A draft regulation is not binding yet, but it is also not something to wait out. Most institutions that wait end up compressing a year of work into a few months once the final version lands. Rbi model risk management now spans two connected documents, the FREE-AI framework released in August 2025, and a draft guidance on model risk management released in June 2026 that explicitly covers AI and machine learning for the first time. This piece covers what each one actually requires and how to prepare before either is finalised further.

RBI model risk management: 

RBI model risk management currently rests on two instruments: the FREE-AI Framework, released 13 August 2025 with seven guiding Sutras and 26 recommendations across six pillars, and the draft Guidance on Regulatory Principles for Model Risk Management, 2026, released 24 June 2026, which is the first RBI guidance to explicitly cover AI and machine learning models across their full lifecycle. The draft guidance requires a board approved Model Risk Management Framework, risk based model tiering, independent validation, and treatment of third party and vendor supplied models with the same rigor as internally built ones. For banks and NBFCs, the practical message is that the core expectations are already clear enough to begin implementation now, since the draft is expected to supersede the RBI's 2002 Guidance Note on Credit Risk Management once finalised.

What does RBI expect for AI model risk?

Rbi model risk management expectations currently come from two separate but connected RBI publications, not a single finalised regulation. The rbi free-ai framework, formally the Framework for Responsible and Ethical Enablement of Artificial Intelligence, sets the strategic and ethical direction for AI adoption in financial services. It does not itself mandate specific technical controls.

The rbi model risk guidelines, formally the draft Guidance on Regulatory Principles for Model Risk Management, 2026, is the more technical instrument, covering governance, model validation, credit models, and lifecycle management for every model a regulated entity uses, whether built internally, sourced from a third party, or both. For a broader breakdown of what a complete model inventory should contain, see the model your inventory is likely missing, and the complete guide to AI compliance for financial institutions.

See Where Your Business Stands on AI Readiness

Why this matters now for Indian banks and NBFCs

Three developments make this an active priority rather than a future concern.

• The ethical framework already exists and sets real expectations. RBI's official press release on the FREE-AI Committee Report, dated 13 August 2025, confirms the framework's seven Sutras and 26 actionable recommendations across six strategic pillars, Infrastructure, Policy, Capacity, Governance, Protection and Assurance.

• The technical guidance is more specific, and the clock is already running. RBI's draft Guidance on Regulatory Principles for Model Risk Management, 2026, released 24 June 2026, requires a board-approved policy covering model taxonomy, governance structure, and risk tiering methodology, with the public comment period having closed 24 July 2026.

• This is the first RBI instrument to name AI and ML models directly. Unlike the 2002 Guidance Note on Credit Risk Management that it is intended to supersede, the 2026 draft explicitly states that outsourcing a model does not outsource its risk, meaning vendor supplied and embedded AI tools fall under the same oversight as internally built models.

See how this connects to a broader AI adoption plan in critical AI adoption roadmap and regulatory compliance for AI.

A five step framework to prepare now

Here is the sequence that gets a bank or NBFC ready for both instruments together, rather than treating them as separate projects.

1. Build a complete, living model inventory. Many NBFCs discover they run more models than they thought once chatbots, voice bots and generative AI customer interfaces are counted alongside credit scoring models. AI security and compliance services support institutions building this inventory directly.

2. Apply risk based model tiering. The draft guidance expects validation and oversight effort to scale with a model's materiality, with high risk models requiring Risk Management Committee of the Board approval specifically.

3. Get board approval for the Model Risk Management Framework itself. A data science policy alone will not satisfy this requirement, the framework needs to reach the board, not stop at a technical team.

4. Run independent model validation as a second line function, separate from the team that built the model. This applies equally to credit models built internally and to third party models where explainability may be limited by the vendor.

5. Document an audit trail and explainability evidence for every material model. Data integration consulting services help connect the underlying data so this evidence can be generated reliably, and Samta.ai's Veda platform and the Veda AI decision analytics product support this step directly, keeping model and validation data traceable across connected systems as the engineering execution layer once the framework itself is defined.

