What AI governance obligations do the RBI IT Governance Directions 2023 create for banks and NBFCs?

RBI's Information Technology Governance, Risk, Controls and Assurance Practices Directions, 2023 (DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, issued November 7, 2023, effective April 1, 2024) are the foundational IT compliance framework for Indian banking — the infrastructure layer that makes other AI governance obligations (MRMF 2026, FREE-AI Framework 2025) operationally enforceable. The Directions apply to all 12 public sector banks, 21 private sector banks, 6 small finance banks, 6 payments banks, all NBFCs in the Upper Layer (15 named entities) and Middle Layer (~200+ entities with assets Rs 1,000 crore and above), 5 All India Financial Institutions (NHB, NABARD, EXIM Bank, SIDBI, NaBFID), and 6 Credit Information Companies (CIBIL, Experian, Equifax, CRIF, CIRILPC, NESL) — approximately 260+ regulated entities covering near-100% of India's banking system assets. Five specific AI governance obligations embedded in the Directions: (1) Data governance for AI systems: training data lineage, quality controls, privacy compliance, and bias mitigation are required as part of the IT risk framework — not voluntary best practice but compliance requirements within the IT governance structure; (2) Model lifecycle documentation: board-approved inventory of material models, classified by risk, complexity, and business impact, with independent validation requirements for AI/ML models used in credit, fraud, and collections; (3) AI vendor and outsourcing oversight: IT outsourcing provisions require due diligence on AI model providers — LLM API providers, credit scoring vendors, fraud analytics platforms — including contractual controls, security audit rights, and documented exit planning; (4) Algorithmic change management: the Directions' change and patch management requirements explicitly cover AI model updates — a bank's model retrain or version update is a managed change event requiring approval, documentation, and rollback planning; (5) Annual assurance audit: annual IS/IT audits conducted by CERT-In empanelled auditors must cover AI systems, creating a recurring, regulator-grade audit obligation across the full AI lifecycle.

How does the RBI IT Governance Directions 2023 relate to the RBI MRMF 2026 and FREE-AI Framework 2025?

The RBI IT Governance Directions 2023, the RBI Draft Model Risk Management Framework 2026, and the RBI FREE-AI Framework 2025 form three distinct layers of India's bank AI governance stack — each addressing a different dimension: (1) RBI IT Governance Directions 2023 = the compliance infrastructure layer: mandatory data governance, AI vendor due diligence, algorithmic change management, and annual audit obligations for ALL AI systems at ALL covered entities. This is a legally binding Master Direction with specific compliance deadlines; (2) RBI Draft MRMF 2026 = the model risk management layer: specific principles for model inventory, risk tiering, independent validation, and ongoing model monitoring — a framework for managing model risk that sits above the IT governance base. The MRMF provides the model-specific risk management architecture that the IT Governance Directions make auditable; (3) RBI FREE-AI Framework 2025 = the principles layer: 7 Sutras (Fairness, Robustness, Explainability, Ethics, Autonomy, Inclusivity, Cybersecurity) with the INDIC-BIAS methodology and sectoral guidance for banks, insurers, and NBFCs. The FREE-AI Framework provides the principled evaluation criteria that the IT Governance Directions require to be operationalised. Together, these three documents define India's AI governance compliance obligation for banks and NBFCs. A bank that has implemented MRMF and FREE-AI principles but does not have board-approved IT governance procedures covering its AI systems, CERT-In audit coverage of its AI infrastructure, or contractual audit rights over its AI vendors is non-compliant with the IT Governance Directions 2023 regardless of its MRMF and FREE-AI alignment.

What AI vendor due diligence obligations does the RBI IT Governance Directions 2023 create for banks using third-party AI?

The RBI IT Governance Directions 2023's outsourcing and third-party risk management provisions create specific AI vendor due diligence obligations that have become increasingly material as banks rely on external AI providers for credit scoring, fraud detection, KYC/AML, and customer service: (1) Pre-engagement due diligence: before deploying any material AI model from a third-party vendor, the bank must assess the vendor's technical capabilities, data security practices, AI model governance, regulatory track record in India, and concentration risk (a bank using the same AI fraud vendor as most of its sector peers faces systemic concentration risk); (2) Contractual AI governance controls: contracts with AI vendors must include explicit provisions for: model performance monitoring and reporting obligations, data privacy and security requirements for training and inference data, the bank's right to audit the AI vendor's systems and processes, and defined escalation and exit procedures; (3) Ongoing monitoring: the bank must continuously monitor the AI vendor's performance — model accuracy, incident history, regulatory compliance status — and have mechanisms to identify deteriorating AI performance or emerging vendor risk; (4) Exit planning: banks must maintain documented exit plans for each material AI vendor, including procedures for migrating to an alternative model, data portability requirements, and transition timelines. The practical challenge: most banks' vendor contracts with AI providers (credit bureau models, fraud analytics platforms, LLM API providers) were negotiated before the IT Governance Directions 2023 and do not include audit rights or AI-specific governance provisions. Renegotiating these contracts to include IT Governance Directions compliance provisions is one of the most significant near-term AI governance obligations for the Indian banking sector.

What does the algorithmic change management obligation under RBI IT Governance Directions 2023 mean for banks updating AI models?

