Regulations

Built in line with the regulation.

Rho maps its evidence to 50 rules across 12 markets, labelled honestly for what each one is.
Reviewed 24 September 2026.
Access demo

Our position

We help you stay effortlessly accountable to your regulator, for every AI action.

Evidence, not a certificate

Compliance is still yours. Rho takes away the effort.

The evidence for every answer is already recorded, mapped and signed.

Evidence, not a certificate

Rho records what every agent did and what happened next, and turns it into the evidence a rule asks for. Your teams decide, report and remain accountable. Rho doesn't make you compliant, validate your models or file reports for you.

Every rule labelled for what it is

Binding law, supervisory guidance, a draft, a consultation or a voluntary principle: each card says which, and when it applies. We don't present a consultation as a requirement.

Built for where you operate

Rho maps to the rules in each market it runs in, and runs in your region. Where a rule covers Rho itself, as a service provider or a store of personal data, we say so and help you register us.

By market

What each regulator asks for, and the evidence Rho gives you.

BindingIn force since 28 November 2025

Reserve Bank of India

Managing Risks in Outsourcing Directions, 2025

What it requires

  • The board stays accountable for outsourced IT, including AI services
  • Keep an inventory of outsourced services and their supply chains
  • Monitor vendors; report their cyber incidents to RBI within six hours

Evidence Rho gives you

  • Inventories third-party agents and the vendors behind them
  • Scores each vendor on one measure, from your own outcome data
  • Alerts and incident evidence packs to support your reporting clock

Replaced the 2023 IT Outsourcing Master Direction. Licensed and off-the-shelf software is outside its scope, so not every AI vendor is covered.

Reviewed 24 September 2026
BindingMain duties apply from 13 May 2027

Government of India (MeitY)

Digital Personal Data Protection Act 2023 and Rules 2025

What it requires

  • The bank answers for vendors processing personal data for it
  • Log and review access to personal data; keep logs a year
  • Report personal data breaches to the Board within 72 hours

Evidence Rho gives you

  • Decision records show what personal data each agent saw and used
  • Alerts when an agent goes beyond its permitted data or scope
  • Evidence packs for breach reports, DPIAs and audits

The Data Protection Board has operated since November 2025; most obligations start on 13 May 2027.

Reviewed 24 September 2026Read the source ↗
Draft, not finalReleased 24 June 2026; not yet final

Reserve Bank of India

Guidance on Regulatory Principles for Model Risk Management, 2026

What the draft proposes

  • Inventory every model, including vendor AI; keep records ten years
  • Validate vendor models yourself and track provider-driven updates
  • Kill switch, human override, and review of oversight decisions

Evidence Rho gives you

  • Keeps an inventory of agents and vendor models, retired ones included
  • Alerts when a vendor's model changes behaviour without notice
  • Human-oversight records, plus pause and restrict through your gateway
Reviewed 24 September 2026Read the source ↗
RecommendationsCommittee report, August 2025

Reserve Bank of India committee

FREE-AI Framework

What it recommends

  • Keep a half-yearly AI inventory ready for supervisors
  • Define what agents may do alone; humans oversee higher risk
  • Be able to stop, pause or unwind AI processes

Evidence Rho gives you

  • Inventories every agent, including undeclared ones, with vendor and risk tier
  • Human-oversight records of reviews, overrides and sampled checks
  • Pause or restrict an agent through your gateway, with the decision logged

A committee report, not a direction. No binding FREE-AI direction has been issued.

Reviewed 24 September 2026Read the source ↗

How to read the labels

What each status means.

Binding
Law or a binding rule. Breaching it has consequences. Cards say "what it requires".
Supervisory guidance
What a supervisor expects and examines against. Cards say "what it expects".
Draft, not final
Published for comment; the final text may change. Cards say "what the draft proposes".
Consultation, not final
Proposed; not yet issued in final form. Cards say "what it proposes".
Recommendations
A committee's recommendations to the regulator. Cards say "what it recommends".
Voluntary
Principles firms may adopt. Cards say "what it recommends".
Discussion paper
For dialogue. It creates no obligations. Cards say "what it discusses".

Cutoff

Current as at 24 September 2026.

We reviewed every card against each regulator's published text as at 24 September 2026. Anything published or changed after that date is not reflected. Drafts and consultations above may since have been finalised, and dates may have moved.

These pages are general information, not legal or regulatory advice. Always check the current text and take advice on how it applies to you. See our terms of use.

See the evidence for your market.

Access demo