because a third party built the AI tool it is using. Consequently, both regulators are avoiding rules about the technology itself. Instead, they’re focusing on the governance around AI — who’s responsible, how it’s monitored, how risks are managed.

 

This marks a shift for company boards. AI has been treated like a tech project, run by information technology (IT) or digital teams. Now it needs to sit alongside cybersecurity, risk management, and other board-level concerns, and boards need to ask where AI is most critical in their business, and which decisions are being shaped by algorithms. They should understand what data is feeding these systems and how good that data is, and how bias is being caught and fixed. They need to know whether management can explain how a key model is reaching its answers, and how the company is detecting model drift over time. It’s worth asking what the backup plan is if the system fails, how dependent the company is on outside AI vendors, and, importantly, who is responsible when something goes wrong.

 

Models constantly change as they are learning from new data, so it is difficult to build a detailed rulebook. Recognising this, both regulators have chosen broad principles over narrow rules: This is a welcome change from the prescriptive approach that regulators usually adopt.

 

AI is changing too fast for rigid, specific regulations to stay useful for long. The Ministry of Corporate Affairs is unlikely to issue a dedicated AI rulebook, leaving corporate India without one overarching law.  The papers from the RBI and Sebi offer practical, sector-tested guidance on governance and accountability. Any company can adopt these, making them useful to India Inc.  Corporations should treat these as a starting point for dealing with AI.

 

The writer is with Institutional Investors Advisory Services, a Sebi registered proxy advisory firm.

 

The views are personal. @AmitTandon_In