RBI’s draft Guidance on Regulatory Principles for Model Risk Management, 2026, released on 24 June 2026, defines a model broadly enough to include rule engines, scoring algorithms and material spreadsheets, not only AI. Every regulated entity would need a board-approved model risk management framework covering all of them.
Most credit teams read “model risk” and think of the machine learning scorecard. The draft reads wider than that. If a thing takes inputs, applies a method and produces an output that a lending decision relies on, it is in scope, and the entity is accountable for its outcome whether it built the thing, bought it or assembled it from both.
The question the draft asks is not “is it AI?” It is “does a customer outcome depend on it?” For most Indian lenders, the honest answer includes the rules engine nobody has validated since go-live.
Who it covers
The draft applies across the regulated universe, including commercial banks, small finance banks, payments banks, co-operative banks, NBFCs, All India Financial Institutions, asset reconstruction companies and credit information companies. It applies to all models those entities use, including third-party models and models employing AI or machine learning.
The accountability point is the one to read twice. A regulated entity remains accountable for the outcomes of the models it uses, regardless of whether a model was developed internally, sourced from a third party, or a combination of the two. A vendor’s scorecard is the lender’s model risk.
What now counts as a model
| In scope | Commonly assumed out of scope, but not |
|---|---|
| AI and machine learning models, including generative AI | The business rules engine that approves, declines and prices |
| Statistical credit scorecards and PD/LGD models | Scoring algorithms embedded in the LOS |
| Fraud detection and AML transaction monitoring models | Material spreadsheets that influence lending rates or customer pricing |
| Collections propensity and early-warning models | Third-party models bought as part of a platform |
Two obligations follow directly from that breadth.
A model inventory. The entity maintains an accurate, comprehensive and current inventory of all active, inactive and decommissioned models, including those under development, supporting enterprise-wide reporting and showing interdependencies. No model may be used, relied upon or deployed unless it is in the inventory. For a lender whose rules engine has been changed weekly for three years by whoever had access, building that inventory is the project.
Risk tiering. Models are classified by business importance, customer and financial impact, complexity, explainability and regulatory significance, arriving at a composite risk tier. Higher-risk models attract more rigorous validation, closer monitoring and approval by the Risk Management Committee of the Board. For AI models, tiering additionally considers the degree of reliance on the output and the level of autonomy given to it.
The governance the draft expects
- A board-approved Model Risk Management Framework (MRMF) covering governance structures, documentation standards, business continuity and risk policy across the whole model lifecycle.
- The Risk Management Committee of the Board supervising implementation, approving high-risk models, reviewing validation reports, monitoring AI and third-party models and examining significant breaches.
- Named ownership. Every model has an identified business owner with defined responsibilities and documentation behind it.
- Independent validation, separate from the people who built the model, under a three-lines-of-defence structure.
- Human oversight designed against automation bias. The draft is explicit that oversight should account for over-reliance on model outputs and decision fatigue, and that the people doing it must understand the model well enough to challenge, override or escalate.
- Concentration and supply-chain risk for material third-party AI models, datasets and dependencies, including limits on independent validation and provider-driven changes in model behaviour.
- Customer disclosure where decisions are AI-driven, and the ability to deactivate a model when required.
This sits on top of the RBI’s FREE-AI framework, the Committee on the Framework for Responsible and Ethical Enablement of Artificial Intelligence, released on 13 August 2025 with seven guiding principles and 26 recommendations across six pillars. FREE-AI is a committee report, not a directive. The model risk draft is the mechanism by which several of its ideas become supervisory expectation.
Why the rules engine is the hard part
A scorecard is easy to inventory. It has a version, a build date, a documented method and someone who owns it. A rules engine usually has none of that, because it was never treated as a model:
- No version history that means anything. A rule changed in production on a Tuesday, by a person nobody recorded, is a model change with no change record.
- No backtest. The rule was reasoned about in a meeting and shipped. Nobody ran it against the existing book to see what it would have done.
- No reason codes on declines. A decision that cannot explain itself cannot be validated, and cannot be defended to a customer or an ombudsman.
- No replay. Asked why a specific applicant was declined eighteen months ago, the team can re-run today’s rules on today’s bureau data, which answers a different question.
- Rules that have quietly become a model. Two hundred interacting rules with thresholds tuned on observed outcomes behave like a model, whatever the architecture diagram says.
A rules engine is more explainable than a neural network and usually less governed. The draft closes that gap by refusing to distinguish between them.
