When India's central bank publishes a governance framework for AI in the financial sector, every bank, NBFC, and payment system operator is expected to respond. RBI's Framework for Responsible and Ethical Enablement of Artificial Intelligence — published August 13, 2025, and known as FREE-AI — is that document. It is the most comprehensive AI governance framework any Indian financial regulator has produced, and its 26 recommendations are now the operational baseline for AI governance in Indian BFSI.
FREE-AI is not a binding circular in the same sense as a master direction — but its framing as a "framework" should not obscure its supervisory weight. RBI examination teams now ask regulated entities to demonstrate alignment with FREE-AI during supervisory assessments. Banks that cannot map their AI governance practices to FREE-AI's 6 pillars and 26 recommendations face a governance gap that will generate examination findings.
This guide maps FREE-AI's architecture to implementation obligations — pillar by pillar, recommendation by recommendation — so that India BFSI compliance and risk teams have a structured framework for responding.
The Architecture: 7 Sutras, 6 Strategic Pillars, 26 Recommendations
FREE-AI is organized in three tiers. The 7 Sutras are foundational principles — the "why." The 6 Strategic Pillars are the implementation domains — the "what." The 26 recommendations are the specific actions — the "how." Understanding the three-tier structure is essential before mapping to implementation, because a recommendation that seems narrow in isolation often has broader implications when read against its governing Sutra.
The 7 Sutras
Sutra 1 — Trust is the Foundation. AI systems must earn and maintain trust through accuracy, consistency, and transparency. The compliance implication: AI systems deployed in customer-facing or credit-decision contexts must be designed to build trust, not just to perform a technical function. A model that is accurate on average but produces unexplained outliers damages trust — the Sutra requires addressing this at the design stage.
Sutra 2 — People First. AI augments human capability; it does not replace human accountability. For consequential decisions — credit denials, account closures, fraud alerts that trigger account freezes — human oversight must be meaningful, not nominal. A human who rubber-stamps AI decisions without capacity to review them is not providing the oversight Sutra 2 requires.
Sutra 3 — Innovation over Restraint. RBI explicitly frames FREE-AI as a framework for responsible adoption, not a precautionary halt. Regulated entities are expected to innovate; the framework provides the governance architecture within which innovation should occur. This Sutra is important for risk committees that might default to refusing AI deployments — FREE-AI does not authorize excessive caution.
Sutra 4 — Fairness and Equity. AI must not perpetuate or amplify existing inequalities. In the India BFSI context, this has a specific dimension: India's financial inclusion mission — the PMJDY account base, the PM-KISAN beneficiary population, JLG credit customers — is a population that AI systems must not systematically disadvantage. INDIC-BIAS testing is the operational manifestation of Sutra 4.
Sutra 5 — Accountability. Regulated entities retain full accountability for AI outcomes even when AI is procured from external vendors. This is the most commercially significant Sutra. An Indian bank cannot contractually pass its regulatory accountability to its AI vendor — the bank is accountable to RBI for every AI system it deploys, regardless of procurement structure.
Sutra 6 — Understandable by Design. AI must be explainable to the customers it affects and to regulators. This maps directly to MRMF Section 4's explainability obligations, but FREE-AI's framing is broader — the explainability obligation is not just for model validation purposes; it extends to customer-facing disclosure, regulatory examination, and board oversight.
Sutra 7 — Safety, Resilience, and Sustainability. AI must withstand adversarial attack, remain operationally resilient, and be designed for sustainable long-term deployment. This Sutra anchors the AI cybersecurity and red-teaming obligations that RBI has separately directed through the June 2026 FSR and the CERT-In coordination.
The 6 Strategic Pillars: Implementation Domain Analysis
Pillar 1 — Infrastructure
Infrastructure covers the technical foundations for responsible AI: data quality, compute governance, model infrastructure, and monitoring systems. FREE-AI's recommendations under this pillar address:
- Data governance for AI training: quality standards, bias auditing in training datasets, data lineage documentation
- Model infrastructure: versioning, reproducibility, rollback capability, deployment controls
- Monitoring infrastructure: production performance tracking, drift detection, anomaly alerting
- India data residency: training data and inference logs must be stored within India's geographic boundaries, consistent with RBI data localization requirements
The implementation gap most banks face under this pillar: monitoring infrastructure. Banks that deployed AI pre-2025 often have model deployment without production monitoring — they can tell you what the model was validated on, not how it is performing today. FREE-AI's infrastructure pillar makes this a governance deficiency, not just a technical debt.
