As the AI moves from a back-office efficiency tool into the co-ordinator in decision making itself, the regulatory thinking is changing drastically.
Previously we discussed about the reasons behind industries adapting AI and the risks beyond innovations. This article discusses why that embrace introduces governance, operational and market risk. This third part turns to the regulatory response, not by cataloguing what each authority has published, but by asking what that body of publications, read together, reveals about how regulatory thinking itself is changing.
What has changed is how existing objectives, investor protection, market integrity, financial stability, accountability, and fair and orderly markets, are being applied as AI involves itself to trade execution, portfolio construction, advice, surveillance, and compliance.
The trajectory across jurisdictions, despite real differences in legal form, is strikingly convergent: general recognition of AI’s growing footprint has hardened into specific governance expectations, and governance expectations are now hardening into supervisory infrastructure built to observe compliance directly rather than assume it.
From Recognition to Expectation: The Shape of Regulatory Learning
The clearest illustration of this maturing process is IOSCO’s own body of work, produced across three reports over five years. The 2021 report on AI and machine learning use by market intermediaries and asset managers set out six measures reflecting expected standards of conduct, senior management oversight, algorithm testing and monitoring, adequate in-house skill, third-party due diligence, disclosure, and data quality controls.
The March 2025 report shifted focus to evidence-gathering at scale: surveys of regulator members, self-regulatory organisations and market participants across more than 30 jurisdictions, used to map how generative AI and large language models were actually being deployed and what risks: malicious use, model and data weaknesses, third-party concentration, and problematic human–AI interaction, those deployments were generating.
By May 2026, IOSCO had moved a full step further, publishing a supervisory toolkit that does not add new principles so much as operationalise the 2021 measures into structured tools: practical questions supervisors can put to firms, categories of evidence to request, and indicators to monitor across an entire regulated population.
The same arc is visible, at the Monetary Authority of Singapore. MAS’s 2018 FEAT principles, fairness, ethics, accountability and transparency, were deliberately aspirational and technology-neutral, a shared vocabulary for industry and regulator rather than a rulebook.
Proportionality as the Operating Principle
If neutrality answers whether new rules are needed, proportionality answers how existing rules should be applied with any precision. IOSCO’s 2026 toolkit gives this the fullest articulation to date, framing supervisory intensity as a function of three variables: the nature and complexity of the AI system in question; the degree of human oversight, classified along a spectrum from “human-in-control” through “human-in-the-loop” and “human-on-the-loop” to fully autonomous “human-out-of-the-loop” operation; and the potential impact of a failure on clients, the firm, or the market.
SEBI’s June 2025 consultation paper reaches the same place through a two-tier structure of its own: a lighter “regulatory lite” framework for AI/ML use that does not directly affect customers, and fuller governance obligations reserved for customer-facing deployment.
The convergence matters because proportionality is what allows a technology-neutral rulebook to remain useful without becoming either meaningless or brittle. A generic obligation to manage risk “appropriately” says nothing useful about a specific AI deployment; a rule drafted tightly around today’s large language models risks fossilising around a snapshot of technology that IOSCO itself expects to be superseded by agentic and increasingly autonomous systems within a short horizon.
Supervision as Infrastructure, Not Just Instruction
The most concrete marker that regulatory thinking has moved from governance to supervision is that authorities are no longer content to publish expectations and wait to inspect compliance after the fact; several are now building the operational means to observe AI use directly and, in some cases, in real time.
The FCA’s AI Lab and its AI Live Testing initiative are the clearest example: firms far enough along in development work inside the regulatory perimeter, alongside the FCA’s own technical partner, to test live systems under direct supervisory observation before and during deployment, rather than have that system reviewed only once problems surface.
ASIC’s market-wide review of 624 AI use cases and MAS’s thematic review of bank AI practice that preceded its own Guidelines both reflect the same underlying instinct: gathering primary evidence of how AI is actually being used across an entire regulated population, not theorising about it in the abstract.
