Govern AI before scaling it: RBI’s 10 commandments for tech risk

As the Indian financial landscape accelerates into an artificial intelligence (AI) era, the Reserve Bank of India's (RBI's) deputy governor Rohit Jain on Thursday laid out 10 key requirements for banks to manage technology and cyber risks.

Speaking at the State Bank of India Banking & Economic Conclave in Mumbai, Jain called for stronger governance, greater visibility into technology infrastructure, tighter controls and regular testing of operational resilience as financial institutions increasingly adopt AI.

He also said that technology can no longer be treated merely as an enabler of banking but is becoming part of a bank’s risk architecture.

The 10-point framework

His 10-point framework includes ensuring that technology governance translates into outcomes, maintaining visibility across complex technology environments, addressing vulnerabilities and legacy systems, strengthening identity and access controls, and ensuring that security controls actually work as intended.

He also called on banks to keep risk controls aligned with the pace of technological change, manage third-party and external dependencies, strengthen post-incident analysis, regularly test recovery and operational resilience, and address underlying architecture and capacity constraints.

“The important test of governance is ultimately how effectively the framework translates into outcomes,” Jain said, while stressing that identifying vulnerabilities alone was not sufficient and material exposures needed to be addressed based on their severity and potential impact.

Jain’s comments come as banks increasingly rely on cloud infrastructure, application programming interface (APIs), fintech providers and AI models alongside traditional banking systems.

He warned that such interconnectedness can create risks beyond an individual institution.

“Technology may be outsourced, but not the accountability,” he said, adding that banks must understand risks arising from external dependencies, including access controls, concentration, recoverability, data protection and exit options.

On AI specifically, Jain said the technology could improve customer service, fraud detection, risk assessment and productivity, but could also amplify errors. AI-driven outputs can influence credit decisions, fraud alerts, customer access, pricing and service delivery, making validation, monitoring, human oversight and clear accountability essential, he said.

“AI is expected to fundamentally change financial services, but governance must precede scale,” Jain said.

He also warned that AI is increasingly being used by attackers to scale phishing, impersonation and other cyberattacks, while banks can deploy the same technology for threat detection, behavioural analysis and automated incident response.

He said that boards and senior management must ultimately own technology governance, with clear responsibilities across the business risk, compliance, operations, and technology functions.

“In the AI era, governance must provide the discipline that enables innovation to be adopted with confidence, while ensuring that the resilience and trustworthiness of the financial system remain paramount,” he said.

About the Author

Subhana Shaikh is a business journalist at Mint, where she covers the Reserve Bank of India, monetary policy, and India’s bond markets. She has seven years of experience in reporting on financial markets, with a focus on banking and the broader financial system.<br><br>She began her career after completing her postgraduate diploma at the Indian Institute of Journalism and New Media, Bengaluru. She then spent five years at Informist Media, a news wire agency, where she closely tracked bond markets and the BFSI sector, developing a strong foundation in market reporting. She later moved to NDTV Profit, where she expanded her coverage across a wide range of business and economic stories.<br><br>At Mint, Subhana focuses on explaining central bank decisions, bond market movements, and banking trends for her readers. Her reporting combines on-ground inputs with careful analysis to help audiences understand complex financial developments.<br><br>Based in Mumbai, she is interested in exploring stories across the business landscape. Outside of work, she enjoys reading and spending time with her three cats.

^{Get Latest real-time updates}

Stay updated with the latest Trending, India, World and US news.

HomeNewsIndiaGovern AI before scaling it: RBI’s 10 commandments for tech risk