RBI Draft Model Risk Management Guidance: An AI Compliance Checklist for Indian Banks
RBI published its draft Guidance on Model Risk Management on 24 June 2026. The final circular is pending — but Indian banks should start mapping their AI portfolios to its requirements now. Here is a practical checklist.
What the draft guidance covers
The Reserve Bank of India published its draft Guidance on Model Risk Management on 24 June 2026, inviting comments from regulated entities. The guidance applies to banks and other RBI-regulated institutions that use models — including statistical models, machine learning models, and AI systems — for decision-making in areas including credit, fraud detection, liquidity management, and operational risk.
The draft guidance is structured around six pillars: model governance, model development, model validation, model implementation and use, ongoing monitoring, and model retirement. It draws on international best practice — particularly the Federal Reserve's SR 11-7 — while adapting requirements to the Indian banking context, including alignment with SEBI's AI governance expectations and the DPDP Act 2023.
Final guidance has not been published as of October 2026. Institutions should note that the draft is subject to change. However, the core requirements are unlikely to differ materially from international norms, and building governance structures against the draft is the right preparation posture. Waiting for the final circular before starting governance work is not a low-risk strategy.
Compliance checklist
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Board-approved model risk policy | Policy document + board resolution | Governance workflows |
| Model risk appetite defined by tier (Critical / High / Medium / Low / Minimal) | Risk appetite statement | Risk atlas — risk tiering |
| Senior management accountable for model risk | Named risk owner per model | AI asset registry — ownership |
| Model risk committee or equivalent body | Meeting minutes with model approvals | Evidence ledger — committee sign-offs |
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Comprehensive model inventory — all in-scope models | Model register with purpose, owner, risk tier | AI asset registry |
| AI Bill of Materials (training data lineage, architecture, dependencies) | AIBOM documentation | AIBOM — Enterprise tier |
| Development documentation: objective, assumptions, data sources, limitations | Model card / development report | Governance workflows |
| Pre-deployment risk assessment | Risk assessment record | Assessment engine |
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Independent validation before production deployment | Validation report by independent team | Evidence ledger — validation sign-off |
| Adversarial and stress testing for AI models | Test results against adversarial inputs | Red-team (Aval + FinProof B-01–B-14) |
| Fairness assessment for credit and customer-facing models | Bias/fairness test results (NIST MEASURE 2.11) | Governance — fairness controls |
| Validation refreshed after material model changes | Re-validation record with change log | Validation tracking |
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Runtime guardrails on AI model outputs | Guardrail block logs, policy trigger records | Aval guardrails |
| Approved use case documented and enforced at runtime | Approved scope vs. actual use records | Governance workflows |
| Human-in-the-loop for high-risk decisions | Escalation logs, human review event records | Agent control room — human review |
| Output monitoring: model drift and degradation | Monitoring dashboard and alert history | Continuous monitoring |
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Performance monitoring post-deployment | Monthly / quarterly performance metrics | Continuous monitoring |
| Periodic re-validation (minimum annual for Critical / High tier) | Re-validation schedule and reports | Governance workflows |
| Incident reporting: model errors, failures, adverse outcomes | Incident register with root-cause analysis | Evidence ledger |
| Regulatory reporting on model risk | MRM committee report (board-submittable) | Evidence export (PDF / OSCAL) |
| Requirement | Evidence required | Zytra module |
|---|---|---|
| Documented retirement process with decision rationale | Retirement decision record | Governance workflows |
| Evidence retained post-retirement per RBI data-retention norms | Archived model record set | Evidence ledger — retained records |
| DPDP Act data deletion for personal data used in model training | Deletion certificate | Privacy controls |
Key dates and status
Draft published: 24 June 2026. Final guidance: pending publication.
Institutions should take three actions now, before the final circular lands:
Start the model inventory. The inventory requirement is certain regardless of final wording — every version of MRM guidance at every jurisdiction requires a complete model register. Begin cataloguing all AI and ML systems in production, including models you did not build (third-party models, vendor AI systems), against the six-pillar structure above.
Implement risk tiering. Classifying models as Critical / High / Medium / Low / Minimal aligns with both the RBI draft and SR 11-7. This tiering drives validation frequency, monitoring intensity, and evidence depth — decisions that should be made before an examination, not during one.
Build the evidence infrastructure. Retrofitting evidence collection after an inspection is significantly harder than building it as part of deployment. The evidence an examiner will ask for — board resolutions, validation reports, monitoring dashboards, incident registers — should be a byproduct of your governance process, not a manual exercise triggered by an examination notice.
Closing
The RBI draft guidance signals that model risk management for AI will be a regulatory priority in India. The institutions best positioned when the final circular lands are those treating the draft as actionable now — not as a preview to acknowledge and file.
Model risk is now AI risk. The checklist above is a starting point.
Map your AI portfolio to RBI's requirements before the final circular.
Zytra's India regulatory pack covers RBI draft MRM Guidance, SEBI, and DPDP Act 2023 — out of the box.