RBI Draft Guidance on Model Risk Management - Perspective 2 of 6

 Published 08 July 2026.

Beyond Principles: Seven Operational AI Risks Every Bank Should Prepare For

From Governance Principles to Operational Readiness.

Author: Nayakanti Prashant

3rd Gen Banker & Citizen Lobbyist – Bengaluru

Advocating Digital Transactions Day (April 11)

________________________________________

Estimated Reading Time

5 Minutes

Disclaimer: These are the author's personal reflections intended to contribute constructively to the RBI's public consultation.

The ultimate destination is April 11 – Digital Transactions Day. Any, my journey towards the final submission to RBI on this public consultation will assist in a more smoother journey.

The Scope 

 

"An RE should define the scope of AI / ML model, including for foundational AI models and frontier AI models, and put in place additional controls, commensurate with its potential impact on customers, business operations, and financial outcomes."

 

— Reserve Bank of India

Guidance on Regulatory Principles for Model Risk Management, 2026, Chapter V, Paragraph 49.

 

"Good governance is measured not when systems perform normally, but when they behave unexpectedly."

— Nayakanti Prashant

________________________________________

Opening Scene: When Everything Appears to Work

It is a typical Monday morning.

Across India's banking ecosystem, millions of digital transactions begin flowing seamlessly.

There is immense variety in our banking ecosystem.

A customer completes a UPI payment.

A Business Correspondent serves a customer through an Aadhaar Enabled Payment System (AEPS).

An AI-powered virtual assistant responds to customer queries while silently escalating complex requests to human officers.

Everything appears normal.

Yet behind these routine interactions, hundreds of models continuously support operational decisions—detecting fraud, assessing risk, monitoring liquidity, identifying cyber threats, prioritising alerts, and assisting customer service.

Most perform exactly as expected.

That is precisely why operational risk often remains invisible.

Models rarely fail without warning.

Instead, risks emerge gradually.

Customer behaviour changes.

 

Fraud patterns evolve.

Data drifts.

External dependencies change.

Performance slowly diverges from the conditions under which a model was originally validated.

 

By the time these changes become visible, operational consequences may already be affecting customers and institutions.

This is where the Reserve Bank of India's Draft Guidance on Model Risk Management assumes particular significance.

Its focus extends beyond developing intelligent models.

It emphasises operating them responsibly throughout their lifecycle.

The next phase of AI adoption in banking will therefore be defined not simply by better technology, but by stronger operational governance.

That is the perspective explored in this article.

📌 Perspective Snapshot

Beyond Principles: Seven Operational AI Risks Every Bank Should Prepare For

 

As Artificial Intelligence becomes increasingly integrated into banking, governance must move beyond broad principles to everyday operational discipline.

 

The RBI's Draft Guidance encourages regulated entities to prepare not only for technological advancement, but also for the operational realities that accompany it.

 

Seven operational risks deserve particular attention.

**1. Model Drift** 

Models gradually lose effectiveness as customer behaviour, fraud patterns, economic conditions, and underlying data evolve.

**2. Third-Party Dependencies** 

Banks may rely on external AI providers, cloud platforms, or foundation models, but accountability for outcomes always remains with the regulated entity.

**3. Explainability** 

Material banking decisions should remain understandable, reviewable, and capable of being explained to customers, auditors, regulators, and internal governance teams.

**4. Hallucinations and Behavioural Risks** 

Generative AI systems may occasionally produce inaccurate or misleading outputs. Appropriate safeguards become essential wherever such systems influence customer interactions or business decisions.

Humans should be able to sense as to when the AI system is hallucinating and able to put across to other humans, this AI behaviour.

 

 

**5. Automation Bias** 

Human judgement should complement intelligent systems, not quietly disappear because technology appears confident.

**6. Operational Resilience** 

Responsible institutions prepare for situations where critical models become unavailable, unreliable, degraded, or require immediate suspension.

**7. Governance at Scale** 

Managing one model is relatively straightforward. Governing hundreds of interconnected models across business functions requires disciplined oversight, validation, documentation, and continuous monitoring.

These seven risks are not barriers to innovation.

They are the operational disciplines that enable innovation to remain trustworthy, resilient, and sustainable.

________________________________________

Why These Seven Risks Matter

 

One of the strengths of the RBI's Draft Guidance is its principles-based approach.

 

Rather than prescribing detailed technical solutions for every emerging technology, it establishes governance expectations that remain relevant even as Artificial Intelligence continues to evolve.

The responsibility therefore shifts to regulated entities.

Each institution must translate these principles into operational practices suited to its own scale, business model, customer profile, and risk appetite.

These seven risks are not intended to be an exhaustive checklist.

They are practical reflections on the operational realities that banks are increasingly likely to encounter as AI adoption accelerates across India's banking and digital payments ecosystem.

Responsible AI governance is not achieved by deploying intelligent models.

It is achieved by operating them responsibly—every single day.

Beyond Technology: Thinking Like a Banker

 

Perhaps the most significant contribution of the RBI's Draft Guidance is that it places Artificial Intelligence within the broader discipline of Model Risk Management.

Technology will continue to evolve.

New algorithms, new foundation models, and new business applications will emerge.

Good governance principles, however, remain remarkably consistent.

 

Every material model should have a clearly defined purpose.

Every model should be appropriately validated.

Every model should be continuously monitored.

Every model should remain subject to meaningful human accountability throughout its lifecycle.

For bankers, the conversation is therefore no longer about whether Artificial Intelligence should be adopted.

The more important question is:

**"How do we operate intelligent systems responsibly, consistently, and safely over time?"**

 

The answer lies not in any single technology, but in disciplined governance embedded across the institution.

Operational preparedness is no longer merely a compliance expectation.

It is rapidly becoming a strategic capability.

A Continuing Journey

 

The purpose of identifying these seven operational risks is not to predict failure, but to encourage preparedness.

Every technological transformation creates new opportunities alongside new responsibilities.

The institutions that succeed will not necessarily be those deploying the most advanced Artificial Intelligence models.

 

They will be those building the strongest governance cultures around them.

Responsible innovation is sustained not by technology alone, but by governance that remains resilient, accountable, and worthy of public trust.

________________________________________

Digital Transactions Day Reflection

Every successful digital transaction represents far more than speed or convenience.

It reflects confidence in the systems, institutions, and governance that quietly support every payment, lending decision, and customer interaction.

As Artificial Intelligence and analytical models become increasingly embedded within India's banking ecosystem, responsible operational governance becomes a natural extension of digital trust.

These reflections are also shared in support of the proposed observance of **April 11 – Digital Transactions Day**, commemorating the launch of the Unified Payments Interface (UPI) pilot in 2016. The proposal seeks to encourage greater public awareness of secure, inclusive, resilient, and trustworthy digital transactions.

Author's Perspective

 

This series is written from the perspective of a banking practitioner rather than an AI technologist. 

Its purpose is not to advance Artificial Intelligence as a discipline, but to explore how AI and other material models can be governed responsibly within India's banking and digital payments ecosystem. 

These observations are offered as constructive reflections supporting the RBI's public consultation.

---

The Joy of Digital Transactions

Nayakanti Prashant
3rd Gen Banker & Citizen Lobbyist – Bengaluru
Advocating Digital Transactions Day (April 11)

 

Author’s Blogs

https://prashantrandomthoughts.blogspot.com
https://prashantnepayments.blogspot.com
https://innovationinbanking.blogspot.com