Skip to content
72 Networks

What applies to your AI, and from when.

What each rule asks of the AI systems you actually run: the ones already in force, the two DPDP dates still ahead, and the RBI's framework. None of it is optional, and all of it starts in the same place: knowing what you have.

A working summary for operators. It is not legal advice.

30 November 2026

days until the DPDP consent obligations apply

30 November 2026

13 May 2027

days until the DPDP substantive obligations apply

13 May 2027

The instruments

SEBI Regulation 16C

Regulated entities in the securities market

In force now

A regulated entity is solely responsible for the outputs of the AI systems it uses, whoever built them. Responsibility cannot be contracted away, delegated to a vendor, or disclaimed in a terms-of-service document.

What it takes

  • An inventory: you cannot be responsible for systems you cannot list
  • A documented feature list, data lineage and approval record for every decision-affecting system
  • Performance monitored against a baseline, on a cadence, with drift thresholds
  • Inputs, outputs and model versions logged, so a single decision can be reconstructed
Read the briefing

IT Amendment Rules 2026

Anyone generating or publishing synthetic content

In force since February 2026

The rules govern synthetically generated content, and have since February 2026.

What it takes

  • Know which of your systems generate content that reaches customers or the public

DPDP Act: substantive obligations

Every data fiduciary

13 May 2027

The remaining obligations land: knowing every AI system you run, where its data sits, who processes it, and being able to erase from it.

What it takes

  • AI system inventory (DPDP fiduciary accountability)
  • Shadow-AI discovery and acceptable-use policy
  • Named ownership per AI system
  • Erasure inside AI data stores
  • Residency mapping per AI system
  • Data-flow mapping with sub-processors
  • Cross-border transfer assessment
  • Data minimisation in AI pipelines
  • Vendor disclosure of model components

RBI FREE-AI framework

Banks, NBFCs and the wider financial sector

Published 2025

The framework shapes how AI is deployed across the financial sector.

What it takes

  • Governance mapped to the framework alongside DPDP and SEBI, in a single control matrix

Our governance work is mapped to all of these in a single control matrix, and to IRDAI expectations for insurers. Dates and scope change; check the instrument itself, or ask us, before relying on this page.

Find out where you stand.

Eighteen questions across five domains. You get a readiness score, the specific obligations you cannot yet meet, and your exposure dates. About four minutes.

Run the readiness checkTalk to the Assure practice