{"id":12890,"date":"2026-08-14T00:16:57","date_gmt":"2026-08-14T05:46:57","guid":{"rendered":"https:\/\/melento.ai\/en-in\/blog\/?p=12890"},"modified":"2026-08-14T06:54:16","modified_gmt":"2026-08-14T12:24:16","slug":"rbis-new-model-for-risk-guidance","status":"publish","type":"post","link":"https:\/\/melento.ai\/en-in\/blog\/rbis-new-model-for-risk-guidance","title":{"rendered":"RBI’s New Model Risk Guidance: Why AI Governance Is Becoming an Enterprise Responsibility"},"content":{"rendered":"

A practitioner’s read on what the Draft Guidance is really regulating, how it measures up against the EU, the US, and Singapore, and the frontier it now has a chance to lead on.<\/i><\/strong><\/p>\n

On the surface, the Reserve Bank of India’s Draft Guidance on Regulatory Principles for Model Risk Management, 2026 reads like a model risk update, the kind of document that lands with risk teams and gradually reshapes an internal policy manual. Look a little closer, though, and it is doing something broader than that title suggests. What RBI has put out is one of India’s first substantive attempts at AI governance and security regulation for the financial sector, covering not just how models are validated but how they can be attacked, manipulated, and misused.<\/p>\n

That distinction is the eye-opener. A model risk document asks whether a system performs accurately. A governance and security document asks whether that system can be hallucinated into giving wrong advice, prompt-injected into leaking data, drifted into bias, or manipulated by an adversary who understands exactly how it makes decisions. RBI’s Draft Guidance asks all of these questions in the same breath as accuracy and validation, and that is the part of the document that deserves far more attention than it has received.<\/p>\n

We know this territory because we work in it. Melento<\/a> builds the compliance automation, contract lifecycle, and AI-enabled workflow systems that regulated financial institutions run on, and we made a formal submission to RBI on this Draft Guidance. What follows is not a summary of that submission. It is our read on what the Guidance is actually aimed at, how it stacks up against what regulators elsewhere have already done, and where we think India has an opening to lead rather than follow.<\/p>\n

What the Guidance Is Actually Targeting<\/b><\/span><\/h2>\n

Strip the Draft Guidance down to its mechanics, and it is targeting three things at once, not one.<\/p>\n

The first is scope, defined deliberately wide. RBI has defined \u201cmodel\u201d broadly enough to catch machine learning systems, generative AI, rule-based engines, algorithms, and even spreadsheets and decision-support tools, provided they materially influence a business decision. This is a regulator closing a loophole before institutions find it: consequential decisions quietly running through tools that were never built, tested, or documented like a model, precisely because nobody called them one.<\/p>\n

The second is the accountability chain, not the technology. Whether a system was built in-house or licensed from a vendor, the Guidance places responsibility with the regulated entity. That includes foundation models and proprietary AI services where the institution has no access to architecture, training data, or weights. RBI is not asking institutions to understand every layer of a vendor’s model. It is asking them to own the consequences of using it anyway, through contractual controls, integration testing and ongoing monitoring.<\/p>\n

The third, and the one most easily missed, is the security perimeter around the model rather than the model itself. Explainability, fairness, hallucinations, prompt injection, adversarial manipulation, and model drift sit in the same clause as validation and monitoring. That is a regulator treating an AI system the way a security team would: as something with an attack surface, not just an error rate. Very few model risk frameworks anywhere have historically done that. This one does, and it does it early.<\/p>\n

Put together, the target is not \u201cmodels\u201d. It is any point where an automated system touches a customer, a decision, or a regulator’s ability to reconstruct what happened afterward. And the evidence an institution can produce to prove it was governed the whole way through.<\/p>\n

Where India Sits Against What the Rest of the World Has Already Done<\/b><\/span><\/h2>\n

