Govern AI before scaling it: RBI’s 10 commandments for tech risk

The Reserve Bank of India's (RBI) deputy governor, Rohit Jain, on Thursday unveiled ten crucial guidelines for banks to effectively regulate artificial intelligence (AI) and mitigate associated technology and cyber risks. Addressing the State Bank of India Banking & Economic Conclave in Mumbai, Jain emphasized the need for robust governance, enhanced visibility into technology infrastructure, stringent controls, and routine testing of operational resilience as financial institutions integrate AI into their operations.

He clarified that technology should no longer be perceived solely as a tool for banking but should be incorporated into a bank's risk management framework. His comprehensive ten-point framework covers ensuring that technology governance yields tangible results, maintaining oversight across intricate technology environments, tackling vulnerabilities and obsolete systems, strengthening identity and access controls, and confirming that security measures function as intended.

Jain urged banks to align risk controls with the rapid pace of technological advancements, manage third-party and external dependencies, bolster post-incident analysis, conduct regular recovery and operational resilience tests, and address underlying architectural and capacity constraints. He stressed that merely identifying vulnerabilities is insufficient; material exposures must be addressed based on their severity and potential impact.

As banks increasingly leverage cloud infrastructure, APIs, fintech providers, and AI models in conjunction with conventional banking systems, Jain cautioned that such interconnectivity can introduce risks beyond individual institutions. He stressed that banks must comprehend risks stemming from external dependencies, encompassing access controls, concentration, recoverability, data protection, and exit strategies.

In the specific context of AI, Jain highlighted that while the technology could enhance customer service, fraud detection, risk assessment, and productivity, it could also magnify errors. AI-driven outputs can impact credit decisions, fraud alerts, customer access, pricing, and service delivery, making validation, monitoring, human oversight, and clear accountability imperative.

Jain warned that AI is being increasingly exploited by attackers to scale phishing, impersonation, and other cyberattacks, while banks can employ the same technology for threat detection, behavioral analysis, and automated incident response. He stressed that boards and senior management must ultimately assume responsibility for technology governance, with clear roles and responsibilities across business risk, compliance, operations, and technology functions.

Jain underscored that in the AI era, governance must provide the discipline necessary to enable innovation adoption with confidence while ensuring the resilience and trustworthiness of the financial system remain paramount.