AI for banks, NBFCs, insurers and fintechs.

SEBI moved first. Three notifications dated 6 February 2025 amended the SEBI (Intermediaries) Regulations 2008, the SCR (SECC) Regulations 2018 and the SEBI (Depositories and Participants) Regulations 2018. AZB and Partners set out the substance: an entity using AI or machine learning tools carries sole responsibility for the privacy, security and integrity of investor data, for the output those tools produce, and for compliance with applicable law — internal tools included, not only the ones a customer sees. A consultation paper followed on 20 June 2025, which IndiaCorpLaw summarises as proposing a board-approved governance framework, periodic audits, model validation for bias and explainability.

The Reserve Bank took the longer route. Its FREE-AI committee — Framework for Responsible and Ethical Enablement of Artificial Intelligence — was constituted in December 2024 and reported on 13 August 2025, with seven governing principles and, on Dvara Research's count, 26 recommendations across six pillars. Three principles read as engineering requirements. Final decision-making vests with humans, not models. Decisions must be traceable to comprehensible human logic. Customers must be told when they are dealing with a model. S&R Associates, summarising the report, also records regular model audits, with critical models externally assessed each year.

Insurance is a stage behind. Business Standard reported on 18 June 2026 that IRDAI has constituted a working group on AI adoption, chaired by Sandeep Shukla of IIIT Hyderabad, covering governance and audit frameworks for AI deployment with claims and fraud prevention named explicitly, and due to report within three months. Assume that framework is coming and that what you build now will be read against it.

The general-purpose failure mode is a fluent paragraph assembled from three unnamed documents, which a reader cannot act on without checking — and the checking was the work you were removing. So the unit of retrieval is the citable unit of the document, not a fixed number of tokens: clauses with their defined terms, tables with their headers and footnotes, a schedule with the section that invokes it. Fixed-size chunking severs all three, and no model recovers what was never in the context window.

Refusal is a first-class outcome, not an error state — a threshold below which the system says it cannot answer and names what it would need. Wrong about branch opening hours costs an apology. Wrong about whether a claim falls inside an exclusion costs a complaint and a remediation, so the threshold is set per workflow. Most of our RAG and LLM integration work in this sector is that, not model selection.

It survives review, which is what makes it dangerous. The passage is real, the citation resolves, the text says what the system said it says. Nobody catches it until an auditor asks why a withdrawn threshold was being applied.

So the corpus carries a lifecycle rather than a timestamp: an in-force window, a supersession pointer, an amendment chain — a master direction amended four times is neither four documents nor one. Retrieval filters by as-of date before ranking rather than after, so a superseded passage is never a candidate, and a complaint about a 2023 decision resolves against the corpus as it stood in 2023.

This is ordinary version control applied to text. It lives or dies on ingestion, which is why data engineering is where the real project starts.

A test set written in an afternoon by the build team encodes what that team expects to be asked. Real queues do not. They hold questions whose answer is conditional, questions where the correct response is that two circulars conflict and the matter needs escalating, questions built on a false premise, and questions answered wrongly at the time and corrected later.

So we mine the set from the compliance mailbox, the ombudsman file, the internal audit observations and the training material that exists because people kept getting something wrong. Cases are labelled with the passage that should have been retrieved, not only the answer that should have been given — that separation distinguishes a retrieval miss from a reasoning error. Then it becomes a gate: the set runs before every release, a drop stops it, and when a circular is amended the affected cases are re-labelled.

FREE-AI's recommendations on data lineage and AI audit, SEBI's proposed documentation standard and the audit frameworks IRDAI's working group has been asked to design all point at the same artefact, and application logs do not produce it. Logs record that a request happened, not why the answer was what it was.

What we write instead, at answer time and as data: the question, the retrieved passages with their document identifiers and version numbers, the prompt template and model version, the policy rules applied, the confidence and any refusal, the answer as delivered, and what the recipient did with it. Immutable, queryable by customer, document and date. Internal audit then stops needing an engineer as interpreter, and when a document turns out to have been wrong you can identify every answer that relied on it.

