RBI's Draft Model Risk Management Guidance Would Bring AI and Spreadsheet Models Under Board Policy, Independent Validation, Human Oversight and a Kill-Switch Requirement

The Reserve Bank of India has released a draft framework for managing the risks of the models that regulated lenders use, with specific provisions for artificial intelligence and machine learning. The details in this article come from an analysis by the consultancy Vinod Kothari, dated June 24, 2026, of the RBI's draft Guidance on Regulatory Principles for Model Risk Management, 2026. The RBI's own press release and the draft text were not reviewed for this article. The analysis does not state the deadline for comments or an implementation date, so neither is given here. Some descriptions of the draft that circulated in press coverage list particular categories of lenders, and this article follows only what the analysis says.

Status and scope

The draft is out for public consultation, which means the RBI is inviting comments before finalising it. According to the analysis, it applies to all regulated entities, and the analysis specifically discusses non-bank financial companies in several categories. Once final, the guidance is intended to replace Chapter 3, on credit risk models, of the RBI's 2002 Guidance Note on Credit Risk Management. That is a notable detail: the old chapter dealt with traditional credit scoring and similar models, while the new text is written with AI and machine learning in mind.

What counts as a model

The definition is broad. A model is any system that takes inputs, applies processing logic and produces outputs that materially affect decisions. The analysis stresses that this applies whether or not the entity calls it a model, and that it includes spreadsheet-based tools. Its example is a loan pricing calculator that determines lending rates. A lender that thinks of a spreadsheet as just a spreadsheet may therefore find it in scope if it drives material decisions.

Governance requirements

The draft requires a model risk management framework approved by the board and covering AI and machine-learning models. Models are to be tiered by risk, and high-risk models need approval from the Risk Management Committee of the Board. Entities must keep a living model inventory, and decommissioned models must be retained for more than 10 years. The retention period is long, and it implies that entities must be able to reconstruct how an old decision was made.

Validation and vendors

Independent validation is mandatory. The analysis says the entity must validate a model independently even if a vendor provides its own certification. It also says entities need enhanced oversight from the board's risk committee regardless of risk tier, along with contractual rights to the vendor's technical documentation and to audit access. The analysis summarises the principle as: outsourcing a model does not outsource the risk. For lenders that buy scoring or fraud tools from technology firms, this is a significant obligation, since it means they must be able to examine what they buy.

Explainability and fairness

Credit underwriting models fall under material decision-making, which carries higher explainability thresholds. Where a model cannot be fully explained, the entity must add enhanced validation, output verification, more frequent monitoring and restrictions on use. On fairness, entities must identify the risk of discriminatory outputs, particularly in credit decisions, carry out fairness assessments and recalibrate or redesign models where necessary.

Customer-facing AI

For chatbots, voice bots and generative AI that interact with customers, the analysis lists several requirements. The customer must be told they are dealing with an AI or machine-learning system and what its limitations are. They must be able to switch to a human on request. The entity must apply system-level controls against hallucinations, which are fabricated outputs, and build protections against prompt injection, adversarial inputs and anomalous use. It must also run structured red-teaming and challenge testing, meaning deliberate attempts to make the system fail.

Human oversight and the kill switch

The draft requires human-in-the-loop or human-on-the-loop arrangements, kill-switch or override mechanisms and periodic human review of AI-driven decisions. A kill switch is a way to stop or override a model quickly when it behaves badly. The analysis notes that the draft specifically flags automation bias, the tendency of reviewers to accept a machine's answer, and decision fatigue among those reviewers. The requirement therefore goes beyond having a person nominally in the process: it asks whether the person can actually exercise judgment.

What is not in the analysis

Several things are not stated in the source: when comments are due, when the final guidance will take effect, whether any category of small entity will be exempt, and exactly how the tiers of risk are defined. Those will determine how much the draft changes day-to-day practice. Readers who must comply should consult the RBI's published draft.

What it means for insurers

The analysis concerns RBI-regulated lenders, and this article does not claim the draft applies to insurers, which are supervised by IRDAI. It is relevant to insurers only as a signal of how Indian regulators are approaching AI governance, and as a point of comparison for the AI work that IRDAI has begun.

Limits

This article relies on a consultancy's analysis of a draft, not on the RBI's own document. The draft may change after consultation. It is general information, not legal or compliance advice.