What AI vendor governance obligations does RBI's Master Direction on Outsourcing of IT Services 2023 create for banks and NBFCs?

RBI Master Direction on Outsourcing of IT Services (RBI/2023-24/102, April 10, 2023, effective October 1, 2023) creates six AI vendor governance obligations for all RBI-regulated entities in scope: (1) AI/ML classification as Material IT Service: 'data analytics and machine learning' is explicitly listed as a Material IT Service category within cloud computing services. This classification is consequential — Material IT Services trigger the full suite of the Master Direction's compliance obligations, including senior management approval, pre-deployment due diligence, contractual requirements, and exit planning. An AI/ML SaaS tool or managed ML inference service delivered via cloud is not a generic technology procurement; it is a Material IT Service with a specific regulatory compliance track; (2) Board and senior management accountability: the board retains ultimate accountability for ensuring that all outsourced IT/AI service providers — including cloud AI vendors, third-party ML model providers, and AI SaaS platforms — meet the same standards the regulated entity would apply to internally operated systems. AI vendor failures do not reduce the regulated entity's accountability to RBI; (3) Pre-deployment due diligence on material AI vendors: before engaging any material AI/ML vendor, regulated entities must conduct structured due diligence covering technical capability assessment, data security practices, regulatory track record (including any regulatory actions against the vendor), business continuity provisions, and concentration risk evaluation. Generic vendor security questionnaires are insufficient — the due diligence must be proportionate to the materiality and risk of the AI service; (4) Contractual requirements for AI vendors: contracts with material AI/ML providers must include model performance reporting obligations, data privacy requirements for training and inference data, right to audit the AI vendor's systems and processes, incident reporting timelines, and defined exit procedures. Contracts that are silent on these provisions are non-compliant with the Master Direction regardless of when they were executed — the effective date of October 1, 2023 created a remediation obligation for existing contracts; (5) Cloud AI data localization: the Appendix on cloud computing services applies to AI workloads — AI inference data, model training data, and model outputs generated by cloud-based AI services are subject to data localization requirements where they contain customer data or transaction data. This has direct implications for banks and NBFCs using global AI platforms (US-based foundation models, European AI analytics services) that process Indian customer data outside India; (6) Exit planning for AI vendors: regulated entities must maintain documented, tested exit plans for each Material IT Service engagement, including AI/ML vendors. Exit plans must cover transition procedures, data portability requirements, model portability or documentation to enable in-house or alternative-vendor continuation, and timeline assumptions. A bank that cannot exit an AI vendor without operational disruption to its credit scoring, fraud detection, or customer service functions has an exit plan gap.

How does RBI's IT Outsourcing Master Direction 2023 differ from the RBI IT Governance Master Direction 2023, and why are both needed?

The two Master Directions address fundamentally different aspects of IT governance in Indian banking: (1) RBI IT Governance Master Directions (DoS.CO.CSITEG/SEC.7, November 7, 2023): governs internal IT governance — the board's IT Strategy Committee, IT management structures, internal audit of IT systems, IT risk management framework, IS audit, business continuity planning, and IT operations within the regulated entity. It sets the standards for how the regulated entity governs its own IT function. AI governance under this MD covers internal AI systems that the bank itself develops and operates; (2) RBI Master Direction on Outsourcing of IT Services (RBI/2023-24/102, April 10, 2023): governs the procurement and management of IT/AI services from external vendors — the contractual, due diligence, and accountability framework for third-party AI services. It sets the standards for how the regulated entity governs its relationships with AI vendors. AI governance under this MD covers externally-sourced AI tools, cloud AI services, and managed AI capabilities; (3) Three specific differences for AI governance: the IT Outsourcing MD's AI/ML classification as a Material IT Service creates a formal procurement and compliance gateway — a bank must apply the full due diligence and contractual framework before engaging an AI vendor, not after; the IT Governance MD's internal AI governance framework assumes the AI system is already inside the perimeter — it addresses how it is governed once deployed; (4) Combined compliance requirement: a bank deploying an AI credit scoring model that is developed using a third-party ML platform (outsourcing MD) and then runs on internal infrastructure (IT governance MD) needs both frameworks satisfied. An internal AI model developed entirely in-house primarily requires the IT Governance MD. A cloud-based AI service primarily requires the Outsourcing MD. Hybrid deployments (internal data science team using cloud AI APIs) require both; (5) Different materiality thresholds: the Outsourcing MD's materiality assessment applies to the AI service being procured. The IT Governance MD's risk assessment applies to AI systems by their operational impact on the regulated entity's critical functions.

