India AI Governance 2026: Every Regulation, Every Obligation, Every Deadline

A scheduled commercial bank operating in India in October 2026 is answering to more AI-specific regulatory language than it was three years ago, across at least four distinct layers, enforced by more than one authority. The honest version of "AI governance for Indian banks" is no longer "have a validated model register" — that was sufficient when SR 11-7-style model risk management was the whole conversation. It isn't anymore.

This piece maps the instruments compliance teams are actually dealing with right now, what each one requires in practice, and in what order to act on them — with the caveat that some of this landscape is still moving, and a few dates below need confirming against the regulator's own release before you put them in a board paper.

How India's AI governance stack got built

• August 2023 — DPDP Act 2023 enacted. India's Digital Personal Data Protection Act. Obligations apply at the AI inference layer, not just data storage. Draft Rules were circulated for consultation in January 2025; the practical compliance work — consent hooks, PII detection at inference — needs to start well before any final enforcement date, regardless of exactly when that lands.
• 2024 — RBI supervisory signals on AI intensify. RBI began treating AI-specific risk explicitly in its supervisory conversations with regulated entities — governance framework, audit trail, AI inventory, outsourcing controls, customer protection, incident reporting are the themes showing up in examinations.
• June 2025 — SEBI consultation on AI/ML governance for intermediaries. Principles commonly summarized as fairness, accountability, transparency, robustness, privacy, and explainability, for all AI used by SEBI-registered entities.
• August 2025 — RBI's FREE-AI committee report. The committee chaired by Prof. Pushpak Bhattacharyya (IIT Bombay), convened by RBI, delivered a report built around seven guiding "Sutras" and 26 recommendations.
• November 2025 — MeitY National AI Governance Guidelines. National policy under the IndiaAI Mission, organized around accountability, safety, transparency, fairness, and inclusion. Banks satisfying RBI's sector-specific obligations generally satisfy this layer as a side effect.
• 2026 — RBI model risk guidance for AI. Often referenced in industry commentary as "eMRM," with mandatory independent validation and tiered model classification under discussion. Confirm the exact title, scope, and current status directly against RBI's own publication before treating any specific month as final.

The obligations map, as of today

Why a global governance platform leaves a gap for an Indian bank

Arthur AI, Credo AI, Holistic AI, and Lakera are built against EU AI Act, NIST AI RMF, and ISO 42001 — the frameworks that dominate every global AI governance vendor deck. Those are real, substantial frameworks, and none of them are what an RBI examiner opens with.

A bank running one of those platforms as its sole governance layer typically has no clause-level mapping to RBI's supervisory themes, no control mapping to the FREE-AI report's recommendations, no validation lifecycle aligned to RBI's model risk guidance, and no DPDP-specific inference-pipeline controls. That bank will pass a GDPR-style audit and still get a list of findings in an RBI examination — the frameworks weren't built for the same regulator, the same legal context, or the same examination process, and treating them as interchangeable is where the gap opens.

I've sat across the table from an examiner asking "show me the governance record for this model's last deployment" while the bank's own AI inventory lived in three different spreadsheets owned by three different teams. That's not a tooling failure so much as a mapping failure — nobody had connected the global framework they'd licensed to the specific obligation the examiner was actually testing.

What to implement first, in order of examination exposure

1. RBI supervisory readiness — already active, already showing up in examinations. If your AI inventory, audit trail, and governance framework can't be produced on request today, this is the immediate priority.
2. FREE-AI alignment — active since August 2025. Fairness and reliability controls for credit-decisioning AI specifically should already be in place; verify your mapping against the committee's actual report rather than a secondary summary.
3. DPDP inference-pipeline work — the Act is in force regardless of exactly when the Rules fully bite; implementation (PII detection, consent hooks) realistically takes 6–12 months for a bank without that infrastructure already built. Start now rather than waiting for a final date.
4. RBI model risk guidance ("eMRM") — still clarifying. Tier-classify your AI inventory now and identify which models will likely need independent validation, since building that capability takes 6–12 months of lead time regardless of when the final guidance lands.
5. SEBI alignment — for SEBI-regulated entities, map capital markets AI against the consultation's six principles now, ahead of any final circular.

What a bank should actually do with this list

1. Build one AI inventory, not four — tag each system against every applicable instrument so one piece of evidence serves every regulator asking about it.
2. Get your FREE-AI mapping checked against the committee's primary report, not a vendor's summary of it, before you present it to your board.
3. Start DPDP inference-pipeline work this quarter regardless of Rules timing — the architecture takes longer to build than the Rules will take to finalize.
4. Tier-classify your AI models now, ahead of RBI's model risk guidance landing in final form, so you're not starting from zero when it does.
5. If you're dual-regulated by RBI and SEBI, build one evidence chain tagged to both — running two separate compliance exercises for the same AI system is the most common waste I see in this space.