What are the key AI-related obligations in RBI's July 2026 Draft Guidance on Regulatory Expectations for Data Governance?

RBI's Draft Guidance on Regulatory Expectations for Data Governance (Press Release 2026-2027/677, July 15, 2026; consultation closed August 17, 2026) explicitly names advanced analytics and automated decision-making processes as drivers of data governance complexity requiring the framework. The guidance creates the upstream data layer obligations that feed every AI/ML model across all RBI-regulated entities. Six AI-relevant obligations: (1) Board-approved enterprise-wide Data Governance Framework (DGF): the board must approve an enterprise-wide DGF covering all organisational data — including the training data, feature stores, and inference data that feed AI/ML credit scoring, fraud detection, AML, customer segmentation, and risk management models. Without a board-approved DGF, the data foundation of every AI model in the regulated entity is ungoverned at the highest accountability level; (2) Board-level Data Governance Committee (or assignment to existing board committee): the board committee formulates the DGF, reviews it periodically, and analyses reports on material data breaches. For AI governance specifically, this creates board-level accountability for data quality in AI systems — a material data quality failure in an AI model's training data is reportable to the board's data governance committee; (3) Data quality metrics reported quarterly to board committee: the quarterly reporting of data quality metrics directly governs the data inputs to AI/ML models. Credit scoring models trained on poor-quality income or employment data, fraud detection models trained on incomplete transaction histories, AML models trained on improperly labelled suspicious activity records — all of these quality failures are now subject to board-level visibility through the DGF's quarterly data quality reporting; (4) Metadata and lineage management: the guidance requires metadata and data lineage management that enables AI model auditability and traceability of feature engineering. When an AI credit scoring model produces a decision that a customer disputes, the bank must be able to trace the exact data fields, transformations, and lineage that went into that model's training and inference — the DGF's lineage requirements create the technical foundation for AI model explainability under eMRM; (5) Single Source of Truth (SSoT) principle: one authoritative data source per data element, with transformation logic requiring a prior impact assessment before changes. For AI models, this means: the feature used in a credit model must come from the authoritative data source, not a derived or locally-cached version; changes to the data transformation pipeline that feeds an AI model require a prior impact assessment before implementation; (6) Third-party data governance: regulated entities bear full responsibility for data shared with outsourced service providers — covering AI vendor data access, model training data custody, and output data storage. An AI vendor that receives customer data for model training inherits the regulated entity's data governance obligations for that data.

How does RBI's Data Governance Framework draft guidance relate to MRMF 2026 and IT Governance 2023, and why is it a distinct compliance layer?

RBI's three major AI-adjacent governance frameworks form a layered compliance stack with distinct but complementary roles: (1) Data Governance Framework (DGF, July 2026 draft): the upstream layer — governs the data that feeds AI models. Data quality, lineage, metadata, single source of truth, board-level accountability for data. Without this layer, AI models operate on ungoverned data. This is the 'garbage in, garbage out' problem addressed at the regulatory level; (2) Model Risk Management Framework (MRMF, June 2026): the model governance layer — governs the AI models themselves. Model validation, independent review, tiering by risk, performance monitoring. MRMF assumes the input data is adequately governed; the DGF is the framework that governs that data; (3) IT Governance Master Direction (2023): the infrastructure layer — governs the technology systems that data and models run on. IT resilience, outsourcing controls, vendor management, system availability. Neither data quality nor model validation is the primary subject. Three specific differences that make the DGF a distinct compliance layer: (1) Different subject matter: DGF governs data quality, lineage, and metadata. MRMF governs model validation and risk tiering. IT Governance governs infrastructure resilience. Each addresses a different AI risk dimension — data risk, model risk, infrastructure risk; (2) Different board accountability structure: DGF requires a board-level Data Governance Committee with quarterly data quality reporting. MRMF requires model risk to be reported to the senior management committee responsible for model risk. IT Governance requires the board's IT Strategy Committee to oversee IT policy. Three separate board-level accountability streams for the three AI governance layers; (3) Different compliance owner: DGF is owned by the Chief Data Officer (CDO) or equivalent senior data executive at no less than CGM rank. MRMF is owned by the Model Risk Management function. IT Governance is owned by the CTO/CIO and IT Risk function. A bank implementing all three frameworks correctly has three separate compliance tracks, each with board visibility, addressing complementary AI governance dimensions.

