AI Governance Framework for India: What RBI FREE-AI, DPDP Act, SEBI, and IRDAI Require — and What No International Framework Covers

India has more active AI-adjacent regulatory attention on financial services than any market outside the EU, but the mistake foreign-trained compliance teams make is assuming India's requirements are a lighter version of the EU AI Act. They aren't a subset — they're a different shape entirely, built around proxy-variable fairness testing the EU has no equivalent for, a per-instance penalty regime under the DPDP Act, and a sectoral structure where a single bank can answer to RBI, SEBI, and IRDAI at once with no consolidated AI statute tying them together. This guide works from what's actually documented, not the tidiest acronym.

Proxy-variable fairness testing is the one requirement no Western toolkit ships with

RBI's FREE-AI report calls out fairness testing that accounts for India's social structure, and the practical translation is testing for caste, religion, language, and disability proxies — not direct inputs, since no compliant bank collects that data as a model feature. Pincode and surname patterns can correlate with caste community in ways a standard fairness audit never looks for; counterparty name and geographic concentration can proxy for religious community; mobile network, device language, and app usage can proxy for linguistic community; screen-reader usage and transaction completion time can proxy for disability. IBM's AIF360 and Google's What-If Tool were built against US and EU protected-class definitions, and running them unmodified on an Indian credit book will pass a model that is quietly discriminating on exactly these proxies. Building this capability from scratch means pairing census-level demographic data with your own feature set to construct a statistical proxy indicator — it's slower and more analytically demanding than a standard disparate-impact run, and banks that budget for it like a checkbox item consistently underestimate the timeline.

DPDP Act exposure is per-instance, not a multiplier you can model with a spreadsheet

The ₹250 crore figure under the DPDP Act's Schedule is the statutory ceiling for a data fiduciary's failure to implement reasonable security safeguards, and the Data Protection Board sets the actual penalty per instance of non-compliance it finds — it is not an automatic per-decision or per-record multiplier. What is true, and worth the board's attention, is that a high-volume AI system creates more individual instances where something can go wrong — more surface area for a finding, not a mathematically larger single penalty.

Sectoral regulation means the same evidence has to satisfy three different readers

RBI, SEBI, and IRDAI each evaluate AI governance through their own lens, and a bank with a capital markets arm and a bancassurance tie-up is producing governance evidence for all three from the same underlying AI systems. SEBI's 2024 disclosure obligations for AI/ML use by registered intermediaries focus on labeling and accountability for AI-generated outputs in advisory and trading contexts — a different evidentiary ask than RBI's examination focus on audit trail and board oversight. Build one evidence chain that can be re-formatted for each regulator's submission template rather than three separate compliance programs; the underlying facts (what model, what risk tier, what was tested, what was found) don't change, only the presentation does.

What an India-specific governance program actually has to contain

Start with an inventory that explicitly captures DPDP Act exposure per system — how many data principals does each AI decision touch — alongside the standard model-risk criteria, because risk tiering that ignores data-principal scale will misclassify a high-volume, low-dollar-value system as lower risk than it actually is. Layer India proxy-variable testing into both pre-deployment validation and ongoing production monitoring, since a model that passed at launch can drift into proxy discrimination as the customer mix shifts. Build the audit trail to answer DPDP data-principal access and correction requests, not an automated-decision override right the statute doesn't grant. Report to the board in terms specific enough that an examiner questioning a board member gets a substantive answer, not a recollection of having approved "an AI policy" at some point.

Action checklist for an India-specific AI governance program

1. Verify every FREE-AI or "RBI AI Circular" citation in your existing governance documentation against RBI's actual published report and master directions before an examiner catches the mismatch first.
2. Build or procure India proxy-variable testing (caste, religion, language, disability) for every credit, underwriting, and fraud model — test pre-deployment and on a recurring production cadence.
3. Tag each AI system's inventory entry with the number of data principals it affects, not just its traditional model-risk tier.
4. Build one evidence chain capable of being reformatted for RBI, SEBI, and IRDAI submissions rather than three disconnected compliance tracks.
5. Brief the board with domain-specific residual risk detail, so a board member can answer an examiner's follow-up without reaching for the policy binder.