More Stories

Informist, Wednesday, Jun. 24, 2026

 

--RBI issues draft guidance on regulatory principles for model risk mgmt 

--RBI seeks views on draft model risk mgmt guidelines by Jul 24 

--RBI moots cos to have model risk mgmt norms for all models, including AI 

 

NEW DELHI – The Reserve Bank of India on Wednesday proposed that regulated entities must set up a 'Model Risk Management Framework' applicable to all business models, including artificial intelligence and machine learning. "Considering model usage has expanded significantly and regulated entities are increasingly using models, including those employing artificial intelligence/machine learning, across various business and decision-making processes; weaknesses in their governance, oversight, risk management and controls may expose the regulated entities to financial, operational, compliance, and reputational risks," the RBI said in its draft 'Guidance on Regulatory Principles for Model Risk Management'. 

 

These guidelines provide broad, holistic regulatory expectations for model risk management across the model lifecycle, it said. The central bank sought views on the draft guidelines by Jul. 24. 

 

According to the draft guidelines, the board-approved risk management framework of the regulated entities must cover model taxonomy, governance structure, scope of model use, model risk tiering methodology, and inventory and documentation standards. The framework should also cover concomitant policies for the model lifecycle, including standards and procedures for model selection and development, validation, approval structure, deployment and monitoring, change management, business continuity management, and decommissioning. 

The regulated entity's board must be responsible for overseeing the risk management framework, including approving and periodically reviewing it, approving the company's risk appetite and tolerance for model risk, and ensuring it is forward-looking, the RBI said. The board will also approve the model risk tiering proposed by the central bank. 

 

The RBI also proposed a risk-based model-tiering structure to classify models by complexity and use. The regulated entity must ensure that the integration of multiple factors does not result in one factor offsetting or diluting another, and that the model tier reflects the model's composite risk profile. "... a low complexity should not result in a disproportionate reduction of the overall risk tiering of a highly material model," it said.

 

The central bank also said that regulated entities must ensure that the use of AI models does not introduce vulnerabilities in the models or the entities' production environments. It proposed implementing appropriate safeguards, including access controls to prevent unauthorised access, safeguards against cyber risks, and controls for risks arising from external interfaces or integration pipelines with third-party components or systems.

 

According to the draft guidelines, regulated entities must assess whether the risks arising from AI models can be adequately identified, measured, monitored, and managed. "It should ensure that such AI/ML (artificial intelligence/machine learning) models are deployed only in the business processes/use cases where commensurate risk can be effectively managed." The central bank also said that a regulated entity must identify and address risks arising from the behavioural characteristics of AI models and implement appropriate safeguards. It should test the model behaviour under atypical or stressed scenarios to ensure vulnerabilities do not arise under edge cases, abnormal inputs, manipulations, and adversarial conditions, it said.

 

The central bank also proposed that regulated entities implement enhanced controls for AI models with dynamic or automatic updates, including defining a clear scope of what can be updated automatically, providing strict justifications for enabling automatic updates, enhancing data quality checks, and implementing more stringent and frequent monitoring. "An RE (regulated entity) should have enhanced documentation for the AI models considering their complexity, self-adapting nature, and huge reliance on training data, to enable traceability, reproducibility, and auditability."

 

For third-party models, the regulated entities must undertake due diligence before onboarding them, the RBI said.

 

As per the draft guidelines, regulated entities must assess model risk at both individual and enterprise-wide levels, on an ongoing basis. If the assessed risk of a model exceeds the entity's risk appetite, the entity should initiate timely action, such as enhanced controls, restrictions on use, remediation, and decommissioning, and a report to this effect must be placed before the committee. 

 

It should implement the three lines of defence, with model owners as the first line of defence, an independent model risk management and validation function as the second line of defence, and a robust and independent internal audit function as the third line of defence, the RBI said. "It should undertake ongoing performance testing using backward-looking and forward-looking approaches, including AI-specific evaluations where applicable, and benchmarking, as appropriate," it added. 
 

The central bank also proposed that regulated entities maintain an accurate, comprehensive, and up-to-date inventory of all active, inactive, and decommissioned models to provide an overview of individual and enterprise-wide model risk. This will serve as a basis for management reporting and help identify model inter-dependencies. No models can be used unless they are part of this inventory, the RBI said.   End

 

Reported by Priyasmita Dutta

Edited by Saji George Titus

 

For users of real-time market data terminals, Informist news is available exclusively on the NSE Cogencis WorkStation.

 

Cogencis news is now Informist news. This follows the acquisition of Cogencis Information Services Ltd. by NSE Data & Analytics Ltd., a 100% subsidiary of the National Stock Exchange of India Ltd. As a part of the transaction, the news department of Cogencis has been sold to Informist Media Pvt. Ltd.

 

Informist Media Tel +91 (11) 4220-1000

Send comments to feedback@informistmedia.com

 

© Informist Media Pvt. Ltd. 2026. All rights reserved.