# RBI FREE-AI Framework Explained > Updated 2026-11-05 - 9 min read If you're a bank, NBFC or fintech weighing how seriously to take RBI's FREE-AI report, here's the short version: it isn't law yet, but it reads like a preview of one. This guide covers what the framework actually says, which of its 26 recommendations already have a clear audit trail, and what to do about it before RBI turns any of this into a Master Direction. ## What FREE-AI is, and why RBI commissioned it The Reserve Bank of India constituted the FREE-AI Committee in December 2024, chaired by Dr. Pushpak Bhattacharyya (IIT Bombay), to recommend a framework for responsible and ethical AI adoption in the financial sector. The Committee submitted its report - Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) - to the RBI Governor on 13 August 2025. The report draws on two RBI surveys: a 612-entity Department of Supervision survey and a 76-entity FinTech Department survey, both run between February and May 2025. The headline finding was low AI adoption - only 20.8% of the 612 supervised entities were using or developing AI at the time, concentrated in larger banks and NBFCs running simple rule-based models, with cybersecurity, credit underwriting, customer support and sales/marketing as the most common use cases. ## The 7 Sutras - guiding principles - Trust is the Foundation - trust in AI systems is non-negotiable and should remain uncompromised - People First - AI should augment human decision-making but defer to human judgment - Innovation over Restraint - foster responsible innovation with purpose, not blanket caution - Fairness and Equity - AI outcomes should be fair and non-discriminatory - Accountability - accountability for AI outcomes rests with the entity deploying it, never the model - Understandable by Design - explainability is a design requirement, not an afterthought - Safety, Resilience and Sustainability - AI systems should be secure, resilient and energy efficient ## Six pillars, two sub-frameworks, 26 recommendations The Committee organizes its 26 recommendations into two complementary sub-frameworks. An Innovation Enablement framework covers Infrastructure (shared data/compute, an AI Innovation Sandbox), Policy (adaptive regulation, a graded liability framework, a standing AI committee) and Capacity (AI skills within REs, regulators and the industry). A Risk Mitigation framework covers Governance (board-approved AI policy, data and model governance, product approval), Protection (consumer protection, cybersecurity, red teaming, business continuity, incident reporting) and Assurance (AI inventories, audits, public disclosures, compliance toolkits). ## The recommendations with the clearest audit trail for REs Not all 26 recommendations are equally actionable today - several depend on RBI, MeitY or industry bodies building shared infrastructure first. The ones a regulated entity can and should start on now, because they map directly onto what a future RBI inspection or vendor-security review would ask for, are: - A board-approved AI policy with a low/medium/high risk classification for every AI use case (Recommendation 14) - AI system governance covering the full model lifecycle, with explicit human oversight for autonomous AI in medium/high-risk use cases (Recommendation 16) - AI-specific risk evaluations folded into the existing product approval process (Recommendation 17) - Strengthened cybersecurity controls addressing AI-specific threats - adversarial attacks, data poisoning, model manipulation (Recommendation 19) - Structured red-teaming, at least semi-annual for medium/high-risk AI applications (Recommendation 20) - AI-specific additions to Business Continuity Plans, with fallback mechanisms for model degradation (Recommendation 21) - A tiered AI incident reporting process, inspired by aviation-style near-miss reporting (Recommendation 22) - A comprehensive internal AI inventory - models, use cases, dependencies, risk tier, grievances - updated at least half-yearly (Recommendation 23) - A risk-based AI audit framework, with independent third-party audits for high-risk or complex use cases (Recommendation 24) - AI-related disclosures in annual reports, alongside existing climate and cybersecurity disclosures (Recommendation 25) ## Is FREE-AI mandatory right now? No. As of this guide's last update, FREE-AI remains a Committee report submitted to the RBI Governor - it has the status of a strong policy signal, not a Master Direction or binding circular. Recommendation 6 itself proposes that RBI 'may consider issuing consolidated AI Guidance' built on the 7 Sutras as a future step, which is explicit confirmation that one doesn't yet exist. That said, treating it as optional is a mistake. RBI has a consistent pattern of turning committee recommendations into binding directions within one to two years (the 2026 Commercial Banks Cybersecurity Directions followed exactly this path). Building the board-approved AI policy, model inventory and red-teaming cadence now means you're compliant on day one of whatever RBI eventually issues, rather than scrambling with a deadline attached. ## What this means if you supply AI or technology to a regulated entity The Committee's own gap analysis (Annexure IV) flags that RBI's existing outsourcing guidelines don't yet explicitly cover AI-specific governance, risk mitigation and data-confidentiality obligations for third-party AI vendors - but it recommends closing that gap, not leaving it open. If you sell an AI/ML model, GenAI tool or AI-enabled service to a bank or NBFC, expect your contract and vendor-security review to start asking about model documentation, red-teaming evidence, bias testing and incident-reporting commitments, whether or not RBI has formally mandated it yet for your client. ## FAQ **What does FREE-AI stand for?** Framework for Responsible and Ethical Enablement of Artificial Intelligence - the RBI Committee report submitted to the Governor on 13 August 2025. **Is FREE-AI a new RBI regulation?** No. It's a Committee recommendation report, not a Master Direction or binding circular. Recommendation 6 itself proposes that RBI may later issue consolidated AI Guidance based on it - confirm the current status on rbi.org.in before treating any recommendation as mandatory. **Does FREE-AI apply to FinTechs, or only banks and NBFCs?** The report's terms of reference cover banks, NBFCs, FinTechs and Payment System Operators. Several recommendations (the AI Innovation Sandbox, the data infrastructure) explicitly include FinTechs as intended beneficiaries and participants. **What should a regulated entity do first?** Start with a board-approved AI policy that classifies your AI use cases by risk, and a basic AI inventory - these two are foundational to nearly every other recommendation (red-teaming cadence, audit scope, incident reporting) and are the first things a future inspection would ask to see. **How is FREE-AI different from SEBI's AI/ML consultation paper?** They cover different regulators and sectors - FREE-AI is RBI's framework for banks, NBFCs and the broader financial sector; SEBI's 2025 consultation paper addresses responsible AI/ML usage specifically in Indian securities markets. An entity regulated by both may need to satisfy both.