RBI mandates kill switch for AI models as banks face sweeping new AI risk management rules

RBI Introduces Comprehensive AI Risk Management Framework for Financial Sector

The Reserve Bank of India has released a sweeping draft framework that will fundamentally reshape how banks and financial institutions deploy and manage artificial intelligence systems. The draft Guidance on Regulatory Principles for Model Risk Management, 2026, released for public consultation on Wednesday, mandates that all regulated entities must have the ability to instantly override, suspend or deactivate any AI model through kill switch arrangements 1

1

. This requirement ensures that no AI system can operate without the capability to be immediately shut down if it produces harmful or erroneous outputs. Stakeholders have until July 24, 2026, to submit comments on the proposed RBI AI guidelines 2

2

.

Kill Switch for AI Models and Mandatory Human Oversight Requirements

The RBI draft framework for AI establishes stringent requirements for human oversight for AI across all automated decision-making systems. Regulated entities must implement human-in-command mechanisms, including human-in-the-loop or human-on-the-loop oversight arrangements 2

2

. The framework specifically addresses automation bias—the tendency of bank employees to over-rely on AI outputs without applying independent judgment. Personnel responsible for overseeing AI systems must possess sufficient expertise to effectively challenge, override, or escalate concerns in model outputs where required. For customer-facing AI systems, banks must disclose to customers that they are interacting with an AI system and provide them with the option to switch to a human at any point 1

1

. The Reserve Bank of India has also mandated periodic human review of model outputs and AI-driven decisions to identify anomalies, with regular reviews of human interventions, overrides, incidents and near misses.

Board-Level Accountability and Risk-Based Model Classification

For the first time, AI governance in banking is being placed squarely at the board level. Every regulated entity must establish a board-approved model risk management framework covering all models—whether built internally, sourced from vendors, or a combination 1

1

. The board is responsible for approving the entity's risk appetite for model risk and setting policies for risk classification. The framework introduces a risk-based tiering structure requiring regulated entities to classify all models—from simple spreadsheet-based calculators to complex frontier AI systems—by their risk level, and apply proportionate oversight accordingly 1

1

. High-risk models require approval from the Risk Management Committee of the Board before deployment and cannot be cleared by technology or risk teams alone. The risk tier of a model must be reviewed at least annually, with AI models assessed based on the extent of reliance and level of autonomy placed on model outputs for decision-making 2

2

.

Strict Controls on Third-Party AI Vendors and Supply Chain Risks

The draft guidelines take a particularly firm stance on third-party AI vendors and externally sourced AI models in financial sector. A regulated entity remains fully accountable for the outcomes of any model it uses, regardless of whether it built the model itself or acquired it from outside 1

1

. The RBI has specifically flagged supply chain risk—the risk arising from over-dependence on a limited number of AI model providers—as a concern that banks must actively manage. This represents a pointed reference to the growing concentration of AI capabilities in a handful of global technology companies. For material third-party AI models, datasets and dependencies, regulated entities should consider risks arising from dependence on a limited number of providers, limitations in independently validating models, and behavioral changes resulting from provider-driven updates 2

2

. Banks must ensure all models, including third-party models, are subject to independent validation 3

3

.

Model Explainability and Enhanced Cybersecurity for Generative AI

The RBI has introduced specific requirements for model explainability that go beyond conventional model validation. Banks must define explainability thresholds for all AI models—the ability to explain, in understandable terms, why a model produced a particular output 1

1

. Models relied upon for material decision-making or having significant impact on customers or operations should meet higher explainability standards 2

2

. For generative AI models that interface with customers or external users, additional cybersecurity controls must be implemented 3

3

. The guidelines apply to commercial banks, small finance banks, payments banks, local area banks, co-operative banks, regional rural banks, NBFCs, all-India financial institutions, asset reconstruction companies and credit information companies 2

2

. If risks are found to be excessive, lenders should take timely corrective steps, including enhanced controls, restrictions on use, remediation or decommissioning of the model, and submit a report to the board's risk management committee 3

3

.