On 24 July, the public consultation window closes on the Reserve Bank of India’s (RBI) Draft Guidance on Regulatory Principles for Model Risk Management. This MRM framework follows the Indian central bank’s Free-AI report, which set forth the principles of accountability, transparency, human oversight and fairness to govern artificial intelligence (AI) in India’s financial sector. Financial entities now have the ‘what’ of their task but not the ‘how.’
We noted this across our conversations with bank and fintech executives, technology providers, legal experts, regulators, auditors and policy specialists while researching AI governance.
Further, RBI’s own survey of about 600 regulated entities covering 90% of the sector’s asset base found that only 21% of all institutions are implementing or developing AI.
And where AI is being used, it is largely for low-stake applications such as customer-facing chatbots, voicebots for transaction confirmation and internal process automation. Its use in high-stake functions such as credit decisions, fraud detection and risk management remains limited.
Within policy rooms, the question has two parts. First, how to adopt AI responsibly. Second, how to govern it. The recent concerns around Anthropic’s unreleased frontier model Mythos have made those questions all the more important.
Policymakers around the world have invested considerable effort in defining what responsible AI should look like, and now the MRM framework turns many of those expectations into specific institutional requirements insofar as any model used by a bank or other regulated entity adopts the use of any AI technology.
The framework provides policy direction. The gap that remains is an absence of operational clarity, which impacts an entity’s capacity to implement it. So when we speak with industry executives, their questions do not start with a ‘why’ anymore; they start with many ‘hows’ and ‘whos.’
Who owns an AI system once it goes live? Which committee approves its deployment? How should AI risk be incorporated into the enterprise risk management system? What constitutes an ‘AI incident’? What documentation should be maintained for supervisory review? How should boards receive meaningful information on AI risk without being overwhelmed by technical complexity? These questions cannot be answered by principles, however well-drafted they are.
No less importantly, the Free-AI report also placed an onus on regulated entities to promote innovation for inclusion. Acknowledging their probabilistic nature, it recommended a graded liability framework that would allow entities to prudently experiment with the application of AI technologies in financial sector use-cases.
But boards and product heads have no clear answer to what the exposure would be if a product goes live and something goes wrong even after good-faith compliance. Financial innovation will be a downstream exercise that follows once the principle of graded liability is defined clearly.
The next phase of this AI journey will therefore be enabled by management clarity on how banks can convert broad principles into everyday organizational practice through clear accountability, practical controls, effective oversight and continuous governance, coupled with new regulations.
The MRM framework requires every regulated entity to maintain a model inventory; it explicitly states that no model can be used unless it appears in that inventory.
It requires risk-based model-tiering so that governance intensity is calibrated to the potential impact of each system. It requires independent validation of all models, including those sourced from third-party vendors, regardless of assurances from vendors. It also requires specific controls for AI systems, covering explainability thresholds, hallucination mitigation, bias assessment and red-teaming to catch failures.
These requirements have direct operational implications. A financial institution that does not currently maintain a model inventory, has not classified its AI systems by risk, and has no AI-specific provisions in its vendor contracts is already behind the governance architecture outlined by RBI’s guidance document.
The consultation period is the right time for institutions to assess gaps and work on closing them. They should do so because the work of building governance capability takes time and the institutions that begin now will be in a significantly stronger position when RBI’s final requirements are published. This is precisely the approach that the sector needs.
Work is underway to produce practical tools that operationalize requirements such as a maturity assessment, model inventory template, risk-scoring instrument and a vendor governance checklist designed for governance, risk and compliance, a function that involves far more than just the technology teams of financial entities.
The eventual framework should be grounded in a comparative analysis of global and Indian governance frameworks and tested with practitioners across banks, fintech, legal and policy firms and technology organizations. While the MRM framework does move the needle from principles (in the Free-AI report) to actionables, applications of AI technologies go beyond models. The vacuum between high principles and operative frameworks must now be addressed.
Let’s use the consultation window as a prompt to begin work on it.
The authors are, respectively, head of responsible AI governance, Future Shift Labs; and founder and principal, Black Dot Public Policy Advisors.