Every large Indian bank operates a customer-facing conversational AI — a WhatsApp bot, a mobile app chat assistant, an AI-powered IVR system, or a web chatbot. Many insurance companies have deployed AI assistants for policy queries and claims initiation. SEBI-registered investment advisers and robo-advisory platforms provide AI-assisted investment guidance through chat interfaces.
These deployments have regulatory exposure at three layers that operate independently and simultaneously. A single customer interaction with a bank's WhatsApp bot can be subject to RBI customer service regulations, IRDAI digital distribution rules (if the bank is also a corporate agent for an insurer), Consumer Protection Act provisions, and potentially SEBI's robo-advisory requirements if the bot discusses investment products. No global AI governance vendor has written guidance on governing chatbots at this intersection — it is entirely India-specific.
Layer 1: RBI's No-Credit-Commitment Rule and Grievance Escalation Obligations
The credit commitment prohibition
RBI has established a clear governance boundary for AI-assisted credit interactions: no AI system may commit to specific credit terms — approval status, credit limits, interest rates, tenure, or processing fees — without explicit human authorization. This applies regardless of the channel: WhatsApp bot, mobile app assistant, IVR, or website chat.
The practical trigger for most banks: an AI system that says "Based on your profile, you are eligible for a personal loan of ₹3 lakh at 13.5% per annum" has made a commitment — or, from the customer's perspective, created a legitimate expectation — that RBI does not permit. Even if the AI's estimate is probabilistically accurate for most customers with that profile, it is not an authorized offer from the institution. The language "you may be eligible" or "subject to verification and final credit assessment" does not fully cure the governance problem if the AI is providing specific numbers.
The technical implementation of this rule requires: a guardrail that detects output containing credit-commitment language patterns (specific rates, amounts, approval statements), a hard block on that output category, a redirect to either a pre-approved offer verified against a live eligibility system or a "please apply and our team will assess" message, and a conversation log showing the guardrail fired.
RBI MRMF applies to this guardrail: it is a model component, it must be in the model inventory, and its performance (block rate, false positive rate for legitimate queries that were incorrectly blocked) must be monitored.
Grievance redressal escalation
RBI's Customer Service Master Circular and the RBI-IOS Scheme require that banks have accessible, functional grievance redressal mechanisms — and that AI-assisted customer service channels facilitate escalation to human agents when a customer has a complaint, cannot be resolved by the AI, or explicitly requests human assistance.
The governance failures RBI Ombudsman orders have identified include:
- AI chatbots that loop customers through automated resolution flows without providing a clear escalation option
- AI systems that acknowledge a complaint but do not generate a complaint reference number (required under RBI complaint tracking requirements)
- Chatbots that provide grievance process information that is inconsistent with the bank's current complaint handling procedures
- AI systems that provide timelines for complaint resolution that do not match the actual resolution process
Each of these failures produces an ombudsman-adjudicatable complaint. The governance implication: the grievance escalation flow in a banking chatbot must be tested against the RBI-IOS requirements, documented as a model component (because the escalation logic is part of the AI system), and monitored for accuracy over time as complaint handling procedures change.
Layer 2: IRDAI Digital Distribution Regulations 2024 for AI-Assisted Insurance
IRDAI Insurance (Digital Distribution) Regulations 2024 govern how insurance products are sold and distributed through digital channels — including AI assistants. These regulations apply to insurers, corporate agents (banks operating as insurance distribution intermediaries), and insurance brokers that use AI in their distribution workflows.
Mandatory AI disclosure requirements
When AI is involved in an insurance recommendation or distribution interaction, the following disclosures are mandatory:
AI involvement disclosure. The customer must be told that AI is being used in the process — before the AI provides a recommendation or product description. This must be affirmative and clear, not buried in a terms-of-service acknowledgment the customer clicked through at onboarding.
Recommendation basis disclosure. For any AI-generated product recommendation ("Based on your profile, we recommend the Term Life Plus plan"), the AI must be able to state the basis for the recommendation in terms the customer understands: their age, income, dependents, existing coverage, stated risk preference. The recommendation cannot be "the algorithm suggests this" — it must be anchored to customer attributes.
Key terms and exclusion disclosure. Any AI interaction that leads to or facilitates a purchase must include disclosure of the policy's key terms and material exclusions — particularly exclusions that affect the customer's stated reason for purchasing. A customer who asks about travel insurance for a pre-existing medical condition and is sold a policy that excludes pre-existing conditions without that exclusion being disclosed has a valid complaint under IRDAI regulations and Consumer Protection Act.
Human advisor right disclosure. Before completing any insurance purchase through an AI-assisted channel, the customer must be offered the opportunity to speak with a human advisor. The AI cannot complete a policy sale without this offer being made and the customer's choice documented.
Insurer liability for AI-assisted distribution
IRDAI places the liability for digital distribution compliance squarely with the insurer, not the technology vendor. A bank that uses an AI chatbot for insurance cross-sell — even if the chatbot is provided by a third-party technology vendor — is the corporate agent under IRDAI regulations and bears the liability for non-compliant disclosures. This creates a vendor governance requirement: the bank must contractually ensure that its AI chatbot vendor's system generates all required disclosures, and must independently test that these disclosures appear correctly in production conversations.
Layer 3: Consumer Protection Act 2019 and E-Commerce Rules 2020
Consumer Protection Act 2019 defines "unfair trade practice" broadly enough to cover AI-generated financial product representations. For banking and insurance chatbots, the most relevant provisions:
False representation. Section 2(47) defines unfair trade practice to include making a false or misleading representation about the nature, standard, or characteristics of a service. An AI chatbot that describes a fixed deposit as "guaranteed 8% returns" when the actual rate is 7.5% or subject to premature withdrawal penalties has made a false representation. The financial institution — not the AI — is responsible for that representation.
