The Reserve Bank of India has released a sweeping draft framework on Model Risk Management that mandates stringent controls for banks using artificial intelligence. According to The Economic Times, the framework requires banks to have the ability to instantly override, suspend or deactivate any AI model deployed in their operations, including kill switch arrangements to ensure immediate shutdown if harmful or erroneous outputs occur. The draft guidelines call for robust human oversight of all AI-driven decision-making and establish a risk-based tiering structure requiring regulated entities to classify all models by risk level with proportionate oversight, validation and controls. High-risk models require approval from the Risk Management Committee of the Board before deployment, with the risk tier of models reviewed at least annually. The RBI has now invited feedback on the draft guidelines by July 24, 2026, as reported by The Hindu BusinessLine.
The Reserve Bank of India has mandated that banks and regulated entities complete board-approved gap assessments and formulate time-bound action plans by end-June to address frontier AI model risks. As reported by The Economic Times, the central bank's advisory follows growing concerns about models like Claude Mythos, which can detect zero-day vulnerabilities in packaged software, scan networks at unprecedented speed, and autonomously probe security perimeters. The RBI's latest draft guidelines require banks to establish board-approved Model Risk Management Framework (MRMF) covering all models, including AI and machine learning applications, according to the draft Guidance on Regulatory Principles for Model Risk Management released on Wednesday. Regulated entities must assess risk at both the individual model level and across the enterprise on an ongoing basis, with the central bank stating that if risks are found to be excessive, lenders should take timely corrective steps, including enhanced controls, restrictions on use, remediation or decommissioning of the model, and submit a report to the board's risk management committee. The framework introduces board-level accountability for AI governance with specific requirements for disclosure of AI use to customers and management of risks associated with third-party AI providers.
Western intelligence agencies have issued a stark warning that AI cyber threats are months, not years, away from becoming a reality. The Five Eyes intelligence alliance - comprising Australia, the US, the UK, New Zealand and Canada - released a report stating that frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The warning comes after US President Donald Trump blocked foreign nationals from using Anthropic's latest AI models Fable 5 and Mythos 5 in June, prompting the AI company to shut down these models. As reported by Euronews, the agencies emphasized that "the rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years," urging immediate action and adaptation to evolving threats. The report specifically warned that "unnecessary internet connectivity, weak identity and access controls, a lack of planning by organisations, legacy systems and sluggish patching loops are the weaknesses that AI will exploit."
Indian banks are implementing a comprehensive four-pillar cybersecurity strategy to counter emerging threats from advanced AI models. According to reports from The Economic Times, the framework focuses on code and identity protection, AI-driven threat detection, micro-segmentation, and zero-trust architecture. This strategic approach aims to defend against AI models capable of autonomously identifying software vulnerabilities, representing a qualitatively different threat from conventional cyberattacks. The urgency is underscored by intelligence warnings that "the timeline is not years, it is months," as reported by the Five Eyes agencies. The agencies advised that "success will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy," warning that "those that do not will face growing operational and strategic disadvantage."
Banks have proposed deploying advanced AI models to proactively identify and patch vulnerabilities in their own systems as part of their defensive approach. According to The Economic Times, this strategy involves using AI technology to detect and address potential security weaknesses before they can be exploited by malicious actors. The plans emphasize reducing dependence on third-party vendors while maintaining greater control over critical software infrastructure. The RBI's latest guidelines require banks to establish human oversight for AI models used in automated decision-making, with additional cybersecurity controls implemented for generative AI models that interface with customers or external users. For customer-facing AI systems, including generative AI applications, the RBI has proposed additional cybersecurity safeguards such as protection against prompt-injection attacks and adversarial inputs, limits on session and context persistence, and mechanisms to detect anomalous usage patterns. The framework also requires regulated entities to inform users when they are interacting with an AI-based system, disclose the limitations of such systems, and provide an option to switch to human assistance upon request.
