What binding AI governance obligations does SEBI's Intermediaries Amendment Regulations 2025 create through Chapter III-A?

SEBI (Intermediaries) (Amendment) Regulations 2025 — gazette-notified February 6, 2025, effective February 10, 2025 — inserts Chapter III-A titled 'Usage of Artificial Intelligence' into the SEBI (Intermediaries) Regulations, 2008. This is a binding gazette-notified amendment to a principal regulation, not a circular or consultation paper — it has the force of law from the effective date. Chapter III-A creates four core AI governance obligations for all SEBI-registered intermediaries: (1) Sole non-delegable liability for AI tool outputs: every SEBI intermediary that uses AI/ML tools bears sole responsibility for the outputs of those tools. This liability cannot be transferred, delegated, or disclaimed to a third-party AI technology service provider. An intermediary that procures an AI model from a fintech vendor and deploys it to serve investors remains the sole accountable party for the AI's outputs — regardless of what the vendor contract says; (2) Sole responsibility for investor and stakeholder data: intermediaries bear sole responsibility for the privacy, security, and integrity of all investor and stakeholder data that is used or processed through any AI/ML tool. Client portfolio data, KYC data, trading data, and communication data processed by AI tools remain the intermediary's sole regulatory responsibility — data protection failures by an AI vendor tool are the intermediary's regulatory liability; (3) Full compliance with applicable law for all AI/ML usage: intermediaries must comply with all applicable laws — SEBI regulations, DPDP Act 2023, Reserve Bank directions for dual-regulated entities, and any other applicable law — in all AI/ML usage, at all scales of adoption. The regulation explicitly states that these obligations apply 'irrespective of the scale and scenario of adoption' — there is no threshold below which an intermediary's AI use falls outside the regulatory accountability framework; (4) Structural anchoring in principal regulations: by inserting these obligations into the Intermediaries Regulations 2008 (a principal regulation) rather than issuing a circular, SEBI has given AI governance obligations the same legal status as other SEBI registration and conduct requirements. A breach of Chapter III-A is a breach of the Intermediaries Regulations — subject to SEBI enforcement action, registration suspension, and adjudication penalties under SEBI's enforcement framework.

How does SEBI's Intermediaries Amendment Regulations 2025 Chapter III-A differ from the SEBI AI/ML Responsible Usage Framework 2025?

SEBI's Intermediaries Amendment Regulations 2025 (Chapter III-A) and the SEBI Guidelines for Responsible Usage of AI/ML (consultation paper June 2025, final circular August 2026) are two distinct regulatory instruments in SEBI's AI governance architecture with different legal character and different content: (1) Legal status: Chapter III-A is a gazette-notified amendment to a principal regulation — it has statutory force from February 10, 2025. The Responsible Usage Guidelines are issued as a circular — they have binding force through SEBI's regulatory directions power, but as circular guidance rather than a statutory amendment; (2) Timing: Chapter III-A came into force February 10, 2025. The Responsible Usage Framework consultation paper was issued June 20, 2025 — four months after Chapter III-A was already binding law. The final circular followed in August 2026; (3) Content focus: Chapter III-A establishes the fundamental liability and accountability structure for AI use — who bears responsibility, what cannot be delegated, what law must be complied with. The Responsible Usage Framework establishes operational governance requirements — kill-switch mandates, human oversight requirements, model governance infrastructure, vendor contract clauses, investor disclosures. Chapter III-A is the accountability foundation; the Responsible Usage Framework is the operational implementation guidance; (4) Enforcement pathway: Chapter III-A breach is enforced as a breach of the Intermediaries Regulations — the same enforcement regime as registration condition breaches. Responsible Usage Framework circular breach is enforced as non-compliance with SEBI directions. Both are serious, but the statutory amendment breach pathway may expose intermediaries to registration-level consequences; (5) Combined compliance requirement: both instruments apply simultaneously. An intermediary that has implemented the Responsible Usage Framework's operational requirements (kill-switch, human oversight, vendor clauses) but has not documented its AI governance accountability structure satisfying Chapter III-A's sole-liability requirements is non-compliant with the earlier, legally stronger instrument.

Which SEBI-registered entities does Chapter III-A of the Intermediaries Amendment Regulations apply to?

Chapter III-A applies to all SEBI-registered intermediaries under the SEBI (Intermediaries) Regulations 2008 — the broadest scope of any single SEBI AI governance instrument. The covered population includes every entity category registered with SEBI: (1) Market Infrastructure Institutions (MIIs): stock exchanges (NSE, BSE, MCX, NSE IFSC), depositories (NSDL, CDSL), and clearing corporations — the most systemically important entities in India's securities market; (2) Trading and execution intermediaries: all ~1,500 SEBI-registered stockbrokers, including discount brokers and full-service brokers; all depository participants (approximately 1,000+ DPs); (3) Investment management: all ~45 AMCs (Asset Management Companies), all ~400+ registered portfolio managers, all alternative investment funds; (4) Advisory and research: all ~1,300 Investment Advisers, all ~1,400 Research Analysts; (5) Credit and valuation: all SEBI-registered credit rating agencies (CRISIL, ICRA, CARE, Brickwork, India Ratings), valuation agencies; (6) Market infrastructure support: all registrar and transfer agents (RTAs), all custodians, all merchant bankers; (7) Other SEBI intermediaries: proxy advisors, investment bankers, market makers. The total regulated population across all these categories exceeds 10,000 entities. Every one of them has been subject to the Chapter III-A AI obligations since February 10, 2025 — regardless of whether they use AI for client-facing or back-office functions, regardless of the scale of their AI use, and regardless of whether the AI tools are in-house or procured.

