WARRANT13 August 2025, and what it meant.
The Reserve Bank of India released the Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector on 13 August 2025. The release was announced under press release reference 2025-2026/902. The release closed an arc that started eight months earlier, when the RBI's Statement on Developmental and Regulatory Policies dated 6 December 2024 announced the constitution of a committee to study AI adoption in Indian financial services and recommend a governance framework. The committee was formally constituted on 26 December 2024 under press release 2024-2025/1779.
The publication moment matters in three ways at once. First, it is the first integrated AI policy document any Indian financial regulator has produced. SEBI had circulated a Retail Algo Framework consultation in 2024 covering algorithmic trading on Indian exchanges; IRDAI had a draft on InsurTech sandboxes; IFSCA had run AI sandbox cohorts at GIFT City. None of these spoke to the cross-cutting use-cases banks and NBFCs were already running: AI-driven credit underwriting, fraud screening, KYC verification, and customer-service automation. FREE-AI is the first document that names these use-cases together and describes a single governance model.
Second, FREE-AI lands at a measured policy moment. The Digital Personal Data Protection Act 2023 was notified by Parliament in August 2023; the DPDP Rules followed in 2025. The Bharat AI Mission was approved by Cabinet in March 2024 with INR 10,372 crore over five years for compute, datasets, and model development. The IndiaAI mission's AIKosh dataset platform, which FREE-AI's recommendation 1 binds to, was announced in 2024 [verification pending on exact AIKosh launch date from canonical RBI text]. The framework reads as the financial-sector layer on top of these enabling rails, not as a standalone instrument.
Third, the framework is published into a banking sector with measurable AI adoption. The committee surveyed banks, NBFCs, fintechs, and global regulators before drafting; the survey informed the framework's tolerant supervisory stance and its emphasis on innovation enablement alongside risk mitigation. The report is not a study of AI's potential. It is a study of AI in production, written by people who saw the production stack from the inside.
Nine months on, FREE-AI sits where committee reports usually sit: cited by industry counsel, referenced in supervisory engagement, not yet codified into binding direction. The gap between recommendation and direction is the operative gap regulated entities now manage.
The chair, the mandate, the surveys.
The committee was constituted with eight members. The chair, Dr Pushpak Bhattacharyya, is a professor of computer science at the Indian Institute of Technology Bombay and a former director of IIT Patna, with research focus on natural-language processing. Other members reported in the press release include Ms Debjani Ghosh, then a Distinguished Fellow at NITI Aayog and former president of the National Association of Software and Service Companies; Dr Balaraman Ravindran, professor and head of the Wadhwani School of Data Science and AI at IIT Madras; representatives from HDFC Bank and Microsoft India; and additional members from academia, government, finance, and technology [exact full member list verification pending on the canonical PDF preamble].
The mandate set four questions for the committee: assess adoption (where is AI in Indian financial services today, and globally), review regulation (what supervisory approaches do peer jurisdictions use), identify risks (what failure modes does AI introduce into financial decisioning), recommend a framework (what governance posture should the RBI adopt). The four questions structure the report's chapters [exact chapter titles and count verification pending on the canonical PDF].
The committee engaged a wide range of stakeholders during its eight-month working window. Surveys went to scheduled commercial banks, urban cooperative banks, NBFCs of various sizes, fintech entities, and payment system operators. Submissions were taken from technology vendors, academic researchers, and consumer representatives. Cross-jurisdictional inputs were sought from peer regulators and from industry counsel familiar with European and US regimes. The framework that emerged is, by design, a synthesis of what Indian regulated entities are already doing, what peer regulators are saying, and what the committee judged could realistically be implemented across a sector that ranges from systemically important banks to single-state cooperative banks.
The FinTech Department at the RBI provided secretariat support. The Department of Supervision and the Department of Regulation were consulted at the drafting stage. The framework's tolerant supervisory stance for first-time errors, its emphasis on board-approved policy as the accountability anchor, and its treatment of the AI inventory as the practical model registry all read as the product of supervisor-side input.
