Free resource · AI governance

AI Governance Checklist for Banks: 50 Controls Across 8 Domains

Use this checklist to identify gaps across your AI governance program. Each control is mapped to the regulatory frameworks that require it — SR 11-7, EU AI Act, NIST AI RMF, ISO 42001, RBI 2024 AI Circular, FREE-AI Framework, eMRM, DPDP Act, and SEBI.

50
Controls
8
Domains
12+
Frameworks mapped
Free
No gating

The checklist covers global frameworks (SR 11-7, EU AI Act, NIST AI RMF, ISO 42001) and India-specific requirements (RBI 2024 AI Circular, FREE-AI 26 recommendations, eMRM June 2026 draft, DPDP Act, SEBI Responsible AI). Use it quarterly or before any regulatory examination.

01
Model Inventory and Risk Tiering
SR 11-7 · RBI 2024 · eMRM
  • Complete inventory of all AI models in production, including third-party and shadow AI
    SR 11-7RBI 2024eMRM
  • Each model assigned a risk tier (Critical / High / Significant / Standard / Minimal)
    eMRMSR 11-7
  • AI Bill of Materials (AIBOM) per model: training data, architecture, dependencies, version
    EU AI ActNIST AI RMFRBI 2024
  • Shadow AI discovery process — models deployed outside formal channels identified and catalogued
    SR 11-7RBI 2024
  • Model inventory reviewed and updated at minimum quarterly; continuous preferred
    SR 11-7eMRM
  • Named accountability owner per model with documented approval for production deployment
    SR 11-7EU AI ActSEBI
02
Model Validation and Independent Review
SR 11-7 · eMRM · EU AI Act
  • Independent validation completed for all Tier 1–2 models (independence from development and use)
    SR 11-7eMRM
  • Validation covers third-party/vendor AI — vendor attestations alone are not sufficient
    eMRMSR 11-7
  • Non-deterministic validation methodology for generative AI (sampling-based output quality)
    SR 11-7 ext.eMRM
  • Adversarial red-team evaluation included in pre-deployment validation for all customer-facing AI
    FREE-AI R-3EU AI Act Art.9
  • Hallucination rate measured on BFSI-specific test sets with acceptable rate threshold documented
    SR 11-7 ext.FREE-AI R-5
  • Model Risk Committee approval documented for Tier 1–2 models before production deployment
    SR 11-7eMRM
03
Runtime Security and Guardrails
RBI FREE-AI · OWASP LLM Top 10 · MITRE ATLAS
  • Prompt injection detection active in production for all customer-facing AI
    OWASP LLM01MITRE ATLASFREE-AI R-3
  • Jailbreak attempt detection with logging and alerting per incident
    OWASP LLM01FREE-AI R-3
  • PII exfiltration detection in model outputs — Aadhaar, PAN, account numbers, phone numbers
    DPDP ActOWASP LLM06
  • Guardrail false-positive rate measured on benign BFSI query set — threshold defined
    SR 11-7 ext.EU AI Act
  • KV Cache tenant isolation enforced — no cross-tenant context leakage in shared inference
    SR 11-7 ext.ISO 42001
  • Financial advice, investment advice, and regulated activity guardrails active
    SEBIFCAMAS TRM
04
Fairness, Bias, and Non-Discrimination
FREE-AI Pillar 1 · EU AI Act · SEBI
  • Bias assessment completed for all models making customer decisions (credit, KYC, pricing)
    FREE-AI F-1EU AI ActSEBI
  • Demographic parity and equal opportunity metrics defined and monitored in production
    FREE-AI F-2NIST AI RMF
  • Protected attributes (gender, religion, caste, disability, age) tested for discriminatory outcomes
    FREE-AI F-3EU AI Act
  • Fairness monitoring continuous — not only at model launch
    FREE-AI F-4NIST AI RMF
  • Fairness threshold breach triggers re-validation (not only alerting)
    FREE-AI F-8eMRM
  • Training data bias assessment documented — representativeness of protected segments
    FREE-AI F-5EU AI Act Art.10
