RBI AI Guidelines 2026: FREE-AI & the Draft Model Risk Management Rules

Most banks we talk to think RBI’s AI rules are something that will arrive "someday", giving them time to experiment freely with copilots, credit models and chatbots in the meantime. That reading is wrong on two counts. First, the strategic framework already exists — RBI released the FREE-AI Framework on 13 August 2025, and it is not a think-piece; it carries 26 recommendations across six pillars. Second, the detailed rulebook is already on the table: the Draft Guidance on Regulatory Principles for Model Risk Management (2026) is in public consultation with comments reportedly due by 24 July 2026. The draft will get sanded at the edges, but its core expectations — board-approved frameworks, model inventories, independent validation, explainability thresholds, red-teaming — are not going to disappear. If your AI programme cannot meet them today, the consultation window is preparation time you are wasting.

This guide walks through both components — what is final, what is draft, who is covered, and the specific artefacts an RBI-regulated entity should be able to put on the table when the final circular lands. It is written from the perspective of people who sit in RBI IT examination rooms with clients, not from a press-release summary.

A point worth being precise about: the 2026 Model Risk Management guidance is a draft, not a binding direction — yet. But drafts from RBI are rarely abandoned; they are refined. Institutions that waited for SEBI’s CSCRF or RBI’s outsourcing directions to become final before starting learned the same lesson: the implementation period is never as generous as you hoped.

The draft applies across essentially the entire regulated perimeter:

Fintechs, Lending Service Providers, cloud AI vendors and technology providers are not directly named — but they are indirectly covered wherever their models or services are used by an RBI-regulated entity. The regulated entity remains accountable for the model’s outcome. In practice this means every credit-scoring API, fraud engine and GenAI assistant a fintech sells to a bank will be pulled into the bank’s due-diligence, contract and validation machinery. If you sell AI into BFSI, these are now your requirements too.

The centrepiece expectation is a Board-approved Model Risk Management Framework covering every model in the house — internally developed, third-party, AI/ML, generative AI, automated decision systems, and models embedded quietly inside applications, APIs and business workflows. The framework must define model taxonomy, governance, inventory, risk classification, validation, approval, deployment, monitoring, change management, continuity and decommissioning. "We have a data science policy" will not pass; the framework has to reach the Board.

The draft’s simplest rule is also its most disruptive: no model should be used unless it is recorded in the approved inventory. The inventory must span models under development, in testing, active in production, inactive, third-party and retired — and decommissioned models stay on the register for at least 10 years (longer where another law requires it). For each model, expect to capture:

When we run discovery exercises at mid-size lenders, the model count is usually 3–5× what the risk team believed — spreadsheets doing pricing, vendor scores buried in LOS workflows, an experiment someone promoted to production during a quarter-end crunch. Building the inventory is the single most time-consuming step, which is exactly why it should start now.

Every model gets a risk tier, driven by factors including financial, customer and regulatory impact; complexity; use of personal or sensitive data; explainability; unstructured data use; degree of automation; reliance on output; autonomous-decision capability; third-party dependency; and potential systemic impact. High-risk models earn stronger controls, more frequent validation, enhanced monitoring and Board Risk Committee approval. Classifications are reviewed at least annually and on material change.

All models, explicitly including third-party and vendor-provided ones, must undergo independent validation: before deployment, after deployment, after material changes, after data or concept drift, following incidents, on risk triggers, and periodically per risk tier. Validation covers data quality and representativeness, assumptions, conceptual soundness, design, performance, fairness and bias, explainability, robustness, intended use, output stability, security and regulatory compliance. Findings must be documented — and the draft requires validation reports to reach the Board Risk Committee (or delegated authority) within three months of completing validation. The sentence vendors will dislike most: vendor certification alone is not sufficient; the regulated entity must conduct its own independent validation.

Entities must define explainability and transparency thresholds per AI model, with higher bars where the model touches customers’ money or rights: credit decisions, loan pricing, fraud blocking, eligibility, customer risk classification, AML alert disposition, recovery and collections, insurance or investment recommendations, complaints and regulatory reporting. Where full explainability is genuinely impossible, compensating controls are expected — enhanced validation, output corroboration, usage restrictions, frequent reviews and continuous monitoring.

