When it comes to Artificial Intelligence (AI), only a small number of countries and companies have the resources to compete at the frontier. The World Bank's World Development Report 2026 - “The Promise of Artificial Intelligence”, though mentions India’s Sarvam AI among the national efforts making inroads (p. 2) in the field. Most developing countries, it argues, do not need to advance the frontier AI to benefit substantially, but they all need to adopt and adapt AI (p.11). The report also observes that a handful of companies in a handful of economies dominate foundation models, chips and cloud services, and that this reliance can affect cost and terms of access.

The objective of AI is not to limit access to foreign technologies, but to guarantee access to a wide range of providers and maintain the ability to switch between them (Box 7.2, p.245). For a regulated financial entity, the ability to switch is the practical test of concentration risk.

In financial regulation, concentration risk is a familiar concern because failures affecting a dominant provider can have a cascading effect across institutions. While discussions of AI risk often focus on algorithmic errors, bias, or cybersecurity threats, an emerging concern is the concentration risk in the market for advanced AI models. The Reserve Bank of India's (RBI) Financial Stability Report (FSR) June 2026 identifies AI as an emerging source of operational risk for the financial sector. The central bank stated that frontier AI models may generate systemic risk through shared vulnerabilities and technology concentration risk, where dependence rests on a small number of service providers or shared infrastructure (FSR, June 2026, Section III.3.1, "Evolution of Emerging Frontier AI Models", p.133). 

The OECD's policy brief - Artificial Intelligence Markets: Recent Developments and Competition Issues (June 2026), describes the market for AI models as “highly oligopolistic”, even as leading firms face constant pressure from the arrival of better models, so that leadership at the frontier lasts “only a few months” (pp. 2–3). For regulators, this raises an important question: can market incentives alone ensure responsible deployment of increasingly powerful AI models, or will additional oversight be required to mitigate these risks?

India has already recognised many of the challenges through its efforts to support indigenous AI development while simultaneously deploying global models on Indian infrastructure.

The chart, based on a survey of 33 banks and 10 upper-layer NBFCs, shows that 95% of respondents identify AI-enabled threats among the three most significant cyber risks over the next 12 months. The survey also reveals a significant gap in AI preparedness.

Emerging AI-enabled Cyber Threats 

(Source: Financial Stability Report, June 2026, RBI, p. 53,) 7

It shows 45% of respondents place their cyber risk resilience at the developing stage, and 38% at the intermediate stage, while only 5% report mature capabilities and none report reaching the advanced stage. The issue, therefore, is not merely one of technology adoption but of ensuring that the institutions underpinning India's digital infrastructure remain resilient to disruptions originating beyond its borders.

At the global level, various countries and companies are undertaking regulatory measures to manage AI risks. In fact, the chief executives of several leading AI laboratories told a United Nations Security Council meeting in September 2026 that the industry requires global oversight. Recently, frontier firms also signed a joint commitment at the White House undertaking to maintain internal controls, engage independent external auditors and establish board-level oversight of safety.

In India, the RBI's FREE-AI Committee, reporting in August 2025, warned that reliance on foreign AI providers for core financial models could expose systemic vulnerabilities (FREE-AI, para 2.1.6, p.9). It highlighted the concentration risk arising from a limited number of dominant vendors, and flagged that institutions have restricted visibility into those vendors' controls and still less over their subcontractors (para 2.2.5, p.11). It also flagged herding and model convergence when institutions deploy similar systems (para 2.2.8, p.12).

The RBI placed in the public domain a draft Guidance on Model Risk Management in June 2026. It covers all regulated entity categories and all models used by them whether developed internally, or sourced from third parties, or a combination of the two. The draft requires a Board-approved model risk management framework, kill-switch arrangements and human-in-the-loop controls for AI systems, and independent validation of externally sourced models even where a vendor has certified them. It directs entities to assess the risk arising from reliance on a limited number of providers.

India’s AI policy approach is strategic and poignant. It is geared towards enabling responsible and ethical AI, with a clear “people-first” focus. At the launch of the World Development Report 2026, it was announced that a consultation paper covering AI safety, cybersecurity and the benefits and harms of AI would be released in November 2026, and this paper would form the basis for AI regulation in India. That consultation is the opportunity to connect these elements. The FREE-AI Committee has recommended a permanent multi-stakeholder AI Standing Committee under the RBI alongside a dedicated financial-sector institution operating in coordination with the national AI Safety Institute (Recommendation 9, p.50). Building on these approaches, one possible option for India would be to establish an independent institution for frontier AI evaluation and safety, with a role in assessing systemic and sector-specific risks.