How does BCBS 239 alignment in RBI's Data Governance Framework affect AI model governance for Indian banks?

BCBS 239 (Principles for Effective Risk Data Aggregation and Risk Reporting, January 2013) establishes 14 principles for risk data aggregation and risk reporting at systemically important banks. RBI's July 2026 Data Governance Framework draft explicitly aligns with BCBS 239, extending its scope beyond systemic banks to the full range of RBI-regulated entities. BCBS 239 has five specific implications for AI model governance: (1) Accuracy principle and AI model inputs: BCBS 239 Principle 2 requires that risk data be accurate and reliable. For AI models used in risk management — credit risk scoring, market risk models, operational risk pattern detection — this accuracy requirement extends to the training data and inference data fed to those models. A risk model trained on data that does not meet BCBS 239 accuracy standards is itself non-compliant, regardless of how well the model itself is validated; (2) Completeness principle and AI feature coverage: BCBS 239 Principle 3 requires that risk data capture all material risk data. For AI risk models, completeness means the feature space covers all material risk drivers — a credit scoring model that systematically omits repayment history from certain data sources due to data governance gaps is incomplete in the BCBS 239 sense; (3) Timeliness principle and real-time AI inference: BCBS 239 Principle 4 requires that risk data be available when needed. For AI models driving real-time decisions (fraud detection, anti-money laundering alerts, intraday credit line monitoring), the data pipeline feeding those models must meet the timeliness requirements — stale inference data is a data governance failure under BCBS 239; (4) Adaptability principle and AI model updates: BCBS 239 Principle 5 requires that risk data be adjustable for different scenarios and stress conditions. When an AI model is retrained or updated to reflect stress conditions, the underlying data governance framework must support that adaptability — audit trails of data changes, lineage of stress scenario data sets, documentation of model recalibration; (5) Board reporting principle and AI risk transparency: BCBS 239 Principles 6–11 cover risk reporting — the board must receive accurate, complete, timely, and distributed risk information. AI models that summarize risk do not replace BCBS 239-compliant risk reporting; the board reporting obligation requires that AI model outputs be traceable to underlying data satisfying Principles 1–5.

What practical implementation steps does RBI's Data Governance Framework draft guidance require from banks and NBFCs?

RBI's Draft Guidance translates into five practical implementation requirements: (1) Establish the governance structure: appoint a Chief Data Officer or senior data executive at no less than Chief General Manager rank; establish a Board-level Data Governance Committee (or assign data governance to an existing board committee); constitute an executive-level data committee drawing from data management, IT, information security, risk, compliance, and business. These three layers — board committee, executive committee, senior data executive — form the governance backbone; (2) Develop and board-approve the DGF: draft an enterprise-wide Data Governance Framework covering data classification, data quality standards, metadata standards, lineage documentation requirements, data ownership mapping, and third-party data governance. The DGF must be formally approved by the board — not just the board committee, but the full board; (3) Implement data quality monitoring and reporting: establish data quality metrics for critical data domains (credit data, transaction data, customer data, risk model input data); configure quarterly data quality reporting to the Board Data Governance Committee; implement materiality thresholds triggering immediate board notification for material data quality failures; (4) Deploy metadata and lineage infrastructure: implement metadata management tools covering all critical applications and data pipelines, with particular focus on AI/ML model training data pipelines; establish lineage documentation from source data through transformations to AI model feature inputs; maintain lineage records sufficient for AI model auditability and regulatory explanation under eMRM; (5) Assess SSoT compliance and third-party data: audit existing data flows to identify violations of the Single Source of Truth principle — multiple conflicting authoritative sources for the same data element; implement impact assessment process for data transformation changes affecting AI model inputs; review all AI vendor contracts for data access, training data custody, and output data storage provisions against the DGF's third-party accountability requirements.