RBI specifically expects system-level or model-design controls to mitigate hallucination risk — not a disclaimer at the bottom of a chatbot. The toolbox: restricted knowledge sources, retrieval from approved internal repositories, output verification, confidence thresholds, human approval, prohibited-response rules, citation and source validation, transaction-level restrictions, and blocking AI from directly executing sensitive actions.

Models must be tested against edge cases, abnormal and adversarial inputs, manipulated data, stress scenarios, out-of-sample data, changing customer behaviour and economic conditions, data drift, concept drift and provider-driven model updates — and shown not to rely on spurious correlations or to produce unexplained variation for similar inputs.

For customer-facing or externally accessible generative AI, the draft layers on cybersecurity expectations covering prompt-injection attacks, adversarial inputs, unauthorised access, data leakage, malicious API calls, session and context persistence, anomalous usage patterns, third-party interfaces, integration pipelines, model manipulation and unauthorised model changes. The principle: AI systems must not introduce vulnerabilities into the institution’s production environment, and external APIs and integration points need strong access control.

An institution should not use a model that harms consumers — the draft translates that into concrete product requirements for customer-facing AI: clear disclosure that the customer is talking to AI, information about material limitations, access to human assistance, complaint and grievance mechanisms, review or appeal of AI-driven decisions, fair and non-discriminatory treatment, protection of customer data, and appropriate explanations for material decisions. RBI specifically proposes that customers be allowed to switch to human assistance on request — design your chatbot flows accordingly.

Using OpenAI, Google, Microsoft, AWS, an AI fintech or a credit-scoring provider does not transfer accountability away from the regulated entity. Before adoption, assess vendor credibility, model methodology, data quality, limitations, security and privacy controls, concentration and supply-chain risk, update practices and exit arrangements. Contracts must secure:

Continuous monitoring must track performance deterioration, bias, accuracy, false positives and negatives, drift, hallucinations, customer complaints, security incidents, unexpected behaviour, provider-capability and data-source changes, and override and exception rates. Every model change needs impact assessment, testing, approval, version control, a change log, a rollback mechanism and revalidation where material. Models that update themselves dynamically — increasingly common with vendor LLMs — require stricter controls, clearly defined automatic-update boundaries and more frequent monitoring.

The draft expressly calls for structured challenge processes and red-teaming for customer-facing and generative models. A credible test plan covers prompt injection, jailbreaking, data extraction, harmful output generation, identity manipulation, fraud scenarios, adversarial data, bias scenarios, hallucination testing, business-rule bypass, privilege escalation, API abuse and model poisoning. This is precisely where AI governance meets classic offensive security — and where most in-house teams need external help.

Plan for AI service unavailability, model failure, performance degradation, vendor outage, security compromise, corrupted data, failed updates and withdrawal of third-party models. Acceptable fallbacks include manual decision-making, rule-based processes, backup models, alternative vendors, restricted operations and emergency shutdown. Formal decommissioning requires stakeholder notification, dependency removal, data retention, audit-trail preservation and migration to replacement processes.

The FREE-AI framework organises its 26 recommendations under six pillars — Infrastructure, Policy, Capacity, Governance, Protection and Assurance. Read together with the draft MRM guidance, the direction of travel is unambiguous: innovation is encouraged, but on rails, with the Board holding the accountability.

When RBI examiners ask "show me your AI governance", this is the pack an RBI-regulated organisation should be able to produce:

Do not wait for the final circular. The core requirements — Board oversight, model inventory, risk tiering, independent validation, fairness, explainability, human control, cybersecurity, vendor accountability, customer disclosure and continuous monitoring — are already sufficiently clear in the draft and in FREE-AI to begin implementation now. A pragmatic 90-day sequence: (1) discover and inventory every model in the estate; (2) draft the Board policy and risk-tiering methodology; (3) classify models and shortlist the high-risk tier; (4) commission independent validation and a GenAI red-team on customer-facing systems; (5) remediate contracts with AI vendors for audit rights and incident notification. Institutions that arrive at the final guidance with this scaffolding in place will treat it as a confirmation exercise; everyone else will be running a fire drill.