RBI is not writing on a blank page, and seeing where it sits against three live 2026 approaches is what makes this genuinely interesting rather than another compliance memo.<\/p>\n

The European Union has gone furthest toward binding law. Under the EU AI Act, AI systems used to evaluate the creditworthiness of natural persons are explicitly classified as high-risk, triggering documented risk management, data governance, automatic logging, transparency, and human-oversight obligations, backed by a conformity assessment before deployment. New high-risk systems had to be compliant by August 2026, with legacy systems given until February 2027, backed by penalties denominated in real numbers. It is a regime built for enforcement first. The United States has just made a very different choice, and it is the most telling data point of the three.<\/p>\n

In April 2026, the Federal Reserve, the OCC and the FDIC replaced their fifteen-year-old model risk guidance with SR 26-2 and deliberately placed generative AI and agentic AI outside its formal scope, describing them as too novel and fast-moving to regulate through a fixed rulebook.<\/p>\n

American banks are now governing their fastest-growing AI systems without a shared supervisory template, at exactly the moment those systems are scaling the most. Singapore has taken a third path: principles first, tooling second.<\/p>\n

The Monetary Authority of Singapore built its Fairness, Ethics, Accountability and Transparency principles back in 2018, then spent years turning them into the Veritas initiative, an open-source toolkit with shared fairness metrics and assessment methodologies.<\/p>\n

Its newer AI Risk Management Guidelines extend that proportional, full-lifecycle approach to generative and agentic AI directly. Set against these three, here is the eye-opener: RBI’s Draft Guidance chose to bring generative AI, RAG systems and autonomous agents inside the perimeter from the outset, rather than carving them out the way the world’s largest banking regulator did four months earlier.<\/p>\n

India is not playing catch-up here. On this specific point, it is ahead of the United States, and closer in spirit to Singapore’s inclusive, full-lifecycle stance than most coverage of the Draft Guidance has given it credit for.<\/p>\n

The Frontier RBI Now Has a Chance to Lead<\/b><\/span><\/h2>\n

Being broader in scope than the US and more inclusive than most peer frameworks puts India in a genuinely strong starting position. What happens next is where the real opportunity sits, and it is the same opportunity every regulator in this space is currently racing to seize, not a shortcoming unique to this draft.<\/p>\n

The first frontier is turning principle into a shared operating rhythm. Every framework we looked at, including RBI’s, eventually has to answer the same practical question: what does \u201cgoverned\u201d look like on a Tuesday afternoon, when a supervisor asks for evidence rather than intent? Singapore answered this by building a shared toolkit alongside its principles.<\/p>\n

RBI has the chance to do something similar for the Indian market, and given how many institutions across the sector would benefit from a common measurement layer for explanability and fairness rather than each building its own, this is a genuine opening rather than a gap to be filled defensively.<\/p>\n

The second frontier is workflow-level risk, and this is the newest and most interesting problem in AI governance globally, not a flaw in any one country’s drafting. A generative model drafting a credit memo that a human then approves inside a separate, older scoring model creates a risk pathway that belongs to neither system on its own.<\/p>\n

Researchers studying the US’s own SR 26-2 are actively building control frameworks to address exactly this, months after that guidance was finalised. RBI is drafting at a moment when this problem is already visible elsewhere, which means India has the rare advantage of designing for it directly rather than discovering it after the fact, the way other markets currently are.<\/p>\n

The third is timing and consequence, and here the opportunity is simply sequencing. The EU’s deadlines and enforcement structure show what the mature end state can look like once an ecosystem is ready for it. RBI has chosen, wisely in our view, to start from principles and proportionality rather than immediately importing that machinery.<\/p>\n

It is worth flagging now, while the draft is open for comment, that institutions will move faster and more confidently once a clear runway with defined milestones exists. That is a natural next step for the Guidance to build toward, not a missing piece today.<\/p>\n

Key Takeaways for CXOs and Decision-Makers<\/b><\/span><\/h2>\n