What practical compliance steps must SEBI intermediaries take to satisfy Chapter III-A's non-delegable liability framework?

Chapter III-A's non-delegable liability framework creates several practical compliance obligations: (1) AI tool inventory and ownership documentation: every AI/ML tool deployed by the intermediary must be documented, with the intermediary's ownership of the tool's outputs and data handling explicitly recorded. A 'we use our vendor's AI' defense is not available under Chapter III-A — the documentation must reflect the intermediary's assumption of liability for vendor AI; (2) Vendor contract review for liability alignment: existing technology vendor contracts that purport to indemnify the intermediary for AI tool failures, or that place data security liability on the vendor, must be reviewed against Chapter III-A. Such provisions cannot override SEBI's regulatory liability allocation — the intermediary remains liable to SEBI regardless of what the vendor contract says. However, the intermediary can still structure commercial indemnification from the vendor while accepting the regulatory liability; (3) Data governance documentation for AI-processed investor data: the investor and stakeholder data that AI tools process must be subject to the intermediary's own data governance controls — access controls, encryption, retention limits, audit trails — not just the vendor's platform controls. The intermediary's sole responsibility for data privacy, security, and integrity requires direct governance, not vendor delegation; (4) Applicable law compliance mapping: the Chapter III-A compliance with 'all applicable laws' obligation requires a specific mapping exercise — what laws apply to the intermediary's specific AI use cases? For a stockbroker using AI for trade execution surveillance, applicable laws include SEBI regulations, the Securities Contracts (Regulation) Act, DPDP Act 2023, and potentially IT Act data protection obligations. For a dual-regulated entity (an NBFC that is also a SEBI broker), RBI obligations also apply; (5) Scale-independence documentation: because Chapter III-A applies 'irrespective of the scale and scenario of adoption', intermediaries cannot argue that their limited AI use creates limited compliance obligations. Even an intermediary that uses a single AI chatbot for client communication must document its AI governance in compliance with Chapter III-A.

AI Governance · SEBI · Chapter III-A · Intermediaries · Sole Liability · India BFSI

SEBI Intermediaries AI Amendment Regulations 2025 Chapter III-A: Gazette-Notified Binding AI Accountability — Non-Delegable Sole Liability for AI Outputs, Investor Data Security and Scale-Independent Obligations for All 10,000+ SEBI-Registered Intermediaries India

SEBI (Intermediaries) (Amendment) Regulations 2025 — gazette-notified February 6, 2025, effective February 10, 2025 — structurally inserts Chapter III-A 'Usage of Artificial Intelligence' into the SEBI (Intermediaries) Regulations 2008. Unlike the SEBI AI/ML Responsible Usage Guidelines (consultation paper June 2025, final circular August 2026), Chapter III-A is a binding statutory amendment with immediate legal force. All 10,000+ SEBI-registered intermediaries — stockbrokers, AMCs, IAs, RAs, DPs, portfolio managers, RTAs, custodians, and all Market Infrastructure Institutions — bear sole non-delegable liability for AI tool outputs, investor and stakeholder data privacy/security/integrity, and full compliance with all applicable laws in all AI/ML usage. Applies irrespective of scale or scenario of AI adoption. No minimum threshold, no transition period, no vendor delegation of liability. Zero global competitor coverage.

Zytra Research Team · February 2025 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

SEBI issued a consultation paper in June 2025 and a final circular in August 2026 on responsible AI usage. Those get attention because they are detailed operational guidance. What gets less attention is what SEBI did four months earlier: a gazette-notified statutory amendment that changed the legal foundation of how AI accountability works for every intermediary in India's securities market.

Chapter III-A creates the liability structure that everything else builds on. The June 2025 guidelines tell you how to implement AI governance. Chapter III-A tells you that you are solely and non-delegably liable for what your AI does — regardless of vendor contracts, regardless of scale, regardless of function. That liability allocation is now part of the principal regulation, with enforcement consequences that match any other registration condition breach.

The Scale-Independence Clause

The clause that Chapter III-A applies "irrespective of the scale and scenario of adoption" is unusual in financial regulation. Most AI governance frameworks implicitly or explicitly scale obligations to the significance of AI use — major institutions with significant AI exposure face heavier obligations. Chapter III-A has no such graduation. A small IA using a single AI tool for client risk profiling carries the same legal accountability structure as the largest AMC deploying AI across every function. The compliance effort differs; the liability does not.

Chapter III-A AI Governance Compliance Checklist

☐ Chapter III-A inventory: all AI/ML tools deployed across all business functions documented; liability ownership mapping confirms sole intermediary accountability for each tool's outputs and data handling
☐ Vendor contract review: all technology vendor contracts reviewed against Chapter III-A non-delegable liability; contracts that purport to shift AI liability to vendor documented with note that SEBI regulatory liability cannot be commercially delegated
☐ Investor data governance: AI-processed investor and stakeholder data subject to intermediary-controlled data governance (access controls, encryption, audit trails, retention policies) — not vendor-platform-dependent governance
☐ Applicable law compliance mapping: for each AI use case, applicable laws mapped and documented: SEBI regulations, DPDP Act, PMLA for AML AI, IT Act for data security; dual-regulated entities must also map RBI obligations
☐ Chapter III-A + Responsible Usage Framework integration: Chapter III-A accountability documentation and SEBI AI/ML Responsible Usage Framework operational governance (kill-switch, human oversight, vendor clauses) confirmed as both in place and consistent with each other
☐ SEBI inspection readiness: AI tool inventory, vendor contract review records, data governance documentation, applicable law compliance mapping — packaged for SEBI intermediary inspection