The seven Sutras, verbatim.
The seven Sutras are the framework's principles spine. They are the values the framework reads downstream recommendations against. Each Sutra is short, declarative, and written in the tone of a charter rather than a regulation. The list is not aspirational; the framework binds each Sutra to operational recommendations under the six pillars.
Each Sutra carries a Warrant evidence-field correspondent. Trust traces to a record that is independently verifiable without contacting Warrant. People First traces to the human oversight and disclosure flags inside the per-decision trace. Innovation over Restraint is the supervisory posture, not a per-decision artefact, but the framework's emphasis on calibrated incident reporting (recommendation 10) carries through. Fairness and Equity traces to the cohort-level evaluation and bias testing recorded as a record mapped to a specific obligation. Accountability traces to a record mapped to a specific obligation that binds the decision to the named accountable officer's role. Understandable by Design traces to the per-decision rationale and the alternatives-considered field. Safety, Resilience and Sustainability traces to the residual-risk classification recorded in the model inventory entry.
The six pillars, twenty-six recommendations.
The six pillars sit in two halves. Three pillars enable innovation: Infrastructure (the rails on which AI is built), Policy (the rules governing its use), Capacity (the people who build and run it). Three pillars mitigate risk: Governance (board-level oversight), Protection (consumer and cyber safeguards), Assurance (audit and monitoring). The architecture is deliberate. Innovation enablement and risk mitigation are presented as complementary forces rather than tradeoffs to be balanced.
The twenty-six recommendations distribute across the six pillars unevenly. Governance and Protection between them carry the bulk of the operational load: board-approved policy, AI inventory, incident reporting, expanded outsourcing standards, expanded cybersecurity standards, and the DPDP cross-reference. The Infrastructure recommendations (AIKosh integration, sandbox, indigenous models) are state-led; regulated entities consume the rails rather than build them. The Policy recommendations are RBI-internal: the Standing Committee, the consolidated guidance, the periodic review cadence are commitments the RBI makes to itself.
Recommendation 18 deserves separate emphasis. It expands the existing RBI Outsourcing of IT Services Master Direction to include algorithmic bias and accountability clauses for vendors. The expansion is the operative path through which foreign-headquartered foundation-model providers are brought into the framework's perimeter. The Indian regulated entity remains the accountable party, but the contract with the vendor must now carry the accountability terms. This is the recommendation that, when codified, produces the largest contractual rework across the sector.
What changed between August 2025 and May 2026.
Nine months sit between FREE-AI publication and the present. Three observations frame the supervisory cycle implication.
First, no public RBI enforcement action has cited FREE-AI as a binding obligation in this period. The framework remains, on the operative read, advisory. Counsel commentary published in the months following release uniformly notes that codification into Master Directions is the path through which FREE-AI becomes binding, and that until codification adoption will likely be uneven. The Lexology, Mondaq, and Bar & Bench commentary all converge on this point.
Second, the framework reads through to existing binding directions even before codification. Recommendation 18's expansion of the Outsourcing Master Direction sits on top of the existing direction. The board-approved AI policy under recommendation 7 reads against the existing IT Governance Master Direction's board-approval expectation. The AI inventory under recommendation 9 reads against the supervisor's existing right to inspect. The framework's operational footprint is larger than its formal status suggests, because much of what it asks for is already implicit in directions the regulated entity already obeys.
Third, the supervisory engagement pattern has shifted. Industry reports from Q1 2026 indicate that on-site inspections and Risk-Based Supervision (RBS) cycles since late 2025 have increasingly probed AI use-cases in line with the framework's recommendations. Examiners ask about the AI inventory. They ask about the board-approved policy. They ask about incident reporting. The framework is being read into the supervisory conversation even where it is not the operative direction. This is the pattern committee reports usually take through Indian financial supervision: the report informs supervisory expectation before binding circulars catch up.
