RBI FREE-AI Framework Explained

What FREE-AI is, and why RBI commissioned it

The Reserve Bank of India constituted the FREE-AI Committee in December 2024, chaired by Dr. Pushpak Bhattacharyya (IIT Bombay), to recommend a framework for responsible and ethical AI adoption in the financial sector. The Committee submitted its report - Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) - to the RBI Governor on 13 August 2025.

The report draws on two RBI surveys: a 612-entity Department of Supervision survey and a 76-entity FinTech Department survey, both run between February and May 2025. The headline finding was low AI adoption - only 20.8% of the 612 supervised entities were using or developing AI at the time, concentrated in larger banks and NBFCs running simple rule-based models, with cybersecurity, credit underwriting, customer support and sales/marketing as the most common use cases.

The 7 Sutras - guiding principles

• Trust is the Foundation - trust in AI systems is non-negotiable and should remain uncompromised
• People First - AI should augment human decision-making but defer to human judgment
• Innovation over Restraint - foster responsible innovation with purpose, not blanket caution
• Fairness and Equity - AI outcomes should be fair and non-discriminatory
• Accountability - accountability for AI outcomes rests with the entity deploying it, never the model
• Understandable by Design - explainability is a design requirement, not an afterthought
• Safety, Resilience and Sustainability - AI systems should be secure, resilient and energy efficient

Six pillars, two sub-frameworks, 26 recommendations

The Committee organizes its 26 recommendations into two complementary sub-frameworks. An Innovation Enablement framework covers Infrastructure (shared data/compute, an AI Innovation Sandbox), Policy (adaptive regulation, a graded liability framework, a standing AI committee) and Capacity (AI skills within REs, regulators and the industry). A Risk Mitigation framework covers Governance (board-approved AI policy, data and model governance, product approval), Protection (consumer protection, cybersecurity, red teaming, business continuity, incident reporting) and Assurance (AI inventories, audits, public disclosures, compliance toolkits).

The recommendations with the clearest audit trail for REs

Not all 26 recommendations are equally actionable today - several depend on RBI, MeitY or industry bodies building shared infrastructure first. The ones a regulated entity can and should start on now, because they map directly onto what a future RBI inspection or vendor-security review would ask for, are:

• A board-approved AI policy with a low/medium/high risk classification for every AI use case (Recommendation 14)
• AI system governance covering the full model lifecycle, with explicit human oversight for autonomous AI in medium/high-risk use cases (Recommendation 16)
• AI-specific risk evaluations folded into the existing product approval process (Recommendation 17)
• Strengthened cybersecurity controls addressing AI-specific threats - adversarial attacks, data poisoning, model manipulation (Recommendation 19)
• Structured red-teaming, at least semi-annual for medium/high-risk AI applications (Recommendation 20)
• AI-specific additions to Business Continuity Plans, with fallback mechanisms for model degradation (Recommendation 21)
• A tiered AI incident reporting process, inspired by aviation-style near-miss reporting (Recommendation 22)
• A comprehensive internal AI inventory - models, use cases, dependencies, risk tier, grievances - updated at least half-yearly (Recommendation 23)
• A risk-based AI audit framework, with independent third-party audits for high-risk or complex use cases (Recommendation 24)
• AI-related disclosures in annual reports, alongside existing climate and cybersecurity disclosures (Recommendation 25)

Is FREE-AI mandatory right now?

No. As of this guide's last update, FREE-AI remains a Committee report submitted to the RBI Governor - it has the status of a strong policy signal, not a Master Direction or binding circular. Recommendation 6 itself proposes that RBI 'may consider issuing consolidated AI Guidance' built on the 7 Sutras as a future step, which is explicit confirmation that one doesn't yet exist.

That said, treating it as optional is a mistake. RBI has a consistent pattern of turning committee recommendations into binding directions within one to two years (the 2026 Commercial Banks Cybersecurity Directions followed exactly this path). Building the board-approved AI policy, model inventory and red-teaming cadence now means you're compliant on day one of whatever RBI eventually issues, rather than scrambling with a deadline attached.

What this means if you supply AI or technology to a regulated entity

The Committee's own gap analysis (Annexure IV) flags that RBI's existing outsourcing guidelines don't yet explicitly cover AI-specific governance, risk mitigation and data-confidentiality obligations for third-party AI vendors - but it recommends closing that gap, not leaving it open. If you sell an AI/ML model, GenAI tool or AI-enabled service to a bank or NBFC, expect your contract and vendor-security review to start asking about model documentation, red-teaming evidence, bias testing and incident-reporting commitments, whether or not RBI has formally mandated it yet for your client.