In lending, AI stalls at sign-off, not at the model.
For banks and NBFCs supervised by the RBI. Kalmi redesigns the workflow around the AI, builds in the controls credit, risk and compliance need to sign it, and keeps it running with evidence you can produce on the day you are asked.
If three of these are true, the problem is not the model.
Vendor AI is live in credit or collections, and it is not in the model inventory, because nobody classed a vendor's scoring or calling tool as a model.
A person approves every AI recommendation before it takes effect, and approves nearly all of them. The review exists. The oversight does not.
The decision logs were built to debug the system. Nobody can reconstruct a single decision from them a year later.
A tool went live into the old process: the same roles, the same handoffs, the same exception queue. Turnaround barely moved.
Three vendors touch one customer journey, and nobody owns the outcome across them.
The timetable is the regulator's. The process is still yours.
RBI's draft model risk guidance, released for consultation in June 2026, reaches every model that feeds a business decision, built or bought. It asks for an inventory, risk tiers, human oversight and a way to switch a model off.
Most lenders will meet that on paper first. The harder part is the process. Decision rights, review thresholds and exception handling were designed for people, and an AI dropped into them inherits every gap.
Four functions where AI has to clear credit, risk and the RBI.
Credit
Where a model informs a lending decision, the decision is high risk, credit committee owns it, and the evidence standard is the highest in the institution.
Collections
Allocation, outreach and field work often run on different vendors' tools. The outcome belongs to nobody unless the workflow is redesigned as one.
Servicing and grievances
Customer-facing AI has to say it is AI, hand over to a person on request, and leave a record a grievance officer can use.
Fraud and compliance monitoring
An alert closed by AI has to show why it was closed, to a reviewer who was not there when it happened.
One workflow at a time, signed off by credit and risk.
Triage and value case
Two to three weeks. The one or two workflows worth doing, the metrics they will be judged on, and the use cases that should not proceed, with the reason.
Workflow redesign
Decision rights, review thresholds and exception queues set before any tool, with the controls your model risk framework will ask for specified now.
Deploy
Tools from a disclosed shortlist, or alongside your vendor's own team, integrated and taken through a go-live gate signed by credit and risk.
Adoption and change
Operating procedures, an override policy and incentives that match the new process, for the teams who will use it every day.
Measure and operate
Turnaround, rework, override rates and cost per case against the baseline. Operated under a support window with exit agreed at the start, or handed to your team.
From what the RBI asks to what runs.
Each obligation becomes a control that operates in the workflow and leaves evidence behind. Several sources below are drafts. Where they change when finalized, the mapping changes with them.
Every model, built or bought, in a central inventory with a risk tier.
RBI draft model risk guidance, June 2026.
A register entry for each workflow and each vendor system it touches, with its tier.
A register extract your model risk team can reconcile.
Human oversight of automated decisions, with the means to override, pause or switch a model off.
RBI draft model risk guidance, June 2026.
Review thresholds set by risk, an override path, and a kill path that stops the system.
Every override and stop logged with who acted and why.
Accountability for a vendor's model stays with the lender, with audit and exit rights.
RBI draft model risk guidance, June 2026; IT outsourcing directions, 2023.
Vendor AI checked against the same policies as your own, and contract terms specified for audit, exit and continuity.
One decision record across your systems and the vendor's.
What AI may do on its own, and when a person must step in, defined in advance.
FREE-AI committee report, August 2025.
Decision rights written into the redesigned process and enforced where the workflow runs.
The policy version that applied to each decision.
Data used by models governed and traceable.
RBI draft data governance guidance, 2026.
A data flow map for each workflow, covering prompts, tools, memory and logs.
Lineage for each decision, from source to output.
Purpose limits, security safeguards, logs and erasure for personal data.
DPDP Act 2023 and Rules 2025; core obligations from May 2027.
Masking before model calls, and retention and erasure that reach agent memory and embeddings.
Logs held separately from personal data, for at least a year.
We build these controls and operate them. Your model risk function validates them.
Built for the way a lender is supervised.
AI you did not build
Much of the AI in a lending stack belongs to vendors. We evidence it from your systems and theirs, against the same policies, without competing for the vendor's configuration work.
In your environment
Deployment defaults to your environment, under your controls and your identity management. Your data does not move to us.
Contracted to the outsourcing rules
Audit rights, inspection access, data residency, continuity and exit are drafted to the outsourcing directions that apply to you, not to a standard supplier template.
First line, by design
We build and operate controls. Your model risk function validates them and internal audit reviews them. We build so that both can.
A paid triage of one workflow.
Two to three weeks, at a fixed fee. You keep the output whether or not anything follows: the workflows worth doing and the ones to stop, with reasons, a metric baseline, and a value case your credit and risk heads can read.
If defensibility has to come first, start from a diagnostic instead: an inventory of the AI already in use, including vendor AI, the gaps against RBI expectations, and a plan that names who operates each control.
The first conversation is a diagnosis, not a pitch.
Bring a workflow that should be in production and is not, or a deployment whose numbers did not move. We will tell you what we typically see at that stage, specifically enough that you can confirm it or correct it. If an engagement follows, it starts with a paid, fixed-fee triage. We do not run free assessments.
Replies come from Sudip, usually within a working day.