RBI Draft Rules: Banks, NBFCs Liable for AI Use, Third-Party Models No Defence

The Reserve Bank of India has proposed a new set of draft regulations that put the onus of artificial intelligence-driven decisions squarely on banks and non-banking financial companies. Under the proposed framework, lenders cannot escape liability by blaming third-party AI models or vendors.

The draft rules, published on Tuesday, require all regulated entities to ensure their AI systems are transparent, fair, and explainable. The move signals a hardening of the regulator's stance on algorithmic accountability in the financial sector.

Full Liability on Regulated Entities

The RBI's draft makes it clear that the ultimate responsibility for any AI-driven action lies with the bank or NBFC, not with the technology provider. This includes decisions related to credit scoring, loan approvals, fraud detection, and customer risk assessment.

If an AI model makes a biased or erroneous decision, the regulated entity cannot claim ignorance or point to the third-party model as a defence. The regulator expects lenders to have complete oversight of the algorithms they deploy.

Officials have not yet confirmed whether the final rules will include penalties for non-compliance.

Transparency and Explainability Requirements

The draft mandates that all AI models used by banks and NBFCs must be explainable. This means that when a customer is denied a loan or faces a higher interest rate, the lender must be able to articulate precisely why the AI reached that conclusion.

Banks will also need to document the data sets used to train their models, the logic behind the algorithms, and any testing conducted to detect bias. The RBI has indicated it may conduct audits of AI systems during its regular inspections.

The rules apply to both in-house developed models and those procured from external vendors.

Third-Party Models Under Scrutiny

Many Indian banks rely on AI models built by fintech firms and global technology companies. The RBI's draft rules remove any ambiguity about who bears the risk when these models malfunction.

Regulated entities must now conduct independent validation of third-party AI models before deployment. They must also ensure that vendor contracts include clauses allowing full access to model details, training data, and performance metrics.

Industry watchers say this could increase compliance costs for smaller NBFCs that lack in-house AI expertise.

Public Consultation and Next Steps

The RBI has invited comments from stakeholders on the draft rules. The deadline for submissions is August 24, 2026. After that, the central bank will review feedback and issue the final circular.

Banking associations are expected to seek clarifications on the scope of the rules, particularly regarding legacy systems and low-risk AI applications.

The final guidelines will likely reshape how Indian financial institutions adopt and manage artificial intelligence, shifting the compliance burden firmly onto their own desks.