Which regulated entities are in scope for RBI's IT Outsourcing Master Direction 2023 and what are the key implementation obligations for AI?

RBI's Master Direction on Outsourcing of IT Services 2023 applies to approximately 700+ regulated entities across six categories: (1) All Scheduled Commercial Banks (excluding Regional Rural Banks) — including public sector banks (SBI, PNB, BoB, etc.), private sector banks (HDFC, ICICI, Kotak, Axis, etc.), foreign bank branches, small finance banks, and payment banks; (2) NBFCs excluding Base Layer — Upper Layer NBFCs (systemically important), Middle Layer NBFCs (non-deposit), and Upper Layer NBFCs (deposit-taking), with the Base Layer exempted given their smaller scale; (3) Credit Information Companies — CIBIL, Experian India, Equifax India, CRIF High Mark — entities whose entire business model is built on data analytics; (4) All India Financial Institutions — NABARD, SIDBI, NaBFID, EXIM Bank, NHB; (5) Local Area Banks; (6) Primary (Urban) Co-operative Banks above prescribed thresholds. Key AI implementation obligations: (a) Material IT Service inventory: regulated entities must maintain a register of all Material IT Service engagements including AI/ML providers. Where AI tools were deployed before October 1, 2023 without a materiality assessment, a retroactive assessment and remediation of contract gaps is required; (b) Risk-based IT outsourcing policy: the board must approve an IT Outsourcing Policy that specifically addresses AI/ML service categories — materiality criteria, due diligence standards, contractual requirements, and concentration risk thresholds for AI vendors; (c) Concentration risk monitoring: multiple regulated entities engaging the same AI vendor (e.g., the same cloud foundation model provider) creates systemic concentration risk. The Master Direction requires concentration risk assessment and mitigation — relevant for the Indian banking sector's use of a small number of global AI API providers; (d) Sub-outsourcing: where an AI vendor sub-outsources its own infrastructure (a fintech AI tool running on AWS/Azure/GCP), the regulated entity must ensure the sub-outsourcing arrangement satisfies the same standards. The regulated entity cannot disclaim accountability because the AI runs on a sub-outsourced cloud.

What contractual provisions must Indian banks include in AI vendor agreements to comply with RBI's IT Outsourcing Master Direction 2023?

RBI's Master Direction on Outsourcing of IT Services 2023 specifies minimum contractual provisions for Material IT Service engagements, including AI/ML vendors. Five categories of required contractual provisions: (1) Performance and quality standards for AI: contracts must define the performance standards the AI system must meet, the metrics used to measure performance, the reporting cadence, and the remediation mechanism when performance falls below defined thresholds. For AI credit scoring models, this means minimum Gini coefficient or AUROC thresholds; for fraud detection AI, minimum recall and false positive rate bounds; for AI customer service systems, accuracy and escalation standards; (2) Data privacy and security for AI-processed data: contracts must address how the AI vendor handles the regulated entity's customer data — training data use restrictions (customer data cannot be used to train the vendor's general models without consent and regulatory compliance), inference data retention limits, encryption standards, and data breach notification timelines. For banks, this includes DPDP Act 2023 compliance obligations flow-through to AI vendors; (3) Audit and inspection rights for AI: the regulated entity must have contractual rights to audit the AI vendor's systems, processes, and data handling practices — including model audit rights (access to model documentation, version history, validation results) and physical or virtual inspection rights for AI infrastructure. RBI examiners have the right to access AI vendor systems during examination; contracts that limit audit access are non-compliant; (4) Business continuity and disaster recovery for AI: AI vendor contracts must specify RTO (Recovery Time Objective) and RPO (Recovery Point Objective) for AI service availability; business continuity obligations during vendor-side failures; and backup or failover provisions ensuring the regulated entity can continue critical AI-dependent operations during outages; (5) Exit and transition management for AI: contracts must include data portability guarantees (customer data and derived data must be returnable in a usable format), model documentation and portability provisions (model architecture, training data descriptions, validation results should be available for transition), and defined transition assistance obligations of the outgoing vendor. Lock-in that prevents AI transition is a compliance red flag under the Master Direction.

