On June 24, 2026, the Reserve Bank of India released its draft "Guidance on Regulatory Principles for Model Risk Management, 2026."
Every bank, NBFC, payments bank, cooperative, and all-India financial institution is now on notice. The way AI models are selected, deployed, monitored, and governed in Indian finance is about to change fundamentally.
At Actioneer, we've been working on the context layer that makes AI trustworthy in exactly these environments. And reading through this draft, paragraph by paragraph, we kept arriving at the same thought: this is the regulation we've been building toward.
Here is a full breakdown of what the guidance says, what it means in practice, and what regulated entities should be doing right now.
What Is the RBI's New Model Risk Management Guidance?
The guidance is a draft regulatory framework setting out how regulated entities must govern the models they use, including AI and machine learning models, across the entire model lifecycle. It covers governance structures, risk tiering, model inventory and documentation, validation, deployment, change management, and decommissioning.
It applies to models that are developed internally, sourced from third parties, or a combination of both. A dedicated chapter addresses AI/ML models specifically, covering explainability, hallucination risk, human oversight, and deployment controls.
Once finalised, this guidance will supersede the credit risk model provisions of the RBI's 2002 Guidance Note on Credit Risk Management.
Why Is the RBI Introducing These Requirements?
Financial institutions are using models, including AI and ML systems, at a growing scale to drive efficiency, improve customer service, and strengthen risk management. The RBI's own framing in the draft is direct: the benefits that come from using models usually come with additional risks. Left unmanaged, these risks can lead to inaccurate outcomes, flawed decisions, financial losses, operational disruption, and compliance failures.
The RBI is also acting on a commitment it made earlier. The draft references its broader Utkarsh 2029 strategic framework, under which further AI-specific requirements may follow this guidance.
In short, the RBI is moving from broad principles to operational rules, because AI adoption in Indian finance has reached a point where informal governance is no longer sufficient.
Which Financial Institutions Will the Guidance Apply To?
The guidance casts a wide net. It applies to:
Commercial banks, including foreign banks and the State Bank of India. Small finance banks. Payments banks. Local area banks. Regional rural banks. Urban cooperative banks. Rural cooperative banks. Non-banking financial companies across all layers, base, middle, upper, and top. All-India financial institutions, including EXIM Bank, NABARD, NaBFID, NHB, and SIDBI. Asset reconstruction companies. Credit information companies.
Practically speaking, this covers nearly every regulated lender, deposit-taker, and credit infrastructure provider in the country. If an institution uses any model, including a spreadsheet-based pricing tool that influences a lending decision, it falls within scope.
What Is the RBI Asking Financial Institutions to Do?
At a high level, the guidance asks every regulated entity to:
Put in place a Board-approved Model Risk Management Framework covering every model it uses. Classify every model into a risk tier based on materiality, complexity, and other relevant factors. Maintain a comprehensive, up-to-date inventory of every active, inactive, and decommissioned model. Independently validate every model, including third-party models, before and after deployment. Establish a structured approval process, with high-risk models requiring Board-committee sign-off. Implement the three lines of defence: model owners, an independent validation function, and internal audit. Build in business continuity and decommissioning plans for every model.
For AI and ML models specifically, the guidance adds a further layer of requirements covering explainability, hallucination prevention, behavioural testing, human oversight, and deployment safeguards. These are covered in detail below.
What Does the RBI Mean by Explainable AI?
The draft defines explainability as the property of a model to express important factors influencing its results in a way that is understandable. It requires institutions to define explainability thresholds for every AI model, with higher thresholds for models that drive material decisions or significantly affect customers.
Where full explainability is not achievable, enhanced monitoring, output corroboration, and usage restrictions follow automatically.
Most conversations about AI explainability focus on the model itself. But in practice, a model can only explain what it knows. If the context it is drawing on is incomplete, unstructured, or unverifiable, no amount of model-level tuning will produce an explainable output. That is the gap the context layer is built to close, which we explain in detail in the next section.
How Does the RBI Expect Institutions to Prevent AI Hallucinations?
This draft marks the first time the RBI has explicitly required controls against hallucinations in generative AI models in official regulatory guidance.
The requirement applies specifically to models that drive customer interaction or decision-making. Institutions must implement system-level controls or model design features to mitigate hallucination risk. They must disclose to users that they are interacting with an AI system. They must offer customers the option to switch to a human when requested.
Hallucinations are fundamentally a context problem. Models hallucinate when they do not have reliable, structured information to draw on. The fix is not just better model weights. It is better context infrastructure, governed, versioned, and grounded in verified institutional knowledge rather than open-ended generation.
What Is the Context Layer, and Why Does It Matter for AI Governance?
The context layer is the structured, governed knowledge infrastructure that sits between an institution's data and the AI models built on top of it. Instead of an AI model generating answers from whatever it has learned during training, or pulling unverified information from the open web, the context layer feeds it a controlled, versioned, and auditable body of institutional knowledge to draw on.
This matters because most of the operational requirements in the RBI's draft guidance are, at their root, context problems rather than model problems.
Explainability requires a model to be able to point to exactly what informed its output. That is only possible if the underlying information is structured and traceable in the first place.
Hallucination control requires a model to ground its responses in verified information rather than generating plausible-sounding but unverified content. A governed context layer is what makes grounding possible at scale.
