Introduction
Banks have long been expected to justify their credit and risk decisions to the customer, to the board and to the regulator. That expectation sits uneasily with the direction in which artificial intelligence is being adopted in the sector. A recent global study, Why AI at Scale Needs Governance at Speed, prepared by FT Longitude with SAS and Microsoft on the basis of a survey of 300 banking leaders across 31 countries.
Further records that a majority of respondents would accept a model they cannot fully explain if it performs better, while only a small minority report AI governance that is fully operational. The findings have drawn attention on professional networks for the question they leave open. If a bank cannot explain an AI decision, cannot control its execution, and cannot vouch for the data underneath it, on what footing can it claim to be accountable?
Growing AI Adoption and Gaps in Governance
The study highlights the growing reliance on AI in banking, particularly in credit and risk management, while raising concerns about the institutions’ ability to govern its use. A significant proportion of banking leaders are willing to adopt black-box models, which offer limited transparency into their decision-making, if they deliver better performance, returns or liquidity than explainable alternatives.
However, many institutions continue to lack adequate mechanisms to monitor model behaviour, intervene when models exceed prescribed limits or deactivate them when necessary. The study also indicates that AI is already embedded in several credit risk processes, making these concerns relevant to existing banking operations rather than merely future developments. This reflects a widening gap between the adoption of AI in critical banking functions and the ability of institutions to explain, monitor and control the decisions made by these systems.
Accountability Requires Explainability, Control and Reliable Data
Accountability in a regulated institution is not satisfied by showing that a decision was efficient. It requires the institution to be able to do three things: to explain why a decision was taken, to intervene when the system behaves outside its limits, and to establish that the data on which the decision rested was reliable. The study’s findings map onto each of these. A black-box model weakens the first capacity, because the reasons for an outcome cannot be reconstructed for a customer, an auditor or a supervisor.
The absence of a kill switch weakens the second, because a bank that cannot suspend a model in operation cannot contain an error once it begins to repeat across thousands of accounts. Weak governance over data weakens the third, because a sophisticated model fed with incomplete or unrepresentative data will produce confident but unreliable outcomes. The difficulty is that these failures compound: an unexplainable decision, produced at scale by a system that cannot be stopped, from data that has not been verified, leaves no point at which responsibility can be fixed.
RBI's Regulatory Approach: Accountability Over Performance
The RBI has taken steps to address the risks arising from the growing use of AI in the banking sector. The FREE-AI Framework, released on 13 August 2025 following the recommendations of a committee constituted for this purpose, sets out seven guiding principles and 26 recommendations across six pillars. Subsequently, on 24 June 2026, the RBI issued the draft Guidance on Regulatory Principles for Model Risk Management, 2026 (“Draft Guidance”).
The Draft Guidance proposes to cover eleven categories of regulated entities, including commercial banks, small finance banks, non-banking financial companies, asset reconstruction companies and credit information companies. The RBI invited comments on the Draft Guidance until 24 July 2026. As of the date of writing, the final guidance is awaited.
The Draft Guidance places responsibility for model-driven outcomes on the regulated entity, irrespective of whether the model is developed internally or procured from a third-party provider. It also requires regulated entities to establish a Board-approved Model Risk Management Framework covering all models, including AI and ML models. Further, entities must define explainability and transparency thresholds for each AI model, with stricter requirements for models used in material decisions or those having a significant impact on customers.
Data Governance and the DPDP Act: Ensuring Accuracy and Accountability
The reliability of data used to train and operate AI models is equally important to their accountability. The Draft Guidance requires regulated entities to ensure that data used for model development complies with their internal data governance processes. It also requires them to address issues relating to data quality, incomplete or unrepresentative datasets and changes in data patterns over time.
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) further strengthens these obligations where AI models process personal data. Section 8(3) requires a Data Fiduciary to ensure the completeness, accuracy and consistency of personal data where such data is likely to be used to make a decision affecting the Data Principal. Further, Section 8(1) holds the Data Fiduciary responsible for compliance with the Act, irrespective of whether processing is undertaken directly or through a Data Processor. Section 8(5) also requires the implementation of reasonable security safeguards to prevent personal data breaches. These obligations are particularly relevant to AI-driven lending and credit risk models, where personal data directly influences decisions affecting customers.
However, the DPDP Act does not provide a standalone right to an explanation of decisions made through automated processing. Accordingly, a customer whose credit application is rejected by an opaque AI model would primarily rely on the Act’s obligations relating to data accuracy, rights of access and correction, and grievance redressal, along with the RBI’s consumer protection requirements. The Draft Guidance further reinforces this position by requiring regulated entities to avoid using models that harm consumers and to address grievances arising from consumer-facing models through their grievance redressal mechanisms.
Thus, under the Indian regulatory framework, the requirement to explain AI-driven decisions arises primarily from the RBI’s supervisory expectations rather than an express statutory right to an explanation under the DPDP Act.
AMLEGALS Remarks
The growing use of AI in banking makes accountability a central concern for regulated entities. The key question is no longer whether banks should adopt AI in their credit and risk functions, but whether they can justify the decisions made by these systems and intervene when they produce unreliable outcomes.
Regulated entities should begin aligning their existing AI governance practices with the requirements of the Draft Guidance, without waiting for its final adoption. This includes maintaining an inventory of all models, including those procured from third-party providers, and classifying them based on their level of autonomy and potential impact. Banks should also establish clear explainability thresholds for each AI use case and document the additional safeguards adopted where full explainability is not possible.
For any queries or feedback, feel free to connect with Dhwani.tandon@amlegals.com