Industry commentary on Indian bank AI governance has been referring to RBI's developing model risk guidance for AI as "eMRM" — enhanced Model Risk Management — with mandatory independent validation for all models, including third-party AI, as its headline feature. Treat the details below as the current working understanding, not a citation you can hand to an examiner without checking the primary source first: the exact title, scope, and publication timeline deserve direct confirmation against RBI's own release.
What does appear consistent across industry discussion of this guidance: it extends the SR 11-7 paradigm — first developed by the US Federal Reserve — into India's banking regulatory context, and it explicitly reaches AI and ML models at regulated entities, not just traditional statistical models. If the final form matches current expectations, it would be the first RBI instrument to mandate independent validation as a formal control requirement, the first to apply Indian model risk discipline to third-party models specifically, and the first to introduce a formal tier classification determining how much validation each model needs.
Where this guidance sits relative to the rest of RBI's AI framework
Indian banks are working against three complementary layers of RBI AI expectation, each addressing something different:
- RBI's supervisory themes on AI governance — the architecture layer: board-approved framework, AI inventory, audit trail, outsourcing risk management, incident reporting. What the governance structure has to look like.
- FREE-AI committee report (Aug 2025) — the quality-standards layer: 26 recommendations covering fairness, reliability, explainability, and ethics-adjacent themes. What responsible AI has to actually achieve.
- Model risk guidance for AI ("eMRM"/"MRMF") — the validation-lifecycle layer: development standards, independent validation, ongoing monitoring, retirement. How every model gets assessed and governed across its life.
These aren't alternatives to each other. A bank with a clean AI inventory but no validation lifecycle has a list of models with no validation status attached to any of them. A bank with FREE-AI-aligned fairness controls but no independent validation discipline can't actually prove those controls were tested by anyone other than the team that built them.
The requirements that matter operationally
Independent validation, including for vendor models
The most operationally painful piece of this guidance, if it lands as currently understood, is mandatory independent validation for AI/ML models driving credit, risk, or customer decisions — including models a bank didn't build itself. Independence here means the validating function can't be the team that developed or procured the model; it has to be a separate internal function or an external validator.
For a bank leaning on vendor AI — credit-bureau scoring models, fintech-partner underwriting tools, vendor fraud detection — this is a new procurement obligation: either get vendor validation evidence that genuinely meets RBI's standard, or commission independent validation of the vendor's model yourself. "The vendor says it's validated" has never satisfied an independence requirement, and it won't start now.
Model tier classification
A tiering structure for models by complexity and impact, roughly:
| Tier | Description | Validation requirement | Review frequency |
|---|---|---|---|
| Tier 1 — Critical | High-complexity models driving major credit or risk decisions; systemic impact | Full independent validation, including challenger-model testing | Annual minimum, plus event-triggered |
| Tier 2 — Significant | Material business or customer impact; complex ML in production | Independent validation with performance benchmarking | Biennial minimum, plus event-triggered |
| Tier 3 — Standard | Lower complexity, internal use, limited customer impact | Documentation review plus performance monitoring | Per monitoring SLA, issue-triggered |
| Tier 4 — Minimal | Simple rules-based or lookup models, minimal risk | Owner attestation plus change management oversight | Change-triggered |
A bank running 200 AI models in production can't validate all of them at Tier 1 depth — nobody has that budget. The tiering structure exists to give you a defensible way to prioritize, and it's worth building that tiering discipline now, independent of exactly when the final guidance lands, because the underlying logic (validate harder where the blast radius is bigger) isn't going away.
Development standards, ongoing monitoring, and retirement
Beyond validation itself, the guidance as currently understood sets expectations for how models get built in the first place — documented purpose, scope, and assumptions before development starts; training-data lineage and representativeness documentation; bias analysis at development time; model card documentation per model — plus ongoing monitoring between validation cycles (performance thresholds, distribution-shift detection, automatic alerting) and formal retirement requirements (defined retirement criteria, replacement-model validation before the incumbent is retired, evidence the retiring model's outputs stopped being used, and archived governance documentation for a minimum retention period).
Most banks handle model retirement informally today — someone turns off the old model when the new one looks fine. That's the gap a formal retirement requirement is specifically designed to close, and it's worth fixing before any examiner asks you to prove a retired model's outputs actually stopped feeding decisions.
The third-party AI gap is the one that will hurt
Outsourcing a model doesn't outsource the risk that comes with it — if this guidance lands as currently expected, it makes that operational rather than aspirational: independent validation is required for third-party models driving material decisions, regardless of what the vendor itself claims about its own testing.
Most Indian banks today have limited ability to independently validate a vendor's AI model. The typical process — read the vendor's documentation, sign the vendor's attestation — doesn't satisfy an independence requirement under any reasonable reading of it. Banks need either an internal validation function capable of testing third-party models, external validation partners, or both; there isn't a third option that survives an examination.
A realistic implementation checklist
| Requirement | Implementation action | Typical gap at Indian banks today |
|---|---|---|
| Tiered model inventory | Complete inventory, tier assigned per the classification criteria | Inventory incomplete; no formal tiering; shadow AI not captured at all |
| Independent validation function | Separate function with real independence from development and use | Validation performed by the same people who built or use the model |
| Third-party validation evidence | Independent validation or equivalent-standard evidence for Tier 1–2 vendor models | Vendor attestations only; no contractual validation requirement |
| Validation documentation per model | Structured report: methodology, findings, exceptions, approval | Informal validation; findings never tracked to resolution |
| Ongoing monitoring with thresholds | Automated monitoring for Tier 1–2 models, alerting on breach | Monitoring exists with no formal threshold; alerts not systematically tracked |
| Committee approval workflow | Model risk committee reviews and approves Tier 1–2 models pre-deployment and on material change | Ad hoc senior sign-off; approvals undocumented |
| Evidence chain for audit | Tamper-evident record linking validation, approval, deployment, monitoring, issues | Governance spread across systems; reconstructing the record takes weeks |
What to do now, regardless of exactly when the final guidance lands
- Confirm the actual name, scope, and status of RBI's model risk guidance for AI against RBI's own publication before using any specific date in a board paper.
- Build a tiered model inventory this quarter — the tiering logic is sound practice independent of the final guidance's exact form.
- Audit every vendor AI model you rely on for a material decision, and determine today whether you hold anything beyond an attestation.
- Stand up (or contract for) an independent validation function with genuine separation from model development and use — don't wait for the final rule to force this.
- Build one evidence chain that already covers your 2024-era RBI supervisory obligations and FREE-AI alignment, so the validation-lifecycle layer slots on top rather than becoming a fourth separate compliance program.
Complete India AI governance framework
RBI FREE-AI Framework: 26 recommendations
Fairness, Reliability, Explainability, Ethics — clause-level mapping to controls.
Read →RBI AI Circular 2024 compliance checklist
Six obligation categories, examination evidence requirements, common gaps.
Read →DPDP Act AI inference pipeline obligations
Consent, PII detection, data minimisation before enforcement begins.
Read →eMRM-ready before the final guidelines land
Zytra's India team will map your current model governance against eMRM's tier classification and validation requirements, identify the gaps, and build the implementation plan before the deadline.