What AI governance obligations does RBI's Draft Model Risk Management Framework 2026 create?

RBI's Draft Guidance on Regulatory Principles for Model Risk Management 2026 (RBI Press Release No. 2026-2027/528, June 24, 2026) creates India's first comprehensive enterprise-wide AI/ML model governance mandate for financial institutions. The framework applies to 11 categories of RBI-regulated entities including all commercial banks, NBFCs, payments banks, ARCs, credit information companies, co-operative banks, and all-India financial institutions. Five specific AI governance obligations stand out: (1) Board-approved MRMF covering AI/ML: the MRMF must be board-approved and must explicitly cover AI/ML models — not only statistical models and econometric frameworks; this is the first RBI document to directly require board-level governance of AI systems rather than delegating it to the IT or risk function; (2) Enterprise-wide model inventory: every model in use, including AI/ML models built internally, sourced from third parties, or hybrid, must be inventoried — creating an institutional obligation to know and catalogue AI systems that most banks do not currently have; (3) Killswitch mandate: every AI/ML model must have a documented and tested capability to immediately decommission a malfunctioning AI — the first killswitch requirement in any RBI circular; (4) Explainability and bias testing: AI/ML models must have explainability requirements for model outputs and must be bias-tested across demographic and credit segments — the first time RBI has mandated both explainability and bias testing in a single framework; (5) Independent model validation: AI model validation must be conducted by a function independent of the model development team — replicating SR 11-7's independent validation standard for the first time in Indian banking regulation.

How does RBI's MRMF 2026 create a killswitch governance obligation for AI models at Indian banks?

RBI's Draft MRMF 2026 requires every AI/ML model to have a 'kill-switch capability to immediately decommission a malfunctioning AI' — a requirement that has no precedent in prior RBI circulars. The governance implications of a killswitch mandate extend beyond having an off switch: (1) Killswitch definition: a killswitch for a production AI model is not simply shutting down a server. For a credit scoring model embedded in the loan origination system, 'immediately decommissioning' requires a fallback process — a human review protocol, a rule-based interim system, or a predecessor model that activates when the AI is disabled. The killswitch includes the fallback, not only the deactivation; (2) Killswitch testing: documenting a killswitch exists is insufficient under the MRMF's model lifecycle governance — the killswitch must be tested to confirm it actually works and that the fallback activates correctly. Untested killswitches are governance theatre; (3) BCP integration: for customer-facing AI models (pre-authorization, loan eligibility, transaction fraud scoring), the killswitch event becomes a business continuity event. The MRMF's BCP requirements for AI must address the operational continuity of regulated functions (credit decisions, fraud screening) when the AI is decommissioned; (4) Tiered killswitch protocols: a low-risk AI model and a high-risk AI model face different decommissioning urgency requirements. The MRMF's risk-based tiering (low/medium/high) should translate to a tiered killswitch activation protocol — what triggers immediate decommission vs. a 24-hour escalation window vs. a scheduled replacement.

What bias testing AI governance does RBI's MRMF 2026 require for Indian banks?

RBI's Draft MRMF 2026 mandates bias testing for AI/ML models across demographic and credit segments — the first time RBI has explicitly required bias auditing of AI models. India's AI bias risk in banking is acute and distinct from global contexts: (1) Demographic bias dimensions: India's credit gap by gender (45% of women are unbanked), geography (Tier-3 and rural credit access), caste and community (Constitutional protections apply), and religion create a complex bias surface that international bias testing frameworks (designed for US demographic categories) do not adequately cover; (2) Credit segment bias: AI credit models trained on urban salaried borrower data consistently underperform for rural agricultural borrowers, gig economy workers, and micro-enterprise borrowers — not because those populations are higher risk, but because the training data underrepresents them and their creditworthiness signals differ from salaried employment patterns; (3) Language and vernacular bias: India's 22 scheduled languages and hundreds of dialects mean that AI models processing text-based financial data (account descriptions, loan applications, customer service interactions) may have embedded language bias — performing accurately on English and Hindi text while making systematic errors on Telugu, Tamil, Bengali, or Marathi inputs; (4) MRMF bias testing cadence: bias testing must occur at model development (pre-deployment), after significant model updates, and as part of ongoing monitoring — not only at initial validation. An AI credit model validated for bias in 2022 may have acquired bias through retraining on more recent data; (5) Adverse action bias: when a biased AI model denies a loan application, the borrower has a right to know why under RBI's customer service guidelines. Bias-driven denial reasons must be explainable.

How does RBI's MRMF 2026 govern third-party AI vendor models used by Indian banks?