The IT Governance Directions 2023's change and patch management provisions treat AI model updates as managed technology changes — the same change management framework that governs software patches, system upgrades, and configuration changes now applies to AI model retrains, version updates, and parameter changes. Five operational implications for banks: (1) Change approval process: every AI model update — a credit scoring model retrain, a fraud detection model version change, a new LLM prompt engineering configuration — must go through a formal change approval process with documented business justification, risk assessment, and approval from designated authority; (2) Pre-change impact assessment: before deploying a model update, the bank must assess the potential impact on model performance, affected customers and business processes, and regulatory compliance. For credit scoring models, a pre-change impact assessment must evaluate whether the new model version continues to satisfy RBI Digital Lending Guidelines' non-discrimination and explainability requirements; (3) Rollback planning: every AI model change must have a documented rollback plan — the ability to revert to the previous model version if the new version produces unacceptable outputs. This is particularly significant for banks using AI models in real-time fraud detection: a model update that increases false positive rates requires immediate rollback capability; (4) Change documentation: all AI model changes must be documented in the change management log — model identifier, version, nature of change, change date, approvals, post-change monitoring results. This creates the audit trail that CERT-In auditors review; (5) Emergency change procedures: for AI models operating in critical business functions (real-time fraud detection, payment authorization), the Directions require documented emergency change procedures — defining when a change can be deployed outside the standard approval process and what compensating controls apply. For most Indian banks, the algorithmic change management obligation requires retrofitting AI model update workflows into formal IT change management processes that were historically designed for software, not statistical and ML systems.

AI Governance · RBI · IT Governance · Banks · NBFCs · AI Vendor Risk · India BFSI

RBI IT Governance, Risk, Controls and Assurance Practices Directions 2023 AI Governance: AI Model Inventory, Training Data Lineage, AI Vendor Due Diligence and Annual CERT-In Assurance Audit for 260+ Banks and NBFCs India

RBI's Information Technology Governance, Risk, Controls and Assurance Practices Directions, 2023 (DoS.CO.CSITEG/SEC.7/31.01.015/2023-24, effective April 1, 2024) are the foundational AI compliance infrastructure for India's banking system — the legally binding framework that makes MRMF and FREE-AI obligations operationally enforceable. AI data governance, board-approved model inventory, AI vendor due diligence with contractual audit rights, algorithmic change management treating model retrains as managed technology changes, and annual CERT-In audit coverage of all AI systems. Applies to all 12 public sector banks, 21 private sector banks, ~200+ NBFCs in Upper and Middle Layer, 5 All India Financial Institutions, and 6 Credit Information Companies — approximately 260+ entities covering near-100% of India's banking system assets. Zero global competitor coverage.

Zytra Research Team · April 2024 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's AI governance conversation focuses on the MRMF, the FREE-AI Framework, and sectoral circulars — the visible, named AI obligations. Less discussed but equally binding is the foundational IT governance layer: the RBI IT Governance Directions 2023. These are not an AI-specific document. They are the master framework for all technology governance in Indian banking, and AI systems sit squarely within their scope.

The Directions matter for AI governance because they create four obligations that no AI-specific circular repeats: AI vendor due diligence with contractual audit rights, algorithmic change management for model updates, training data lineage as part of IT risk, and annual CERT-In audit coverage of AI infrastructure. A bank with strong MRMF compliance but no IT Governance Directions coverage for its AI systems has a compliance gap the next IT audit will find.

The Foundational Layer Problem

India's banking AI governance is structured in three layers. The IT Governance Directions 2023 are the base — the compliance infrastructure that makes the other layers auditable. MRMF 2026 sits above, providing model-specific risk management principles. FREE-AI Framework 2025 sits at the principles level, providing the fairness and ethics criteria. All three are binding on banks. Compliance with two of three is not compliance.

The practical gap most banks face: AI systems deployed before the Directions' April 2024 effective date are not retroactively exempt. Pre-existing AI vendor contracts that lack audit rights are non-compliant from the effective date. Pre-existing AI model updates that bypassed formal change management are historical compliance gaps. The Directions required banks to retrofit AI governance into existing IT governance frameworks — a significant operational undertaking.

RBI IT Governance Directions 2023 AI Compliance Checklist

☐ AI data governance: training data lineage documented for all material AI models; data quality controls in place; privacy compliance (DPDP Act 2023) verified for training datasets; bias mitigation procedures documented
☐ Board-approved model inventory: material AI models inventoried; classified by risk level, complexity, business impact; inventory presented to board; review cadence defined
☐ AI vendor due diligence: due diligence conducted for each external AI provider (credit scoring, fraud analytics, LLM APIs); contractual audit rights secured; vendor monitoring programme in place; exit plans documented
☐ Algorithmic change management: AI model retrains and version updates treated as managed changes; change approval, impact assessment, and rollback planning integrated into IT change management workflow; change log maintained
☐ Annual CERT-In audit: AI systems included in annual IS/IT audit scope; CERT-In empanelled auditor engaged; AI-related audit findings tracked and remediated; audit evidence on file
☐ Intersection with MRMF 2026: IT Governance Directions compliance aligned with MRMF model inventory and validation obligations — no duplicate effort where both apply
☐ RBI examination readiness: IT governance AI documentation, vendor contracts, change management records, audit evidence — packaged for RBI IT examination