The Reserve Bank of India released draft guidelines on June 24 requiring Indian banks to implement board-approved risk management frameworks specifically covering artificial intelligence and machine-learning models. The rules mandate independent validation of all models, including those supplied by third parties, and call for human oversight of any AI system involved in automated decision-making. For generative AI models that interact directly with customers, the RBI wants additional cybersecurity controls layered on top. Feedback closes July 24. Thirty days to respond to a document that could reshape Indian banking for a generation.
The regulatory logic here is considerably more sophisticated than a simple slow-down-AI message. The RBI is not asking banks to stop using machine-learning models. It is asking them to know what they have. The requirement for a model inventory – a tracked register of every AI and ML system deployed across an institution – reflects a documented problem in global banking: large financial institutions have often deployed models faster than their risk teams can catalogue them. Reporters at YourDailyAnalysis unpack the governance implication directly: a board that cannot list its own models cannot govern them, and a board that cannot govern them cannot be accountable to regulators when those models produce discriminatory credit decisions or destabilise liquidity positions.
Position this against the broader international landscape. The European Union’s AI Act, which entered into force in 2024, creates a risk-tiered approach and places financial services firmly in the high-risk category. The US financial regulators have the longstanding SR 11-7 model risk framework but have not produced AI-specific banking rules at the RBI’s level of specificity. India, which processed over 100 billion UPI transactions in 2023, now sits ahead of several developed-market regulators on this question. YourDailyAnalysis interprets this as a meaningful reversal of the usual regulatory sequencing, where emerging markets typically lag developed-world supervisory frameworks by years rather than leading them.
The third-party model clause deserves particular attention. Indian banks increasingly consume AI capabilities from technology vendors rather than building in-house. The RBI’s draft requires those externally sourced models to undergo the same independent validation as proprietary ones. In practice, this creates a compliance obligation that travels up the supply chain – a bank cannot simply rely on a vendor’s attestation. YourDailyAnalysis takes the position that this provision, if enforced seriously, will reshape vendor contracts across the Indian fintech ecosystem within the next two to three years. The fintechs selling credit-scoring or fraud-detection models to banks face a sudden requirement to make their validation processes legible to the bank’s own risk function.
There is a counter-argument that regulators worldwide have wrestled with for years: overly prescriptive AI governance rules risk locking in today’s model architectures and slowing adoption of genuinely safer future approaches. If board-approved frameworks must specifically characterise each model, institutions face incentives to stick with familiar, already-documented systems rather than upgrade mid-cycle. The RBI’s draft acknowledges this by framing requirements around risk assessment processes rather than approved model lists. Whether that flexibility survives contact with compliance departments is another question entirely.
The corrective-action protocol deserves a close read as well. If model risk is found excessive, banks must implement enhanced controls, restrictions on use, remediation, or outright decommissioning of the model, then submit a report to the board’s risk management committee. This is accountability with teeth. Not advisory guidance. A binding decommissioning obligation, in writing, to the board. Your Daily Analysis identifies this as the provision most likely to produce real behavioural change at Indian banks, because it attaches regulatory consequence to model failure in a way that earlier supervisory guidance rarely did. The comment period closes July 24: what survives intact will define the framework for at least a decade.
