Let DGPSI-AI guide the RBI and REs for FREE AI implementation

…Continued from the Previous post

The  Bhattacharyya committee report on FREE AI has a confusing name. First of all it is not a “Free” AI software as it may first imply. It is a framework for Responsible  and Ethical Enablement of Artificial Intelligence recommended by the Committee to RBI for its consideration in the Financial sector. RBI may consider it and decide how it can be adopted and actioned.

Basically this is a framework suggested for the RBI and inter-alia speaks about what the Government may do or the industry may do.

This is not to be considered as a “Framework of Compliance for AI deployers  or Developers”.

The REs who are the regulated entities under the RBI, consisting of Banks, NBFCs etc can watch out for RBI coming up with some binding guidelines following this report.

The Committee was constituted on December 6, 2024 with the following terms of reference.

i. To assess the current level of adoption of AI in financial services globally and in India.

ii. To review regulatory and supervisory approaches on AI with a focus on the financial sector globally.

iii. To identify potential risks associated with AI, if any, and recommend an evaluation, mitigation and monitoring framework and consequent compliance requirements for financial institutions, including banks, NBFCs, FinTechs, PSOs, etc.

iv. To recommend a framework including governance aspects for responsible, ethical adoption of AI models/ applications in the Indian financial sector.

v. Any other matter related to AI in the Indian financial sector

The Committee has come up with its recommendations based on Seven Sutras and 26 recommendations.

We have tried to summarize the contents of the report in the earlier articles ending with “Observations on the FREE AI Committee Report”

This framework is  not like the DGPSI-AI framework which is a framework for DPDPA Compliance by the Data Fiduciaries. It is also not a law on AI. It contains some provisions which have been listed  in our previous article suggesting 13 action points for the REs .

If any of the REs want to start acting on the implementation of the report at this stage without waiting for the RBI to issue its acceptance  circular, they can start with the development  of an AI policy at the Board level.

One of the action points suggest

AI System Governance Framework: 

REs must implement robust model governance mechanisms covering the entire AI model lifecycle, including model design, development, deployment, and decommissioning.

Model documentation, validation, and ongoing monitoring, including mechanisms to detect and address model drift and degradation, should be carried out to ensure safe usage.

REs should also put in place strong governance before deploying autonomous AI systems that are capable of acting independently in financial decision- making. Given the higher potential for real world consequences, this should include human oversight, especially for medium and high-risk use cases and applications.

In the above recommendation, the first two paragraphs relate to the AI developers and only the third para refers to the AI deployers. DGPSI-AI is the relevant framework for the REs for meeting this recommendation.

The framework makes reference to “Institutional product approval framework” which needs to be developed. REs need to also ensure Board approved consumer protection framework that prioritizes on transparency, fairness and accessible recourse mechanisms for customers. The DGPSI-AI addresses these requirements.

REs must also identify potential risks arising out their use of AI  which also is covered by DGPSI-AI.

The recommendations include creation of AI inventory and AI audit framework with internal audits, third party audits and periodical review. DGPSI-AI addresses these requirements.

The requirements also recommend that REs should include AI related disclosures in their annual reports and websites.

The DGPSI-AI audit would be the right tool to meet some of these requirements.

Though the DGPSI-AI framework of DPDPA compliance was developed independently without the knowledge of what was brewing in the committee, it was a coincidence that the DGPSI-AI framework was published right before the FREE AI Report was published.

I hope RBI will study DGPSI-AI framework and use it as part of the guidelines to RE.

Naavi

About Vijayashankar Na

Naavi is a veteran Cyber Law specialist in India and is presently working from Bangalore as an Information Assurance Consultant. Pioneered concepts such as ITA 2008 compliance, Naavi is also the founder of Cyber Law College, a virtual Cyber Law Education institution. He now has been focusing on the projects such as Secure Digital India and Cyber Insurance
This entry was posted in Privacy. Bookmark the permalink.