When an RBI examiner asks a bank to produce its AI governance policy, the examiner is looking for a document that reflects the bank's actual AI deployment reality — not a model risk policy with "AI" inserted in the title. The gap between these two documents is where examination findings concentrate, and it is a gap we have watched examiners find in minutes: ask where the policy covers the LLM chatbot on the bank's own website, and the silence answers the question.
A model risk policy governs statistical models: their development, validation, approval, monitoring, and retirement. It was designed before LLMs existed, before AI agents took autonomous actions in production systems, and before AI fairness was a regulatory expectation rather than a technical aspiration. An AI governance policy that does not extend beyond model risk will leave gaps visible to any examiner who looks at the bank's actual AI inventory and asks where the policy covers the third-party fraud detection AI, or what it says about the bank's DPDP Act obligations for automated decisions.
Required Sections: What an AI Governance Policy Must Contain
1. Scope definition: what counts as AI. The policy must define what systems it governs. This is more consequential than it looks: a scope defined as "quantitative statistical models" will miss LLMs, rules-based expert systems augmented with AI, third-party AI embedded in vendor products, and AI-assisted robotic process automation. A defensible scope covers all systems using machine learning, deep learning, or language model methods; all systems making or recommending consequential customer-facing decisions; all generative AI and agentic AI deployments; and third-party AI used in material banking processes. Include a de minimis threshold to keep the scope operationally manageable, but document the threshold and its basis — an undocumented threshold is just an unscoped exemption with better PR.
2. AI risk taxonomy and tiering. The policy must define how AI systems are risk-tiered, since tiering determines governance intensity. A practical BFSI framework uses four tiers: Critical (customer-facing AI making consequential decisions at scale; AI in material financial calculations; LLMs with customer advisory scope); High (AI in material internal decisions; fraud and AML AI; AI in material vendor-managed processes); Medium (internal productivity and decision support; non-consequential customer-facing AI); and Low/Minimal (AI with full human review of outputs; sandboxed experimental AI). The tiering criteria must be explicit and applied consistently in the AI inventory, not re-derived ad hoc each time someone asks which tier a new system belongs in.
3. Fairness obligations and India proxy variable registry. The policy must define fairness obligations for AI systems making customer-facing decisions. For India banking, this should cover the protected dimensions the bank monitors — standard demographic dimensions plus India proxy variables such as geographic/pincode cluster, religion-proxy counterparty patterns, language/device type, and disability-proxy interaction patterns; a maintained India proxy variable registry documenting features that may serve as proxies, with rationale and oversight; fairness metric standards and adverse impact thresholds; and the governance response when thresholds are breached. The proxy variable registry is unique to India banking practice — no international AI governance framework requires it, and examination practice is moving toward expecting it even though it is not yet a codified requirement.
4. LLM and generative AI governance. A section specifically covering generative AI must address prompt versioning and change control, since system prompt changes that materially affect LLM behavior are a governance event requiring approval; RAG knowledge base governance, because the content and versioning of retrieval sources affect LLM outputs and need documentation; hallucination management standards; financial advice boundary enforcement for customer-facing LLMs; and agentic AI authorization scope — what actions AI agents may take, how authorization is granted and revoked, and how multi-agent communication is governed. Without this section, the policy has no coverage for what is likely the fastest-growing category of AI deployment in the bank.
5. Third-party AI governance. The policy must define due diligence requirements before procurement, minimum contract provisions, ongoing oversight requirements, and escalation procedures when vendor AI exhibits performance degradation or fairness violations. It must also assign clear accountability for third-party AI governance to a named function separate from IT vendor management — otherwise third-party AI oversight quietly becomes nobody's job.
6. Board risk appetite and governance structure. The policy must include a board-approved AI risk appetite statement with domain-level thresholds — the section most frequently absent from model risk policies repurposed as AI governance policies. It must define which AI risk domains carry low, medium, or high tolerance; specific threshold triggers that escalate to the board or risk committee; and the frequency and format of board-level AI risk reporting. The governance committee itself needs a defined membership, meeting frequency, and reporting line to the board risk committee.
7. Explainability and customer rights. At minimum, customer-facing AI making consequential decisions needs per-decision local explainability consistent with the Fair Practices Code; explanations must be available in the customer's preferred language; and DPDP Act explanation and grievance-redressal rights need a defined response process, including for RAG systems where source attribution matters.