RBI's Draft MRMF 2026 extends model risk governance to third-party sourced AI/ML models — a critical governance gap for Indian banks that extensively use third-party LendingTech, credit bureau AI, and fintech AI platforms. Third-party AI governance under the MRMF has four specific dimensions: (1) Third-party model inventory: third-party AI models must be included in the enterprise model inventory — the bank cannot exclude a vendor-supplied AI model from its MRMF coverage because it does not own the model; (2) Validation obligation for black-box AI: when a bank uses a third-party AI model for which it has limited access to model internals (black-box AI from a LendingTech vendor), the MRMF's independent validation requirement still applies. The bank must conduct proxy validation — testing the model's outputs for accuracy, bias, and stability even without access to the underlying code — or negotiate contractual access for validation purposes; (3) Explainability in vendor contracts: the MRMF's explainability requirement for AI outputs applies to third-party AI as much as internally-built AI. A bank cannot satisfy a regulatory inspection by pointing to a vendor's explainability documentation; the bank must have explainability evidence specific to its use case and deployment; (4) Change management for vendor AI: when a LendingTech vendor updates its AI model, the bank's MRMF requires assessment of the model change, re-validation if material, and board or committee approval before the updated model goes live in production. Most current bank-vendor contracts do not provide the notification and approval rights needed to comply with this requirement.

AI Governance · RBI · Model Risk Management · MRMF · Killswitch · India BFSI

RBI Model Risk Management Framework 2026 AI Governance: Board-Approved MRMF for AI/ML, Killswitch Mandate, Bias Testing, Explainability and Third-Party AI Vendor Obligations India

RBI's Draft Guidance on Regulatory Principles for Model Risk Management 2026 (RBI Press Release No. 2026-2027/528, June 24, 2026) applies to all 11 categories of RBI-regulated entities and creates India's first enterprise-wide AI/ML governance mandate: board-approved MRMF covering every AI model, killswitch capability, bias testing across demographic and credit segments, explainability for model outputs, and independent validation. Prior RBI circulars permitted or touched AI governance — this one mandates it comprehensively. Zero global competitor coverage of any Indian MRMF circular.

Zytra Research Team · June 2026 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's banking sector has deployed AI extensively — credit scoring models at HDFC Bank, ICICI Bank, Axis Bank, and SBI process millions of loan applications; fraud detection AI operates across the RTGS, NEFT, and UPI payment stack; customer service AI handles hundreds of millions of interactions annually. But until RBI's Draft Guidance on Regulatory Principles for Model Risk Management 2026, no single RBI circular required banks to govern all of this AI comprehensively at the board level.

The MRMF Draft (RBI Press Release No. 2026-2027/528, June 24, 2026) changes this. It applies to 11 categories of RBI-regulated entities and covers every model in the institution — statistical models, econometric frameworks, and AI/ML systems built internally, sourced from third parties, or hybrid. Five requirements are genuinely new for Indian banking: a board-approved MRMF that explicitly covers AI/ML, an enterprise model inventory, a killswitch capability for malfunctioning AI, bias testing across demographic and credit segments, and independent model validation separate from development teams.

The Killswitch: India's First AI Decommissioning Mandate

No prior RBI circular required banks to have a documented, tested capability to immediately decommission a malfunctioning AI system. The MRMF Draft's killswitch requirement is therefore genuinely new — and it has an operational complexity that extends well beyond having an off switch. A killswitch for a production credit scoring model requires a complete fallback protocol: what happens to loan applications in the queue when the AI is deactivated? Who makes credit decisions? What is the turnaround time for human review? How does the bank restore SLA compliance?

The killswitch obligation is not satisfied by a technical capability alone. It requires governance infrastructure: a documented activation protocol, tested fallback operations, communication procedures for affected business lines, and a post-decommission assessment process that determines whether and when the AI can be reactivated.

Bias Testing: India's Demographic Reality in AI

India's credit landscape is among the most demographically complex in the world. AI credit models trained predominantly on urban salaried data — the customer segment most banks historically served — have systematic calibration gaps for gig economy workers, agricultural borrowers, micro-enterprise operators, and first-time credit users. The MRMF's bias testing requirement across "demographic and credit segments" is not a generic ESG obligation: it is a direct response to documented evidence that AI credit models in Indian banking underserve the bottom half of the credit pyramid.

Compliance requires defining the demographic segments for bias testing (gender, geography, income tier, credit history depth), establishing acceptable disparate impact thresholds, conducting testing at development and on an ongoing basis, and maintaining evidence of testing outcomes that can withstand RBI inspection.

RBI MRMF 2026 AI Governance Checklist

☐ Board-approved MRMF: AI/ML models explicitly covered; board approval documented; annual MRMF review with AI/ML section
☐ Enterprise model inventory: all AI/ML models inventoried including third-party; model owner, risk tier, validation status, last review date per entry
☐ Risk tiering: AI/ML models classified low/medium/high; tiering criteria documented; high-risk models subject to enhanced controls
☐ Killswitch: per AI/ML model decommission protocol; fallback operations tested; BCP integration for customer-facing AI
☐ Explainability: output explainability standard defined per model tier; adverse decision rationale available for customer disputes and RBI inspection
☐ Bias testing: demographic and credit segments defined; testing conducted at development and ongoing; disparate impact thresholds documented; evidence on file
☐ Independent validation: validation function separate from development team; third-party AI proxy validation protocol; validation findings tracked to closure
☐ Third-party AI governance: vendor AI in inventory; validation rights in contracts; change notification protocol; explainability evidence obligation
☐ RBI examination readiness: MRMF document, model inventory, validation reports, bias testing results, killswitch protocol — packaged for RBI inspection