Description

SEBI issues advisory to all regulated entities on the use of emerging advanced AI tools for cybersecurity vulnerability detection, providing guidance on responsible adoption and risk management.

Summary

SEBI has issued a circular dated May 5, 2026 (Ref: HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026) providing an advisory to all regulated entities on the use of emerging advanced Artificial Intelligence (AI) tools for vulnerability detection. The circular is addressed to all market participants including AIFs, Mutual Funds, Stock Exchanges, Depositories, Clearing Corporations, Stock Brokers, and other intermediaries.

Key Points

  • SEBI has issued guidance on leveraging emerging advanced AI tools for cybersecurity vulnerability detection within SEBI-regulated entities.
  • The advisory is addressed to the full spectrum of SEBI-regulated entities: AIFs, SCSBs, Clearing Corporations, CIS, CRAs, Custodians, Debenture Trustees, Depositories, DDPs, Depository Participants, Investment Advisors, Research Analysts, KRAs, Merchant Bankers, Mutual Funds/AMCs, Portfolio Managers, RTAs, Stock Brokers, Stock Exchanges, and VCFs.
  • The circular acknowledges the growing role of AI in identifying and addressing cybersecurity vulnerabilities in financial market infrastructure.
  • Circular reference number: HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026, issued under SEBI’s IT Department.

Regulatory Changes

This is an advisory circular rather than a prescriptive regulatory change. SEBI is providing guidance on the responsible use and evaluation of advanced AI-based tools for vulnerability detection. No amendments to existing regulations are indicated, but regulated entities are expected to consider AI tools as part of their cybersecurity posture.

Compliance Requirements

  • All SEBI-regulated entities should review the advisory and assess the applicability of advanced AI tools for vulnerability detection within their IT security frameworks.
  • Entities are expected to consider adoption of AI-based vulnerability detection tools as part of their cybersecurity risk management practices.
  • Compliance with existing SEBI cybersecurity circulars and frameworks remains mandatory; this advisory supplements those requirements.

Important Dates

  • Circular issued: May 5, 2026
  • No specific deadline mentioned in the visible content; entities should review and act on the advisory at the earliest practicable opportunity.

Impact Assessment

This advisory has a broad reach, covering the entire landscape of SEBI-regulated entities. The operational impact is moderate — entities will need to review their existing IT security and vulnerability management practices and evaluate whether advanced AI tools can enhance their cybersecurity posture. There is no direct market trading or pricing impact. The advisory signals SEBI’s intent to keep regulated entities aligned with emerging technology trends in cybersecurity, particularly relevant given increasing cyber threats to financial market infrastructure.

Impact Justification

Broad advisory to all SEBI-regulated entities on AI-based vulnerability detection tools; no immediate mandatory action or market trading impact, but operationally significant for IT and cybersecurity governance across the entire regulated ecosystem.