Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector

What it is

FREE-AI is the Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector. The Reserve Bank of India set up a committee on 26 December 2024, chaired by Dr Pushpak Bhattacharyya of IIT Bombay, to recommend how AI should be adopted in Indian finance. Its report was placed on the RBI website on 13 August 2025.

The framework rests on seven sutras, the same seven principles later used in MeitY’s India AI Governance Guidelines.

• Trust is the Foundation
• People First
• Innovation over Restraint
• Fairness and Equity
• Accountability
• Understandable by Design
• Safety, Resilience and Sustainability

Under those sutras sit 26 recommendations grouped into six pillars. Three pillars enable innovation (Infrastructure, Policy and Capacity) and three mitigate risk (Governance, Protection and Assurance).

Who it applies to

The report is addressed to the financial sector. Some recommendations are for the RBI and other financial sector regulators, some for government and industry bodies, and many for regulated entities (REs) such as banks, non-banking financial companies and other entities the RBI supervises. It is a committee report, so it creates no obligations by itself. Regulated entities should read it as a strong indication of what supervisors will look for.

What it requires

The recommendations aimed at regulated entities are the ones an AI governance programme can act on.

• Board-approved AI policy (Rec. 14). A policy approved by the board covering governance structure and the other key areas of AI use.
• Data lifecycle governance (Rec. 15) and an AI system governance framework (Rec. 16).
• Product approval (Rec. 17). Bring AI into the product approval process.
• Consumer protection (Rec. 18). The report says consumers must be explicitly informed whenever they are interacting with AI.
• Cybersecurity (Rec. 19), red teaming (Rec. 20) and business continuity plans for AI systems (Rec. 21).
• AI incident reporting (Rec. 22). Regulators should set up a dedicated AI incident reporting framework for REs and fintechs, applied in a tolerant, good-faith way.
• AI inventory (Rec. 23). An internal inventory covering all models and use cases, updated at least half-yearly and available for supervisory inspection and audit, with a sector-wide repository held by regulators.
• AI audit framework (Rec. 24). Audit of AI systems, addressed to both supervisors and regulated entities.
• Disclosures (Rec. 25). AI disclosures in annual reports and on websites.

Recommendation 8 proposes an AI liability framework with a tolerant supervisory stance for first-time or one-off failures where safeguards were followed. That tolerance does not extend to repeated breaches, and regulated entities remain liable for customer losses.

The innovation pillar recommends financial sector data infrastructure, an AI innovation sandbox, incentives for smaller entities, indigenous financial AI models and integration with digital public infrastructure.

Key dates

• 26 December 2024. The RBI constitutes the FREE-AI committee.
• 13 August 2025. The committee report is published on the RBI website.
• 24 June 2026. The RBI issues a draft Guidance on Regulatory Principles for Model Risk Management. It applies to all models used by a wide range of regulated entities, including third-party and AI or ML models, and the RBI links it to the FREE-AI report.
• 24 July 2026. Comments on the draft model risk guidance close.

Check the RBI website for the status of the final model risk guidance and any directions that follow from FREE-AI.

How it relates to other frameworks

FREE-AI is the financial sector counterpart to the India AI Governance Guidelines, and the two share their principles. Personal data used by AI in finance remains subject to the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025.

Its recommendations line up closely with other financial supervisors’ expectations. The Monetary Authority of Singapore’s AI Risk Management Guidelines ask for an AI inventory, risk materiality assessment and lifecycle controls. ISO/IEC 42001 gives a management system structure that covers the policy, inventory, audit and incident elements. A bank already working to one of these will find most of FREE-AI familiar. The India-specific additions are the half-yearly inventory update, consumer notice whenever AI is in use and public disclosure of AI use.

A note on this page

This is Aicura’s reading of the FREE-AI report, written to help you understand it. It is not legal advice and it is not the report itself. Read the primary report and any later circulars on the RBI website, and take advice on how they apply to your organisation.