Third-party model validation requires institutions to understand and audit how a model produces its outputs. A context layer that is owned and inspected within the institution's own environment, rather than embedded inside a vendor's black box, makes that audit tractable.
Documentation and traceability requirements ask institutions to demonstrate, on demand, why a model behaved the way it did. A context layer with versioned knowledge and clear provenance turns this from a forensic exercise into a built-in capability.
This is the infrastructure layer Actioneer builds. Deployed on-premises, inside the institution's own environment, with a governed and versioned knowledge base that AI models draw on instead of the open web. When a model can point to exactly what it used to reach a conclusion, explainability, hallucination control, and auditability stop being separate problems and become outcomes of the same underlying architecture.
What Does the RBI Say About Third-Party AI Models?
One of the most consequential clauses in this guidance is the requirement that regulated entities independently validate every third-party AI model they use, regardless of any certification or assurance the vendor provides.
On top of that, the Risk Management Committee of the Board must oversee all third-party AI models irrespective of their risk tier. Contractual arrangements must include access to technical documentation, audit rights, and defined exit arrangements.
This is a major shift. Institutions can no longer treat a third-party AI model as a black box that someone else is responsible for. They are accountable for its outcomes.
We've designed Actioneer with this requirement in mind. On-prem deployment means the institution owns the environment. The context layer is fully inspectable, with versioned documentation that satisfies the audit and traceability requirements this guidance demands. When the validator comes knocking, the documentation is already there.
Working with top fintechs has also meant we've had to meet this bar from day one. Fintech partners don't have the luxury of opaque AI. Their regulators and enterprise clients demand traceability. We built to that standard before it became mandatory for the broader sector.
Why Does the RBI Require Human Oversight of AI?
The draft requires "human-in-command" arrangements for AI models, including mechanisms to override, suspend, or deactivate a model and explicit kill-switch arrangements. It flags the risks of automation bias and decision fatigue. It requires that humans overseeing AI models actually understand how the models work well enough to challenge their outputs.
This is not the regulation slowing down AI adoption. This is the regulation defining what responsible AI adoption looks like.
Actioneer's architecture is built around augmenting human decisions, not replacing them. The context layer surfaces the right information, with provenance, at the right moment. The human remains in command. The model remains explainable. The institution remains accountable.
That is the design philosophy this guidance is now mandating.
What Documentation Will Banks and NBFCs Need for AI Models?
Beyond the AI-specific clauses, the guidance sets out requirements that will create significant operational lift for most institutions.
Every model must be inventoried, whether active, inactive, under development, or decommissioned. No model can be used unless it is in the inventory. Decommissioned models must remain on record for at least ten years. Documentation must cover the full lifecycle, and for AI models specifically, must enable traceability, reproducibility, and auditability.
This is not a one-time project. It is an ongoing operational commitment.
The institutions that have the right context infrastructure in place will find this manageable. The ones trying to retrofit documentation onto existing AI deployments after the fact will find it significantly harder.
What Should Regulated Entities Do Before the Guidance Becomes Final?
This is still a draft. Public consultation is open. The final guidance will supersede the credit risk model guidelines from 2002, and the RBI has signalled that further AI-specific requirements may follow under the Utkarsh 2029 framework.
But the direction is unmistakable. India's financial sector is moving toward a world where every AI model must be explainable, validated, governed, and documented across its entire lifecycle. The institutions that build the right foundations now, rather than waiting for the final text, will be ready when the guidance lands.
At Actioneer, we work with regulated entities and fintechs who understand that the context layer is not a nice-to-have. It is the infrastructure that makes compliant, trustworthy AI possible.
If you are working through what this guidance means for your organisation, we'd like that conversation.
Frequently Asked Questions
Is the RBI's Model Risk Management Guidance final or still a draft? It is currently a draft, released for public consultation on June 24, 2026. The final version will be issued after the consultation period and will supersede Chapter 3 of the RBI's 2002 Guidance Note on Credit Risk Management.
Does the guidance apply only to AI models? No. It applies to all models used by regulated entities, including traditional statistical and rule-based models. AI and ML models are addressed in a dedicated chapter with additional, more stringent requirements.
Does this guidance apply to NBFCs as well as banks? Yes. It applies across all NBFC layers (base, middle, upper, and top), as well as commercial banks, small finance banks, payments banks, cooperative banks, all-India financial institutions, asset reconstruction companies, and credit information companies.
What happens if an institution cannot make an AI model fully explainable? The guidance does not require every model to be fully explainable. Where full explainability is not achievable, institutions must apply enhanced risk management measures instead, including more frequent validation, continuous monitoring, output verification mechanisms, and usage restrictions.
Can institutions rely on a vendor's certification for third-party AI models? No. The guidance explicitly states that regulated entities must independently validate third-party models regardless of any certification, validation, or assurance provided by the vendor.
What is the context layer in relation to AI governance? The context layer is the structured, governed knowledge infrastructure that AI models draw on to generate outputs. Rather than relying purely on training data or open-web information, a well-built context layer grounds AI outputs in verified, traceable, institution-specific knowledge, which directly supports explainability, hallucination control, and audit requirements.
How long must institutions retain records of decommissioned AI models? At least ten years from the date of decommissioning, or from the date the model ceases to serve as a backup or benchmark reference, whichever is later, or longer if required by other applicable law.
The draft Guidance on Regulatory Principles for Model Risk Management, 2026 was released by the Reserve Bank of India for public consultation in June 2026.