EASE 9.0: Showing the Work on AI

A bank that deploys AI has done something useful. A bank that can show how its AI reached each decision has done something more durable. EASE 9.0 now names AI as part of the agenda for India's public sector banks, and the foundations it lists point toward the second kind of bank. That is a sensible place for the conversation to go.

What 9.0 asks for

Edition 9.0 was launched in February 2026 by the DFS Secretary, M. Nagaraju. It groups the agenda into four pillars: Risk and Resilience, Innovation, Socio-economic Impact and Excellence. By the close of EASE 8.0, reported by ANI on October 21, 2026, the programme ran 16 action points, more than 50 initiatives and over 150 KPIs.

Some of what 9.0 asks for reads less like strategy than like foundations: a global capability centre strategy for FY27, core AI stacks with LLM licensing and GPU planning, enterprise consent management, and tokenisation and anonymisation at scale. These are the unglamorous parts of AI, and they decide whether the glamorous parts can be trusted.

The agenda does not use the word evidence. That is our reading of where these foundations lead: each one is something a bank can either demonstrate or not.

The banks have not been idle. The IBA's chief executive, Atul Kumar Goel, said in July 2025 that public sector banks had accelerated generative-AI readiness and implemented pilot use cases under EASE. A later report said seven banks had introduced 32 generative-AI tools, a figure that rests on a single press source. The direction is clear, and the pilots are real.

The regulator and the ministry are asking early

The Reserve Bank's Deputy Governor put the principle to public sector bank chiefs at PSB Manthan on September 12, 2025:

“Regulation can guide, but governance must come from within.”Swaminathan J, Deputy Governor, Reserve Bank of India, PSB Manthan, September 12, 2025

He went on to say that as banks adopt AI and data-driven systems, assurance "must also extend to these new domains", covering fairness, transparency and accountability in automated decisions. A regulator can set the rules. Only the bank can produce the evidence that it followed them.

The Finance Ministry has moved in the same direction. In April 2026 the Finance Minister convened bank chiefs on the risks of advanced AI, and in late September 2026 Whalesbook reported that the ministry is reviewing how banks use AI in loan collection and credit monitoring, with questions on explainability, cybersecurity and how pilots reach production. The second is one report, so the detail deserves caution. A regulator and a ministry that ask this early are helping banks build AI that lasts.

From capability to evidence

Public sector banks have a familiar way of reporting new technology: the capability exists. The chatbot is live, the model is built, the pilot is complete. With AI a second step matters. A model that scores a borrower or sequences a collections call is making a decision about a person, and the natural question is about that decision, not the model. Why this customer? On what data? With whose consent? Who could have overridden it?

Capability answers "do you have it." Evidence answers "show me one." The banks that can do the second are the ones customers, boards and regulators will trust with more. It is also where the programme's incentives point: a public ranking tends to reward what can be demonstrated, and a peer group learns fastest from banks that can explain what they did.

What would that look like in practice? Take one collections call. A decision-log entry might record the model version that scored the account, the data fields it used and the consent basis for each, the score and the rule that set the call sequence, whether a person reviewed or overrode it, and the outcome. Five things, written by the system at the moment of the decision rather than reconstructed afterwards. This is an illustration, not an EASE specification.

The Reserve Bank's own survey shows how far there is to go. Of the 127 regulated entities that reported using AI, only 18 percent said they maintained audit logs, and 15 percent used interpretation tools such as SHAP or LIME. That covers banks, non-bank lenders and others, not public sector banks alone, and it is a snapshot from 2025. But it suggests why evidence is the natural next step.

The idea is already written into law elsewhere. The EU AI Act requires high-risk AI systems, a category that includes systems used to assess creditworthiness, to allow automatic recording of events over their lifetime so that their functioning can be traced. After the 2026 Digital Omnibus, those rules apply to such systems from December 2, 2027.

Four questions behind four asks

Each of the 9.0 asks above carries a question that a careful reviewer, or a careful board, will put to a bank.