IOSCO’s supervisory toolkit institutionalises this shift most explicitly, setting out recordkeeping and audit-trail expectations across the AI lifecycle and a defined set of indicators, the proportion of AI use cases in production versus pilot, the frequency and severity of AI-related incidents, and the degree of third-party concentration among AI providers, that supervisors are encouraged to track systematically, not firm by firm but across their whole market. SEBI’s 2019 circular requiring market infrastructure institutions to make quarterly disclosures of their AI/ML use was, in retrospect, an early instance of the same instinct: building the data pipeline before attempting to build the rule.
This is supervisory technology in its most practical sense, not the digitisation of a regulator’s own back office, but the deliberate construction of engagement and monitoring infrastructure suited to a technology that resists static, point-in-time compliance review.
The Accountability That Cannot Be Delegated
One proposition recurs, without a single exception, across every jurisdiction examined: using AI does not relocate legal responsibility. Boards and senior management remain accountable for an outcome whether it was produced by a human analyst or a model. IOSCO’s third-party risk management toolkit states this in direct terms, a regulated firm retains full responsibility and regulatory liability for outsourced AI functions to precisely the same extent as if the function were performed in-house [3].
SEBI has also recently amended the Securities and Exchange Board of India (Intermediaries) Regulations, 2008 (“Intermediaries Regulations”) and transposes this logic directly into Indian law by fixing accountability for AI-driven outputs on the regulated entity that deploys them, regardless of whether the underlying model was built in-house or licensed from a vendor.
This is also the point at which the concentration and third-party dependency risk that IOSCO and the FSB have separately identified intersects with accountability. As market participants converge on a narrowing set of foundation-model and cloud infrastructure providers, a single vendor failure or flaw can propagate across many regulated firms simultaneously.
IOSCO’s toolkit documents a related and more immediate enforcement concern it terms “AI-washing”, firms overstating, or simply misdescribing, the extent and sophistication of their own AI use in filings, marketing, or investor communications, precisely the kind of conduct that non-delegable accountability is designed to catch, since responsibility cannot be shifted to the vendor whose model generated the underlying claim.
What This Means for Indian Capital Market Participants
SEBI’s own regulatory arc mirrors the global pattern with clarity and on a compressed timeline. required market infrastructure institutions to disclose their AI/ML use on a quarterly basis, without imposing any substantive governance obligation.
A February 2025 amendment to Intermediaries Regulations introducing Regulation 16C then fixed accountability for AI-driven outputs on regulated entities directly. By June 2025, SEBI had issued a consultation paper proposing principles-based, proportionate governance obligations, a paper that expressly draws on IOSCO’s 2021 measures and references the approaches taken by MAS and other overseas regulators as comparators. That sequence – disclosure, then liability, then proportionate principles, is the same recognition-to-governance-to-supervision progression traced globally above, compressed into roughly six years.
For portfolio managers, brokers, exchanges, depositories and asset managers operating in India, the significance lies less in any single proposed obligation than in that sequencing. Without speculating on the form SEBI’s eventual framework will finally take, market participants can reasonably anticipate continuity with themes now well established elsewhere: governance obligations calibrated to whether AI use is customer-facing, senior management accountability that cannot be outsourced to a vendor or technology provider, and closer supervisory attention to concentration and third-party dependency as AI adoption scales across the market infrastructure that connects India’s capital markets to the rest of the system.
Conclusion
None of the developments traced in this article amount to the emergence of a new field of “AI law” for capital markets. They represent the extension, jurisdiction by jurisdiction and in different legal forms, of long-standing regulatory objectives into an environment in which AI now sits inside the decision chain rather than at its periphery.
What is genuinely new is the sequence by which that extension has occurred: awareness reports have hardened into governance expectations, and governance expectations are now hardening into supervisory infrastructure- sandboxes, live testing, structured toolkits, and systematic monitoring indicators, built to observe compliance directly rather than to assume it. That progression, more than any single rule discussed above, is the clearest evidence of where global regulatory thinking on AI in capital markets is heading.
Authored by: Anshu Bansal, Partner, and Rashmita Das, Legal Researcher.
