Last week, the Reserve Bank of India released a draft framework titled ‘Guidance on Regulatory Principles for Model Risk Management, 2026’. The proposed rules apply to commercial banks, small finance banks, payments banks, cooperative banks, NBFCs, all-India financial institutions, asset reconstruction companies and credit information companies.
The draft notes that all models must operate under a board-approved Model Risk Management Framework, undergo independent validation before and after deployment, and receive approval from the risk committee.
Ajay Sirikonda, Partner and Leader for Financial Services Risk Management at EY India, says no country currently regulates AI model risk with the same scope.
“Under the draft, AI moves out of the technology function and into the risk management lifecycle that already governs credit and market risk,” he tells AIM.
Sirikonda believes that the RBI draft is ahead of the EU AI Act, the US Federal Reserve, and the UK Prudential Regulation Authority in terms of coverage and strictness.
The implications go beyond regulation. According to Gartner, the framework fundamentally changes how AI models will be governed inside financial institutions.
Apeksha Kaushik, Senior Principal Analyst at Gartner, says the proposal marks a shift from retrospective compliance to ongoing oversight. "The framework operationalises model risk as an enterprise governance imperative, moving beyond legacy, retrospective compliance to a paradigm of continuous, dynamic oversight,” she adds.
Kaushik further notes that the requirement for a unified inventory removes the use of informal or “shadow IT” models while assigning clear ownership across development, validation, and audit teams. Third-party models also fall under the same accountability framework, extending scrutiny to vendor contracts.
According to Gartner, governance and responsible AI capabilities will be embedded in three-quarters of AI platforms by 2027 and will become a primary competitive differentiator for AI vendors.
The firm also expects AI governance to become a feature of every national AI law by 2027. By 2030, fragmented AI regulation is projected to grow fourfold, covering three-quarters of the world's economies and driving one billion dollars in compliance spending.
Validation and human oversight
Sirikonda points to a growing skill gap. Indian model validation teams have traditionally focused on credit scorecards, rather than on evaluating GenAI applications, explainability, hallucinations or data drift.
Kaushik says that the automation bias, in which staff defer to algorithmic output rather than question it, poses a barrier to effective oversight. She notes that aligning fast-moving AI systems with fixed validation cycles shortens time to market and requires investment in both technology and culture.
Meanwhile, Ankur Saxena, General Manager and Head of South Asia at ACI Worldwide, links the oversight requirement to the kill-switch provision in the draft. "Requirements such as kill-switch mechanisms and explainability mean that customer-facing AI systems can no longer be designed as fully autonomous."
Banks, he says, must be able to intervene, override or suspend an AI model whenever unacceptable risk appears. Customers must also know when they are interacting with AI and have a clear path to speak to a human.
But some set out to balance between automation and judgement.
"Human oversight should not become a procedural checkbox but should also serve as a meaningful layer of risk management that strengthens confidence in AI-driven decisions,” Deepak Wadhwa, Founder of TRADERSloop, tells AIM.
He adds that financial decisions carry context, ethics and customer circumstances that AI alone cannot fully evaluate. Effective validation, therefore, needs skilled staff and clearly defined accountability.
Explainability and credit models
Sirikonda says material credit decisions will be subject to greater explainability under the draft framework. This is likely to favour scorecards, generalised additive models, and gradient-boosted models, in which banks can inform customers of the reason for a negative credit decision.
The draft does not ban deep, opaque models, but it requires a person in or on the loop and ongoing monitoring when a model cannot explain its output. Saxena adds that explainability moves institutions away from opaque models toward systems that give clear reasons to regulators, customers and internal teams.
Vishal Chopra, CEO and Co-founder of WeRize, addresses the bias provisions from a lending standpoint. "Fintechs can't rely on sensitive attributes, even if they improve model accuracy,” he says.
Chopra explains that the draft pushes credit scoring away from caste, religion or gender as inputs, toward banking, transaction and behaviour data instead. He adds that the change favours lenders that already hold disciplined data pipelines and regulatory alignment over those that took shortcuts with sensitive variables.
The law and liability angle
Probir Roy Chowdhury, Partner at JSA, sets out where legal exposure sits once the framework takes effect. He says RBI dictates that regulated entities remain solely accountable for the outcomes of AI models.
Chowdhury also explains that compliance with the framework serves only as a baseline. Banks could still face strict liability for financial or consumer losses caused by an AI model, regardless of adherence to RBI rules, and need indemnification clauses in vendor contracts to manage this exposure.
On data protection, Chowdhury links the RBI's fairness assessments to the Digital Personal Data Protection Act and says both regimes call for institutions to ensure their training data is free of quality issues that could produce discriminatory output.
He also points out that banks cannot rely solely on vendor assurance. Regulated entities must validate before deployment, even when purchasing third-party systems.
A few legal experts believe that a board-approved Model Risk Management Framework elevates AI from an IT issue to an entity-level duty, making directors on the Risk Management Committee responsible for risk appetite and approval of high-risk models.
Institutions will also need documentation that provides complete traceability and reproducibility of model decisions during audits.
Catalyst or constraint
Sirikonda expects larger banks to absorb the compliance cost and treat the framework as a basis for AI investment, given that clear rules remove the fear of regulatory surprise. He says, "The guidelines create clear guardrails for AI adoption, and this is something which will catalyse the decision-making for AI adoption."
He points to RBI's tiering approach, under which a basic internal reporting tool faces lighter requirements than an autonomous credit engine, as the answer for smaller players.
Kaushik takes the same view, stating that clear guardrails open the door to boardroom approval for AI investments. Fairness checks, bias mitigation, and independent validation, she argues, are foundational to building long-term trust that AI use requires.
Saxena and Wadhwa also believe the framework supports adoption rather than blocking it, provided institutions build the technology and governance capacity the draft assumes.
From a fintech perspective, Chopra says the framework raises the barrier to entry for AI-driven lending, but largely in favour of responsible players.
Institutions with disciplined data governance and strong regulatory practices are likely to benefit, while those relying on loosely governed models or sensitive proxy variables may find it harder to compete.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.