What RBI's FREE-AI framework asks of banks, in plain terms
The framework favours innovation and asks for governance in return. For most lenders, the hard part is knowing which AI they already use.
Amogh Suman
In August 2025 the Reserve Bank of India published the report of its committee on a Framework for Responsible and Ethical Enablement of Artificial Intelligence, known as FREE-AI. It is the clearest statement so far of how India's banking regulator thinks about AI, and it is worth reading in full. This is a plain summary of what it asks for and where I think regulated entities will struggle.
Seven principles
The report is built on seven principles it calls sutras:
- trust is the foundation
- people first
- innovation over restraint
- fairness and equity
- accountability
- understandable by design
- safety, resilience and sustainability
The third one sets the tone. The committee treats innovation and risk control as goals to pursue together, not as a trade-off. That is a deliberate signal to banks and NBFCs that the regulator does not want AI to be avoided out of caution.
Twenty-six recommendations
The principles lead to 26 recommendations under six pillars. Three of the pillars are about enabling AI: shared infrastructure, policy and capacity. The other three are about managing its risks: governance, protecting customers, and checking that AI systems behave as intended over time. The report also includes practical material, such as a suggested outline for a board-approved AI policy and a sample form for reporting AI incidents.
What it means for a bank or NBFC
Read as a to-do list, the framework asks for four things.
- A board-approved AI policy that says what the institution will and will not use AI for, and who is accountable.
- A view of every AI system in use, including models inside vendor products. Most institutions do not have this today.
- Customer protection built in: customers should know when they are dealing with AI, and there should be a way to reach a person and to seek redress.
- Monitoring and incident reporting, so that a model that drifts or fails is caught and recorded.
The hardest recommendation for most lenders is not the policy. It is knowing every place they already use AI.
Where institutions will struggle
The policy is the easy part. A board can approve a well-drafted document in a quarter. The inventory is hard. AI arrives inside credit decision engines, fraud tools, call centre software and marketing platforms, often without anyone recording it as AI. A mid-sized lender may have dozens of such systems and no single list of them.
The second difficulty is skills. Monitoring a model for drift or bias needs people who understand both the model and the business it serves. Few institutions outside the largest banks have them in-house.
What it leaves out
The framework is a good start because it is practical. The institutions that benefit most will be the ones that treat it as a way to scale AI safely, not as one more document to file.