SEBI — Cybersecurity Framework, Regulation 16C, and the AI Consultation

CSCRF 2024 — binding today

If SEBI regulates you, CSCRF already applies. That covers brokers and depositories. It covers mutual funds and portfolio managers. It covers investment advisers and market infrastructure institutions.

CSCRF is SEBI's Cybersecurity and Cyber Resilience Framework. SEBI issued it in 2024. It binds you now. It is not a proposal. The rules have tiers. How much you must do depends on how big you are.

• A documented information security policy.
• Every quarter, check your systems for weaknesses and then try to break in yourself. This is called VA/PT — vulnerability assessment and penetration testing.
• A Security Operations Centre. This is a team that watches your systems for attacks all day and all night.
• Quarterly cyber incident reporting.

CSCRF has been amended since it was issued

We have opened only the original circular of 20 August 2024. SEBI has issued later changes to CSCRF, but we have not opened them, so we do not list their dates or any deadlines here. Check sebi.gov.in for the current version. Pending confirmation

On 5 May 2026 SEBI issued Circular No. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026, "Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection". We opened the circular page on sebi.gov.in on 9 October 2026 but have not read the advisory, so we do not say what it requires.

Regulation 16C — the binding AI rule

There is also a separate AI rule, and it is already law.

SEBI added it through the SEBI (Intermediaries) (Amendment) Regulations, 2025. SEBI used its power under Section 30 of the SEBI Act, 1992. It notified the rule on 6 February 2025. The rule took effect when the Official Gazette printed it on 10 February 2025. That second date is the one that matters.

The rule sits in a new Chapter IIIB of the SEBI (Intermediaries) Regulations, 2008. The chapter is called "Usage of Artificial Intelligence". Regulation 16C is in it. Its heading is "Responsibility for the use of artificial intelligence".

If you use an AI tool, you own what it does. Regulation 16C makes this simple: a SEBI-regulated firm is solely responsible for any AI or machine-learning tool it uses. It does not matter whether you built the tool or bought it. It does not matter how small the use is.

You are responsible for three things: keeping client and stakeholder data private and secure, including data you hold on someone else's behalf; whatever the tool outputs; and staying compliant with the law. SEBI can act against you if any of that fails.

Buying the tool from a vendor does not move the liability to the vendor.

SEBI enforces this under Chapter V of the Intermediaries Regulations.

Regulation 16C covers intermediaries. SEBI gave other firms the same sole-responsibility rule. It used two matching instruments. SEBI's 208th Board meeting approved them. Primary-source link pending for both.

Stock exchanges and clearing corporations came under it on 10 February 2025. The instrument was the Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) (Amendment) Regulations, 2025.

Depositories and participants followed on 1 April 2025. The instrument was the SEBI (Depositories and Participants) (Amendment) Regulations, 2025.

AI-in-markets consultation — the proposed layer, not yet binding

SEBI is also thinking about going further, but it has not done so yet.

SEBI put out a paper on AI in securities markets on 20 June 2025. It asked for comments. It took them until 11 July 2025. We found no final guidelines in SEBI's list. We last checked on 6 October 2026. So it creates no duty today. Here is what it proposes:

• Model documentation.
• Model validation.
• Drift monitoring.
• Human oversight.
• Explainability for AI-driven investment tools.

Again, this is a proposal, not a rule. It asks nothing of you today. Consultation-to-binding-rule status: Pending confirmation.

Read the CERT-In breach-response and cyber duties guide →

So: you owe CSCRF work now. Regulation 16C makes you answerable for any AI tool you use, now. The consultation paper only warns you about what may come next.