RBI circular RBI/2017-18/153 of 6 April 2018 requires the entire data relating to payment systems operated by a system provider to be stored in a system only in India, covering the full end-to-end transaction details, with the foreign leg permitted to be stored abroad as well. The outsourcing direction repeats the constraint at section 16(g), and Privacy World's analysis of the notified DPDP Rules records that Significant Data Fiduciaries may not transfer specified categories of personal data outside India without government approval.

Embedding and inference then run in Indian regions or on infrastructure you control, which narrows model choice and makes open-weight models a serious option rather than a fallback. Where a frontier model earns its place, the boundary is explicit: what is redacted before the call, what is sent, what the provider retains, what the contract says about training. Vector stores, caches and embeddings are personal data stores and get treated as such. Telemetry is the quiet leak, because most observability stacks ship payloads to a region nobody chose.

RBI/2023-24/102 of 10 April 2023 shapes our side too. Section 4(a) is explicit that outsourcing does not diminish your obligations; sections 16(m) and 16(o) give you and the RBI a right to audit the service provider and its sub-contractors; section 22(a) requires a documented exit strategy. That is why the handover artefacts are a deliverable rather than a favour. More on the jurisdiction on our India page, and on phases in engagement models.

The bank chatbot gets proposed because it demonstrates well. It is also the hardest surface to govern: unbounded scope, an unpredictable question distribution, a customer who will reasonably read the answer as the institution's position, and nowhere natural to put a human.

Four shapes work better. An internal answer desk for the relationship managers, underwriters and compliance analysts who already carry the accountability. A drafting assistant producing a cited response that a named human reviews and sends. Structured extraction over claim files and KYC packs, returning fields with confidence and page-level provenance, low-confidence ones routed to a queue. And a monitoring agent that reads incoming circulars and flags which internal policies they touch — a genuine agent problem, because it holds state, runs on a schedule and takes an action.

In each of them the human stays where the accountability already sits, which is what FREE-AI's accountability sutra asks for - accountability rests with the entity deploying the system and cannot be delegated to the model, and the scope is bounded, so it can be evaluated.

Which Indian regulators have written something down about AI?

Four, at different stages. SEBI is binding already: three notifications dated 6 February 2025, set out by AZB and Partners. The Reserve Bank's FREE-AI committee reported on 13 August 2025, with 26 recommendations on Dvara Research's count. IRDAI constituted a working group on AI in insurance, reported by Business Standard on 18 June 2026. DPDP sits under all three.

Can the data stay inside India end to end, including the model?

Yes, and for some of it you have no choice. RBI circular RBI/2017-18/153 of 6 April 2018 requires the entire data relating to payment systems to be stored in a system only in India, and the outsourcing Master Direction repeats the constraint for vendors at section 16(g). Discovering this at deployment usually means the model has to move, not just the database.

What does DPDP change for a system we start building now?

The Rules were notified on 13 November 2025 with a phased commencement. Privacy World's analysis puts consent manager registration at 13 November 2026 and the substantive obligations at 13 May 2027. That is a build window, not a deadline: consent revocable per purpose, deletion that reaches the vector store and the conversation logs, and a processing record you can produce on request are cheap now and expensive later.

If the system gets an answer wrong, who is responsible?

You are, and it is in writing. AZB and Partners record that SEBI's February 2025 amendments place sole responsibility on the regulated entity for investor data, for the output the tools produce and for compliance with applicable law, reaching internal tools as well as customer-facing ones. RBI's outsourcing direction says the same at section 4(a).

Do you subcontract, and who has access to our data?

No subcontracting - the people who scope your engagement build it. Sections 16(m) and 16(o) of RBI's outsourcing direction give you and the RBI a right to audit the service provider and its sub-contractors and to reach data they hold. A vendor chain you cannot enumerate is a right you cannot exercise. Access is named individuals, listed in the contract.

What does a first engagement look like?

A free scoping call, then a fixed-scope diagnostic with defined exit criteria before anything is built. Diagnostics start in the low lakhs; production builds are a multiple of that depending on integrations and how strict the residency requirement is. A fair share of these calls end with us saying the corpus is not ready.