AI Governance · RBI · IT Outsourcing · AI Vendors · Cloud AI · Material IT Service · Banks · NBFCs · India BFSI

RBI Master Direction on Outsourcing of IT Services 2023: Data Analytics and Machine Learning as Material IT Service, Board Accountability for AI Vendors, Pre-Deployment Due Diligence and Cloud AI Data Localization for All Scheduled Commercial Banks and NBFCs India

RBI Master Direction on Outsourcing of IT Services (RBI/2023-24/102, April 10, 2023, effective October 1, 2023) — the binding regulatory framework governing AI vendor relationships for all Indian banks and NBFCs. "Data analytics and machine learning" explicitly classified as a Material IT Service within cloud computing — triggering the full compliance framework for all AI/ML SaaS, PaaS, and managed ML inference services. Board retains ultimate accountability for outsourced AI vendors meeting the same standards as internal systems. Pre-deployment due diligence mandatory before engaging any material AI vendor: technical capability, data security, regulatory track record, concentration risk. AI vendor contracts must include model performance reporting obligations, data privacy requirements for training and inference data, right to audit AI systems and processes, and defined exit procedures. Cloud AI workloads subject to data localization requirements. Exit plans required for each material AI engagement. Applies to 700+ REs: all scheduled commercial banks, NBFCs (excl. base layer), CICs, all-India FIs, UCBs. Distinct from RBI IT Governance MD 2023 (governs internal AI) — this governs third-party AI. Zero global competitor coverage.

Zytra Research Team · April 2023 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP Act in one place.

Every Indian bank's AI governance compliance discussion focuses on internal model governance — validation, risk tiering, explainability. But most AI capability at Indian banks today is not internally built: it is procured from vendors. Credit risk models from third-party analytics firms, fraud detection AI from fintechs, customer service AI from SaaS providers, cloud ML inference from global hyperscalers.

The governance framework for all of this external AI is RBI's Master Direction on Outsourcing of IT Services 2023. It is not a new concept — RBI has regulated IT outsourcing since 2010 — but the 2023 Master Direction explicitly names data analytics and machine learning as a Material IT Service category, creating a formal compliance gateway for every AI vendor engagement across 700+ regulated entities.

The Material IT Service Classification Is the Threshold

Whether an AI vendor engagement triggers the full compliance framework depends on whether it qualifies as a Material IT Service. The Master Direction provides criteria: if the AI service is critical to the regulated entity's operations, involves customer data, or its failure would materially impact operations or customers, it is material. AI credit scoring, fraud detection, AML, and customer service AI will typically qualify. The explicit inclusion of data analytics and machine learning in the cloud computing Material IT Service category removes ambiguity that existed under the 2010 guidelines — AI tools are in scope by design, not by inference.

The Concentration Risk Problem for Indian Banking AI

Indian banks and NBFCs have concentrated their AI procurement around a small number of global providers — particularly cloud AI APIs from US hyperscalers and a handful of India fintech AI vendors. Where multiple systemically-important regulated entities depend on the same AI vendor, a single vendor failure or regulatory action creates systemic risk. The Master Direction's concentration risk monitoring requirement applies at the regulated entity level, but RBI's supervisory view spans the system — concentration patterns that are individually compliant can be systemically concerning.

RBI IT Outsourcing AI Compliance Checklist

☐ Material IT Service inventory: all AI/ML vendor engagements assessed for materiality; register maintained; retroactive assessment for pre-October 2023 AI vendor contracts completed
☐ Board IT Outsourcing Policy: board-approved policy includes AI/ML service category; materiality criteria, due diligence standards, and concentration risk thresholds for AI vendors defined
☐ Pre-deployment due diligence: structured due diligence documented for all material AI vendors covering technical capability, data security, regulatory track record, and concentration risk
☐ Contract compliance: all material AI vendor contracts reviewed against Master Direction requirements; performance reporting, audit rights, data privacy, BCP, and exit provisions present
☐ Cloud AI data localization: AI workloads on cloud assessed for data localization compliance; customer data and transaction data in AI pipelines confirmed to comply with localization requirements
☐ Sub-outsourcing: AI vendors' own infrastructure sub-outsourcing assessed; sub-outsourcing arrangements confirmed to meet Master Direction standards
☐ Exit plans: documented and tested exit plans maintained for each material AI vendor; data portability and model documentation provisions confirmed
☐ Concentration risk: AI vendor concentration assessed at individual and systemic level; mitigation measures implemented where concentration exceeds thresholds