Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector

The RBI has historically regulated technology in a technology-neutral way, through directions on IT governance, cybersecurity, outsourcing, digital lending and customer service. The FREE-AI Committee found that these directions already address many AI risks implicitly, but not explicitly.¹ In its Statement on Developmental and Regulatory Policies of 6 December 2024, the RBI announced a committee to develop a Framework for Responsible and Ethical Enablement of AI (FREE-AI) in the financial sector.¹ The Committee's terms of reference were to assess AI adoption in India and globally, review regulatory and supervisory approaches, identify risks and recommend an evaluation, mitigation and monitoring framework for banks, NBFCs, fintechs and payment system operators, and recommend a governance framework for responsible adoption.¹

The Committee was chaired by Dr. Pushpak Bhattacharyya of IIT Bombay. Its members were Debjani Ghosh (NITI Aayog Distinguished Fellow and former NASSCOM president), Prof. Balaraman Ravindran (IIT Madras), Abhishek Singh (Additional Secretary, MeitY), Rahul Matthan (Trilegal), Anjani Rathor (HDFC Bank) and Sree Hari Nagaralu (Microsoft India), with Suvendu Pati of the RBI's FinTech Department as Member Secretary.¹ It followed a four-pronged method of stakeholder engagement, two surveys with follow-up interviews, a review of global literature and approaches, and an analysis of existing RBI directions. It met stakeholders ranging from Sarvam AI, Microsoft, Infosys and NPCI to Nandan Nilekani and the Vidhi Centre for Legal Policy, and its secretariat consulted more than 50 banks, NBFCs, fintechs and technology firms, including OpenAI.¹ The RBI published the report on 13 August 2025.¹³

The RBI's Department of Supervision surveyed 612 supervised entities, representing close to 90% of sector assets, between February and May 2025. The FinTech Department ran a more detailed survey of 76 entities and interviewed the technology heads of 55 of them.¹ Key findings included:

The Committee concluded that adoption was concentrated in large institutions using relatively simple models, and that smaller entities faced barriers of talent, cost, data quality, compute and legal uncertainty. It also found that data governance for model training was fragmented and that post-deployment monitoring was weak.¹³

The report's seven Sutras are its guiding principles:¹

1. Trust is the Foundation: trust is non-negotiable.
2. People First: AI should augment human decision-making but defer to human judgment and citizen interest.
3. Innovation over Restraint: foster responsible innovation with purpose.
4. Fairness and Equity: outcomes should be fair and non-discriminatory.
5. Accountability: accountability rests with the entities deploying AI.
6. Understandable by Design: explainability is built in.
7. Safety, Resilience and Sustainability: systems should be secure, resilient and energy-efficient.

The 26 recommendations are spread across six pillars:¹

On consumers, the Committee wrote that customers "must be explicitly informed whenever they are interacting with AI systems", should always have the option to switch to human representatives, and should be able to challenge AI-driven decisions through grievance mechanisms.¹ Annexures set out suggested AI-specific changes to existing RBI directions on outsourcing, cybersecurity, digital lending, customer service, fraud risk and IT governance, along with an outline board AI policy and an indicative AI incident reporting form.¹

The report presents innovation and risk mitigation as "complementary forces" to be pursued together rather than traded off, an approach summed up in the Sutra "Innovation over Restraint".¹ Two recommendations depart most clearly from conventional prudential practice:

• Graded liability (Recommendation 8). Because AI systems are probabilistic and non-deterministic, the Committee recommends that regulated entities remain liable to customers for losses. Supervisors, however, should take an accommodative stance where an entity has followed safeguards such as incident reporting, audits and red teaming. This leniency would be limited to first-time or one-off aberrations and denied for repeated breaches, gross negligence or failure to remediate.¹
• Tolerant incident reporting (Recommendation 22). Reporting AI incidents should not by itself trigger penal action if corrective action is timely and disclosure complete. Customers who are harmed must still be compensated.¹

The report also recommends a lighter compliance touch for low-risk AI uses that advance financial inclusion (Recommendation 7). It calls for indigenous multilingual models because general-purpose LLMs are trained largely on Western-centric data, and it flags emerging agentic protocols such as MCP and agent-to-agent frameworks as a coming governance challenge.¹³

The report is not a direction and creates no binding obligations. RBI Governor Sanjay Malhotra named artificial intelligence as one of five fintech priorities at the Global Fintech Fest on 8 October 2025, citing the Committee's recommendations on data systems, compute and indigenous models.⁵

The first regulatory follow-through came on 24 June 2026, when the RBI released a draft Guidance on Regulatory Principles for Model Risk Management for comments until 24 July 2026. The RBI's press release links the draft to its 2024 draft principles on credit model risk and to the FREE-AI report. It says the guidance would apply to "all models used by regulated entities, including third party models and models employing AI / ML" at commercial, small finance, payments, local area, regional rural and co-operative banks, AIFIs, NBFCs, asset reconstruction companies and credit information companies.² As reported by MediaNama, the draft would require:⁴

• a board-approved model risk management framework covering tiering, inventory, validation, monitoring and decommissioning;
• risk classification of AI models that takes account of their autonomy and the degree of reliance on their outputs;
• human oversight arrangements, including kill-switch arrangements that allow any AI system to be overridden, suspended or deactivated;
• explainability thresholds, controls against hallucination, fairness assessments and red-teaming, particularly for generative AI;
• independent validation of third-party models and contractual access to technical documentation; and
• disclosure to customers that they are dealing with an AI system, with the option to switch to a human.

The draft states that further AI-specific requirements may be issued later.⁴

FREE-AI is the most detailed AI governance framework issued by an Indian financial regulator. It closely follows the Union government's preference for principle-based, innovation-first governance over a horizontal AI statute. MediaNama noted its emphasis on India-specific multilingual models, AI integrated with digital public infrastructure such as UPI and Account Aggregators, and its treatment of autonomous AI systems.³

The report's own survey data shows the gap it is trying to close. Most surveyed entities lacked dedicated policies for training data, data lineage systems or drift monitoring, and smaller co-operative banks and NBFCs had barely begun using AI.¹ The tolerant supervisory stance is balanced by a rule that entities stay fully liable to customers. Only supervisory penalties are relaxed, and only for first-time failures.¹ Because the framework is non-binding, its practical effect depends on how far the RBI turns it into directions. The June 2026 model risk draft is the first such step, and it makes kill switches, explainability and human oversight supervisory expectations instead of voluntary good practice.²⁴

As of 14 October 2026 the FREE-AI report remains a published, non-binding framework. The draft Guidance on Regulatory Principles for Model Risk Management of 24 June 2026 closed for comments on 24 July 2026. The RBI's draft and press release listings consulted for this entry did not show a final version as of mid-October 2026.² The sources reviewed did not confirm whether the RBI has set up the recommended AI Standing Committee, the financial-sector AI sandbox or a sector-wide AI incident repository.