Technology is already involved in many of the decisions financial institutions make every day, from credit assessment and fraud detection to portfolio monitoring and risk management. AI and machine learning are now extending that role further, allowing institutions to process larger volumes of information and support increasingly complex decisions.
As these systems become more influential, however, institutions need to know what is driving those decisions, how reliably the underlying models are performing and where accountability sits when something goes wrong.
RBI’s draft Guidance on Regulatory Principles for Model Risk Management, 2026, released in June, addresses exactly this issue.
The draft covers traditional analytical models as well as AI and machine-learning systems. It proposes a governance framework across their entire lifecycle, from development and validation to deployment, monitoring, modification and eventual decommissioning.
The draft’s significance lies in its breadth. RBI is effectively asking financial institutions to understand not only whether a model works, but where it is being used, what it influences, who owns it and how its performance is being governed over time.
Model governance moves beyond the technology team
Under the proposed framework, regulated entities would need a Board-approved Model Risk Management Framework with defined responsibilities around model development, validation, monitoring and use.
RBI also proposes classifying models according to their risk. Materiality, complexity, explainability and potential customer impact are among the factors that could determine how much oversight a model requires.
Higher-risk models would receive greater scrutiny, including independent validation and involvement of the Risk Management Committee of the Board in reviewing validation reports and approving deployment.
That matters because models are no longer confined to specialist risk teams. As they become embedded across financial operations, model risk increasingly becomes an enterprise issue.
A model inventory could provide much-needed visibility
Another important proposal is the requirement for a central inventory covering active models, under development, and even those that have been decommissioned.
This might sound like another documentation requirement, but the underlying issue is quite practical.
Large financial institutions can have models operating across multiple functions and technology systems. Some consume outputs from other systems, some influence downstream workflows, and others may have been modified several times since they were first introduced.
Without a central view, understanding where models are being used and what they influence becomes increasingly difficult.
A model inventory gives institutions a way to establish that visibility. It also makes ownership clearer, which becomes particularly important as AI and automated decision-making spread across more business functions.
Third-party technology does not mean third-party accountability
One of the clearest messages in the draft concerns models supplied by external technology providers. If an institution buys or uses a model from a vendor, it still owns the risk.
RBI’s proposed framework makes it clear that regulated entities cannot outsource accountability simply because the underlying technology comes from a third party. Institutions would still need to independently validate these models and ensure they have sufficient technical documentation, auditability and oversight.
This has implications for technology providers as well.
A sophisticated model sitting inside a black box becomes much harder for a regulated institution to govern. Vendors serving financial institutions will increasingly need to think about documentation, traceability, validation support and audit trails alongside the performance of their technology.
That could ultimately create stronger relationships between financial institutions and technology providers because governance becomes part of the technology architecture rather than an exercise conducted after implementation.
AI still needs human judgement
RBI gives additional attention to AI and machine-learning models because their complexity and autonomy can create risks that are harder to identify through conventional controls.
The draft addresses explainability, bias, model drift and the level of reliance institutions place on automated outputs. It also expects appropriate human oversight, including the ability to override, suspend or deactivate models when required.
There is an important point here for the wider AI conversation. Governance does not have to slow adoption.
If an institution understands how a model is performing, what data it relies on, where its limitations lie and when human intervention is required, it can make a much more informed decision about where that technology can safely be deployed.
In financial services, that confidence matters just as much as technical capability.
Debt resolution is a good example
A debt resolution workflow generates an enormous amount of information through borrower conversations, payment history, contactability, commitments, field visits, notices, legal proceedings and eventual resolution outcomes.
There is an obvious opportunity to use models to make sense of that information.
They can potentially help institutions identify patterns across portfolios, prioritise accounts and determine where different interventions may be appropriate.
But if a financial institution is going to change its borrower engagement or resolution strategy based on an algorithmic recommendation, leadership also needs to understand why that recommendation was made.
Was it influenced by payment behaviour? Previous borrower interactions? Contactability? Portfolio history? Has the model continued to perform as expected? Can someone intervene when the recommendation does not make sense in the context of a particular case?
These questions become increasingly important as technology moves from simply digitising resolution workflows to influencing decisions within them.
The opportunity, therefore, is not simply to put more AI into debt resolution. It is to build systems where intelligence can be used without losing the context, traceability and human judgement required in a regulated financial environment.
Where this leaves financial institutions and technology providers
RBI’s draft reflects a broader change taking place across financial services.
The conversation around AI is gradually moving beyond experimentation and capability. Institutions are now considering what it takes to use these technologies reliably across real financial workflows and at much greater scale.
That requires more than sophisticated models.
Financial institutions will need visibility into where models operate and how they perform. Technology providers will need to make their systems easier to understand, validate and govern. And both sides will need to think about accountability before intelligent systems become deeply embedded in critical processes.
The consultation window for the draft closed in July 2026, and the final guidance is still awaited. The exact requirements may therefore evolve.
But the direction is already becoming clear.
The financial institutions that scale intelligent technology successfully will not simply have the smartest models. They will have the strongest understanding and control over how those models are used.