Misleading advertisements. Section 2(28) defines "misleading advertisement" to include any representation that falsely describes a service. AI chatbots that generate promotional language about financial products are generating representations subject to this definition — and the bank is responsible for ensuring those representations are accurate.
E-Commerce Rules 2020. Consumer Protection (E-Commerce) Rules 2020 apply to entities providing services through digital means, which includes banks operating mobile banking applications with AI assistants. These rules require, among other things: clear identification of the service provider, transparent dispute resolution information, and prohibition on automatic consent (the customer must affirmatively choose any additional service).
The civil liability exposure from Consumer Protection Act is separate from and cumulative with RBI and IRDAI regulatory exposure. A single customer interaction can produce: an RBI ombudsman complaint, an IRDAI complaint, and a consumer forum complaint — each adjudicated by different authorities. The governance framework for an AI chatbot must address all three layers, because the controls required differ.
SEBI Robo-Advisory: AI Chat for Investment Products
Banks and investment advisers that provide AI-assisted investment suggestions through chat interfaces — whether "what should I invest in," recommendations for mutual fund SIPs, or portfolio rebalancing suggestions — are subject to SEBI's guidelines for investment advisory and robo-advisory platforms.
SEBI's AI/ML Guidelines 2026 suitability requirement applies: AI-assisted investment recommendations must be grounded in the customer's documented risk profile, investment horizon, and financial objectives. An AI chatbot that says "invest in this small-cap equity fund" without referencing the customer's risk category or investment horizon has not met the suitability standard.
SEBI also requires explicit disclosure when AI is being used in investment advisory — the customer must know they are receiving AI-assisted guidance, not human financial planning. The disclosure obligation mirrors IRDAI's disclosure requirement but is anchored in different regulations (SEBI Investment Adviser Regulations 2013 and the 2025 AI disclosure circular).
Technical Governance Framework: Controls by Layer
Layer 1 controls (RBI)
- Credit commitment guardrail: Model component that detects and blocks output patterns containing specific rates, approved amounts, or credit commitments. Tested against a library of credit-commitment output patterns before deployment; monitored in production for bypass attempts.
- Grievance escalation flow: Hard-coded escalation option available in every conversation turn; generates complaint reference number; tested against RBI-IOS complaint tracking requirements.
- Conversation audit log: Every chatbot conversation logged with full transcript, guardrail fire events, and escalation actions for 3-year minimum retention (aligned to RBI customer records retention).
Layer 2 controls (IRDAI)
- AI disclosure injection: Mandatory disclosure text injected at conversation initiation for any session involving insurance products; cannot be skipped; logged as a conversation event.
- Recommendation basis generation: AI generates recommendation alongside its basis (customer attributes that support the recommendation); basis language reviewed for plain-language comprehensibility.
- Human advisor offer: Mandatory offer to speak with a human advisor before any insurance purchase completion; customer response documented in conversation log.
- Vendor contract clause: Technology vendor contractually obligated to generate all required IRDAI disclosures; bank independently tests in production via regular conversation audits.
Layer 3 controls (Consumer Protection)
- Product description accuracy review: All AI-generated product descriptions reviewed against current product documentation before deployment; change management process for when product terms change post-deployment.
- Output review and monitoring: Sample of chatbot outputs reviewed weekly by compliance team for accuracy; anomaly detection for output patterns that were not present in pre-deployment review.
- Complaint tracking: Consumer forum complaints involving AI chatbot conduct tracked, root-caused, and used to update guardrail and output review processes.
Implementation Checklist by Institution Type
Scheduled Commercial Banks (RBI-regulated):
- ☐ Credit commitment guardrail deployed and tested; performance monitored in MRMF model inventory
- ☐ Grievance escalation flow compliant with RBI-IOS; generates complaint reference number
- ☐ Chatbot interaction logs retained (minimum 3 years); accessible for RBI examination
- ☐ MRMF model inventory includes chatbot as AI system with model card documentation
- ☐ Output accuracy review process; change management for product term updates
Banks operating as insurance corporate agents (IRDAI-regulated):
- ☐ AI involvement disclosure implemented at conversation initiation; tested and logged
- ☐ Recommendation basis generation implemented; reviewed for plain-language compliance
- ☐ Human advisor offer implemented before insurance purchase completion
- ☐ Key terms and exclusion disclosure tested for material exclusions relevant to customer queries
- ☐ Vendor contract includes IRDAI disclosure obligation; independent production testing schedule
SEBI-registered investment advisers and robo-advisory platforms:
- ☐ AI investment advisory disclosure compliant with SEBI Investment Adviser Regulations 2013 and 2025 AI circular
- ☐ Suitability reasoning generated per SEBI AI/ML Guidelines 2026: recommendation references customer risk profile, horizon, objectives
- ☐ Robo-advisory conversation logs retained; accessible for SEBI inspection
All entities (Consumer Protection Act):
- ☐ All AI-generated product descriptions reviewed for accuracy before deployment
- ☐ Change management process: product term changes trigger output review and redeployment
- ☐ Consumer forum complaint tracking for AI chatbot conduct; root cause analysis and guardrail updates
- ☐ E-Commerce Rules 2020 compliance: service provider identified, dispute resolution information accessible
The three-layer compliance problem for India banking chatbots is not solved by general-purpose content moderation or by the standard AI safety frameworks that global vendors sell. RBI's credit commitment rule requires domain-specific financial output guardrails. IRDAI's disclosure requirements need to be embedded in the conversation flow design, not just the system prompt. Consumer Protection Act liability requires ongoing accuracy monitoring as product terms evolve. A bank that addresses one layer without the others has partial compliance — and each layer has its own enforcement authority and complaint pathway.