05
Explainability and Transparency
FREE-AI Pillar 3 · EU AI Act · SEBI
  • Explainability capability deployed for all AI systems making material customer decisions
    FREE-AI E-1EU AI Act Art.13SEBI
  • Explanation available at customer level on request — not only at aggregate model level
    FREE-AI E-3GDPR Art.22
  • Explanation logs maintained for audit — sample of decisions with explanations stored
    FREE-AI E-5SR 11-7
  • Customers disclosed that AI materially influences decisions made about them
    SEBIEU AI Act
  • Human escalation pathway for decisions customers wish to contest
    FREE-AI Et-2EU AI Act Art.14
06
Data Protection and Privacy at Inference
DPDP Act · GDPR · FREE-AI
  • PII detection active at AI inference layer — inputs and outputs both scanned
    DPDP Act §4GDPR
  • Consent verified before personal data used in AI-driven profiling or scoring
    DPDP Act §6GDPR Art.6
  • Purpose limitation enforced — AI models cannot be used beyond declared use
    DPDP ActGDPR Art.5
  • Data localisation for AI workloads processing Indian personal data (within India)
    DPDP ActRBI 2024
  • Data principal rights workflow covers AI-derived data (scores, recommendations, outputs)
    DPDP Act §11-13GDPR Art.17
07
Audit Trail and Evidence Chain
RBI 2024 · SR 11-7 · EU AI Act
  • Audit trail for all AI-driven decisions: timestamped, complete, tamper-evident
    RBI 2024SR 11-7EU AI Act Art.12
  • Governance actions (approvals, validations, reviews) linked to model in evidence chain
    SR 11-7eMRMISO 42001
  • Evidence exportable on demand — PDF, OSCAL, or regulator-required format
    RBI 2024SR 11-7
  • Retention period for AI governance evidence meets regulatory minimum (typically 7 years)
    RBI 2024EU AI Act
  • Forensic replay capability: reconstruct model context state at any point in time
    eMRMSR 11-7 ext.
  • Board and committee approvals recorded in signed, tamper-evident ledger
    RBI 2024SR 11-7EU AI Act
08
Agentic AI Governance
FREE-AI R-3–R-6 · MITRE ATLAS · SR 11-7 ext.
  • All autonomous agents have declared capability scope — tools, APIs, and data they may access
    MITRE D-10FREE-AI R-4
  • Authorization boundary enforcement at runtime — agents cannot acquire undeclared capabilities
    MITRE D-10SR 11-7 ext.
  • Indirect prompt injection detection in agent pipelines — documents, emails, retrieved content
    MITRE D-09OWASP LLM01
  • Multi-agent interaction audit trail — calls between agents logged with full context
    MITRE D-11RBI 2024
  • Human-in-the-loop defined for high-stakes agent decisions (financial transactions, credit, KYC)
    FREE-AI Et-2EU AI Act Art.14
  • Agentic AI risk-tiered separately from model risk — agent scope drives tier, not model complexity alone
    eMRM ext.SR 11-7 ext.
After the checklist

Turn your gap list into an automated control framework

Schedule an AI governance review

Zytra's team will walk through your gap list, prioritise by examination exposure, and map each control to the evidence you need to generate.

Request a review →

141-dimension AI risk assessment

Deeper than this checklist: 141 risks across 21 domains, scored against your controls, with residual risk heat maps by domain.

Start free →

India-specific RBI readiness assessment

Four-layer India coverage: RBI Circular, FREE-AI, eMRM, and DPDP Act. Know your RBI examination score before your examiner does.

Start →

Ready to automate the controls you just checked off?

Zytra automates evidence collection for every control in this checklist — SR 11-7, EU AI Act, RBI, SEBI, DPDP Act — with examination-ready output that requires no manual scramble.

Request a demo Explore governance platform →