Banks and other regulated entities (REs) must ensure that any artificial intelligence they deploy can be instantly overridden, suspended or deactivated through “kill-switch arrangements”, the Reserve Bank of India (RBI) has proposed.

The draft provides rules which would govern how banks, non-banking financial companies (NBFCs) and other financial institutions can develop, deploy and oversee models, including those for AI and machine-learning.

The RBI mandates banks and other REs to put in place a board-approved model risk management framework (MRMF) covering governance, model tiering, inventory, documentation, validation, approvals, monitoring, change management, business continuity and decommissioning.

While the board should be responsible for the oversight, the risk management committee would review high-risk models, monitor third-party and AI models, review model tiering at least annually and review reports of breaches or other material concerns.

Regulated entities must assess risk at both the individual model level and across the enterprise on an ongoing basis, the RBI said.

If risks are found to be ​excessive, lenders should take timely corrective ​steps, including enhanced controls, restrictions on use, remediation or ‌decommissioning ⁠of the model, and submit a report to the board's risk management committee, it added.

The RBI also said banks should ensure ​all models, ​including third-party ⁠models, are subject to independent validation.

As per the draft guidelines, REs should establish human oversight for AI models used in automated decision-making. 

For generative AI models that interface with customers or external users, ⁠additional cybersecurity controls should be implemented.

The RBI has invited stakeholders to submit comments until 24 July.