New Delhi: The Reserve Bank of India (RBI) wants banks and other lenders to build a “kill switch” into every artificial intelligence system they use, so that a human can shut down a faulty model at once. A draft framework it released Wednesday puts responsibility for AI-driven decisions squarely with the entity’s board of directors.
Banks now lean on software to approve loans, price them, screen transactions for fraud, score credit and answer customers on apps. The RBI’s draft lays out how lenders must govern these systems from the day they pick a model to the day they retire it.The draft asks regulated entities to put in place “override, suspension, or deactivation mechanisms, including kill-switch arrangements” for AI models. The RBI uses the term “regulated entities”, or REs, for banks, non-banking financial companies (NBFCs) and other firms it supervises. It has invited feedback from these entities and the public by 24 July.
The framework, titled ‘Guidance on Regulatory Principles for Model Risk Management, 2026’, covers 11 categories of entities the central bank regulates, among them commercial banks, small finance banks, payments banks, co-operative banks, NBFCs and credit information companies.It applies to all “models”. A model, the draft says, is any tool that processes inputs and produces an output that feeds a business decision. Therefore, not just machine-learning systems but also simpler tools such as a spreadsheet, if a bank uses it to set lending rates, comes under this category.The rules apply “irrespective of whether such tools are recognised as models by the RE”, the draft says. In simpler terms, the test is what the tool does, not what the bank chooses to call it.The framework holds lenders accountable for the outcomes of every model they use, whether they build it in-house or buy it from a vendor. “An RE is accountable for the outcomes of all models used by it, irrespective of whether the models are developed internally, sourced from third-parties, or a combination thereof,” it says.A bank cannot pass the blame to a technology supplier. It must run its own independent checks, even after the vendor certifies it, screen the vendor’s track record before signing up, and write rights into the contract to see how the model works, to audit it, and to exit cleanly if it has to. This means that the contract must include exit and continuity terms, letting the bank drop the vendor’s model and move to an alternative without disrupting operations.The RBI also pushes responsibility to the top of the organisation. Each RE will have to set up a board-approved model risk management framework. The Risk Management Committee of the entity’s board will have to clear any model the lender classifies as high-risk before deploying it. The board has to fix how much model risk the bank is willing to live with, and senior management has to find the people and systems to make the framework work on the ground.
