If you run technology, risk, or compliance at an Indian financial institution, the most important regulatory development of the last 18 months did not arrive as a circular. It arrived as an 80-page committee report.
On 13 August 2025, the RBI released the report of the Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) committee, chaired by Dr. Pushpak Bhattacharyya of IIT Bombay. The framework lays out seven guiding “Sutras”, six strategic pillars, and 26 recommendations that will reshape how every Scheduled Commercial Bank, NBFC, Payment System Operator, and RBI-regulated fintech adopts AI for the next decade.
Here is the part most CTOs are missing: while the framework itself is currently advisory, its provisions are explicitly intended to be incorporated into RBI Master Directions. Once that happens — and signals from RBI through 2025 and 2026 suggest it will happen in stages — the framework becomes binding. The institutions that prepare in 2026 will pass audits in 2027. The ones that wait will spend 2027 explaining to supervisors why they did not.
This guide is for the people who have to operationalise this. Not the legal summary. The execution playbook.
Where Indian BFSI Actually Stands on AI Today
Before discussing what to do, understand what RBI knows about you. The FREE-AI Committee ran two surveys covering banks, NBFCs, and fintechs. The results, in their own data:
- Approximately 21% of surveyed entities were using or developing AI systems.
- Among 171 surveyed NBFCs, only 27% were using AI in any form.
- No AI adoption was reported by Tier 1 Urban Cooperative Banks. Tier 2 and Tier 3 UCB adoption was below 10%.
- Asset Reconstruction Companies: zero AI adoption observed.
- Adoption that exists is largely simple rule-based models, not advanced ML or generative AI.
- Primary use cases: customer support (15.6%), credit underwriting (13.7%), sales and marketing (11.8%), cybersecurity (10.6%).
- 67% of surveyed entities expressed interest in exploring AI use cases.
The takeaway: India’s financial sector is at the beginning of its AI journey, not in the middle of it. The regulator knows this. The framework is being designed to bring laggards up — which means baseline expectations are coming for everyone.
The Seven Sutras: What They Actually Mean for Your Architecture
The FREE-AI framework distils its philosophy into seven principles. Most legal summaries reproduce them verbatim. Here is what each one forces you to build.
1. Trust as the foundation
Every AI system must be auditable end-to-end. Architecturally, this means logging at the model decision level — not just transaction level. If your fraud model declines a loan, you must be able to reconstruct, six months later, exactly what features drove the decision.
2. People first — humans retain final authority
AI cannot be the final decision-maker on consumer-affecting outcomes. Architecturally: every autonomous AI workflow needs an override path and a human escalation queue. This is not optional UI polish; it is regulatory necessity.
3. Innovation over restraint
The regulator is not trying to slow you down. This Sutra exists to give compliance teams permission to ship. Use it. When risk teams resist AI deployments citing “uncertainty”, point to Sutra 3.
4. Fairness, equity, and inclusion
Architecturally: you need a bias audit pipeline. Not a one-time review. A pipeline that runs on every model retrain, with documented thresholds and rollback triggers.
5. Accountability
Liability cannot be outsourced to your AI vendor. The regulated entity is accountable, full stop. This forces a contracting change — your vendor agreements need indemnification, audit rights, and explicit AI-risk clauses.
6. Understanding by design (explainability)
Black-box models in consumer-facing decisions are now a regulatory red flag. Architecturally: SHAP, LIME, or equivalent interpretation layers must be production-grade, not data-science notebooks. Customers and regulators must be able to ask “why” and get an answer.
7. Safety, resilience, and sustainability
AI systems must be hardened against adversarial attacks, model poisoning, and drift. Architecturally: model monitoring is now a Tier-1 production system, not a quarterly report.
The Six Pillars and the Master Directions Being Amended
The FREE-AI framework operates across six pillars: Innovation Enablement, Governance, Risk Management, Data Stewardship, Model Lifecycle Management, and Stakeholder Engagement. What matters for execution is which of your existing RBI Master Directions are being amended to incorporate AI obligations. Here is the practical map.
Master Direction on IT Governance, Risk, Controls and Assurance Practices
Amendment direction: Provisions for managing access to autonomous AI systems, accountability for autonomous decisions, security of AI models in production. What you must do: Update your IT governance policy to include an AI section. Get it board-approved.
Master Direction on Outsourcing of IT Services
Amendment direction: Service providers must disclose AI usage in service delivery; AI-specific risk assessments required for outsourcing arrangements. What you must do: Re-paper every active vendor contract that touches AI. Add AI disclosure, audit rights, and bias-accountability clauses.
