RBI Technology Risk: 5 Questions for Bank Boards

RBI technology risk guidance now puts AI, bank systems, and outside vendors on the board agenda. The core idea is simple. A bank must know how its technology can fail and how it will keep serving customers when that happens.

Why RBI technology risk now belongs on the board agenda

On September 24, 2026, RBI Deputy Governor Rohit Jain spoke about technology and cyber risk. He said banks should treat technology architecture as a major business risk. It now sits beside credit, market, and liquidity risk.

This view reflects how banking works today. Core banking, payments, onboarding, fraud checks, and reports all rely on linked systems. So a bank can have strong capital and still fail its customers during a major outage.

The board must see the full chain. That chain includes software, data, cloud services, application programming interfaces, and AI models. It also includes the firms that supply them.

Outsourcing does not move the duty away from the bank. The bank still owns the result. As a result, it must understand access rules, data safety, shared vendors, recovery plans, and exit options.

How RBI technology risk changes AI oversight

Traditional technology checks ask if a system is safe, available, and easy to recover. AI adds a different risk. It can read data, form a view, and shape a decision.

For example, an AI error may affect a loan, fraud alert, price, message, or account. The system may stay online while it gives a poor answer. A normal uptime report will not catch that failure.

Therefore, AI governance is part of decision governance. Directors do not need to read model code. However, they need proof that managers know where AI is used and what each system can do.

They also need clear answers when conditions change. What happens when data quality falls? Who can stop a model? How does the bank cope if a key provider goes offline?

A sound bank AI operating model makes these duties clear. It names the owners, sets the checks, and shows who can act during an incident.

Governance must come before scale

Jain used a direct test: governance must precede scale. Banks can use AI and gain from it. Yet they should expand a system only after its controls work in practice.

Many firms start with a small pilot. The team cleans the data and watches every result. Then the firm rolls the tool out across the bank.

At that point, real life changes the test. Data gets messy, rare cases appear, and staff face time pressure. The bank also becomes more reliant on the system. FinTech Central’s analysis of financial AI implementation explains why a strong pilot can still fail in daily work.

So the order starts with the system’s purpose and limits. Next, name its owner and set data rules. Then test human review and recovery. Scale should follow only when those controls hold up.

Five RBI technology risk questions for bank boards

1. Do we have a complete AI inventory?

The board should know which systems can affect customers, money, credit, fraud checks, compliance, or key services. The list must include AI inside purchased software. It should also include models run by vendors.

Each entry needs an owner, data sources, outside providers, and the level of control given to the system. It should state who may be harmed and how serious that harm could be.

2. Who owns a failure?

AI work often crosses business, technology, risk, and vendor teams. This can blur the line of duty. Therefore, every major use needs one named executive owner.

A contract may divide tasks between firms. Still, it cannot remove the bank’s duty to customers or the regulator.

3. Have we tested difficult cases?

Average accuracy can hide rare failures. A model may score well and still fail when data is missing or a customer has an unusual case.

Tests should cover repeat use, unusual facts, hostile inputs, data drift, and weak escalation. When a system takes action, the bank should check what it wrote, changed, or sent. The model’s own account of its work is weak proof.

4. Can the bank operate without the AI service?

Business continuity plans should cover the loss of a model service, cloud region, data feed, or specialist vendor. A paper fallback offers little comfort.

Instead, the bank should test the backup process at real volume. Staff need the tools, time, and authority to keep key services running.

5. Does the board receive evidence?

Board reports should cover incidents, control gaps, overrides, complaints, model drift, vendor exposure, and recovery tests. These facts show whether controls work.

Use-case counts and claimed savings tell only part of the story. A bank AI value scorecard should also show customer outcomes and risk.

RBI technology risk and shared vendors

One bank may view a vendor as a small exposure. Yet the same firm may support many banks. A fault can then spread through cloud hosting, identity checks, fraud tools, or model access.

This risk may sit beyond a bank’s own supplier list. So banks need facts about subcontractors, hosting sites, data flows, and recovery links. Regulators may also need a wider view of shared exposure.

Procurement teams should check more than price and speed. They should test portability, audit rights, data separation, incident notices, service cover, and the cost of exit.

Human judgment is still a control

Human review should match the impact of the choice. A low-risk office task may need checks at set dates. A decision about credit, fraud, account access, or the movement of funds needs stronger review.

However, adding a person to the process is not enough. The reviewer needs useful facts, enough time, and the right to challenge the system. A queue of hundreds of alerts can turn oversight into a routine click.

The bank should record each override and appeal. Over time, those records can reveal weak rules, poor data, or a change in customer behavior.

RBI technology risk actions for banks

RBI’s September remarks provide guidance and signal likely areas of review. Banks can act now through six practical steps.

• Map AI systems and key technology links to essential banking services.
• Name an executive owner for every major AI use.
• Rate each system by customer harm, financial impact, autonomy, and ease of reversal.
• Test model behavior, data, human review, and recovery as one process.
• Find shared exposure across cloud, software, data, and AI firms.
• Give the board a dashboard based on incidents, gaps, and tested controls.

These steps fit the RBI’s wider work on operational resilience, responsible AI, and model-risk management. Together, they point to one standard: know the system, test it, watch it, and retain control.

Strong controls can support faster adoption

Good governance can help a bank move faster. A bank that knows its systems and has tested recovery can scale a useful model with more confidence.

The stronger edge may come from repeat use. A bank should be able to deploy new models without losing control of its data, vendors, or customer duties. RBI technology risk thinking places architecture, AI governance, and resilience inside one board problem.

Sources

• RBI Deputy Governor Rohit Jain’s reported remarks on technology and cyber risk, September 24, 2026
• RBI FREE-AI Committee Report, August 2025
• RBI Bulletin, June 2026
• RBI draft guidance on model risk management, June 2026