Pillar 2 — Policy
Policy covers the governance framework documents that should exist at the board and senior management level. FREE-AI's recommendations include:
- Board-approved AI governance policy: every regulated entity must have a board-approved policy specifically addressing AI — not a generic technology policy amended to mention AI, but a dedicated AI governance policy addressing risk appetite, accountability, human oversight requirements, and prohibited AI uses
- AI ethics framework: principles-based guidance for AI development and procurement decisions, aligned to the 7 Sutras
- Prohibited uses list: explicit documentation of AI use cases the institution will not pursue — untransparent scoring of protected characteristics, fully automated credit denials without appeal mechanism, AI systems deployed without human oversight for irreversible decisions
- AI risk appetite statement: board-level expression of the institution's tolerance for AI-related risks by domain
Most Indian banks have technology governance policies that pre-date the AI era. FREE-AI's policy pillar requires updating these to explicitly address AI — the board's sign-off on a policy that does not name AI is not the same as the board approving an AI governance policy.
Pillar 3 — Capacity
Capacity addresses human capability — ensuring that boards, senior management, compliance teams, and frontline staff have the knowledge to govern AI responsibly. FREE-AI's recommendations include:
- Board and senior management AI literacy programs — directors must understand AI well enough to exercise meaningful oversight, not just approve recommendations they cannot evaluate
- Compliance and risk team AI training — MLCO, CRO, and internal audit teams must be equipped to assess AI models, not just document that a vendor validated them
- Regulator capacity: FREE-AI explicitly acknowledges that RBI and other regulators must also build AI examination capacity — a realistic concession that regulatory supervision of AI is a two-way capacity challenge
Pillar 4 — Governance
Governance covers the internal structures for AI decision-making, oversight, and accountability. This is the most operationally detailed pillar for compliance purposes:
- AI governance committee: cross-functional oversight body (risk, compliance, technology, business) with defined authority over AI deployment decisions — not a working group but a formal governance body with documented mandate and reporting line to the board
- AI model inventory: complete catalogue of AI systems in production, with risk tiering and validation status — this directly implements MRMF's model inventory requirement
- AI incident management: defined process for identifying, reporting, investigating, and remediating AI-related incidents, including incidents that affect customers without immediately triggering the bank's standard incident detection (model drift that gradually degrades credit decisions, for example)
- AI audit function: internal audit coverage of AI systems — not just IT audit coverage of the systems AI runs on, but substantive audit of whether AI models are performing as intended and whether governance processes are functioning
Pillar 5 — Protection
Protection covers consumer protection and data privacy. FREE-AI's recommendations include:
- AI disclosure to customers: customers must be informed when AI plays a material role in decisions affecting them — credit assessments, insurance underwriting, fraud alerts. The disclosure must be meaningful, not buried in terms and conditions
- Right to explanation: customers who are adversely affected by AI-influenced decisions must have access to an explanation of the factors that influenced the outcome — this implements the adverse action explanation requirement from multiple regulatory directions
- Grievance mechanism: dedicated pathway for AI-related grievances — customers who believe they were incorrectly assessed by an AI system must have a channel that escalates to human review, not a chatbot that routes them back into the same automated system
- DPDP Act alignment: AI systems processing personal data must comply with DPDP Act 2023 consent, purpose limitation, and data principal rights requirements — FREE-AI explicitly cross-references DPDP compliance as a non-negotiable component of responsible AI
Pillar 6 — Assurance
Assurance covers the testing and audit mechanisms that provide evidence that AI systems are functioning as intended. This pillar directly implements Sutra 7 (Safety, Resilience, Sustainability):
- AI stress testing: periodic assessment of AI system behavior under adverse conditions — adversarial inputs, data distribution shifts, operational failures. This is the FREE-AI anchor for the AI red teaming mandate RBI issued through the June 2026 FSR
- Third-party AI audit: for material AI systems, independent audit by a qualified third party — not just validation by the institution's own model risk team
- AI innovation sandbox: FREE-AI endorses RBI's regulatory sandbox framework as the appropriate mechanism for testing innovative AI use cases before production deployment — regulated entities should use the sandbox rather than deploying novel AI into production and seeking retrospective governance alignment
- Regulator reporting: regulated entities should be prepared to report their AI systems, governance framework, and any significant AI-related incidents to RBI on request — FREE-AI establishes this as a standing expectation, not an exceptional disclosure obligation
Third-Party AI Vendor Accountability: The Most Commercially Significant Obligation
FREE-AI Sutra 5 and Pillar 4 together create the most commercially significant obligation for most Indian banks: full accountability for AI systems procured from vendors.
