India now has the most comprehensive home-grown AI governance framework in Asia — and it was built from the financial sector outward. RBI FREE-AI (August 2025) provided the conceptual foundation — seven sutras, 26 operational recommendations, six implementation pillars — and MeitY adapted it into India's national AI governance framework two months later. This sequencing is not accidental: India's most sophisticated AI governance thinking emerged from the RBI committee process, not from a generic technology ministry exercise, because India's most intensive AI deployment is in financial services.
For Indian banks, the practical consequence is a layered framework: RBI FREE-AI as the mandatory-adjacent standard (backed by the regulator with examination authority), MeitY guidelines as the national framework setting India's AI governance character for all sectors. Banks that implement RBI FREE-AI comprehensively are simultaneously compliant with MeitY's national framework — the seven sutras are identical.
The Seven Sutras: Operational Meaning for Banking AI
Trust is the Foundation
Banking AI earns trust through validated performance, documented limitations, and audit-able governance. RBI MRMF operationalizes this: model inventory + validation + audit trail = the trust infrastructure for banking AI. Trust is not claimed through marketing language — it is established through evidence that can be examined by regulators, auditors, and boards.
People First
AI for banking must serve people across India's full demographic diversity: rural and urban, Hindi and Tamil and Telugu and Bengali, first-time digital banking and sophisticated investor, high-income and priority sector borrower. An AI that serves only the easiest-to-serve segments and optimizes its metrics on that population fails People First — regardless of its accuracy on that segment.
Innovation over Restraint
India's AI governance is deliberately principles-based. Banks should govern AI to manage real risk, not perform compliance theater. Over-governance — treating all AI as high-risk, requiring the same documentation depth for a spell-check AI and a credit scoring AI — is as problematic as under-governance. Proportionality in governance is itself a governance principle under FREE-AI.
Fairness and Equity
India's fairness testing challenge is unique in global AI governance: proxy discrimination testing must cover caste (geographic pincode proxies), religion (transaction pattern proxies, counterparty name proxies), language (mobile device type proxies, UPI app choice proxies), and regional origin. No other financial market has this combination of protected dimensions, historical data bias concentrations, and diversity of financial behavior patterns.
Accountability
Named human accountability for AI outcomes. Every AI model used in banking must have a named owner — not a team or a system, but a person — who is accountable for its behavior. When AI produces harm, the accountability chain leads to a responsible person. RBI MRMF's model inventory captures this: model owner is a required field, not an optional metadata note.
Understandable by Design
Explainability is architectural, not an afterthought. Credit AI decisions must be explainable to borrowers who received adverse decisions. Risk AI summaries must be comprehensible to board risk committees. Regulatory reporting AI must produce outputs examiners can audit. Each explanation audience requires different explanation depth and vocabulary — banking AI governance must distinguish between customer-facing explainability and board-facing explainability and examiner-facing explainability.
Safety, Resilience, Sustainability
Banking AI must be safe (operate without causing unacceptable harm), resilient (maintain integrity under cyberattacks and adversarial inputs — CERT-In Blueprint alignment), and sustainable (not create systemic risk through concentration, exclusion, or environmental harm). FSB's concern about AI concentration risk (88% LLM API spend in 3 providers) is the Sustainability sutra at systemic scale.