Master Direction on Fraud Risk Management (July 2024)
Amendment direction: Active encouragement of AI for early warning signs of fraud, with regular accuracy testing. What you must do: This direction is already in force. If you do not have an AI-driven Early Warning System integrated with your CBS, you are already non-compliant — see the March 2026 Supreme Court directive for the latest reinforcement.
Cyber Security Framework in Banks
Amendment direction: AI-related risks added — model poisoning, adversarial attacks, AI-specific incident reporting. What you must do: Extend your existing cybersecurity policy and incident response runbooks to cover AI-specific threats. Train your SOC team accordingly.
Guidelines on Digital Lending
Amendment direction: Mandatory transparency in AI-driven credit assessment; fairness audits to detect algorithmic bias. What you must do: Document every feature your underwriting model uses. Disclose AI usage to borrowers. Build a fairness-audit cadence into your model governance.
Master Circular on Customer Service in Banks
Amendment direction: Customers must be notified when interacting with AI; right to challenge AI-driven decisions. What you must do: Disclosure language on every chatbot, robo-advisor, and AI-driven communication. Grievance redressal pathway specifically for AI decisions.
The Board-Level AI Governance Policy: What Must Be In It
The single most concrete recommendation in the FREE-AI report is this: every regulated entity must adopt a board-approved AI Policy. Not a tech team policy. A board policy.
If you are a CTO, your job in 2026 is to draft this and get it approved. Here is what a regulator-acceptable AI Policy actually contains:
Section 1 — Scope and Definitions
- What constitutes “AI” for the purposes of the policy (rule-based, ML, deep learning, generative, agentic — all defined separately).
- Which business processes the policy covers.
- Definitions of “high-risk” vs “low-risk” AI use cases.
Section 2 — Governance Structure
- Board oversight committee (typically Risk Committee with AI as a standing agenda item).
- Management-level AI Risk Committee.
- Roles: AI sponsor, AI custodian, model owner, validator, auditor.
- Permanent AI Standing Committee under RBI is a recommendation in the framework — your internal structure should mirror this.
Section 3 — AI Lifecycle Management
- Use-case approval workflow.
- Pre-deployment AI Impact Assessment (mandatory).
- Model validation, including bias and fairness testing.
- Production monitoring, drift detection, retraining cadence.
- Decommissioning and rollback protocols.
Section 4 — Risk Management
- Categorisation of AI risks: model risk, data risk, third-party risk, conduct risk, cyber risk.
- Risk appetite statement specifically for AI.
- Mitigation controls per risk category.
Section 5 — Data Governance
- DPDP Act 2023 alignment.
- Data minimisation principle.
- Data lineage from ingestion to decision.
- Synthetic data and federated learning policy where relevant.
Section 6 — Third-Party and Vendor Management
- AI vendor due diligence framework.
- Contractual requirements (audit rights, indemnification, AI disclosure).
- Concentration risk monitoring (if 80% of your AI capability runs on one cloud, that is a finding).
Section 7 — Consumer Protection
- AI disclosure protocol.
- Grievance redressal for AI-driven decisions.
- Override and appeal pathway.
- Communication standards for AI-related incidents.
Section 8 — Cybersecurity for AI
- Adversarial attack defence.
- Model poisoning detection.
- AI-specific incident response.
- Reporting protocols (aligned with RBI cyber incident reporting).
Section 9 — Audit and Assurance
- Internal audit cadence for AI systems.
- External audit triggers.
- Regulator examination readiness — pre-built artefacts for RBI inspections.
Section 10 — Review and Amendment
- Annual board review.
- Trigger events for off-cycle amendment.
If your current AI policy is a 2-page document or a section in your IT policy, it is not enough. The framework expects a stand-alone, board-approved policy.
Graded Liability: The Most Important Concept Most CTOs Have Missed
Buried in the framework is a recommendation that will define your regulatory experience for the next decade: graded liability.
The principle is simple and pragmatic. Regulated entities remain accountable for customer harm caused by AI. However, the supervisory approach will be flexible where the entity has demonstrably implemented robust safety measures — incident protocols, bias audits, board-approved policies, model documentation.
In plain English: if something goes wrong, having the documented governance in place is the difference between a supervisory observation and a regulatory penalty.
This is why governance is not paperwork. It is your insurance policy.
What MuleHunter.AI Tells You About RBI’s Direction
In parallel with the FREE-AI report, RBI rolled out MuleHunter.AI — an AI/ML system developed by the Reserve Bank Innovation Hub to combat mule account fraud. The March 2026 revised framework on digital banking fraud explicitly promotes MuleHunter.AI as an industry-wide tool.
