India's AI Governance Gap Hits Banks as RBI Guidance Looms

The Reserve Bank of India will close the public consultation window on July 24 for its draft guidance on model risk management. The framework, part of the central bank's Free-AI report, sets out how banks and other regulated entities should govern artificial intelligence. The question for financial institutions has shifted from whether to adopt AI governance to how to meet specific requirements with limited operational clarity.

RBI's own survey of about 600 regulated entities, covering 90% of the sector's asset base, found that only 21% of institutions are implementing or developing AI. Where AI is used, it is largely for low-stake applications such as customer-facing chatbots and internal process automation. Use in high-stake functions like credit decisions and fraud detection remains limited, the survey showed.

A gap between principle and practice is now the central challenge, according to a Mint article by two policy researchers. Industry executives have raised a series of practical questions that the draft guidance does not fully answer. Who owns an AI system once it goes live? Which committee approves its deployment? How should AI risk be incorporated into the enterprise risk management system? What constitutes an 'AI incident'? What documentation should be maintained for supervisory review?

The Questions That RBI's Draft Guidance Leaves Open

The MRM framework requires every regulated entity to maintain a model inventory. No model can be used unless it appears in that inventory. It requires risk-based model-tiering so that governance intensity is calibrated to the potential impact of each system. It requires independent validation of all models, including those sourced from third-party vendors, regardless of assurances from vendors. It also requires specific controls for AI systems, covering explainability thresholds, hallucination mitigation, bias assessment and red-teaming to catch failures.