RBI Issues Draft Model Risk Management Guidance

The Reserve Bank of India (RBI) has issued the draft ‘Guidance on Regulatory Principles for Model Risk Management’. The draft guidance seeks to provide a structured framework for identifying, assessing, monitoring and managing risks arising from the use of models by regulated entities.

The guidance assumes significance in view of the increasing use of models, including those based on artificial intelligence and advanced analytics, in financial decision-making, risk management and customer-facing processes.

1. Applicability and Scope of the Guidance

The draft guidance outlines the applicability and scope of the proposed regulatory principles for model risk management.

It is intended to apply to models used by regulated entities for business, risk, compliance, operational and customer-related functions, depending on the nature, materiality and risk associated with such models.

2. Governance Role of the Board and Committees

The draft emphasises the role of the Board and its committees in overseeing model risk management.

The Board is expected to ensure that appropriate governance structures, policies and controls are in place for the development, approval, validation, deployment and monitoring of models.

3. Responsibilities of Senior Management

The draft also highlights the responsibilities of senior management in implementing the model risk management framework.

Senior management would be responsible for ensuring the proper allocation of responsibilities, effective internal controls, documentation, validation, and continuous monitoring of the models used by the regulated entity.

4. Models Employing Artificial Intelligence

The guidance specifically covers models employing artificial intelligence.

Given the complexity and opacity of AI-based models, the draft stresses the need for appropriate governance, explainability, validation, monitoring, and risk controls to prevent adverse outcomes.

5. Consumer Protection and Grievance Redressal

The draft guidance also addresses consumer protection and grievance redressal.

Regulated entities that use models for customer-related decisions would need to ensure fairness, transparency, and accountability, along with appropriate mechanisms for handling customer complaints and disputes arising from model-driven outcomes.

6. Business Continuity and Model Decommissioning

The draft covers requirements relating to business continuity management and model decommissioning.

Entities are expected to have appropriate processes to manage disruptions affecting model performance and to safely retire or replace models that are no longer fit for purpose.

7. Third-Party Models

The guidance also covers the use of third-party models.

Regulated entities would be required to ensure proper due diligence, oversight, validation, and risk management when models are developed, supplied, or operated by external service providers.

8. Risk-Based Model Tiering

The draft proposes a risk-based model tiering approach.

Under this approach, models may be classified based on factors such as complexity, materiality, business impact, customer impact and regulatory relevance. Higher-risk models would require stronger governance, validation and monitoring controls.

9. Comments Invited

RBI has invited comments and feedback from stakeholders on the draft guidance.

Comments may be submitted by July 24, 2026.

10. Objective of the Draft Guidance

The draft guidance aims to:

• Establish regulatory principles for model risk management;
• Strengthen governance over model development and deployment;
• Address risks arising from AI and advanced analytics models;
• Promote fairness, transparency and accountability in model-driven decisions;
• Ensure effective oversight of third-party models; and
• Support a risk-based approach to model validation and monitoring.

11. Key Takeaway

RBI has issued the draft ‘Guidance on Regulatory Principles for Model Risk Management’ covering model governance, Board and senior management responsibilities, AI-based models, consumer protection, grievance redressal, business continuity, model decommissioning, third-party models and risk-based model tiering. Stakeholders may submit comments on the draft by July 24, 2026.