RBI FREE-AI's Six Pillars and 26 Recommendations
| Pillar | Recommendations | Banking Relevance |
|---|---|---|
| 1. Infrastructure | 1–4 (4 recs) | Regulatory sandboxes for AI testing, shared infrastructure for smaller regulated entities, AI compute access |
| 2. Capacity Building | 5–9 (5 recs) | Board AI literacy, risk team governance training, AI engineering for tech teams, three lines of defense AI capability |
| 3. Policy | 10–13 (4 recs) | Regulatory framework development, principles-based regulation, inter-agency coordination (RBI-SEBI-IRDAI) |
| 4. Governance | 14–18 (5 recs) | Board AI governance committees, AI reporting structures, MRMF board approval, accountability chains |
| 5. Protection & Assurance | 19–23 (5 recs) | AI cybersecurity (CERT-In alignment), consumer protection in AI, kill switches, adverse impact mitigation |
| 6. Monitoring & Evaluation | 24–26 (3 recs) | Ongoing AI governance monitoring, framework evolution, AI performance reporting to regulators |
Three New Institutions: AIGG, TPEC, India AI Safety Institute
Multi-Stakeholder AI Governance Oversight
The AI Governance Group coordinates AI governance across India's regulatory landscape — bridging MeitY, RBI, SEBI, IRDAI, and other sector regulators. For banks, AIGG is the forum where sectoral AI governance standards are harmonized. RBI MRMF positions itself as a sector-specific layer; AIGG's national-level coordination means cross-sector AI governance consistency will develop over time, reducing the risk that India's AI governance fragments into incompatible sector standards.
AI System Evaluation and Certification
TPEC provides a potential certification pathway for AI systems used in regulated industries. For banking AI, TPEC certification (when operational) would provide independent evaluation evidence that supplements banks' internal validation. This is analogous to EU AI Act notified body assessments for high-risk AI — India is building the same infrastructure, though the timeline for TPEC certification of financial AI is not yet defined. Banks building internal AI validation programs should track TPEC developments and plan for certification integration.
AI Risk Research and Safety Evaluation
India's AI Safety Institute (modeled on UK AISI and US AISI) conducts AI safety research, develops evaluation methodologies for AI risk, and provides technical guidance on AI safety standards. For banking AI, the AI Safety Institute's work on agentic AI safety, LLM safety benchmarks for India (including INDIC-BIAS for caste/religion/language fairness), and AI cybersecurity threat assessment will feed directly into future MRMF updates and CERT-In guidance evolution.
MeitY Guidelines + RBI MRMF + CERT-In Blueprint: Three Complementary Layers
Indian banks operate at the intersection of three AI governance frameworks that are now explicitly converging on the same institutional infrastructure:
- National layer (MeitY, November 2025): Seven Sutras, voluntary, cross-sectoral, sets India's AI governance character. Banks that satisfy RBI FREE-AI are automatically aligned with MeitY's national framework — the two frameworks share the same conceptual DNA. National framework compliance is demonstrated through sector-specific compliance, not through a separate national compliance program.
- Financial sector layer (RBI FREE-AI + MRMF, August–June 2025-26): Seven Sutras + 26 recommendations + six MRMF requirements. This is the mandatory-adjacent layer for banks: RBI has examination authority, and the MRMF creates the compliance standards that examiners will assess. Banks must build governance programs that satisfy both FREE-AI's principles and MRMF's operational requirements. The relationship between FREE-AI (principled framework) and MRMF (operational requirements) mirrors the relationship between Basel III principles and specific capital requirement rules — both must be satisfied.
- Cybersecurity layer (CERT-In, May 2026): AI cybersecurity blueprint, 12-hour patch mandate, xBOM, adversarial testing, formal AI governance as security control. CERT-In's explicit inclusion of "formal AI governance mechanisms" as a defensive principle completes the convergence: the three frameworks (MeitY, RBI, CERT-In) are all pointing at the same institutional AI governance infrastructure. Banks that build a comprehensive AI governance program — model inventory, validation, monitoring, explainability, human oversight, security — satisfy all three frameworks simultaneously from a single governance layer.
- What this means for boards: India's board-level AI governance requirements are now explicit from three sources simultaneously. Boards must: approve an MRMF-compliant AI governance policy (RBI MRMF Requirement 1), receive regular reporting on AI risk against the Seven Sutras (FREE-AI Governance Pillar), understand the bank's exposure to AI-assisted cyber threats (CERT-In Blueprint Principle 9), and disclose AI governance approach in climate risk disclosures where AI is used for climate risk assessment (RBI Climate Framework FY2026). These four board obligations are separate regulatory requirements from separate regulatory sources — they must all be satisfied, but they can be satisfied from a common AI governance infrastructure that doesn't require four separate board programs.