The practical impact: a bank that purchases an AI-powered credit scoring system from a vendor cannot tell RBI "the vendor is responsible for the model's fairness." The bank is accountable. This means:
Contract provisions required. Existing technology outsourcing agreements need AI-specific amendments covering: (a) vendor notification obligations when the model is updated in ways that may change scoring behavior; (b) access to model documentation sufficient for the bank to conduct independent validation; (c) subcontractor AI governance requirements — if the vendor uses a foundation model from a third party (OpenAI, Google, Anthropic), the bank's agreement with its vendor must include provisions governing that subcontractor; (d) right to audit the vendor's AI systems on reasonable notice; (e) security incident SLA for AI-specific incidents (data poisoning, adversarial attacks, model theft).
Independent validation requirement. Vendor assurance is not sufficient under FREE-AI. Banks must independently validate third-party AI models — either through their internal model risk team or through a qualified third-party validator. The validation report must be in the bank's records, not the vendor's.
Concentration risk monitoring. If multiple regulated entities use the same AI vendor's model, there is systemic concentration risk — a failure or vulnerability in that model could simultaneously affect multiple institutions. FREE-AI requires banks to assess their AI vendor concentration exposure and report it as part of their technology risk management.
FREE-AI Compliance Implementation Checklist
- ☐ Board-approved AI governance policy: specifically addresses AI (not generic technology policy amendment); covers risk appetite, accountability, human oversight, prohibited uses
- ☐ AI ethics framework: principles-based guidance aligned to FREE-AI 7 Sutras; prohibited uses documented
- ☐ AI governance committee: cross-functional body with formal mandate; reporting line to board; documented authority over AI deployment decisions
- ☐ AI model inventory: complete catalogue with risk tiering and validation status; includes third-party AI systems
- ☐ Board and senior management AI literacy: training program completed; directors can articulate AI governance obligations
- ☐ MLCO/CRO/internal audit AI training: risk and compliance teams equipped to assess AI models independently
- ☐ Third-party AI contracts: AI-specific provisions added (notification, documentation access, subcontractor governance, right to audit, security SLA)
- ☐ Independent validation of third-party AI models: validation reports in bank's records
- ☐ AI vendor concentration risk: assessed; reported in technology risk framework
- ☐ Customer AI disclosure: material AI involvement disclosed to customers in credit and insurance decisions; plain-language disclosure
- ☐ Right to explanation: adverse action explanation mechanism operational; routes to human reviewer
- ☐ AI grievance mechanism: dedicated pathway; escalation to human review; tracked and reported
- ☐ DPDP Act alignment: AI systems processing personal data assessed for consent, purpose limitation, data principal rights compliance
- ☐ AI stress testing / red teaming: periodic adversarial testing program; results documented; remediation tracked
- ☐ Third-party AI audit: material AI systems assessed by independent qualified auditor; audit report in governance records
- ☐ AI incident management process: defined trigger criteria, escalation path, customer notification obligations, regulator reporting triggers
- ☐ Regulator reporting readiness: AI system inventory, governance framework documentation, incident logs — accessible for RBI submission on request
- ☐ INDIC-BIAS testing: AI models in credit, insurance, and public-service contexts tested for disproportionate adverse outcomes for financial inclusion populations
- ☐ Data residency compliance: training data and inference logs for AI systems stored in India; cross-border data flow assessments completed
- ☐ Production monitoring: all material AI systems have live performance monitoring; drift detection operational; escalation thresholds defined
FREE-AI is not a compliance checkbox exercise — it is a framework that requires Indian financial institutions to build a genuine AI governance capability, not just document that they have one. The 26 recommendations will increasingly shape RBI's supervisory expectations as examination teams build AI governance assessment capacity. Banks that implement FREE-AI's architecture now — before it is tested in an examination — will be in a materially stronger position than those who respond reactively to examination findings.