Model risk: Valves for the high bar

The draft Guidance on Regulatory Principles for Model Risk Management, released by the RBI on June 24, requires every bank, NBFC, and co-op lender to govern every model it uses, likely prompted by the imminent spread of AI models. It is comprehensive, earnest, and up-to-date: one more notch in the RBI’s push for technology adoption. It will also shape the course of AI adoption in Indian financial services, and possibly AI regulation in India more broadly. This makes its origins, intent, and likely outcomes, often at odds with intent, worth close scrutiny.

The draft’s lineage is easy to trace. The chassis is American: SR 11-7 of 2011, the Fed’s ur-text of model risk regulation, refreshed in April as SR 26-2. RBI, The possibly tracking it in near-real time, released its draft ten weeks later. The scope-expansion from credit models to everything, everywhere, all at once, is British, from the Bank of England’s SS1/23. The lifecycle architecture is Canadian, from the Office of the Superintendent of Financial Institutions’ (OSFI) Guideline E-23. And the kill switches, human-in-the-loop mandates, and bias audits descend from the EU’s AI Act, via the RBI’s own FREE-AI committee. As a survey of best practice, the draft is genuinely impressive; as regulation, it is furniture imported for a house not yet built.

Public reactions follow familiar lines: some hosannas, some angst born of a broad reading of the implications, and self-advertisements dressed up as opinion pieces from the compliance industry.

Under the draft, every model, from the credit-scoring engine down to the pricing spreadsheet Sharma-ji in the CFO’s office guards like a family heirloom, must go through the wringer. For an NBFC deploying a frontier LLM for customer service, the to-do list turns onerous fast: some items are demanding but doable, others induce a “huh” and are well-nigh impossible for a small organisation, e.g. validating the model, securing contractual rights to technical documentation and audit access, and ensuring no “unexplained variation under similar inputs”.

Beyond the difficulty of executing this list, the draft quietly assumes AI competence at every level of the organisation. This is a concerning assumption. The source regimes (the Fed, the Bank of England, OSFI) were built on doctoral-level quantitative talent: the Fed employs top PhDs, and the BoE confined its rules to a few sophisticated banks its specialist teams could engage with, and even they needed multi-year remediation plans. That depth of expertise is not available at the scale the draft demands, so the regime risks being supervised as paperwork and becoming paperwork. An examiner who cannot assess a validation substantively can only assess its documentation. Absent substantive change, the likely fix is consulting firms certifying everyone, at an avoidable systemic cost.

A deeper concern is the loss-facing pessimism running through the draft. The asymmetry is stark: AI-ML’s many benefits go undiscussed, while the rare error takes centre stage. That over-emphasis means boards and management start by asking what can go wrong, and adoption slows. Add the arithmetic of time: frontier models iterate in months, while a compliance journey measured in quarters must restart at every update, so by the time a model clears the framework, it has been superseded. Indian financial institutions thus risk falling permanently a generation or two behind, not because the frontier is unsafe for balance enquiries, but because we will never have the money or people to push new technology through these requirements. Rules, too costly to comply with, do not produce safety; they produce abstention, pretence, or paperwork.

The preceding is not to say the RBI is wrong to set the bar high. India’s NBFC sector has its own history of stress building quietly inside black-box underwriting, and much of the retail base this draft protects has little capacity to contest an algorithm’s decision. A regulator burned before has reason to prefer over-caution. The real question is not whether the bar should be high, but whether it can be met without a release valve.

The draft invokes the “Innovation over Restraint” sutra from its own FREE-AI committee, but it mostly operationalises the restraint. The source regimes built in valves, e.g. phased scoping in Britain, negligible-risk exemptions in Canada, sandboxes in Europe. We risk importing their obligations without any of their valves. That, more than any clause, is the real risk: not that a chatbot occasionally gets a fact wrong, but that a generation of Indian financial innovation gets quietly priced out before it is born. Capital and talent go where rules are workable; if compliance costs more than the technology is worth, institutions will simply wait and call it prudence. And that may not be consumer protection so much as a slow, unintended strangulation.

None of this argues for abandoning model risk regulation but only for a few valves in the pipes before the concrete sets: a proportionate carve-out for low-risk, non-decisioning uses like a customer service bot, along the lines Canada and Britain already allow; a regulatory sandbox, of the kind the RBI has itself run for fintech, letting institutions pilot frontier models under supervision rather than clear impossible validation upfront; and a shared national testing facility, perhaps at an IIT or under the RBI’s own Innovation Hub, so scarce PhDs validate once for many institutions instead of each pretending to validate alone.

Get even one or two of these into the final guidance, and the RBI can keep its hand exactly where it should be — on a kill switch poised over a malfunctioning model, not hovering over India’s AI future. There is still time to add the valves before the ink dries: let Sharma-ji guard his spreadsheet, and let the customer get through before midnight.

Nobody need worry that the switch, when pressed, turns off the lights in the wrong room.

Disclaimer: The views expressed are the author’s own and do not reflect the official policy or position of Financial Express.