The tolerant supervisory stance under recommendation 6 deserves emphasis. The framework explicitly recommends graded liability and leniency for first-time errors, conditional on the regulated entity having proper safeguards in place: a board-approved policy, an AI inventory, an incident reporting mechanism. Silence or delay in reporting is not protected by the tolerant stance. The stance is conditional on transparency, not a substitute for it.
Counsel reading FREE-AI for client work treats it as a forward read on what binding direction will likely contain. The principles-based reading is the safe-harbor reading: a regulated entity that adopts the framework's recommendations under good-faith interpretation positions itself ahead of codification, and that positioning is itself protective when codification arrives.
The cross-regulator perimeter.
India's financial-sector regulatory architecture is plural. The RBI is one of several authorities. The Securities and Exchange Board of India (SEBI) regulates the securities market and asset management. The Insurance Regulatory and Development Authority of India (IRDAI) regulates insurance. The International Financial Services Centres Authority (IFSCA) regulates the GIFT City IFSC. The Pension Fund Regulatory and Development Authority (PFRDA) regulates pension funds. The Ministry of Electronics and Information Technology (MeitY) administers the DPDP Act 2023 and the IndiaAI Mission.
FREE-AI's operative perimeter is RBI-regulated entities: scheduled commercial banks, urban cooperative banks, NBFCs, payment system operators, and entities under the Payments and Settlement Systems Act 2007. The framework does not formally bind SEBI, IRDAI, IFSCA, or PFRDA regulated entities through direct application [exact verification of cross-regulator language inside the FREE-AI canonical PDF pending; secondary commentary uniformly reports the framework as RBI-perimeter focused].
In practice, three overlap patterns matter. Where an entity holds licences across multiple authorities (a banking-cum-insurance distributor; a wealth platform that lends and recommends mutual funds; a neo-broker that holds payment-system authorisation), each regulator's framework applies inside its own perimeter. The AI agent that issues a credit decision under bank licence reads against FREE-AI; the same agent recommending a mutual fund reads against SEBI's AI guidance; the same agent quoting an insurance product reads against IRDAI's posture. The agent does not split; the supervision does.
The IFSCA case is the cleanest. The GIFT City IFSC operates as a deemed foreign jurisdiction under the IFSCA Act 2019 and runs its own AI sandbox cohorts. An entity inside IFSCA jurisdiction obeys IFSCA direction and reads RBI guidance as informational; the entity outside IFSCA but transacting with one obeys its principal supervisor's direction. Inter-regulator coordination on AI is, as of May 2026, ad hoc rather than institutionalised; the FREE-AI Standing Committee under recommendation 4 is the most likely vehicle through which coordination becomes structural [verification pending on cross-regulator coordination language inside the canonical PDF].
The MeitY interface is different. The DPDP Act 2023 is a statutory regime that binds all entities (including all financial-sector entities) processing personal data of Indian residents. The DPDP Board sits under MeitY. FREE-AI's recommendation 11 directs adoption of DPDP-aligned data governance; the framework defers to the DPDP regime on personal-data questions and overlays AI-governance expectations on top.
What FREE-AI says about when.
FREE-AI does not specify binding adoption deadlines. It is a committee report, not a regulation. The framework is presented as a direction of travel rather than a calendar.
The framework does, however, recommend a review cadence. Recommendation 15 directs biannual framework reviews to incorporate emerging risks and technologies. Recommendation 26 directs the regulator to undertake periodic policy reviews balancing innovation with emerging-risk management. The two recommendations together set an institutional rhythm: the framework is intended to be a living document refreshed at six-monthly intervals, with policy review on a longer cycle.
The implementation calendar is therefore the regulator's calendar, not the regulated entity's. The RBI will, on the framework's logic, codify recommendations into Master Directions or circulars on its own timetable. The regulated entity's optimal posture is forward-leaning: adopt the framework's recommendations under principles-based interpretation now, treating the as-yet-uncodified recommendations as the most likely shape of forthcoming direction.