Comparing five RBI and global model risk instruments

Instrument	Binding status	AI and ML coverage	Key requirement	Best fit
2002 Guidance Note on Credit Risk Management, Chapter 3	Current legacy guidance	None, predates AI entirely	Basic credit model governance	Institutions yet to update, soon to be superseded
FREE-AI Framework, August 2025	Committee report, strategic direction	Strong on ethics, not technical controls	Seven Sutras guiding responsible AI adoption	Board level strategy and policy direction
Draft Guidance on Model Risk Management, 2026	Draft, consultation closed July 2026	Strong, explicit AI and ML and third party coverage	Board approved MRMF, risk tiering, independent validation	Banks and NBFCs preparing for the technical requirements directly
NIST AI Risk Management Framework	Voluntary global baseline	Strong, general purpose AI coverage	Govern, map, measure, manage functions	Institutions benchmarking beyond India specific requirements
Integrated platform supporting inventory, validation and monitoring together	Not regulatory, operational tooling	Strong, continuous	Automated evidence generation across the lifecycle	Enterprise and NBFCs scaling multiple AI models

The middle two rows are where most of the actual preparation work needs to happen right now. For a platform level comparison relevant to the operational layer, see Veda versus a general Data Intelligence Platform.

Get a Clear View of Your AI Model Risk Exposure

Real world use cases

Regulated bank: credit scoring model missing from the inventory

A bank's internal model inventory covered every model built by its own data science team but excluded a vendor supplied credit scoring tool embedded in a loan origination platform. Preparing for the draft guidance's requirements surfaced this gap directly, since the draft explicitly treats outsourced models with the same rigor as internal ones. Bringing the vendor model into the inventory, applying the same risk tiering and validation standard used internally, closed the gap well ahead of any formal examination. See related delivery patterns in Samta.ai's case studies.

General enterprise angle: NBFC with a black box scorecard and no explainability plan

An NBFC's machine learning credit scorecard performed well but could not explain individual decisions in terms a loan officer or a customer could understand. The draft guidance's expectation that models unable to fully explain themselves require enhanced validation, output verification and usage restrictions applied directly. Adding output verification and more frequent monitoring compensated for the model's limited explainability while the underlying model itself remained unchanged, a pragmatic fix rather than a full rebuild.

Key risks and failure modes

• Treating FREE-AI as sufficient compliance on its own. It sets ethical direction but does not itself specify the technical governance controls the draft guidance requires.

• Excluding vendor and third party AI from the model inventory. The draft guidance is explicit that outsourcing a model does not outsource its risk.

• Stopping model risk policy at the technical team level. The draft guidance requires board approval for the Model Risk Management Framework itself, not just departmental sign off.

• Applying uniform validation regardless of materiality. Risk based tiering is a core requirement, and treating every model identically wastes effort on low risk tools while under validating high risk ones.

• Assuming a black box model needs no further work. Limited explainability requires compensating controls, enhanced validation, output verification, and usage restrictions, not acceptance as is.

• Waiting for the final circular before starting. The core expectations are already clear enough to begin implementation now, and institutions that wait typically compress a year of preparation into a much shorter window once the final version is published.

When to start preparing, and what to prioritise

Start now if:

• You operate any credit, fraud or customer facing AI or machine learning model

• Your current model inventory may be incomplete, particularly around vendor supplied or embedded AI

• You have not yet secured board level approval for a model risk management framework

• You are an NBFC using chatbots, voice bots or generative AI customer interfaces without a documented governance plan

A lighter approach may work if:

• You operate very few models, all low materiality and fully internal

• You are early in AI adoption with no production deployment yet

• A recent independent review already confirmed alignment with both FREE-AI and the draft guidance

Related reading: scope a formal rbi ai gap assessment or model risk assessment india engagement before the final guidance lands, rather than after.

