By the VD Hosts team 3 min read
Generative AI has moved quickly from experiments to real projects in financial services: assistants that help staff find policy answers, summarise customer files, draft responses, and guide customers through products. For regulated institutions, the question is no longer whether the technology works, but whether it can be deployed in a way that regulators, auditors and customers can trust.
The regulatory backdrop
In India, the Reserve Bank of India has been developing its approach to AI in the financial sector, including the August 2025 report of its committee on a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI), which sets out principles and recommendations on governance, risk management and consumer protection. AI systems that process personal data also fall under the Digital Personal Data Protection Act, 2023, and existing RBI directions on IT governance and outsourcing apply to the systems and vendors behind them.
In the United States, banks apply long-standing model risk management guidance (SR 11-7) to models, including AI; the Consumer Financial Protection Bureau has said that lenders using complex algorithms must still give specific reasons when they deny credit; and many institutions use the NIST AI Risk Management Framework as a structure for AI governance. Regulatory guidance is evolving, so treat any summary, including this one, as a starting point and check the current texts.
Why retrieval-augmented generation fits banking
A general-purpose language model answers from patterns learned in training. That is a problem in banking, where answers must reflect your current products, policies and regulatory positions. Retrieval-augmented generation (RAG) changes the approach: the system first retrieves the passages from your approved documents most relevant to a question, then the model answers from those passages and cites them.
- Answers stay current: update the document, and the answer changes; no retraining needed.
- Answers are traceable: every answer links to its source, which helps reviewers and auditors.
- Answers can respect permissions: retrieval can be filtered so users only receive answers from documents they are allowed to see.
We explain the approach in more depth on our retrieval-augmented generation page.
Five controls that make an assistant fit for a regulated institution
1. Data protection by design
Decide which data the assistant may see, mask or minimise personal data where possible, and choose models and hosting that meet your data residency and outsourcing requirements. Record the data flows for your DPDP and vendor assessments.
2. Access control
The assistant must never become a way around existing permissions. Apply the user's access rights at retrieval time, and log who asked what and which sources were used.
3. Evaluation before and after launch
Build a test set of real questions with approved answers, agreed with business and compliance teams, and measure accuracy, refusal behaviour and harmful outputs before launch. Re-run it whenever the model, prompts or documents change.
4. Security against misuse
Language models can be manipulated through crafted input, known as prompt injection. Treat model output as untrusted, restrict what tools the assistant can call, and test against the risks in the OWASP Top 10 for LLM Applications.
5. Human oversight and accountability
Keep people responsible for decisions that affect customers, define when the assistant must hand over to a person, and assign an owner for each AI system in your inventory. Our AI governance service covers how to set this up proportionately.
Good first use cases
| Use case | Why it is a good start |
|---|---|
| Policy and procedure assistant for staff | Internal users, clear source documents, measurable time saved |
| Summarising customer correspondence and case files | Saves time while a person stays in charge of the decision |
| Drafting responses for customer service agents | Agents review before sending, so errors are caught |
| Document extraction for onboarding and claims | Structured output checked against rules and by people |
Getting started
Pick one use case with a clear owner and measurable benefit, agree the evaluation set and the controls up front, and run a time-boxed pilot. Scale only when accuracy, cost and governance hold up. VD Hosts helps banks, NBFCs and fintechs with AI strategy, generative AI solutions and the security testing around them.
Common questions
Can customer data be sent to an AI provider?
Should an AI assistant make lending decisions?
How do you stop an assistant from inventing answers?
This article is general information, not legal or regulatory advice. Check the current official texts and take professional advice for your situation. See our Website Disclaimer.
