AI Governance Maturity Model for Banking: Five Levels from Reactive to Governed — and the Gap Most Indian Banks Face When Their First Examination Arrives

Why Most Indian Banks Plateau at Governance Maturity Level 2

Walk into most model risk committees at scheduled commercial banks, UCBs, or NBFC-ND-SIs running AI in credit or collections, and you will find a model inventory and a risk register. That is Level 2. What you will rarely find is a controls assessment that scores each control's effectiveness and rolls up to a residual-risk number the board can act on — that is Level 4, and it is where RBI's risk-based supervision cycle now expects you to be. The gap is not about how many models you have deployed. A bank with four AI models and a tested control framework will clear an examination that a bank with forty models and a spreadsheet will not.

I have watched this exact conversation happen in a Risk Assessment Report (RAR) debrief: the examiner isn't impressed by the inventory, because every bank has one by now. The follow-up question is always "show me how you know this control is working," and a document trail is not an answer to that question.

The Five Levels, and the Artifact an Examiner Asks For at Each One

Level 1 — Reactive. Model risk lives in individual engineers' heads. Validation checks statistical accuracy and stops there; nobody asks whether the model's behavior is bounded for compliance purposes. An examiner finding AI deployed with no documented risk assessment at this level writes it up as a Monitorable Action Plan (MAP) item with a hard deadline, and for a customer-facing credit model, can require you to pause onboarding through that model until remediated.

Level 2 — Catalogued. You have a spreadsheet or wiki listing models, but no consistent risk classification and no named control owner per entry. This is where most Indian banks sit today. The tell is a risk register nobody has opened since the audit that created it.

Level 3 — Mapped. Risks are classified against a named regulatory framework, control owners are tracked in a GRC tool rather than a document, and the mapping is current enough to survive an auditor's spot check. This is an acceptable baseline, but examiners will still write observations on evidence quality.

Level 4 — Measured. Every control has a tested effectiveness score, not a self-assessed one. Residual risk is calculated, not estimated — a simple and defensible version is Residual Risk = Inherent Risk × (1 − Control Effectiveness), applied per domain and rolled into a heat map. This is the level where an examiner's question gets answered with a number pulled from a system, not a narrative written the week before the visit.

Level 5 — Governed. The inventory updates itself when a model is deployed or retrained, the board has signed off on risk appetite thresholds by domain, and monitoring exceptions escalate automatically to committee. Very few Indian banks are genuinely here yet — most that claim to be have automated the dashboard but not the escalation logic underneath it.

Closing the Gap Is a Governance Problem, Not a Deployment Problem

A bank that pauses new AI deployments to "get governance in order" is solving the wrong problem — the backlog of ungoverned legacy models doesn't shrink while you wait. The Level 2-to-4 jump requires three things in parallel: a control-testing cadence with named owners, a residual-risk calculation the board actually reads before the quarterly review, and evidence retained in a form an examiner can query, not just a PDF someone exported. None of that requires fewer AI systems. It requires treating governance as infrastructure rather than as a project that gets marked "done" after the first committee sign-off.

Action Checklist: Moving From Level 2 to Level 4 Before Your Next Examination Cycle

1. Assign a named owner and a test cadence to every control in your current risk register — an unowned control is not a control, it's a line item.
2. Replace self-assessed control ratings with tested effectiveness scores, even a simple pass/fail per quarter is better than an assumed "adequate."
3. Calculate residual risk per domain and put the heat map, not the narrative, in front of the board every quarter.
4. Retain evidence in a system that can answer "show me this control's test history for the last 12 months" in minutes, not an email search.
5. Pressure-test your own inventory before the examiner does: pick three deployed models at random and ask whether you could produce a RAR-ready evidence pack for each one today.