What does RBI draft Guidance on Regulatory Principles for Model Risk Management say about AI in banking?

What are the key points of RBI draft Guidance on Regulatory Principles for Model Risk Management?

• Scope (paragraphs 4 and 6): applies to the listed regulated entities and to all models, whether developed internally, sourced from third parties or both; the draft defines a model to include algorithms and decision-based rules that materially affect decisions even if the RE does not call them models, with a spreadsheet loan-pricing calculator as an illustration.
• Accountability and governance (paragraphs 8 to 13): the RE is accountable for outcomes of all models; a Board-approved Model Risk Management Framework (MRMF) applies to all models including AI/ML; the Risk Management Committee of the Board (RMCB) reviews validation reports of high-risk models and approves their deployment.
• Tiering and inventory (paragraphs 17 to 24): risk-based tiering reviewed at least annually, using materiality and complexity without one factor diluting another; a complete inventory with no model used unless inventoried; decommissioned models kept in the inventory for at least ten years.
• Consumer protection (paragraph 25): an RE should not use any model that harms consumers, and grievance redressal must cover grievances from consumer-facing models.
• Validation (paragraphs 29 to 33): independent validation of all models, including third-party models, before and after deployment, after modification and periodically; reports go to the RMCB within three months of completion.
• Third-party models (paragraphs 45 to 48): the RE is accountable; independent validation notwithstanding provider certification; enhanced RMCB oversight irrespective of tier; contracts must give access to technical documentation, audit rights for the RE and the supervisor, and exit arrangements.
• AI/ML models (paragraphs 49 to 57): additional controls commensurate with impact, including for foundation and frontier AI models; explainability and transparency thresholds; control boundaries against hallucination; fairness assessment; out-of-sample testing; red-teaming; enhanced controls for automatic updates; enhanced documentation.
• Deployment and human oversight (paragraphs 58 to 63): cyber controls against prompt injection and adversarial inputs for customer-facing models, disclosure that users are interacting with an AI/ML system and an option to switch to human assistance, human-in-command arrangements, override, suspension or kill-switch mechanisms, and periodic human review of outputs.

What did RBI draft Guidance on Regulatory Principles for Model Risk Management change for banks?

The draft turns the RBI's 2024 credit-model proposals into a whole-institution model risk standard and, following the FREE-AI report, writes AI/ML-specific principles into it. For banks, if finalised as drafted, it would introduce AI-specific explainability thresholds, red-teaming, kill switches and AI disclosure to customers.

What would the RBI's draft Guidance on Regulatory Principles for Model Risk Management require of banks?

If finalised as drafted, the RBI's Guidance would require each regulated entity to put in place a Board-approved model risk management framework for all models, including AI/ML and third-party models, tier models by materiality and complexity and review the tiers at least annually, keep a complete model inventory, and subject every model to independent validation before and after deployment, with high-risk models approved by the Risk Management Committee of the Board. For AI/ML models it adds explainability thresholds, hallucination and bias controls, red-teaming, enhanced controls for automatically updating models, customer disclosure that they are dealing with AI with an option to reach a human, and human-in-command arrangements including override and kill-switch mechanisms. It is a draft released on 24 June 2026, comments closed on 24 July 2026, and it is not yet in force.

The draft says the final Guidance, following public consultation, would supersede Chapter 3 on Credit Risk Models of the Guidance Note on Credit Risk Management of 12 October 2002, and that it is to be read with other RBI Directions, which prevail in case of inconsistency (paragraph 5). It also notes, citing paragraph I.10 of Utkarsh 2029, that further requirements applicable to AI models may be issued later.

It builds on the RBI's draft circular "Regulatory Principles for Management of Model Risks in Credit" of 5 August 2024 and on the FREE-AI Committee report of 13 August 2025. Separately, the Reserve Bank (Commercial Banks - Asset Classification, Provisioning and Income Recognition) Directions, 2026 dated 27 April 2026 include Chapter V on principles for model risk management under expected credit loss, in force from 1 April 2027.

WHAT THIS MEANS IN PRACTICE

• Compare the existing model inventory and tiering against paragraphs 17 to 24, including spreadsheet-based tools that meet the draft's definition of a model.
• Map AI/ML and third-party models to the Chapter V principles and identify where explainability thresholds, red-teaming and kill-switch arrangements are missing.
• Review vendor contracts for documentation access, audit rights for the bank and supervisor, and exit arrangements.
• Plan Board and RMCB reporting on high-risk model validations and exceptions.
• Watch for the final text and any changes after the consultation that closed on 24 July 2026 before committing build effort.