TL;DR

  • Model governance software covers model inventory, audit trail, maker-checker approval, explainability, and drift monitoring across a bank’s model lifecycle.
  • RBI’s June 24, 2026 draft guidance (comment period closed July 24, 2026, not yet final) would require a board-approved Model Risk Management Framework and independent validation of every model, including vendor-certified ones.
  • Most global model governance tools assume vendor certification reduces the validation burden. The draft guidance does not extend that assumption to the regulated entity.
  • Evaluation should cover per-use-case explainability thresholds, override and kill-switch mechanisms, and audit rights written into vendor contracts, not just standard MLOps monitoring dashboards.
  • iTuring.ai runs Model Governance for 16 banks and insurers live across 200+ use cases in production, with SOC 2 Type II and ISO 27001 certification.

Vendor Certification Does Not Reduce Your Validation Burden Under RBI’s Draft Guidance

A model comes with a vendor certificate. The vendor ran its own testing, its own bias checks, its own performance benchmarks, and signed off. For most global model governance platforms, that certificate is treated as a meaningful input into the bank’s own risk assessment, sometimes enough to lighten the internal validation workload for that model.

RBI’s draft guidance released on June 24, 2026, does not build in that assumption. Under the draft, a regulated entity is expected to independently validate a model’s performance, bias exposure, and explainability regardless of who built it or what certification came with it. The certificate can inform the review. It cannot substitute for one.

This matters because it changes what “compliant model governance software” means for a bank operating in India. A platform built for a market where vendor certification is treated as sufficient evidence will, by design, leave gaps in exactly the place this draft guidance is pointing at. That gap reflects a design decision made for a different regulatory environment, and it is worth naming plainly before evaluating anything.

The guidance is still a draft. The comment period closed July 24, 2026. It has not been finalized, and it is not a Master Direction. Everything that follows treats it accordingly, as the clearest signal available today of where the requirements are heading rather than settled law.

Vendor certification gap in RBI’s model risk management guidance, contrasting assumed vendor certification with the requirement for independent model validation.

Model Governance Software Does Five Specific Jobs

“Model governance” gets used as a catch-all term in vendor conversations. In practice, the category breaks down into five distinct jobs, and a platform that does one well does not automatically do the other four.

Model inventory with risk tiering. Every model in production, every model in development, and every model that was decommissioned needs to sit in a single register, with a risk tier attached based on what the model decides and how much exposure a wrong decision creates. A credit approval model and an internal marketing-segmentation model do not need the same level of scrutiny, and a governance platform needs a way to say so explicitly.

Audit trail and lineage. Every version of every model, every retraining event, every data source that fed it, and every approval it received needs to be reconstructable after the fact. An examiner’s first question is rarely whether the model works. It’s what happened to this model, in order, with who signed off at each step.

Maker-checker approval workflows. No single person deploys, retrains, or retires a model unilaterally. A separate reviewer checks and approves the change before it goes live. This is standard practice borrowed from transaction processing, applied to model lifecycle events.

Explainability tooling, at two levels. Global explainability describes how a model behaves across its whole population, meaning which features matter most in general. Local explainability describes why the model reached its decision for one specific applicant or claim. A bank needs both, and a governance platform needs to generate and document both levels.

Champion-challenger and drift tracking. Models degrade as the population they score changes. A governance platform needs to flag that drift as it happens and support running a challenger model against the live champion early, before a problem surfaces downstream.

Five model governance capabilities for NBFCs: model inventory and risk tiering, audit trails, maker-checker approvals, explainability tooling, and drift monitoring.

Most of These Capabilities Were Built Against a Global Compliance Baseline

Model governance as a software category grew out of requirements set in the US and Europe, model risk frameworks built around independent validation, documentation standards, and periodic review cycles that assume a fairly mature internal risk function on the bank’s side. Those frameworks shaped what the current generation of governance tooling measures and reports on.

India’s own regulatory position on this has been moving on a separate, faster track. RBI’s August 2024 draft on credit model risk was an early signal that account-level explainability and model-specific oversight would become a distinct expectation of their own rather than a subset of general IT risk management. The FREE-AI Committee report, published in August 2025, laid out a broader framework for how financial-sector AI use should be governed across explainability, accountability, and consumer protection.