8. Prohibited and restricted AI uses. Prohibited uses — no approval can authorize these — should include AI designed to exploit customer psychological vulnerabilities, AI designed to produce discriminatory outcomes by protected characteristic, and AI used to circumvent AML or regulatory reporting obligations. Restricted uses requiring elevated approval should include unsupervised consequential customer-facing decisions without human override capability, credit decisions using India proxy variables without fairness testing, and fully autonomous agentic AI that can execute financial transactions without human oversight. This section is the AI equivalent of the conduct risk framework: it defines the floor governance must hold regardless of commercial pressure.
Policy Gap Analysis: What Model Risk Policies Typically Miss
| Policy area | Typical model risk policy coverage | What AI governance policy must add | Examination finding risk if absent |
|---|---|---|---|
| LLM governance | Usually absent: policies predate LLMs or define "model" narrowly | Prompt versioning, RAG governance, hallucination management, financial advice boundary, agentic authorization scope | Material gap — LLM deployments ungoverned by any policy document |
| Fairness and bias | Statistical fairness metrics checked at validation; no ongoing monitoring obligation | Ongoing fairness monitoring as a standing requirement; India proxy variable registry; adverse impact threshold definitions | Fairness finding under FREE-AI's fairness-related recommendations — monitoring exists at validation but not in production |
| Third-party AI | Vendor model policy often covers models built to the bank's specification, not off-the-shelf AI products | Due diligence for procured AI; minimum contract provisions including India fairness testing; ongoing vendor AI oversight function | Vendor AI oversight gap — third-party AI operating without governance coverage |
| Customer-facing AI | Not addressed — policies govern internal decision models, not customer service AI or advisory tools | Guardrail requirements, financial advice boundary definition, Fair Practices Code compliance, customer escalation rights | Customer protection finding — customer-facing AI deployed without governance coverage |
| Board risk appetite | Model risk appetite often defined in aggregate terms; no domain-level thresholds | Domain-level AI risk appetite thresholds; board-level AI risk reporting requirements | Finding under FREE-AI's accountability-related recommendations — board oversight not defined in policy |
India-Specific AI Governance Policy Requirements
India proxy variable registry (mandatory for India BFSI). No international AI governance framework requires a proxy variable registry. Indian banking AI governance, shaped by India's social geography of caste, religion, and language discrimination, requires a documented registry of features that may serve as proxies for protected characteristics — each with the protected characteristic it may proxy, the analytical basis for inclusion despite proxy risk, and the governance oversight behind that decision. This must be a living document, updated whenever new AI systems are deployed or existing models add features.
DPDP Act 2023 automated decision governance. The DPDP Act creates rights for data principals regarding automated AI decisions made using their personal data: the right to explanation, the right to grievance redressal, purpose limitation (which constrains feature engineering that combines data across banking relationships), and data minimization. These are legal obligations the policy must address, with accountability typically assigned to the bank's Data Protection Officer working alongside the AI governance function.
Board evidence of AI oversight. These documents are examination artifacts regardless of their regulatory label — prepare and maintain them with examination access in mind.
AI Governance Policy Action Checklist
- Pull up your current "AI governance policy" and check whether it has a dedicated LLM/generative AI section — if it reads like a model risk policy with "AI" inserted, it is one.
- Stand up the India proxy variable registry as a living document this quarter, not as a one-time compliance exercise.
- Correct any internal reference to a "2024 AI Circular" to cite the actual binding instrument it rests on, plus the FREE-AI report as the forward-looking benchmark.
- Confirm the policy assigns third-party AI oversight to a named function distinct from IT vendor management.
- Produce the last twelve months of board or risk committee minutes and check whether AI oversight is substantively discussed — not just listed as an agenda heading.
Related: AI governance framework for BFSI
AI governance policy that covers LLMs, agentic AI, third-party AI, fairness obligations, and DPDP Act requirements — operationalized in governance workflows, not just documented
Zytra operationalizes AI governance policy requirements: inventory that maps each AI system to policy sections, workflows that enforce governance requirements at each lifecycle stage, and India proxy variable registry as a governed feature of the platform. Board-level AI risk reporting is built in — not assembled at examination time but maintained continuously.