Let’s Find the Right AI Approach for Your Business

Conclusion

Waiting for RBI's draft guidance to become final before starting preparation is the single most common mistake institutions make with regulation like this. The core expectations are already clear enough to act on now. Build the inventory, tier by risk, get board approval, and validate independently. The next step is finding out honestly where your own framework stands against both instruments today.

About Samta

Samta.ai is a Singapore-headquartered AI Product Engineering & Data Intelligence partner helping enterprises build production-grade AI systems for regulated and data-intensive environments.We help organizations move beyond experimentation by engineering scalable, explainable, and enterprise-ready AI solutions from data foundations and model development to workflow automation and deployment.

Our capabilities combine deep AI expertise, data engineering, and product engineering to deliver measurable business impact across FinTech, BFSI, cybersecurity, regulatory technology, and enterprise operations.

Our enterprise AI products power real-world intelligence systems:

• TATVA : AI-driven data intelligence platform for governed analytics, monitoring, and operational insights

• VEDA : Explainable and audit-ready AI decisioning engine built for compliance-sensitive enterprise workflows

• CORA-Property Management Solutions: : Predictive intelligence platform for real-estate pricing, portfolio optimization, and investment analytics

Backed by ecosystem partnerships with Microsoft, Databricks, Snowflake, and AWS, Samta.ai delivers agile, cost-efficient AI engineering with faster turnaround and enterprise-grade scalability. Trusted by enterprises across FinTech, BFSI, and digital transformation initiatives, Samta.ai embeds AI governance, data privacy, and compliance-by-design principles directly into the AI lifecycle , enabling organizations to scale AI with transparency, accountability, and operational control. 

Enterprises leveraging Samta.ai automate 65%+ of repetitive data, analytics, and decision workflows while maintaining governance, explainability, and measurable business outcomes. Samta.ai provides the strategic consulting, AI engineering, and data modernization expertise needed to align enterprise operations with next-generation AI transformation goals.

Frequently asked questions

1. What does RBI expect for AI model risk?

   RBI expects a complete, living model inventory covering internal and third party AI and ML models, board approved model risk management policy, risk based tiering that scales validation effort to materiality, independent model validation separate from the development team, and documented explainability or compensating controls where a model cannot fully explain its own decisions. These expectations currently come from the FREE-AI Framework and the 2026 draft Guidance on Model Risk Management together.

2. Does RBI regulate AI models used by NBFCs?

   Yes, the draft Guidance on Regulatory Principles for Model Risk Management, 2026 applies across the full spectrum of regulated entities, explicitly including NBFC base layer, middle layer, upper layer and top layer categories. It covers AI and machine learning models used in credit underwriting, customer interaction and other business processes, treating vendor supplied models with the same governance rigor as internally built ones.

3. How should banks prepare for RBI AI guidance?

   Start with a complete model inventory, including vendor and third party AI systems, then apply risk based tiering to determine validation depth for each model. Secure board approval for the overall Model Risk Management Framework rather than stopping at a technical team's policy document, and build independent validation and audit trail documentation into the lifecycle rather than retrofitting it later.

4. Summarise RBI guidance on AI and model risk for NBFCs

   RBI's draft 2026 guidance requires NBFCs to maintain a board approved Model Risk Management Framework covering every model in use, apply risk based tiering with high risk models requiring Risk Management Committee of the Board approval, run independent validation as a second line function, and retain decommissioned models for ten or more years. Chatbots, voice bots and generative AI customer interfaces receive specific additional guardrails under the draft.

5. RBI AI governance checklist for banks

   A practical checklist covers five areas: a complete model inventory including third party AI, risk based tiering tied to materiality, board approval for the overall framework, independent validation separate from model development, and documented explainability or compensating controls for any model that cannot fully explain its decisions. Institutions should also track the FREE-AI Framework's seven Sutras as the ethical backdrop these technical controls sit within.