Securities and Exchange Board of India (Intermediaries) (Amendment) Regulations, 2025

What it does

The Securities and Exchange Board of India (Intermediaries) (Amendment) Regulations, 2025 amend the Securities and Exchange Board of India (Intermediaries) Regulations, 2008. On the site's reading, the part that matters for technology is regulation 16C. Under it, a regulated person that uses artificial intelligence or machine learning tools, whether built in house or bought from a vendor, is solely responsible for the privacy and integrity of investor data, for the output of the tools it relies on, and for compliance with the law.

That is a rule about outcome responsibility. It leaves no defence in the fact that a tool came from a supplier. The site's notes describe it as the one place where an Indian regulator has already written a binding rule on AI use for the entities it supervises, in a country that has no AI statute.

Who it binds

It binds the persons regulated under the Intermediaries Regulations, 2008, which are the Board's registered intermediaries. A business that sells AI tools to such a person is not bound by regulation 16C as such, but it feels the effect through the contract, since the regulated person cannot pass responsibility to it. The Board supervises the regulated person for compliance, and the vendor stands behind it only to the extent the contract provides.

What has changed, and when

• The Amendment Regulations were made at Mumbai on 6 February 2025, under F. No. SEBI/LAD-NRO/GN/2025/226, and were published in the Gazette of India Extraordinary, Part III, Section 4, on 10 February 2025.
• On the site's reading, regulation 16C is in force from publication in the Gazette on 10 February 2025.
• The Board's separate guidelines on the use of AI were, as far as the site could trace, a consultation of June 2025 and not binding. The Reserve Bank's FREE-AI report is a committee report and not a rule.

What turns on it in practice

The practical effect is on contracts. Contracts for AI tools are usually drafted as if a warranty and an indemnity settle who answers for the tool. The site's note on AI contracts, diligence and disclosure explains that, in India, they settle who pays, and only up to the cap, while responsibility sits elsewhere. For a regulated person that is now a matter of regulation 16C. An indemnity may move the money. It does not move the responsibility towards the regulator.

For the regulated person, that has several consequences. It has to know what its tools do with investor data, it has to be able to explain the output it relies on, and it has to keep evidence that it tested and supervised them. Diligence on a vendor has to go to the vendor's data handling and to what it owns, and the contract has to give the regulated person the audit and information rights it needs to meet its own duty.

The Digital Personal Data Protection Act, 2023 will say something similar about personal data from 13 May 2027, when its substantive provisions commence under the notification of 13 November 2025. Until then, regulation 16C is the AI-specific responsibility rule that binds a securities intermediary.

The site's technology and data notes, one on contracts and one on what AI law binds today in India, treat this amendment as the existing rule against which the rest is measured. The glossary entry on the contract of indemnity rests on the same point.