RBI Mandates Banks Strengthen AI Oversight: New Rules Demand Board-Approved Risk Frameworks for Machine Learning Models

RBI Mandates Banks Strengthen AI Oversight: New Rules Demand Board-Approved Risk Frameworks for Machine Learning Models​

The Reserve Bank of India (RBI) has proposed stringent guidelines requiring banks to significantly enhance the oversight and risk management associated with Artificial Intelligence (AI) and machine learning models. The move underscores the central bank's commitment to managing emerging technology risks within the regulated banking sector.

Regulated entities must now establish a comprehensive, board-approved risk management framework covering all models utilized by the institution. This includes specific protocols for AI applications and complex machine learning systems deployed across operations.

Mandatory Risk Assessment and Oversight Frameworks​

The RBI has mandated that banks continuously assess risks at two levels: the individual model level and the overall enterprise level. This continuous scrutiny ensures that technology implementation aligns with robust risk tolerance policies defined by the institution.

If any AI or ML models are found to pose excessive risks, immediate corrective action must be taken by lending institutions. Corrective steps can range from imposing enhanced controls and usage restrictions to remediating or fully decommissioning the model.

Governance and Validation Standards for Banking Models​

A key pillar of the new guidelines is ensuring proper governance across all technology implementations. Banks are required to guarantee that every model, whether developed internally or acquired as a third-party solution, undergoes independent validation.

The draft guidelines emphasize establishing human oversight for AI models involved in automated decision-making processes. This requirement ensures that human accountability remains integrated into the deployment of advanced technologies within the bank’s operations.

Cybersecurity and Generative AI Controls​

Specific attention has been paid to the security implications of modern AI tools, particularly generative AI models. For any generative AI models interfacing with external users or customers, banks must implement enhanced cybersecurity controls as stipulated by the RBI.

The proposed guidelines serve as a comprehensive regulatory update to guide financial institutions through the rapid adoption of cutting-edge AI technology. The RBI has invited feedback on these draft regulations until July 24, seeking industry input before finalizing the standards.