What does SEBI's Responsible AI circular require from regulated entities?

SEBI's 2024 Responsible AI circular requires regulated entities (stock brokers, investment advisers, mutual funds, portfolio managers, research analysts) deploying AI in regulated activities to: (1) maintain documentation of AI systems used in regulated activities — purpose, model type, data sources, decision methodology; (2) ensure AI systems are explainable — entities must be able to explain algorithmic recommendations and decisions to SEBI and to clients when asked; (3) conduct regular testing for bias in AI systems affecting investor recommendations and portfolio construction; (4) implement human oversight for AI-generated advice — AI systems cannot operate without human review for advice that materially affects client portfolios; (5) maintain audit trails for algorithmic trading and investment advisory systems. The circular specifically addresses robo-advisory, algorithmic trading, and automated research — three high-volume AI use cases in Indian capital markets where SEBI has direct supervisory authority.

How does RBI FREE-AI define responsible AI for banks?

RBI FREE-AI defines responsible AI for banks through five pillars: Fairness (AI systems must not discriminate on protected characteristics; India-specific requirements include testing for caste, religion, language, and disability proxy variables that may not be explicitly included as data features but can be inferred from correlated variables), Reliability (AI systems must perform consistently and predictably; includes behavioral consistency for LLMs, performance monitoring, and robustness against distribution shift), Explainability (banks must be able to explain AI decisions proportionate to their impact; credit denial requires individual-level explanation; aggregate model documentation is not sufficient for individual customer-facing decisions), Ethics (AI systems must not be used for prohibited purposes; human oversight must be maintained for high-stakes decisions; AI must not manipulate customers), Security (AI systems must be resilient to adversarial manipulation; adversarial robustness testing required). The FREE-AI Framework is the operational definition of responsible AI for RBI-supervised institutions — 'responsible AI' claims that cannot be mapped to FREE-AI pillars are not examination-ready.

What is the difference between responsible AI governance and responsible AI statements?

Responsible AI governance produces evidence; responsible AI statements produce documents. The distinction matters in examination: a bank with a responsible AI policy document but no evidence that the policy is implemented will receive an examination finding that governance is aspirational, not functional. Five capabilities distinguish genuine responsible AI governance from statements: (1) Tested fairness — not a commitment to fairness but documented test results showing the AI system was tested for discriminatory outcomes, using appropriate methods for the deployment context and India-specific proxy variables; (2) Documented explainability — not a statement that decisions are explainable but a mechanism that can produce an explanation for any given decision on demand; (3) Active human oversight — not a policy that AI decisions are reviewed but documented processes showing review happens, who is responsible, and what happens when the reviewer disagrees with the AI; (4) Incident records — not a response plan for AI incidents but evidence of incidents handled, classified, investigated, and closed according to a documented process; (5) Audit trail — not governance documentation but a connected evidence chain from policy through deployment through individual decisions.

Responsible AI in Banking: SEBI Circular, RBI FREE-AI, and What "Responsible" Requires in Practice

Every bank's board deck has a slide on "responsible AI." Almost none of those slides survive contact with an RBI examiner who asks for the fairness test results, the explanation for a specific declined loan, or the sign-off record from the last AI incident review. Responsible AI in Indian financial services is now an examination subject, not a values statement. SEBI's AI/ML disclosure obligations for regulated intermediaries and RBI's FREE-AI framework both convert "responsible" into things a bank has to produce on demand, not describe in a policy document.

What RBI's FREE-AI framework actually asks for

That correction isn't pedantic — it's operationally costly to get wrong, because it tells the examiner where your governance program actually came from. What the report's risk-mitigation recommendations do ask for, in substance, lines up closely with what examiners actually probe in practice:

Fairness testing that covers India-specific proxy variables — pincode and surname as caste proxies, name patterns as religion proxies, device and mobile-usage signals standing in for language or disability. A fairness toolkit imported wholesale from a US or EU vendor doesn't test for any of this, because none of it is a protected characteristic there.
Decision-level explainability for consequential outcomes, especially credit decisions. A model card is documentation. It is not an explanation of why one specific customer's loan was declined.
Human oversight that functions as a real control. A second AI system rubber-stamping the first AI system's decision is not human oversight under any reading of the report's accountability principle, and examiners who have seen this pattern before will say so directly.
Adversarial and robustness testing for any AI system exposed to manipulation — for LLM-based customer service and advisory tools, that means prompt injection and jailbreak testing, not the back-testing statistics teams already run for credit scorecards.

What SEBI expects from capital markets participants

What has stayed consistent across SEBI's AI/ML guidance, regardless of which circular you point to, is the substance. Investment advisers and research analysts using AI have to be able to explain a recommendation to a client in plain language. Robo-advisory platforms need a documented human review step before material portfolio changes go out. Brokers using AI in order generation need an audit trail that can answer a market surveillance query inside SEBI's prescribed response window. None of this is new philosophy — it's the suitability and audit-trail obligations SEBI has always applied to a human adviser, extended to whichever system is actually making the call.

Five things that separate a program from a statement

A responsible AI program and a responsible AI statement look identical in a board deck. They diverge the moment an examiner asks for evidence, and five capabilities consistently make the difference between the two.

Test results, not test intentions, come first — a bank that says it tests for bias has said nothing until it produces the actual run, the demographic cuts used, and the date it ran. A working explanation mechanism is second: if nobody in the room can pull up a feature-level explanation for a specific credit decision during the examination meeting, the "explainability framework" slide was theatre. Human oversight with a paper trail is third — who reviewed the AI-generated advice, what qualified them to review it, and what happened on the occasions they disagreed; if that record doesn't exist, the review didn't happen in any sense that survives scrutiny.

Incident records are the fourth, and the one banks resist most. A responsible AI program with zero logged incidents across a material deployment has either not looked for problems or isn't writing them down when it finds them — neither reads well to an examiner who has walked through a hundred of these conversations before. The fifth is a connected audit trail running from board approval through to the individual decision, retrievable as one query rather than assembled from three systems that each hold a fragment of the story.

What to do about it this quarter

Pull the actual FREE-AI committee report — not a vendor's summary — and re-map your governance documentation to its Sutras and recommendations instead of an invented acronym structure.
Run, and keep on file, one concrete bias test result using India-specific proxy variables, even as a pilot on your highest-volume credit product.
Pick one AI-assisted decision type and build a working, on-demand explanation for it before an examiner asks for one.
Start an incident log for every production AI system today, backfilling anything your teams already know about from the last quarter.
Chain governance records — board approval, validation, monitoring, incidents — so a single query produces the full story for any system, not a scavenger hunt across departments.