A bank’s chatbot answers a question about a loan EMI. A scoring model decides whether a small-business borrower gets a call back. Neither is unusual in Indian finance any more, and both sit inside a set of rules the Reserve Bank of India is still building. The RBI FREE-AI framework is where that work started: a committee report that set out how banks, NBFCs and other regulated entities should adopt artificial intelligence, followed by a draft guidance that would turn several of its ideas into supervisory expectations.
This explainer covers what the framework says, what has moved from report to draft, and what customers can reasonably expect from their bank today.
What FREE-AI is, and what it is not
FREE-AI stands for Framework for Responsible and Ethical Enablement of Artificial Intelligence. The RBI announced the committee in its Statement on Developmental and Regulatory Policies of 6 December 2024 and constituted it on 26 December 2024. The committee, chaired by Dr Pushpak Bhattacharyya of IIT Bombay, submitted its report, which the RBI placed on its website with a press release dated 13 August 2025.
The report is a committee’s recommendations to the regulator. It is not an RBI direction, and nothing in it is enforceable against a bank on its own. Its Recommendation 6 suggests that regulators consider a consolidated AI guidance; that is the step that would give the ideas legal force.
The seven Sutras
The report builds on seven principles it calls Sutras:
| Sutra | What the report says it means |
|---|---|
| Trust is the Foundation | AI should enhance, not erode, public trust in the financial system |
| People First | Final authority rests with humans, who should be able to override AI; people should be told when they are dealing with AI |
| Innovation over Restraint | Other things being equal, responsible innovation is preferred to cautionary restraint |
| Fairness and Equity | Outcomes should be unbiased and not discriminate against individuals or groups |
| Accountability | The entity that deploys AI stays accountable; accountability cannot be delegated to the model |
| Understandable by Design | Explainability is a design feature, with disclosures built in |
| Safety, Resilience and Sustainability | Systems should be secure, detect anomalies and be energy efficient |
Source: FREE-AI Committee Report, RBI, 13 August 2025, chapter 4.
Under these principles sit 26 recommendations in six pillars. Three pillars aim to enable innovation (Infrastructure, Policy, Capacity) and three to limit risk (Governance, Protection, Assurance).
What the report asks of banks and NBFCs
Most of the recommendations that touch customers fall in the risk pillars. The report says regulated entities should:
- adopt a board-approved AI policy covering governance, accountability, risk appetite, consumer protection, AI disclosures and liability (Recommendation 14);
- add AI risks to their product approval process (Recommendation 17);
- set up a board-approved consumer protection framework with transparency, fairness and accessible recourse, and educate customers about AI (Recommendation 18);
- report AI incidents into a sector-wide incident reporting framework (Recommendation 22);
- keep an internal inventory of all AI models, use cases, dependencies, risks and grievances, updated at least half-yearly (Recommendation 23);
- audit AI systems in proportion to their risk and disclose AI use in annual reports and on their websites (Recommendations 24 and 25).
On the innovation side, the report proposes shared financial-sector data infrastructure linked to the IndiaAI Mission’s AIKosh, an AI innovation sandbox and support for indigenous models built for Indian finance. Our explainer on the IndiaAI Mission covers AIKosh and the compute portal.
Why the committee thought rules were needed
The report rests on two RBI surveys. The Department of Supervision surveyed 612 entities between February and May 2025, and only 20.8% (127) were using or developing AI. Among the 127, the report found that 15% used interpretation tools, 18% kept audit logs, 21% monitored data or model drift and 28% relied on human-in-the-loop checks. The report also notes that only one-third of respondents, mainly large public and private sector banks, had some board-level framework for AI oversight.
In a separate FinTech Department survey of 76 entities, 67% were exploring at least one generative AI use case, mostly internal chatbots and basic customer support, and 85% of respondents asked for a regulatory framework.
From report to draft: the model risk guidance
On 24 June 2026 the RBI released the draft “Guidance on Regulatory Principles for Model Risk Management, 2026” for comments, which closed on 24 July 2026. The RBI’s press release presents it as following both a 2024 draft on credit models and the FREE-AI report. It would apply to commercial, small finance, payments, local area, regional rural and co-operative banks, NBFCs in all layers, all-India financial institutions, asset reconstruction companies and credit information companies.
The draft treats AI as one kind of model. A regulated entity would need a board-approved model risk management framework covering every model, including third-party and AI/ML models, and would stay accountable for their outcomes whoever built them. Chapter V adds principles for AI:
- explainability thresholds, set higher for models used in material decisions or with significant impact on customers (paragraph 54);
- controls against hallucination in generative AI, especially where outputs drive customer interaction or decisions;
- for customer-facing models, a disclosure that the user is dealing with an AI/ML system and its limitations, plus an option to switch to human assistance on request (paragraph 59);
- human oversight, including human-in-the-loop or human-on-the-loop arrangements, override and deactivation mechanisms including “kill-switch arrangements”, and periodic human review of model decisions (paragraph 60).
Paragraph 25 says an entity should not use any model that harms consumers, and that its grievance redressal should cover complaints arising from consumer-facing models. The draft also says, citing the RBI’s Utkarsh 2029 strategy, that further requirements for AI models may be issued later.
When this piece was written, the RBI’s list of draft notifications still showed the guidance as a draft. Until a final version is issued, it binds no one.
What customers can do now
Existing rules already apply whatever technology a bank uses. A complaint about a chatbot’s wrong answer or a decision you think a model got wrong goes through the bank’s grievance process, and then to the RBI Ombudsman if the bank does not resolve it; our guide to raising a UPI complaint walks through that escalation. Where a decision rests on your personal data, the DPDP Act’s accuracy duty also applies once its core obligations take effect.
Practical steps:
- Ask whether you are talking to a person or an automated system, and ask for a human if the answer matters.
- Keep screenshots of chatbot replies that give rates, charges or eligibility, and check them against the bank’s own published terms.
- If a loan or card application is declined, ask the bank for the reasons in writing.
Securities-market firms follow a separate track: see our explainer on SEBI’s AI/ML guidelines. For the government’s cross-sector approach, read India’s AI governance guidelines.
Sources
Reserve Bank of India, FREE-AI Committee Report, “Framework for Responsible and Ethical Enablement of Artificial Intelligence”, and press release “Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector”, both 13 August 2025 (chapters 3 and 4, Recommendations 6, 14, 17, 18, 22 to 25). Reserve Bank of India, press release “RBI issues draft ‘Guidance on Regulatory Principles for Model Risk Management’”, 24 June 2026, and the draft Guidance on Regulatory Principles for Model Risk Management, 2026 (paragraphs 2, 4, 8, 9, 25, 54, 59 and 60). RBI Draft Notifications/Guidelines list, checked on 15 October 2026. RBI documents are cited by name and date.
