AIBOM for banks and financial services

Banks have managed model inventories for years. AI brings models they did not build, data they did not collect and services they do not host. An AIBOM extends the existing inventory to cover them.

Why banks need more than a model inventory

Model inventories are established practice in banking. What has changed is the kind of model. A bank may now use a vendor's fraud model, an open-weight language model fine-tuned on internal documents, and a hosted AI service in a customer chatbot. Each brings third-party components, training data of uncertain provenance and versions that change outside the bank's release process. An AIBOM records these dependencies in a standard form.

India: RBI FREE-AI

The RBI's committee report on a Framework for Responsible and Ethical Enablement of AI (FREE-AI) was released on 13 August 2025. Its recommendations include board-approved AI policies covering governance, lifecycle management, risk controls and third-party vendor liabilities; the creation of AI inventories and sector-wide repositories covering models, use cases, dependencies and risks; and AI incident reporting with audit processes ^[1]. The report sets out seven sutras, six pillars and 26 recommendations ^[2]. These are committee recommendations; check current RBI directions for binding requirements.

Group entities that are SEBI-regulated, such as broking or depository subsidiaries, also fall under SEBI's Cybersecurity and Cyber Resilience Framework (August 2024) ^[3].

United States: revised model risk guidance

On 17 April 2026 the Federal Reserve, OCC and FDIC issued revised model risk management guidance (SR 26-2), superseding SR 11-7 ^[4]. Legal commentary notes that the revision raises the primary scope to institutions above USD 30 billion in assets, narrows the definition of a model, and explicitly excludes generative and agentic AI models, which regulators plan to address in separate guidance ^[5]. Banks using those models therefore cannot rely on model risk guidance alone for them, and an AIBOM gives them a documented inventory in the meantime.

European Union: high-risk uses in finance

Annex III of the EU AI Act lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score (excluding fraud detection) and AI for risk assessment and pricing in life and health insurance as high-risk ^[6]. Following the AI Omnibus, Annex III obligations apply from 2 December 2027 ^[7]. Providers must maintain Annex IV technical documentation, which covers third-party pre-trained components and training-data provenance ^[8].

What a bank's AIBOM should add

These sit on top of the CERT-In minimum elements, which include model developer, licensing, performance metrics and data source ^[9].

Getting started

1. Extend the existing model inventory to include vendor models, hosted AI services and AI features in SaaS products.
2. Generate an AIBOM for each, starting with customer-facing and credit-related systems (AIBOM generation).
3. Add AIBOM requirements to vendor contracts (AI procurement requirements).
4. Route new models through an approval gate that checks AIBOM completeness (AIBOM management).

How IntelliXBOM helps

IntelliXBOM helps banks keep AIBOMs for in-house and vendor models, validate them against required-field policies, and correlate models and frameworks with vulnerabilities, licences and the business services they support. It maps the inventory to framework controls with timestamped evidence and can run on-premise or air-gapped.

This article summarises public guidance and is not legal advice.