RBI Draft Model Risk Management Framework 2026: MRMF AI Governance Requirements for All Banks, NBFCs, and RBI-Regulated Entities

RBI's Model Risk Management Framework turns AI governance from a best-practice checklist into an examinable obligation — here's what changes for banks, NBFCs, and every entity RBI regulates.

RBI's draft Guidance on Regulatory Principles for Model Risk Management, published in 2026, is the first Master Direction-level instrument that makes AI/ML model governance a binding obligation across all eleven categories of RBI-regulated entities. [Note: confirm the exact publication date and RBI press release number against the live notification before this goes to press — those details are specific enough that an incorrect reference number will be noticed immediately by a compliance reader.] Board-approved governance, independent validation, customer explainability, and documented human oversight stop being aspirational language in an internal policy and become line items an examiner can cite in a Risk Mitigation Plan.

For three years, Indian banking AI governance ran on advisory frameworks — FREE-AI's principles, the 2024 AI Circular, SEBI's AI guidance — that described what good governance looked like without making any single element mandatory. The MRMF closes that gap, and it does so with one structural change that matters more than any individual requirement: these obligations are now enforceable through the Master Direction mechanism, not just encouraged through supervisory commentary. A risk head who has sat through an RBI inspection knows the difference between "the examiner noted it as an observation" and "the examiner cited the specific clause" — MRMF moves AI governance into the second category.

The scope decision that will surprise some NBFCs: a model sourced from a fintech vendor, built as a hybrid, or developed entirely in-house carries identical regulatory accountability. An NBFC running its credit underwriting on a vendor's AI API owns that model's validation, monitoring, and explainability exactly as if its own data science team had built it. Outsourcing the build does not outsource the risk — and vendor contracts signed without that assumption baked in will need renegotiation.

The Six Requirements That Convert Policy Into Evidence

Board-approved MRMF policy. Every regulated entity needs a documented framework covering model risk appetite, categorisation by risk tier, validation standards per tier, monitoring cadence, and escalation paths — approved by board resolution, not signed off by the CRO on the board's behalf. Entities with an existing AI policy or data-science governance document need to fold it into the MRMF structure and take it back to the board, because "the risk committee saw it" is not the same evidence as a board resolution number.

A comprehensive AI model inventory, including the models nobody officially deployed. Every production model needs an entry capturing purpose, development methodology, training data lineage, deployment environment, validation status, monitoring frequency, a named owner, and last validation date. The inventory requirement that actually bites is the one for shadow models — AI tools a business line stood up outside the formal MRM process. Every bank has at least one of these; the MRMF just makes it everyone's problem to find them.

Independent validation, with a vendor carve-out closed. Validation has to come from a function that didn't build the model — conceptual soundness, data quality, out-of-sample performance, stress testing, and for AI/ML specifically, explainability and fairness testing. Vendor documentation and vendor-run test results do not substitute for this. An entity has to independently validate a vendor's model the same way it validates one it built, which means audit access to the vendor's model internals has to exist in the contract before validation can even start.

Explainability for anything that touches a customer's loan, limit, or KYC status. The bar is a non-technical explanation the customer can actually use — not a feature-importance printout. This sits directly on top of the DPDP Act's right to explanation for automated decisions, so a single customer-facing credit AI deployment now answers to two separate regulatory obligations for the same explanation.

Documented human oversight, with an audit trail of every override. The requirement isn't that a human reviews every AI decision — it's that there's a written process defining when review happens, who does it, and how overrides get recorded and reported. An oversight policy that's never actually been invoked in production isn't oversight; it's a document.

Vendor accountability written into the contract, not assumed. Contracts need audit and validation access, model documentation and training-data provenance, performance reporting on the entity's own MRMF cadence, update notification, and data-use terms consistent with DPDP and RBI data localisation. If a vendor won't give adequate documentation or audit access, the MRMF's answer is simple: don't deploy that vendor's model in a material function.

Where FREE-AI Stopped and MRMF Starts

FREE-AI described good AI governance; MRMF requires it, and the difference shows up most sharply in three places. FREE-AI recommended board oversight as good practice — MRMF requires a board resolution and annual review, full stop. FREE-AI recommended validation processes for AI — MRMF makes independent validation mandatory for material models and explicitly closes the vendor-documentation loophole. And FREE-AI noted third-party AI risk as something to manage — MRMF puts full regulatory accountability for vendor AI on the regulated entity, with audit access as a contractual non-negotiable.

The practical read for a bank that built a genuinely good FREE-AI-aligned program: most of the structure survives, but the board-approval formality, the vendor audit-access gap, and the customer-facing explanation workflow are very likely the three places where an honest self-assessment finds a shortfall.

The Four Gaps Every Bank Will Find When It Actually Looks

Shadow models are the most universal gap — a vendor chatbot here, a collections scoring API there, deployed by a business line that never routed it through MRM. The vendor validation gap is the costliest to fix, because most existing AI vendor contracts don't have audit-access clauses, and renegotiating a live contract takes months a bank doesn't have once the Master Direction is final. Board approval formality trips up banks that genuinely did the governance work but only took it to the risk committee — a real gap in form, not substance, but a gap MRMF will still flag. And customer explainability operationalisation is the gap most banks haven't even started on: having an explainable model is not the same as having a workflow that turns its output into something a call-center agent can read to a customer.

What This Looks Like by Entity Type

Public sector banks already run formal MRM functions for statistical credit models — the open question is whether that function's validators can actually assess a gradient-boosted or deep-learning model, and whether the inventory captures AI embedded in fintech partnerships and government lending programs, not just the models the MRM team built itself. Private banks carry the heaviest vendor-accountability burden because of how many fintech APIs sit inside their credit, fraud, and KYC stack — every one of those API calls is a vendor model under MRMF, and RBI examiners will ask for that inventory by name. NBFCs face the steepest climb: most don't have an independent validation function at all, and the compliance timeline for systemically important NBFCs doesn't leave room to build one slowly. Credit Information Companies face a specific new obligation — bureau scores have to become explainable to the individuals they affect, which is a workflow CICs have never had to build before.

Action Checklist: The First 90 Days After the Final Master Direction

1. Run a shadow-model sweep across every business line — not just the ones MRM already touches — and get every production AI system into the inventory.
2. Audit every AI vendor contract for audit-access and documentation rights; flag the ones that don't have them for renegotiation before the compliance clock starts.
3. Confirm board resolution status on existing AI governance documents — if it stopped at the risk committee, schedule board ratification first.
4. Assess whether your validation function can actually validate ML models, not just statistical ones — build the capability or line up a qualified third party now.
5. Design the customer explanation workflow before an examiner asks to see one — the model being explainable on paper isn't the same as a call-center script that works.