Home / Solutions / Regions / India
India: the inspection is coming.
The audit trail had better exist.
RBI FREE-AI, the DPDP Rules, SEBI's algo mandate, and IRDAI's regulations have converged into the most concrete AI accountability regime of any major market, built for an inspection-driven supervisory culture. Five questions your institution must be able to answer.
Many frameworks, one evidence layer
RBI FREE-AI, DPDP, SEBI, IRDAI, and abroad, DORA and SR 11-7. One evidence layer, built from what your agents actually do, maps to all of them, so coverage scales with your estate, not your jurisdictions.
The frameworks your examiners cite converge on one runtime-evidence layer - so coverage scales with your estate, not with your jurisdictions.
What Indian regulators will actually ask
An AI agent made a non-compliant decision and I have no audit trail, the RBI has asked for it.
RBI FREE-AI · Aug 13, 2025The framework, 7 sutras, 6 pillars, 26 recommendations, calls for AI inventories covering models, use cases, dependencies and risks; AI incident reporting; audit processes; board-approved AI policies; and AI disclosures in annual reports. The RBI's own survey found only 18% of AI-using regulated entities maintain audit logs. Its accountability sutra holds entities responsible for AI decisions regardless of the level of autonomy.
→ Map builds the live inventory of every agent, MCP and endpoint; Measure produces the audit trail from what each AI session actually did, continuously, before anyone asks.
Our AI touched customer personal data and I can't prove how it was handled.
DPDP Act 2023 + DPDP Rules · notified Nov 13, 202572-hour breach reporting to the Data Protection Board. Significant Data Fiduciaries face annual DPIAs, independent audits, and algorithmic fairness assessments. Core operational obligations bind by May 13, 2027. Penalties reach ₹250 crore per violation.
→ Agent-attributed data-access records turn "what did it touch?" into a query you can answer inside the 72-hour window.
Our trading systems can't be reconstructed for SEBI.
SEBI algo framework · fully mandatory April 1, 2026Brokers are the principal. Exchange-assigned Algo IDs, kill switches, full execution logging, auditability by exchange and SEBI. The Jane Street interim order, ₹4,843.57 crore impounded, set the forensic expectation: post-trade reconstruction of algorithmic logic, trigger by trigger.
→ Measure captures execution at the action level, tied to the prompt and identity; Manage provides the kill switch and containment the framework requires.
Our claims and underwriting AI can't explain a decision to IRDAI.
IRDAI regulations & guidelines · 2025Explainability demands on claims denials, pricing, and risk flags. India-only record storage under the 2025 Information & Records Regulations. CISO independence, quarterly risk-committee cadence, CERT-In and DPDP alignment.
→ Decision-path evidence behind every automated outcome, retained under your records framework.
We rolled out copilots and agents to a hundred thousand staff with no runtime oversight.
The deployment realityTCS, Infosys, and Wipro have each deployed Microsoft 365 Copilot to 100,000+ employees; Wipro reports 29,000+ custom agents built by its workforce. GCCs are projected to employ 4–5 million by 2030. The app + OS security surface in India is already enormous, and growing.
→ Endpoint discovery and session telemetry scale with the estate, security that finds the agents and MCPs, instead of waiting to be told.
India: what is already binding, and what is coming
The Indian regime arrived in waves, and the next wave is already dated. Where your institution stands against each line is the first question of any demo.
Aug 13, 2025
RBI FREE-AI issued
7 sutras, 6 pillars, 26 recommendations, inventories, incident reporting, audit processes, board-approved policies.
Nov 13, 2025
DPDP Rules notified
72-hour breach reporting live; phased rollout of remaining obligations begins.
Apr 1, 2026
SEBI algo mandate
Fully mandatory: Algo IDs, kill switches, full execution logging, broker-as-principal accountability.
May 13, 2027
DPDP core obligations
Consent, notice, and Significant Data Fiduciary duties, annual audits, DPIAs, algorithmic fairness assessments, fully bind.
Penalties under DPDP reach ₹250 crore per violation. The Jane Street action (₹4,843.57 crore impounded) shows the enforcement appetite is already here.
Built for India's regulatory reality, not translated to it.
We're engaging with enterprises across Indian banks, insurers, and IT majors. A demo maps your AI estate against RBI FREE-AI, DPDP, SEBI, and IRDAI, clause by clause.