AI Governance in India 2026: Complete Regulatory Landscape — RBI, SEBI, DPDP Act, IRDAI, MeitY, and How to Build One Program That Satisfies All of Them

India doesn't have an AI law. It has RBI, SEBI, IRDAI, and the DPDP Act, each legislating or regulating AI through their own existing mandate, each with a different enforcement mechanism and a different idea of what evidence looks like. A bank with a brokerage arm and an insurance subsidiary is answering to four different regulatory lenses on the same underlying AI systems, and the practical failure mode isn't misunderstanding any one regulator — it's building four disconnected compliance efforts when one properly structured program would satisfy all of them.

Start by naming the actual documents, not the ones circulating secondhand

RBI's binding AI-adjacent instruments are its existing IT governance, cyber-resilience, and outsourcing master directions. RBI's extended model risk guidance, discussed in the market as a mid-2026 draft, postdates this review's knowledge cutoff — treat specific clause-level claims about it as unverified until checked against RBI's published text. SEBI's 2024 AI/ML disclosure and accountability obligations for registered intermediaries, and IRDAI's underwriting and claims AI expectations, are both real; MeitY's IndiaAI Mission framework is genuinely voluntary for most sectors today, correctly described as shaping future mandatory guidance rather than being one itself.

The DPDP Act's penalty mechanism doesn't work the way the headline math suggests

What's genuinely true and worth board attention: high-volume AI processing creates more individual instances where something can go wrong, which is a real operational risk — just not the specific multiplication the original framing implied. Similarly, the Act's 72-hour breach notification figure comes from the draft DPDP Rules 2025 (a detailed report following an initial "without delay" notification to the Board), not a fixed deadline written into the Act itself — treat it as a draft Rules requirement pending finalization, not settled statutory text.

Sector-driven regulation means the same evidence has to speak three dialects

A bank with capital markets and insurance subsidiaries genuinely does face three regulators with three different evidence formats from the same underlying AI governance work — this part of the original analysis holds up. RBI examination evidence centers on audit trail and board oversight; SEBI's ask centers on algorithm documentation and accountability for AI-generated recommendations; IRDAI's centers on underwriting and claims-AI fairness and explainability. Building three separate programs to answer three questions about the same models is the single most common waste of compliance budget this review has seen described across these guides — one evidence chain, reformatted per regulator, is the only approach that scales.

India-specific fairness testing is the one place "satisfied EU AI Act" doesn't transfer

A bank that has run EU AI Act Article 10 training-data bias checks has tested for gender, age, and national-origin bias — categories the EU framework actually covers. It has not tested for caste, religion, language, or disability proxies, because the EU framework was never built to look for them, and RBI's fairness expectations explicitly require that India-specific lens. Treat EU AI Act fairness compliance and India proxy-variable fairness testing as two separate workstreams that happen to share a testing methodology, not one requirement that satisfies the other.

Action checklist for an India multi-regulator AI governance program

1. Audit every internal document for "RBI 2024 AI Circular" or "FREE-AI five pillars" references and replace them with the actual instrument names and structure before your next regulatory submission.
2. Remove any penalty-exposure calculation that multiplies the DPDP Act's ₹250 crore ceiling by record or decision count — reframe around instance-based Board enforcement.
3. Build one evidence chain (inventory, testing, monitoring, board reporting) and produce RBI, SEBI, and IRDAI submission formats from it, rather than three separate compliance tracks.
4. Treat India proxy-variable fairness testing as a distinct requirement from EU AI Act fairness testing — build both if you have both exposures, and don't assume one covers the other.
5. Track RBI's actual published eMRM guidance directly once finalized, and update any compliance plan built on secondhand draft descriptions at that point.