Every bank preparing for an RBI examination of its AI governance faces the same question: what will the examiners ask for, and do we have it? The answer is not a single form or template. It is an evidence chain — a set of documents, records, and data that demonstrate AI governance was operating in practice, not just in policy. We have sat in enough of these examinations to know the question that actually matters is never "do you have a policy," it's "show me the artifact from the last time this policy was applied."
The gap between policy documentation and operational evidence is the most common AI examination finding. A bank may have a model risk policy that covers AI, a fairness testing requirement in that policy, and a validation process that nominally includes AI. But if the examiner asks for the fairness testing output from the last production credit AI validation, and no such output exists — because fairness testing was written into policy but never actually performed — the policy document earns the bank nothing.
AI regulatory reporting, understood correctly, is the practice of generating governance evidence continuously as a byproduct of normal operations, so that examination preparation is a retrieval exercise, not a construction exercise undertaken in a panic the week before the examiners arrive.
What RBI Expects in AI Regulatory Reporting: Five Categories
| Reporting category | What examiners expect to see | Common gap | Examination finding if absent |
|---|---|---|---|
| AI system inventory | Complete catalogue of production AI systems with risk tier, use case, vendor, deployment date, and validation status, current as of examination date | Inventory exists but is not continuously maintained; shadow AI deployed without governance registration creates inventory gaps | Incomplete AI inventory — high severity finding; triggers expanded examination scope |
| Fairness and bias metrics | For customer-facing AI decisions: current fairness metrics and trend data showing they've been monitored over time, not just measured at last validation | Fairness testing done at validation time but not monitored in production; metrics not available for all customer-facing AI systems | Fairness monitoring gap; may require a remediation plan |
| Validation status | Most recent independent validation report per material AI system; findings and open remediation actions; a model change log showing what triggered any re-validation | Validation reports exist but findings aren't tracked to closure; model changes made without triggering re-validation assessment | Validation currency gap — high severity finding |
| AI incident register | A classified log of AI incidents for the examination period: type, affected systems, customer impact, response timeline, root cause, remediation | AI incidents logged as general IT incidents with no AI-specific classification; customer impact not quantified | Incomplete incident register; incident response gap if AI incidents aren't identifiable from the general log |
| Vendor AI oversight | Evidence of periodic vendor performance reviews for third-party AI, change notification records, audit rights exercised, BCM documentation for AI | Vendor reviews cover financial and contractual performance but not AI model performance; change notifications not logged or acted on | Third-party AI oversight gap under vendor risk management expectations |
AI Evidence Pack: Seven Sections for Examination Readiness
1. AI inventory and risk registry. Complete system catalogue, risk tiers, and dates, current as of examination date, with a shadow AI detection log and an inventory change log showing additions and removals.
2. Validation reports and findings. Latest independent validation per material system, a findings register with open/closed status, a re-validation triggers log, and the validation sign-off chain showing validator independence.
3. Production monitoring outputs. Twelve months of performance metrics per system, fairness metrics trend data, drift indicators and alert trigger logs, and override rate tracking.
4. Governance committee records. AI risk committee minutes with AI agenda items, board risk committee AI reporting records, AI deployment approval records, and risk appetite confirmation by the board.
5. AI incident register. A classified incident log for the examination period, customer impact quantification per incident, response timeline against SLAs, and root cause and remediation per entry.
6. Vendor oversight records. Quarterly vendor AI performance reviews, vendor change notification logs, BCM documentation for AI vendor dependencies, and audit right exercise records.
India-Specific AI Regulatory Reporting Requirements
Board oversight evidence for AI.
India proxy variable fairness reporting. An evidence pack showing only standard demographic fairness testing, without India proxy variable coverage, is a real and defensible gap regardless of which pillar name gets attached to the finding.
SEBI AI-in-trading reporting. Banks operating under both RBI and SEBI oversight should maintain separate evidence packs for each regulator regardless, since the two frameworks have different scope and different reporting timelines.
AI Regulatory Reporting Action Checklist
- Build the seven-section evidence pack as a continuously generated operational output, not a pre-examination scramble — assign an owner for each section today.
- Replace every internal reference to a "2024 AI Circular" with the actual practice you're following and why, so the citation survives an examiner's follow-up question.
- Confirm board or risk committee minutes from the last four quarters contain substantive AI discussion, not just an agenda line item.
- Add India proxy variable fairness metrics to the standard evidence pack for every customer-facing credit or fraud AI system.
- If the bank has a SEBI-regulated trading business, confirm with SEBI compliance which AI-specific disclosure or incident reporting obligations currently apply, rather than relying on this article's characterization of them.
Related: AI compliance and examination
Continuous AI evidence generation — examination-ready packs on demand, India proxy variable fairness reporting included
Zytra generates all seven sections of an RBI AI evidence pack as a byproduct of normal governance operations. Monitoring outputs, validation records, committee approvals, incident logs, and vendor oversight records are timestamped and hash-chained continuously. India proxy variable fairness reporting and OSCAL export included.