India governs AI agents through sector regulators and one data law. The RBI, SEBI and IRDAI apply their rules on outsourcing, technology risk, customer conduct and grievance redress to banks, market intermediaries and insurers that deploy agents. The Digital Personal Data Protection Act 2023 governs the personal data agents process. Each puts accountability on the regulated firm, not the vendor.
What do the rules require, in plain words?
The RBI. Banks and non-bank lenders face directions on IT governance, outsourcing of IT services, cyber security, customer service and fair practices. Digital lending rules require transparency about the lending service providers involved, clear disclosure to borrowers and a functioning grievance process. The RBI has signalled that it expects responsible, well-governed AI adoption in the financial sector.
SEBI. Market intermediaries must protect client interests, keep records and manage technology risk. SEBI has asked regulated entities to report their use of AI and machine learning, and its position is that an entity remains responsible for the AI tools it uses, including their outputs and their handling of client data.
IRDAI. Insurers and intermediaries face rules on outsourcing, information and cyber security, policyholder protection and grievance redress. Decisions on claims and underwriting remain the insurer's responsibility however they are produced.
The DPDP Act 2023. A data fiduciary may process personal data for a lawful purpose with the data principal's consent or for certain legitimate uses. Consent must be free, specific, informed and unambiguous, preceded by a notice. Fiduciaries must ensure accuracy where data is used for decisions, keep reasonable security safeguards, report personal data breaches to the Data Protection Board and affected people, erase data when the purpose is served, and run a grievance mechanism. Fiduciaries designated as significant face extra duties, including impact assessments and audits. The Act's obligations are being brought into effect in stages by rules, so check which apply now.
Who does it apply to?
RBI rules apply to banks, NBFCs and payment system operators; SEBI rules to brokers, advisers, fund managers and other intermediaries; IRDAI rules to insurers and intermediaries. The DPDP Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.
What does this mean when the system is an agent that acts?
The agent platform is an outsourced service. Under RBI and IRDAI outsourcing rules, the regulated entity cannot outsource its accountability. The platform needs due diligence, a contract with audit and access rights, and a plan for exit.
The agent is a data processor under the DPDP Act. A data fiduciary may only engage a processor under a valid contract, and the fiduciary stays responsible for compliance, including by the processor. Agent memory, logs and the model provider's handling of prompts fall within that.
Accuracy duties bite on decisions. The DPDP Act requires reasonable efforts to ensure completeness, accuracy and consistency when personal data is used to make a decision affecting the person or is disclosed. An agent that decides on a loan top-up, a claim or an account restriction must draw on current, verified data.
Grievance channels must reach a person. All three regulators, and the DPDP Act, expect working grievance redress. An agent can acknowledge, log and route a grievance; it should not be the last step.
For sector detail, see AI agents for operations leaders in insurance in India and AI agents for compliance teams in payments in India.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Outsourcing: accountability retained | Agent platform assessed and contracted with audit, access and exit terms | Due diligence; contract; exit plan |
| Technology and cyber risk | Agent identity, scoped access, logging, testing | Access maps; logs; test reports |
| SEBI: responsibility for AI tools | Each agent used for client work recorded, with an accountable owner | AI use register; owner sign-off |
| Customer conduct and disclosure | Agent content on products, fees and rights approved | Approved content library |
| Grievance redress | Agent recognises grievances and routes them to the grievance officer | Grievance logs with routing |
| DPDP: notice and consent | Agent purposes covered in notice; consent captured for each purpose | Notice versions; consent records |
| DPDP: processor contract | Platform and model provider bound by contract | Signed contracts |
| DPDP: accuracy for decisions | Decisions draw on the system of record, not cached copies | Source configuration |
| DPDP: erasure and breach | Agent memory and logs erasable; breaches assessed and reported | Deletion logs; breach records |
What will the RBI, SEBI, IRDAI or the Data Protection Board ask?
- Which customer-facing or decision-making processes use agents, and who owns each?
- Where is the outsourcing assessment and contract for the agent platform?
- What did customers consent to, and does the agent stay within it?
- How do you ensure the data behind an agent's decision is accurate?
- Show us a grievance that came in through an agent and how it was resolved.
- How quickly can you detect and report a breach involving an agent?
What do these rules not cover?
India has no AI-specific statute regulating agents, no registration of AI systems and no general list of prohibited AI uses. Sector guidance continues to develop. Firms serving markets abroad must meet those rules too; compare how AI agents are regulated in Australia and how AI agents are regulated in Nigeria. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is consent always required for an agent to process personal data under the DPDP Act?
No. The Act allows certain legitimate uses without consent, for example where a person has voluntarily provided data for a specified purpose and has not objected. Most customer-facing agent work rests on consent or these uses, and the notice must cover it.
Can a lender let an agent approve digital loans?
The rules do not ban it, but the lender stays responsible for credit decisions, fair practices and disclosures. Most lenders keep approval with a person or a governed credit engine, with the agent preparing the file.
Do Indian rules require agent data to stay in India?
The DPDP Act allows transfers abroad except to countries the government restricts. Sector regulators can impose stricter localisation, notably for payment data. Check both before choosing where the platform processes data.