The draft guidelines propose a board-approved Model Risk Management Framework (MRMF) covering all models, including AI/ML models used by regulated entities.
Under the proposed framework, boards will be required to periodically review the MRMF, approve the entity's risk appetite and tolerance for model risk, and ensure these assessments are backed by scenario analysis and stress testing. They will also have to approve policies governing model risk management and model-risk classification.
Ajay Sirikonda, partner and leader (Financial Services Risk Management) at EY India, said the draft guidelines provide Indian banks with a clear playbook for managing model and AI risks, although implementation will be the bigger challenge. Banks that treat AI governance as core infrastructure, he said, will emerge as leaders.
"The guidelines have a channelling effect on AI use cases. They do introduce additional governance and explainability requirements, but primarily for high-stakes areas such as credit, pricing and autonomous decision-making," he said. "Elsewhere, they remove the biggest hurdle — regulatory uncertainty. Banks have held back on AI adoption not just because of the cost, but because there was little clarity on what was permissible. These guidelines provide that clarity. For most use cases, that will accelerate adoption rather than constrain it."
The RBI has also proposed measures to address risks arising from the use of third-party AI models. Regulated entities will be required to assess behavioural risks associated with such models and test their performance under atypical and stressed scenarios. The draft framework requires institutions to evaluate models against edge cases, abnormal inputs, manipulation attempts and adversarial conditions to identify vulnerabilities that may not emerge under normal operating conditions.
Rajesh Chhabra, general manager (APAC and Large Markets) at Acronis, said the framework comes as AI becomes increasingly embedded in financial services and is no longer a peripheral tool in banking operations.
"As AI adoption deepens in the country, this well-defined governance framework is a necessary step to mitigate the associated risks, particularly in the highly interconnected credit ecosystem where banks, NBFCs and fintechs are increasingly relying on algorithm-led financial decisions," he said.
For customer-facing AI systems, including generative AI applications, the RBI has proposed additional cybersecurity safeguards, including protection against prompt injection attacks and adversarial inputs, limits on session and context persistence, and mechanisms to detect anomalous usage patterns.
 "RBI")