What a credit team can do before the final Guidance lands
- Inventory everything that decides. Rules engine, scorecards, pricing sheets, fraud rules, collections propensity, vendor models inside the platform. Count them before you govern them.
- Tier them honestly. Anything that can decline an applicant or set a price is high impact, whatever its technical simplicity.
- Name an owner per model, with documentation attached.
- Separate build from validation. If the person who writes the rule signs it off, there is no second line.
- Make every decision replayable against the inputs and the rule version as they stood at the time, not as they stand now.
- Ask vendors for what you will be accountable for: version control, validation evidence, change notification and the right to audit.
How Trustt’s decisioning is built
Trustt’s business rules engine was designed around the properties this draft asks for. It evaluates 200+ variables across six families and approves, prices and structures a loan in about five seconds, with reason codes on every decision including declines. Rules are authored in plain language by the credit team, compiled, backtested on the lender’s own book, A/B tested on live traffic and shipped the same day, with author and approver on record and one-action rollback. Every decision is replayable against the frozen state it was made on.
Read that against the draft’s requirements and the mapping is close to one-to-one: named authorship and approval is model ownership; backtesting and A/B on live traffic is pre-deployment validation and monitoring; reason codes are explainability; one-action rollback is the deactivation capability; and replay against frozen state is what makes an eighteen-month-old decision auditable rather than reconstructed. For the basics of what a BRE does, see BRE full form: what a business rules engine does in lending.
The same discipline runs through the lending platform, where every field carries its source, timestamp and confidence, and through AI Banking Agents, where facts are fetched live from the knowledge base and LMS and source-tagged, high-risk lines use locked, legally reviewed scripts rather than generated language, and every agent action is logged and replayable for seven years. Agents go through shadow mode, A/B and regression testing before go-live, which is the operational shape of pre-deployment validation.
We have written before about why AI credit decisions in India stall at sign-off. The draft Guidance is, in effect, the regulator describing the sign-off.
If you cannot replay a decline from eighteen months ago against the rules as they stood that day, talk to a Trustt specialist.
Frequently asked questions
What is RBI’s model risk management guidance?
On 24 June 2026 the RBI released a draft Guidance on Regulatory Principles for Model Risk Management, 2026, setting out expectations for how regulated entities govern the models they use across the model lifecycle. It covers all models, including third-party models and those using AI or machine learning. Comments closed on 24 July 2026.
Is the RBI model risk management guidance final?
It was issued as a draft for public consultation, with comments closing on 24 July 2026. On finalisation it is intended to supersede Chapter 3 on credit risk models of the RBI’s Guidance Note on Credit Risk Management dated 12 October 2002. Lenders should check the RBI website for the current status.
Does a business rules engine count as a model?
Under the draft, the definition of a model is broad enough to cover rule engines, scoring algorithms and material spreadsheets that influence business decisions such as lending rates or customer pricing, not only AI and machine learning systems. If a credit outcome depends on it, treat it as in scope.
What is a Model Risk Management Framework (MRMF)?
A board-approved framework covering governance structures, documentation standards, business continuity arrangements and risk management policies for the entire lifecycle of every model an entity uses. The Risk Management Committee of the Board supervises implementation and approves high-risk models.
Who is accountable for a third-party or vendor model?
The regulated entity. The draft is explicit that entities remain accountable for model outcomes whether a model is built internally, sourced from a third party or a combination. For material third-party AI models it also asks entities to consider provider concentration, supply-chain risk and provider-driven changes in behaviour.
What is a model inventory and why does it matter?
A current, comprehensive record of all active, inactive and decommissioned models, including those under development, showing interdependencies and supporting enterprise reporting. Under the draft, no model may be used, relied upon or deployed unless it appears in the inventory, which makes it the first thing to build.
How does this relate to RBI’s FREE-AI framework?
FREE-AI, released on 13 August 2025, is a committee report with seven guiding principles and 26 recommendations across six pillars. It is not binding. The model risk draft is the route by which several of its expectations, particularly on governance, explainability and third-party accountability, reach regulated entities as supervisory expectation.
What is the difference between a rules engine and a machine learning model for compliance purposes?
Technically, a rules engine applies conditions authored by people, while an ML model infers them from data. Under the draft, the distinction does not exempt either. Both need an owner, a tier, documentation, independent validation, monitoring and a place in the inventory.
Technology you can bank on!
Researched and drafted with AI assistance under editorial review by Gautam Bandyopadhyay.
Sources
- RBI issues draft ‘Guidance on Regulatory Principles for Model Risk Management’, RBI press release, 24 June 2026
- Report of the Committee on the Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector, RBI, 13 August 2025
