RBI drafts AI kill switch rules for banks

The Reserve Bank of India's draft guidelines mark a significant shift by elevating AI and model risk management from operational functions to explicit board-level accountability, mandating banks to implement a Board-approved Model Risk Management Framework (MRMF) that governs the entire lifecycle of AI and analytical models. This comprehensive framework requires banks to maintain an exhaustive inventory of all models—active, inactive, and retired—with records preserved for at least 10 years, ensuring transparency and long-term compliance. By early 2026, these measures underscore the RBI's commitment to embedding governance and risk oversight at the highest organizational levels, reinforcing that board members are ultimately responsible for AI model outcomes and risks.

To bolster governance and compliance, the RBI mandates the establishment or strengthening of independent validation functions that are distinctly separated from AI developers and users, ensuring unbiased assessment of model performance and risks. This independent validation is not a one-time checkpoint but a continuous process required before deployment, after any material modifications, and at regular intervals thereafter. Such rigorous validation protocols extend to third-party AI models as well, with banks retaining full accountability and facing enhanced contractual and oversight demands to manage vendor-related risks effectively.

Recognizing the heightened risks posed by AI in banking, the RBI's framework requires that high-risk AI models receive explicit approval from the board's risk management committee prior to deployment, thereby embedding risk governance directly into board deliberations. Complementing this, the guidelines introduce AI-specific controls such as mandatory 'kill switches' for instant model override, robust human oversight mechanisms, and mandatory customer disclosures to address operational challenges like bias, hallucinations, and adversarial attacks. These provisions collectively aim to safeguard customers and maintain trust while ensuring that boards remain actively engaged in overseeing AI-driven decision-making processes.

The Reserve Bank of India’s draft guidelines mark a pivotal shift by mandating AI-specific operational controls such as mandatory 'kill switches'—emergency override mechanisms enabling banks to instantly deactivate AI systems producing harmful or erroneous outputs. These controls are complemented by robust human oversight frameworks, including human-in-the-loop arrangements and explainability standards, designed to counter automation bias and ensure transparency in AI-driven decisions. For customer-facing AI applications like chatbots and robo-advisors, the guidelines require clear disclosures about AI involvement and seamless options for customers to switch to human representatives, thereby enhancing trust and safeguarding consumer interests.

Recognizing the limitations of traditional human-in-the-loop safety assumptions, especially for increasingly autonomous agentic AI models, regulators such as the Bank of England are exploring more deterministic fallback mechanisms and market-wide 'kill switches' akin to circuit breakers to prevent systemic disruptions. This evolving governance paradigm emphasizes the need for sophisticated incident response capabilities, including cross-firm dependency mapping and the ability for one bank to temporarily assume another’s critical functions during AI-driven operational failures, highlighting correlated-failure scenarios as a primary design constraint rather than an edge case.

The RBI’s framework also underscores the necessity for embedding AI risk management throughout the entire model lifecycle—from design and testing to deployment and continuous monitoring—rather than relying solely on post-deployment controls. This lifecycle approach ensures that employees overseeing AI systems possess sufficient technical expertise to critically evaluate outputs and escalate concerns, thereby strengthening incident response readiness. Moreover, the framework mandates comprehensive AI inventories, including third-party vendor systems, to enhance transparency and regulatory reporting, addressing alarming gaps highlighted by a Wolters Kluwer survey where 72% of US banks admitted they could not confirm the ability to shut down malfunctioning AI models or report failures promptly.

Continuous risk management in Indian banking AI governance demands rigorous, ongoing oversight beyond initial deployment, as highlighted by RBI’s draft guidelines mandating independent validation before deployment, after material changes, and at periodic intervals to ensure reliability and compliance. This lifecycle governance approach, championed by experts like Swapna Bapat, embeds risk management proactively from design through monitoring, reflecting a shift from one-off approvals to continuous testing and validation essential for operational resilience in production environments where AI directly impacts real users and workflows.

The rapid evolution of generative and agentic AI models presents unique governance challenges that traditional pre-deployment validation cannot address, necessitating flexible, adaptive risk frameworks. As SR 26-2 guidance notes, these novel AI tools require continuous monitoring and real-time interaction with subject matter experts to refine decision logic, exemplified by Yoav Naveh’s two-loop oversight model that ensures agentic AI remains compliant, self-correcting, and auditable amid shifting inputs and autonomous workflows.

Indian banks face a critical governance gap between informal, unapproved AI tool usage and rigorous oversight, underscoring the need for comprehensive lifecycle governance that includes weekly tracking of performance metrics and error rates to detect when AI solutions fail to deliver incremental improvements. This continuous monitoring, combined with maintaining detailed inventories of all AI models—including inactive and retired ones preserved for at least a decade—supports accountability and regulatory compliance in an environment where AI systems like NBFC underwriting engines have become core operational infrastructure.

Given the limitations of traditional explainability tools like LIME and SHAP for complex adaptive AI such as deep neural networks and agentic AI, Indian banks must adopt new governance strategies that prioritize auditable, reliable AI behavior at scale. This entails a flexible risk management approach that evolves alongside AI capabilities and autonomy, ensuring that operational resilience and regulatory compliance are maintained across thousands of daily decisions, with leadership defining clear ownership and accountability frameworks that influence build-versus-buy decisions more than technology choice itself.