Topic starter
18/08/2026 2:17 pm
TL;DR: Board-approved AI risk gap assessments and action plans are now the RBI's focus for banks and regulated entities, according to Seclore. Sensitive data handling will need to be provable across the AI workflow, not just blocked at the front door.
Editorial analysis by NHI Mgmt Group, based on content published by Seclore: “RBI’s June Deadline on AI Risk: What Banks and Regulated Entities Need to Do Now”.
Key questions
Q: Why is tokenisation more effective than blocking AI outright?
A: Tokenisation is more effective because it preserves usable data for AI while removing the raw values that create exposure and compliance risk.
Q: What breaks when sensitive data is only masked at the prompt?
A: Prompt-only masking breaks as soon as the same data reappears in retrieval results, tool outputs, agent memory, or final responses.
Q: How should banks assess AI risk when customer data can enter public models?
A: Banks should assess AI risk by tracing where sensitive data appears, how it is transformed, and whether it ever leaves approved boundaries in raw form.
Practitioner guidance
- Map all AI touchpoints to sensitive data sources Inventory chatbots, copilots, vendor-embedded AI, and employee experimentation paths, then trace which structured and unstructured data they can reach.
- Tokenise sensitive values before AI processing Replace names, account numbers, and other regulated fields with consistent tokens at source so the model never receives raw customer data.
- Extend protection beyond prompt masking Apply the same control model to retrieval-augmented generation, tool outputs, agent memory, and final responses so data cannot reappear downstream.
Bottom line: AI risk becomes a board-level governance issue when the regulator asks for an approved gap assessment and action plan.
Glossary terms: AI Risk Assessment, Tokenisation, Re-identification, Data boundary
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
18/08/2026 3:10 pm
AI risk is now a data governance issue, not a model governance side note. The RBI directive makes that clear by tying accountability to board-approved assessments and time-bound action plans. If the institution cannot discover where sensitive data sits and how it flows into AI, it cannot claim to govern AI risk at all. The practitioner conclusion is straightforward: AI governance starts with data visibility and ends with auditable handling.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own AI risk accountability in a regulated bank?
A: Board and executive leadership should own AI risk accountability, with clear operational responsibility assigned across data, security, and AI teams. Regulators are no longer looking for informal consensus or departmental policy statements. They want a traceable decision model, defined approvals, and evidence that the institution can produce on demand.
👉 Read our full editorial: RBI’s AI risk deadline makes data governance a board issue