RBI FREE-AI

• RBI set up an expert committee (chaired by Prof. Pushpak Bhattacharyya, IIT Bombay) which published the FREE-AI report on 13 Aug 2025.
• It rests on 7 Sutras (principles): Trust is the Foundation; People First; Innovation over Restraint; Fairness and Equity; Accountability; Understandable by Design; Safety, Resilience and Sustainability.
• It makes 26 recommendations under 6 pillars: Infrastructure, Policy, Capacity (innovation side) and Governance, Protection, Assurance (risk side).
• Recommendations 14 to 25 are the ones that land on regulated entities (REs): board-approved AI policy, data and model governance, product approval, consumer protection, cyber, red teaming, AI BCP, incident reporting, AI inventory, audit and disclosures.
• Status (as of 2026-10-19): still a committee report. RBI has not issued binding Directions implementing it. The closest follow-up is RBI's draft model risk guidance of 24 Jun 2026, which cites FREE-AI as background and covers AI/ML models; it was not final at the time of checking.

• Entities regulated by RBI: banks, NBFCs, payment system operators, all-India financial institutions; FinTechs are named in some recommendations (sandbox, incident reporting).
• Many recommendations are addressed to regulators and industry bodies (Recs 1 to 9, 11 to 13, 26), not to REs.
• Not extraterritorial. A foreign AI vendor is reached only indirectly, through the RE's third-party and outsourcing obligations.

• No penalties in the report. It is a set of recommendations.
• Recommendation 8 proposes a graded liability approach: REs stay liable for customer losses, but supervisors should go easy on a first-time lapse if the RE followed safeguards like incident reporting, audits and red teaming. That leniency should not apply to repeat breaches, gross negligence or failure to fix issues.
• Para 4.4.64: where a customer is harmed, the RE should compensate; reporting an incident should not by itself trigger penal action if corrective steps are timely.
• Enforcement in practice would come later, through RBI Directions or guidance (for example the draft model risk guidance) and supervisory inspection.

• Banks, NBFCs, payment companies: treat Recs 14 to 25 as the checklist RBI supervisors will reference. Most items reappear in the June 2026 draft model risk guidance (board-approved framework, inventory, red teaming, customer AI disclosure, human switch, kill switch).
• AI vendors selling to BFSI: expect customers to ask for model documentation, red-team results, incident cooperation and audit rights, because REs remain accountable for third-party AI.
• FinTechs partnering with REs: your AI features will be pulled into the RE's product approval and inventory.
• It overlaps heavily with ISO 42001; an AIMS covers much of the governance pillar.

Recommendations are addressed to REs unless noted. "Para" numbers are from Chapter 4 of the official report.

• Board resolution approving the AI policy, plus the policy itself (compare with the outline in Annexure V of the report).
• Risk classification method and the current tier of each AI use case.
• Committee charters or minutes showing who owns AI risk.
• AI inventory export with the fields in Para 4.4.68 and a change log showing half-yearly updates.
• Model documentation, validation reports and drift monitoring dashboards.
• Product approval records for AI products, showing the independent evaluator.
• Customer-facing screens or scripts that disclose AI and offer a human option.
• Grievance logs tagged for AI, with resolution outcomes.
• Red-team reports with dates, scope, findings and remediation.
• AI BCP, fallback runbooks and drill results.
• AI incident register and any reports filed.
• AI audit plan, internal and third-party audit reports.
• AI section of the annual report and website.
• Training records for Board, senior management and staff.

• Calling FREE-AI "in force". It is a committee report; cite it as expected practice and watch for RBI Directions.
• Writing an AI policy that never gets to the Board.
• Leaving staff use of ChatGPT-style tools out of scope of the policy.
• An inventory that only lists in-house models and skips vendor AI, or is never refreshed.
• Red teaming only once before launch, even for high-risk models.
• Chatbots that do not say they are AI or have no route to a human.
• BCP plans that only cover outages and ignore silent model degradation.
• Assuming a vendor's certificate shifts liability; the RE stays responsible.

• RE (Regulated Entity): a bank, NBFC or other body supervised by RBI.
• Sutra: a guiding principle; the Sanskrit word means "thread".
• Red teaming: deliberately attacking your own AI to find weaknesses before others do.
• Model drift: a model getting less accurate because real-world data has shifted away from its training data.
• BCP (Business Continuity Plan): the plan for keeping a service running when a system fails.
• Autonomous AI: AI that can act (for example move money) without a human approving each step.
• 1601 series: a phone number series the report names as a verified channel for AI voice interactions with customers.
• EmTech Repository: a repository run by the Reserve Bank Innovation Hub that the report suggests expanding into a sector-wide AI register.

• A committee report, not a Direction: status is voluntary or expected practice until RBI issues rules.
• 30 RE-facing obligations come from Recs 10 and 14 to 26; they read like an ISO 42001 plus AI security checklist.
• RBI's June 2026 draft model risk guidance already carries several items forward (board framework, inventory, red teaming, AI disclosure, human switch, kill switch), so preparing now is low regret.

• FREE-AI Committee Report, RBI publications page (13 Aug 2025), accessed 2026-10-19
• FREE-AI report PDF, accessed 2026-10-19
• Annexure VI, AI Incident Reporting Form (indicative), accessed 2026-10-19
• RBI Press Release 2025-2026/902, report released, accessed 2026-10-19
• RBI Press Release 2026-2027/528, draft Guidance on Regulatory Principles for Model Risk Management, accessed 2026-10-19
• Draft model risk guidance text, accessed 2026-10-19