India's Central Bank Drafted Kill-Switch Rules for Bank AI

India's central bank just did what Washington wouldn't: write frontier AI into bank supervision with a mandatory off-switch. On June 24, the Reserve Bank of India released draft Guidance on Regulatory Principles for Model Risk Management, 2026 — 64 principles across six chapters requiring every supervised bank, NBFC, and financial institution to maintain override, suspension, and kill-switch arrangements for any AI model in production. The draft lands two months after U.S. regulators revised their model-risk bible and explicitly excluded generative and agentic AI from scope. Mumbai is not waiting for a treaty. It is writing the plug.

What's new: The RBI's draft is India's first detailed AI rulebook for finance — supervisory expectations open for public comment until July 24.

• Every regulated entity must adopt a Board-approved Model Risk Management Framework covering all models — internal, vendor-built, or hybrid.
• AI deployments require human-in-command oversight, override mechanisms, and kill-switch arrangements so no model runs without the ability to be shut down immediately if it produces harmful or erroneous outputs.
• The framework expressly covers foundational and frontier AI models, generative systems, and third-party vendor models — with enhanced board-committee approval for high-risk deployments.

Why it matters: India supervises one of the world's largest and fastest-digitizing banking systems. Its rulebook will shape how global AI vendors contract with financial institutions — and it exposes a widening transatlantic split on who governs the models.

• The Economic Times reported the RBI's requirement that banks flag automation bias — employees over-relying on AI outputs without independent judgment.
• Customer-facing AI must disclose that users are interacting with an AI system and offer a path to human assistance at any point.
• Entities "should not use any model that harms consumer" — with grievance-redressal hooks for AI-driven complaints.

The U.S. contrast: In April, the Federal Reserve, OCC, and FDIC jointly issued SR 26-2, replacing the 2011 SR 11-7 model-risk framework.

• The revised U.S. guidance states plainly: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."
• SR 26-2 applies chiefly to banks above $30 billion in assets and traditional statistical models.
• India's draft reaches eleven categories of regulated entities — from commercial banks and payments banks to top-layer NBFCs and credit bureaus — and names frontier AI directly.

What banks must build: The draft operationalizes last August's FREE-AI committee report, which found only about 21% of surveyed Indian financial entities were actively deploying AI — but 67% wanted to explore use cases.

• A complete model inventory: the RBI's rule is categorical — "no model is used, relied upon, or deployed unless it is part of inventory."
• Risk-based tiering reviewed at least annually, from spreadsheet calculators to frontier AI systems.
• Independent validation of third-party models — "notwithstanding any validation, certification, or assurance provided by the third-party provider."
• Controls against hallucination, bias, prompt injection, and adversarial inputs on customer-facing generative systems.
• Ten-year retention of decommissioned model records.

The vendor squeeze: Third-party AI contracts become compliance instruments.

• Banks remain accountable for vendor model outcomes — they cannot outsource liability to OpenAI, Google, or a domestic fintech wrapper.
• The draft requires contractual audit rights for both the institution and its supervisor, plus exit arrangements when vendors won't disclose enough to validate a model.
• That is a direct challenge to opaque frontier-model providers whose terms of service rarely grant banks the transparency a regulator now expects.

The geopolitical read: This is not India copying SR 11-7. It is SR 11-7 updated for the generative-AI moment — with kill switches Washington left for a future rulemaking.

• The RBI's opening rationale warns that model benefits "usually come with additional model risks" that can produce "inaccurate outcomes, flawed decisions, financial losses, operational disruptions, compliance failures and other adverse consequences."
• The draft signals further AI-specific requirements may follow under its Utkarsh 2029 strategy.
• Comments are due July 24, 2026 — one month for global banks operating in India to argue over audit rights, kill-switch mechanics, and vendor opacity.

Convina's view: The kill-switch wars just went global — and India's draft is the most serious bank-AI governance document any major regulator has published. Washington proved it can flip off frontier models through export controls; Mumbai is demanding every bank build that capability into its own stack before a Commerce Department letter arrives. The irony is sharp: U.S. regulators spent April clarifying that generative AI is too novel to supervise under model-risk rules, while India's central bank wrote an entire chapter on hallucination controls, red-teaming, and human override for the same technology. Global AI vendors selling into Indian finance will discover that "enterprise-grade" now means board-committee approval, contractual audit access, and a documented off-switch — not a safety blog post. The draft is not final law. But the direction is unmistakable: in the world's fastest-growing major economy, deploying AI without a kill switch is becoming indefensible.