The June 2026 draft guidance builds directly on both. It is the first version of RBI guidance to specify, in detail, what a regulated entity needs to be able to prove about a model rather than simply what documentation it needs to hold.

What the June 2026 Draft Actually Asks a Regulated Entity to Prove

This section describes a draft. It has not been finalized, it is not a Master Direction, and RBI’s comment period on it closed July 24, 2026. Every requirement below is proposed rather than current law, and should be read that way.

A board-approved Model Risk Management Framework. The draft proposes that the entity’s board formally approve an MRM framework covering every model in use, rather than delegating that approval to a risk committee or a technology function alone.

Independent validation regardless of vendor certification. The draft does not carve out an exception for models that arrive pre-certified by a third-party vendor. The regulated entity’s own validation function is expected to review the model on its own terms.

Audit rights and exit provisions written into vendor contracts. The draft proposes that a bank’s contracts with any AI model vendor include the right to audit the vendor’s model development and validation process, plus a defined path to exit the vendor relationship without losing access to the model’s documentation, lineage, or decision history.

Kill-switch and override mechanisms. The draft proposes that every model in production have a defined mechanism for a human to override or halt its decisions, and that this mechanism itself be documented and tested rather than assumed to exist informally.

Per-use-case explainability thresholds, with enhanced controls where full explainability is not achievable. Rather than a single explainability bar applied uniformly, the draft proposes setting the required level of explainability by what the model decides. A credit decline needs a higher explainability threshold than an internal churn flag. Where a model’s architecture makes full explainability difficult, the draft proposes compensating with additional monitoring and review controls rather than treating the model as exempt.

None of this is final. A bank evaluating model governance software today is evaluating against a moving target, and any vendor who presents these requirements as settled should be treated with the same caution as a vendor who ignores them.

Five Questions to Put to Any Model Governance Vendor Operating in India

Does the platform support a documented maker-checker approval chain for every model lifecycle event: deployment, retraining, retirement, with a separate approver recorded at each step rather than a single sign-off field.

Is the audit trail immutable, meaning past entries cannot be edited or deleted, only appended to, and can the platform produce that trail in a format an examiner can review without engineering support.

Does the model inventory support risk tiering at the individual model level, so that a credit decisioning model and a low-stakes internal model are not held to the same review cadence by default.

How is explainability generated and documented per use case: is it a single global feature-importance report, or does the platform produce a specific, retrievable explanation for an individual account’s decision.

Can the platform produce account-level explainability on demand, meaning a compliance officer or examiner can ask why a specific application was declined and get an answer inside the platform itself, without a separate manual reconstruction process.

A vendor that answers all five with specifics rather than a demo screen is worth a second conversation. A vendor that answers with “our platform is fully compliant” without naming which draft requirement they mean is worth a follow-up question, because the guidance they are claiming compliance with is not yet final.

Compliance-Ready Software Still Requires a Compliance-Ready Process Around It

Software that supports maker-checker workflows does not make maker-checker approvals happen. Someone on the bank’s side still has to define who the checker is for each model category, and hold that role accountable when they approve something without reviewing it properly.

Software that generates an audit trail does not decide what belongs on the board’s agenda. The draft guidance’s proposed requirement for board-approved MRM frameworks is a governance obligation that sits with the bank’s board and risk committee.

Software with audit-rights functionality built in does not write those rights into a vendor contract. That is a legal and procurement exercise the bank has to run for every AI vendor relationship it holds, including the one supplying the governance platform itself.

A platform can make all of this achievable in far less time than building it internally. It cannot make the decision to do it, staff the validation function, or negotiate the contract terms. Any vendor pitch that implies otherwise is overselling what software does.

What This Looks Like in Production

iTuring’s Model Governance module runs across 16 banks and insurers live today, supporting 200+ use cases in production. The platform reaches production 97% faster than typical build timelines, and operates under SOC 2 Type II and ISO 27001 certification.

These figures describe operational maturity and security posture: evidence that the platform runs at scale, in production, under audited controls. They do not certify compliance with RBI’s June 2026 draft guidance, which remains unfinalized and cannot be certified against by any vendor at this stage. Any bank evaluating a platform against that draft should ask for evidence specific to each of the five questions above rather than treat general production or security credentials as a proxy answer.