Topic starter
18/08/2026 2:17 pm
TL;DR: The RBI has told banks and regulated entities to complete a board-approved AI risk gap assessment and action plan by the end of June, pushing AI governance from policy language into executive accountability, according to Seclore. The real control issue is not whether AI is blocked, but whether sensitive data is discovered, tokenized, logged, and kept inside approved boundaries before models touch it.
Editorial analysis by NHI Mgmt Group, based on content published by Seclore: “RBI’s June Deadline on AI Risk: What Banks and Regulated Entities Need to Do Now”.
Key questions
Q: How should banks assess AI risk when customer data can enter public models?
A: Banks should assess AI risk by tracing where sensitive data appears, how it is transformed, and whether it ever leaves approved boundaries in raw form.
Q: Why is tokenisation more effective than blocking AI outright?
A: Tokenisation is more effective because it preserves usable data for AI while removing the raw values that create exposure and compliance risk.
Q: What breaks when sensitive data is only masked at the prompt?
A: Prompt-only masking breaks as soon as the same data reappears in retrieval results, tool outputs, agent memory, or final responses.
Practitioner guidance
- Map all AI touchpoints to sensitive data sources Inventory chatbots, copilots, vendor-embedded AI, and employee experimentation paths, then trace which structured and unstructured data they can reach.
- Tokenise sensitive values before AI processing Replace names, account numbers, and other regulated fields with consistent tokens at source so the model never receives raw customer data.
- Extend protection beyond prompt masking Apply the same control model to retrieval-augmented generation, tool outputs, agent memory, and final responses so data cannot reappear downstream.
Bottom line: AI risk becomes a board-level governance issue when the regulator asks for an approved gap assessment and action plan.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:10 pm
AI risk is now a data governance issue, not a model governance side note. The RBI directive makes that clear by tying accountability to board-approved assessments and time-bound action plans. If the institution cannot discover where sensitive data sits and how it flows into AI, it cannot claim to govern AI risk at all. The practitioner conclusion is straightforward: AI governance starts with data visibility and ends with auditable handling.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own AI risk accountability in a regulated bank?
A: Board and executive leadership should own AI risk accountability, with clear operational responsibility assigned across data, security, and AI teams. Regulators are no longer looking for informal consensus or departmental policy statements. They want a traceable decision model, defined approvals, and evidence that the institution can produce on demand.
👉 Read our full editorial: RBI’s AI risk deadline makes data governance a board issue