AI Governance · RBI · Data Governance · DGF · Banks · NBFCs · BCBS 239 · AI Model Data Quality · India BFSI

RBI Data Governance Framework Draft Guidance 2026: Board-Approved Enterprise DGF, Quarterly Data Quality Metrics for AI/ML Model Inputs, Single Source of Truth, Metadata and Lineage for AI Auditability and Third-Party AI Vendor Data Accountability for All Banks, NBFCs, UCBs and 11 RBI Entity Categories India

RBI Draft Guidance on Regulatory Expectations for Data Governance (Press Release 2026-2027/677, July 15, 2026; consultation closed August 17, 2026; final guidance expected) — the upstream data layer that feeds every AI/ML model at RBI-regulated institutions. Board must approve an enterprise-wide Data Governance Framework covering all organisational data including AI training datasets and inference pipelines. Board-level Data Governance Committee with quarterly data quality reporting to board. Senior data executive at no below CGM rank. Metadata and lineage management creating AI model auditability foundation for eMRM compliance. Single Source of Truth principle constraining arbitrary changes to AI model training data — transformation changes require prior impact assessment. Full third-party data accountability for AI vendor data access and model training custody. BCBS 239 alignment. Applies to all 11 RBI entity categories: commercial banks, SFBs, NBFCs (all 4 scale layers), UCBs, RRBs, all-India financial institutions (NABARD, SIDBI, NaBFID), ARCs, and CICs. Upstream data layer not covered by MRMF or IT Governance. Zero global competitor coverage.

Zytra Research Team · July 2026 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

Every AI model governance framework assumes that the data feeding the model is adequately governed. RBI's MRMF tells you how to validate a model; it does not tell you how to govern the data the model trains on. RBI's IT Governance Directions tell you how to secure the infrastructure the data sits on; they do not tell you how to maintain data quality, lineage, and a single authoritative source. The July 2026 Data Governance draft addresses the layer that the other frameworks assume but do not specify.

The consultation period closed on August 17, 2026. Final guidance is anticipated. The draft's framing — explicitly citing advanced analytics and automated decision-making as drivers of data governance complexity — signals that the final guidance will carry specific AI/ML data governance expectations, not just generic data quality principles.

The Three-Layer AI Compliance Stack for Banks

A bank implementing all three RBI frameworks simultaneously operates three distinct AI governance compliance tracks: data governance (CDO-owned, quarterly board reporting, BCBS 239 aligned), model governance (MRMF, MRM function-owned, independent validation), and technology governance (IT Governance Directions, CTO-owned, infrastructure resilience). Each track has its own board accountability, its own compliance owner, and its own audit pathway. Satisfying one track does not satisfy the others — and the DGF's data quality standards are a prerequisite condition for MRMF model validation to be meaningful.

Note on Draft Status

This guidance is a consultation draft as of October 2026. The consultation period closed August 17, 2026 and RBI is expected to finalize and issue the guidance. Banks and NBFCs with advanced model risk and AI deployment should begin framework design against the draft's expectations — particularly the governance structure (board committee, executive committee, CDO appointment), the data quality reporting cadence, and the lineage documentation requirements — rather than waiting for finalization.

RBI Data Governance Framework AI Compliance Checklist

☐ Governance structure: CDO or senior data executive at no below CGM rank appointed; Board Data Governance Committee established (or existing board committee assigned); executive-level data committee constituted with IT, risk, compliance, business representation
☐ DGF development: enterprise-wide Data Governance Framework drafted covering all data domains including AI training data and inference pipelines; board approval obtained
☐ Data quality metrics: critical data domain quality metrics defined with AI/ML model input data specifically scoped; quarterly reporting cadence to board committee implemented; materiality threshold for immediate board notification defined
☐ Metadata and lineage: metadata management tooling deployed covering all critical AI/ML data pipelines; lineage documented from source data through transformations to model feature inputs; lineage records sufficient for eMRM model auditability
☐ Single Source of Truth: data element ownership mapping completed; conflicting authoritative sources identified and resolved; impact assessment process for data transformation changes affecting AI model inputs implemented
☐ Third-party data accountability: AI vendor contracts reviewed for data access scope, training data custody, and output data storage; DGF third-party accountability requirements applied to all AI vendor data provisions
☐ BCBS 239 alignment: BCBS 239 principles mapped to DGF implementation; accuracy, completeness, timeliness, adaptability obligations verified for AI risk model input data pipelines
☐ Draft monitoring: RBI final guidance on DGF tracked; gap analysis against draft conducted; material changes on finalization assessed for implementation adjustment