Why this matters strategically: the regulator is no longer just permitting AI in BFSI — it is building AI tools and asking the industry to use them. When regulators build infrastructure, they expect adoption. Your AI roadmap should explicitly map to RBI-promoted tools where they exist (MuleHunter.AI for mule detection, AI Kosh for data infrastructure under the IndiaAI Mission, the proposed AI Innovation Sandbox for testing).
A Practical 2026 Roadmap for Your BFSI Institution
Here is the sequence we recommend to BFSI clients planning their 2026 compliance posture.
Q2 2026 (now — by end of June)
- Commission an AI inventory. Every model, every use case, every vendor. You cannot govern what you have not inventoried.
- Draft board-approved AI Policy (skeleton). Get the structure approved even if every section is not finalised.
- Re-paper top 5 AI vendor contracts. Add disclosure, audit, indemnification clauses.
Q3 2026 (July – September)
- Operationalise AI Impact Assessment process. No new AI deployments without it.
- Stand up AI Risk Committee (management-level). Monthly cadence.
- Bias audit pipeline live for at least one production model (start with credit underwriting if you have it).
- Update incident response runbooks for AI-specific scenarios.
Q4 2026 (October – December)
- Full board-approved AI Policy ratified.
- Customer disclosure language live across chatbots, AI-driven communications, and adverse-action letters.
- Audit dry-run with internal audit specifically on AI controls.
- Submit your AI Policy as a board pack item to your supervisory dialogue with RBI.
Institutions that complete this by December 2026 will face the inevitable Master Direction codification from a position of strength. Those that defer will be on the back foot for two years.
What Most Vendors Will Not Tell You
Three uncomfortable truths from the implementation side:
1. Most “AI compliance” tools are document automation. They generate the policy PDFs. They do not build the governance infrastructure. The policy is the easy part.
2. The expensive part is data. You cannot do explainable AI on a data foundation that lacks lineage. You cannot do bias audits without demographic data you may not have collected. Often the AI compliance project is actually a data infrastructure project wearing a different name.
3. Vendor concentration risk is the next regulatory frontier. If 90% of Indian BFSI runs critical AI on the same two cloud providers and the same three foundation models, the regulator will eventually treat it the way RBI treats third-party payment processor concentration. Plan for this now — diversify, document, and be ready for the supervisory question.
Final Thought for BFSI Leadership
The institutions that will define the next decade of Indian financial services are the ones treating AI governance as a strategic capability, not a compliance burden. The Seven Sutras are not legal jargon. They are an architectural manifesto. The Master Directions being amended are not a paperwork exercise. They are the operating system of your future supervisory relationship.
There is a closing window — roughly the next nine months — to get this right calmly, on your own terms, before the framework hardens into binding direction and your competitors have already done the work.
Want a Confidential AI Compliance Maturity Assessment?
Prabalya works with Indian banks, NBFCs, and PSOs to assess current AI governance maturity, map specific FREE-AI framework gaps, and build the operational infrastructure — board-approved policy, AI Risk Committee charter, bias audit pipeline, incident response runbooks — required for the regulatory environment of 2027 and beyond.
Our enterprise relations team can schedule a 60-minute briefing with your CTO, CRO, and Compliance Head. We bring sector-specific data, not generic decks.
Contact: contact@prabalya.com | +91 73700 70555 Request a Briefing →
Frequently Asked Questions
Q: Is the RBI FREE-AI framework legally binding today? Not yet. The framework released on 13 August 2025 is currently advisory. However, RBI has signalled that its provisions will be incorporated into Master Directions in stages, at which point compliance becomes mandatory for all regulated entities.
Q: Which RBI-regulated entities does the framework apply to? All Scheduled Commercial Banks, Cooperative Banks, NBFCs (including HFCs), Payment System Operators, and fintechs operating under RBI’s regulatory ambit. Offshore AI vendors are drawn into the compliance net indirectly through their Indian RE clients.
Q: What is the single most important compliance step for a BFSI CTO in 2026? Drafting and ratifying a board-approved AI Policy. Without it, every other AI governance activity lacks regulatory standing.
Q: How does graded liability work? Regulated entities remain accountable for AI-driven customer harm. However, supervisory leniency may apply where the entity has demonstrably implemented robust safety measures — board-approved policies, AI Impact Assessments, bias audits, and incident reporting protocols.
Q: Do I need a separate AI Risk Committee, or can existing committees cover it? The framework expects governance to be visibly distinct. Most institutions are creating a management-level AI Risk Committee that reports into the existing Board Risk Committee, with AI as a standing agenda item.
Q: How does the framework interact with the DPDP Act 2023? The framework explicitly aligns AI data governance with the DPDP Act. Data minimisation, consent management, and lawful processing under DPDP are baseline requirements for any AI system handling personal data.