Free assessment · India BFSI
RBI AI Readiness: Know your gaps before your examiner does
India's AI governance requirements for banks have expanded significantly: the 2024 AI Circular, the FREE-AI Framework (26 recommendations), the June 2026 eMRM draft, and DPDP Act inference pipeline obligations. This assessment covers all four layers in 15 minutes.
Assessment scope
Four layers of India AI governance — covered in one assessment
Layer 1 · RBI 2024 AI Circular
Governance architecture
- Board-approved AI governance framework
- AI model inventory with risk classification
- Audit trail for all AI decisions
- Outsourcing / third-party AI controls
- Customer protection guardrails
- Incident reporting to RBI
Layer 2 · RBI FREE-AI (Aug 2025)
Quality standards (26 recommendations)
- Fairness: F-1 to F-8 (bias, discrimination, equal access)
- Reliability: R-1 to R-7 (accuracy, robustness, fallback)
- Explainability: E-1 to E-6 (documentation, audit, transparency)
- Ethics: Et-1 to Et-5 (accountability, oversight, societal impact)
Layer 3 · RBI eMRM (Jun 2026 draft)
Validation lifecycle
- Model tier classification (Critical/Significant/Standard/Minimal)
- Independent validation — including third-party AI
- Ongoing performance monitoring with thresholds
- Model Risk Committee approval workflow
- Evidence chain per model
Layer 4 · DPDP Act 2023
Data protection in AI inference
- PII detection in prompt inputs and model outputs
- Consent verification for AI-driven profiling
- Purpose limitation at inference layer
- Data localisation for AI workloads
- Data principal rights (access, correction, erasure)
Where are you?
RBI AI governance maturity model
Level 1
Reactive
No inventory, no formal controls. Risk known only after incidents.
Level 2
Catalogued
List exists. No framework mapping, no tested controls.
Level 3
Mapped
Controls mapped to RBI obligations. Reviewable by examiner.
Level 4
Measured
Controls tested. Residual risk quantified. Heat maps drive decisions.
Level 5
Governed
Board risk appetite set. Continuous monitoring. Evidence on demand.
Most Indian banks deploying AI today are between Level 2 and Level 3. The eMRM draft effectively raises the bar to Level 4 for all Tier 1–2 models.
Self-assessment
RBI examination readiness checklist
RBI 2024AI Circular obligations
- Board-approved AI governance framework exists and is reviewed annuallyRBI 2024 AI Circular Section 4: governance framework must be board-approved and regularly reviewed.
- Comprehensive AI model inventory with risk classification for all production AIInventory must include every AI system in production, including third-party and shadow AI.
- Audit trail exists for all AI-driven decisions, tamper-evident and exportableAudit trail must be complete, timestamped, and producible for RBI inspection.
- Third-party AI vendors have contractual governance obligations and oversight evidenceOutsourcing controls apply to AI sourced from any third party, including large technology vendors.
- AI incident reporting process defined with RBI notification requirements mappedMaterial AI failures must be reportable to RBI with supporting documentation.
FREE-AI26 recommendations coverage
- Bias and fairness assessment performed for all AI systems making customer decisionsFREE-AI Fairness pillar (F-1 to F-8): demographic bias testing required at development and on ongoing basis.
- Model accuracy and robustness monitoring active for all production AIFREE-AI Reliability pillar (R-1 to R-7): performance monitoring with defined thresholds required.
- Explainability capability in place for all AI systems making customer-facing decisionsFREE-AI Explainability pillar (E-1 to E-6): credit, KYC, and customer communication AI must be explainable.
- Human oversight mechanism defined for all AI-driven decisions above a risk thresholdFREE-AI Ethics pillar (Et-1 to Et-5): human-in-the-loop requirements for high-risk AI decisions.
eMRMModel validation lifecycle
- All AI models in production are tier-classified (Critical/Significant/Standard/Minimal)eMRM tier classification determines validation frequency and depth requirements.
- Independent validation completed for all Tier 1–2 models (including third-party)Validation must be independent from model development and use — vendor attestations alone insufficient.
- Model Risk Committee (or equivalent) approval documented for Tier 1–2 modelsCommittee approval with documented rationale required before deployment of Tier 1–2 models.
DPDPData protection at inference
- PII detection active in AI inference pipeline (inputs and outputs)DPDP Act applies at inference layer — Aadhaar, PAN, account numbers must be detected/redacted.
- Consent verified before personal data used in AI-driven profiling or scoringDPDP Act Section 4 and Section 6: consent required for AI-driven processing of personal data.
- AI workloads processing Indian personal data operate within IndiaDPDP Act data localisation obligations apply to AI inference workloads, not just storage.
After the self-assessment
Turn your gap list into an implementation plan
Full RBI AI readiness review
Zytra's India team will assess your AI governance against all four layers — 2024 AI Circular, FREE-AI, eMRM, DPDP — and prioritise the implementation backlog by examination exposure.
Request a review →India BFSI platform overview
See how Zytra maps to each RBI, SEBI, and DPDP obligation — with the evidence outputs your examiner will ask for.
Explore →RBI eMRM: the new validation standard
The June 2026 eMRM draft raises the bar significantly. Independent validation for all AI — including vendor AI — is now a compliance requirement, not a best practice.
Read the guide →Know your RBI AI examination score before your examiner does
Request Zytra's full RBI AI readiness assessment. 45 minutes, four regulatory layers, prioritised gap list with implementation roadmap.