Why did it decide that? The Reserve Bank's FREE-AI report, a committee report published in August 2025, is the regulator's direction of travel, and it addresses every RBI-regulated entity. Two of its seven sutras bear directly on the question. Understandability, it says, should be "a core design feature, not an afterthought," and accountability "cannot be delegated to the model and underlying algorithm." It also recommends output audits that certify decisions such as approving a loan are explainable, fair and consistent, with the most detailed audits for high-risk uses such as credit decisioning. The RBI sets the expectations for how AI should behave. EASE measures whether a bank can demonstrate it. The two work together and are worth keeping apart. The Reserve Bank's June 2026 draft guidance on model risk management goes further. It would require a board-approved framework covering all models, higher explainability thresholds for AI models relied on for material decisions, documentation that enables "traceability, reproducibility, and auditability," and human oversight with override mechanisms. It was still a draft at the time of writing: comments closed in July, and the final text may differ.

Was the customer's data used lawfully? The Digital Personal Data Protection Act, 2023 makes consent a legal object. EASE 9.0's request for enterprise consent management turns it into an operating one: a record, per customer and per purpose, that a model can be checked against.

Was the data protected while it was used? Tokenisation and anonymisation at scale sound technical. The business question is simple. When an analyst, a vendor or an agent touched the data, what exactly did they see?

Who runs it, and where? A GCC strategy and core AI stacks answer a sovereignty question as much as a cost one. A bank that licenses a model and rents the GPUs can still be clear about who controls it.

At the time of writing, compute is also a planning constraint. Bloomberg reported in August 2026 that server builders had told some of Nvidia's largest customers that AI server prices will rise by more than 15 percent in many cases, on memory costs. MeitY has said GPUs can be up to 92 percent of an AI server's value, most of it imported. None of this is specific to banks, but it is a reason to treat GPU planning as a design decision rather than a procurement afterthought.

From pilot to scale

Pilots are easy because the evidence work can wait. A pilot runs on a prepared extract, with a team watching and a sponsor who will vouch for it. Scale asks for three things in their place: lineage for every model, a log for every decision, and a limit for every agent that someone set and can show.

This is not a problem peculiar to banks. An EY-CII report in late 2025 found that 47 percent of Indian enterprises had multiple AI use cases live in production; more than half did not. The pilot-to-scale gap is general, and it is rarely a modelling gap. It is the cost of the surrounding discipline.

→ The same gap, seen from inside the bank: Ten Pilots, No Bank.

It also helps explain why collections and credit, the areas the ministry is reportedly reviewing, are harder than marketing or service. A wrong answer there reaches a borrower. Those are the places where evidence matters most and where the reward for getting it right is largest.

AI is one part of the mechanism

A caution runs through all of this. Technology, and AI in particular, does not change a bank on its own. AI adds capability to the mechanism: it can make decisions faster and show its reasoning, but only if a mandate asks for the evidence and a mindset treats it as normal. The previous article in this series described the pattern in UPI and in EASE, a mandate, a mechanism and a mindset, with all three needed.

EASE 9.0 supplies the mandate for AI. The mechanism is the stacks, consent records and decision logs described above. The mindset, in which a bank reaches for the evidence before it is asked, is the slowest to form and the hardest to measure.

→ The three levers in full: What UPI Can Teach EASE.

The case for a shared playbook

Twelve banks building their own consent logic, model governance and audit trail will duplicate effort and learn more slowly than they need to. The early movers' lessons stay inside their walls.

A ranking tells a bank where it stands. A pattern tells it how to move. The Reserve Bank's report itself suggests that associations such as the IBA could develop a Responsible AI Adoption Score or Index for the financial sector. The IBA's coordinating role is well placed to supply the second: not by prescribing a vendor, but by publishing reference patterns for the plumbing every bank needs, such as what a consent record must contain, what an AI decision log must capture and what a human override must look like. Banks would still own their data and their systems. What they would share is the pattern.

→ How India has done this before: A Shared Rail for EASE's AI Agenda.

What to watch

Three things will show how seriously 9.0 treats AI evidence. The first is whether the AI themes specify system-generated logs as proof, or accept a presentation built for the submission. The second is whether the Finance Ministry's review ends in guidance that banks can build to. The third is whether early movers publish what they learned, so the next bank starts from a pattern instead of a blank page.

None of this slows AI down. It lets banks scale it with confidence, and it turns each deployment into something the bank can stand behind. For a programme that has spent eight years teaching banks to measure themselves, asking them to show their work is a natural next step.

Capability gets AI into the bank. Evidence is what lets it stay.