Overview
- The Reserve Bank of India released a draft Guidance on Regulatory Principles for Model Risk Management on Wednesday, June 24, and has opened it for public comment until July 24, 2026.
- The draft would require every regulated entity to adopt a board‑approved Model Risk Management Framework that covers all models, including AI and machine‑learning systems.
- Banks must build override, suspension or deactivation mechanisms — described as 'kill‑switch' arrangements — and keep all AI‑driven decision‑making subject to human oversight with customers able to request a human instead of an AI.
- Models must be classified by risk, with high‑risk systems needing approval from the board’s Risk Management Committee; the rules also mandate independent validation, lifecycle testing, red‑teaming and explainability thresholds.
- Regulated entities remain fully accountable for third‑party models and must do vendor due diligence, obtain technical transparency or limit use, and adopt extra cybersecurity safeguards for customer‑facing and generative AI.