Strengthening Cybersecurity And Resilience: An Overview Of SEBI's New CSCRF Framework

India has formally moved to regulate deepfakes and AI generated content by notifying the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026.

On June 3, 2026, the Supreme Court of India’s AI Committee released preliminary draft of the Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 (“The Draft”). This marks a shift from scattered experiments with AI tools for translation, transcription, research and case management. With over 93,000 pending matters as of March 2026, the guidelines aim to ease processes for officials and citizens. AI could help reduce backlogs through automated cause-list preparation, transcription, research, and defect scrutiny, but its use also raises serious concerns.

The Supreme Court of India, through notice dated 03.06.2026, has published the draft Regulations for use of Artificial Intelligence in Courts, 2026 (“Draft AI Regulations”). Comments and suggestions from all stakeholders and the general public are invited on the Draft AI Regulations by 20.06.2026

In a rare use of its extraordinary powers under Article 142 of the Constitution of India, the Supreme Court heard a curative petition filed by DMRC, challenging an earlier order that had upheld the arbitral award. The judgment brings finality to a decade-long contractual dispute that began in 2013 with arbitration proceedings.

Between May and August 2026, AI regulation has continued to develop rapidly, with a focus on accountability, transparency, human oversight and protection against AI-related harms.

In a seismic event that has rattled the foundations of India's cryptocurrency landscape, WazirX, the nation's largest cryptocurrency exchange, suffered a devastating cyberattack that resulted in the theft of over $240 million in investor funds.

On May 21, 2025, the NPCI introduced new guidelines to streamline the Unified Payments Interface ("UPI") and its Application Programming Interface ("APIs"), effective August 1, 2025.

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.

On October 27, 2025, OpenAI published a report on its platform stating that approximately 0.15% of the ChatGPT users exhibit suicidal thoughts or psychosis and seek advice on way and methods of self-harm.

On 25 May 2026, the Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology (MeitY), released its “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure” (Blueprint).

On 25 August 2026, the Ministry of Labour and Employment issued two notifications (Notifications) under the Code on Wages, 2019 (Wage Code), thereby operationalising specified provisions relating to payment of statutory bonus for establishments for which the appropriate government is the Central Government. The Wage Code consolidates the legislative framework governing wages and related employee entitlements, including the regime previously governed by the Payment of Bonus Act, 1965.

The Supreme Court in Vanashakti v Union of India, 2025 SCC OnLine SC 1703 held that Environmental Clearance (EC) is necessary for all large scale building and construction projects including educational institutions under the Environmental Impact Assessment (EIA) Notification, 2006 (EIA Notification).

The Securities and Exchange Board of India (SEBI) issued a consultation paper on 23 July 2026 (Consultation Paper). The Consultation Paper proposes a comprehensive review of the SEBI (Portfolio Managers) Regulations, 2020 (PMS Regulations).

In Kotak Mahindra Bank Limited v Trupti Sanjay Mehta and Others, 2026 INSC 943 (Kotak Mahindra), the Hon’ble Supreme Court of India considered whether a bank as defined under Section 2(1)(c) of the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002 (SARFAESI Act) could invoke the provisions of the SARFAESI Act to recover a secured debt acquired from an entity which was not covered under the ambit of the SARFAESI Act at the time of disbursement of the loan.

The Hon’ble Punjab and Haryana High Court (HC) in Jyoti Sareen vs. UOI & Others (CWP No. 15791-2024 (O&M)) (Order) held the retrospective amendments carried out vide the Finance Act, 2026, with respect to the powers of the Jurisdictional Assessing Officer (JAO) to issue a reopening notice under section 148 (Reopening Notice) of the Income-tax Act, 1961 (IT Act), as unconstitutional, being violative of the ‘doctrine of separation of powers’ and thus violative of Article 14 of the Constitution of India.

On 20 July 2026, the Department of Telecommunications (DoT) notified the Telecommunications (Authorisation for Telecommunication Network) Rules, 2026 (Rules). The Rules operationalise Section 3(1)(b) of the Telecommunications Act, 2023 and establish a framework for six categories of telecommunication network authorisations: infrastructure provider (IP) (formerly, IP-I), digital connectivity infrastructure provider (DCIP), internet exchange point (IXP) provider, satellite earth station gateway (SESG) provider, cloud-hosted telecommunication network (CTN) provider and mobile number portability (MNP) provider.

The Maharashtra Stamp (Fourth Amendment) Bill, 2026 (Bill) introduced in the Maharashtra Legislative Assembly on 7 July 2026 proposes a significant reform to the stamp duty treatment of guarantees under the Maharashtra Stamp Act, 1958 (Maharashtra Stamp Act).

The Circular is a much awaited and welcome move by the regulator to ease the difficulties faced by the listed companies in meeting the MPS Requirement.

Between May and August 2026, AI regulation has continued to develop rapidly, with a focus on accountability, transparency, human oversight and protection against AI-related harms.

On 9 September 2026, the Department of Consumer Affairs, Ministry of Consumer Affairs, Food and Public Distribution, notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 (2026 Amendment), amending the Consumer Protection (E-Commerce) Rules 2020 (E-Commerce Rules).