The recommendations that read most directly into existing binding directions (recommendation 18 on outsourcing; recommendation 19 on cybersecurity; recommendation 20 on digital lending; recommendation 21 on customer service; recommendation 22 on fraud risk management; recommendation 23 on IT governance; recommendation 24 on IT services outsourcing) are the highest-probability candidates for early codification. An entity tracking the gap between framework and direction watches these seven recommendations most closely.
The Innovation Sandbox under recommendation 2 has a separate operational track. Sandbox cohorts operate on calendars set by the RBI's FinTech Department. The committee's Standing Committee under recommendation 4 has not, as of May 2026, been publicly announced as constituted [verification pending on RBI announcements between August 2025 and May 2026].
The FREE-AI field map.
The mapping below names each operative FREE-AI clause and the Warrant evidence field that satisfies it. Each row is keyed to a verified recommendation number under the six pillars; verification is against secondary canonical commentary plus the released framework's structure. This is the table an RBI examiner reads against the evidence package on supervisory engagement.
| FREE-AI clause | What evidence must show | Warrant evidence field |
|---|---|---|
| Sutra 1 · Trust | Third-party-verifiable record of decision | a record independently verifiable without contacting Warrant |
| Sutra 2 · People First | Disclosure to data principal + override path | trace.actions[].human_oversight_flag |
| Sutra 5 · Accountability | Named accountable officer bound to regulated officer role | a record mapped to a specific obligation, bound to the officer's role |
| Sutra 6 · Understandable | Per-decision rationale + alternatives considered | trace.actions[].decision_rationale |
| Rec 7 · Board policy | Active policy version at decision time | trace.actions[].policy_engagement |
| Rec 9 · AI inventory | Model id and version per decision | trace.metadata.model_inventory_id |
| Rec 10 · Incident report | Detection trail + reporting timestamp | regulator_evidence.incident_record |
| Rec 11 · DPDP alignment | Lawful basis + purpose limitation per use | trace.metadata.dpdp_lawful_basis |
| Rec 13/14 · Audit | Independent eval results recorded separately | a record mapped to a specific obligation, carrying the eval-suite result |
| Rec 18 · Outsourcing | Vendor lineage and accountability chain | classification.dev_provenance |
FREE-AI and the DPDP Act, in parallel.
The Digital Personal Data Protection Act 2023 is the operative privacy statute in India. It received presidential assent on 11 August 2023 and was notified into the central legislative record. The DPDP Rules followed in 2025. The Act is binding law; FREE-AI is committee guidance. They run in parallel for any AI-driven decision that processes personal data of an Indian data principal.
The DPDP Act attaches at the personal-data layer. Section 6 establishes consent as the primary lawful basis for processing personal data, with limited categories of legitimate uses under section 7 (employment, health emergency, public interest, performance of state function). Section 8 requires data fiduciaries to implement reasonable security safeguards. Section 9 requires breach notification to the Data Protection Board and the affected data principal. Section 11 establishes data-principal rights: access, correction, erasure, grievance redressal, nomination. Sections 33 to 37 establish significant data fiduciary obligations including data protection impact assessments and independent audits.
FREE-AI attaches at the AI-governance layer. Recommendation 11 explicitly directs implementation of data governance per the DPDP Act 2023; the framework does not duplicate the DPDP regime, it defers to it. The framework's other recommendations (board-approved AI policy, AI inventory, incident reporting, fairness testing, audit) overlay AI-governance expectations on top of the personal-data foundation.
The two regimes meet at the per-decision evidence layer. The lawful-basis record under DPDP and the model-decision rationale under FREE-AI live on the same trace. An evidence package that records the DPDP section under which data was processed, alongside the AI-governance metadata required by FREE-AI, satisfies both regimes simultaneously without duplication.
Cross-border data transfer under the DPDP Act becomes operative when a regulated entity sends personal data to a foreign-headquartered AI provider for inference. Section 16 of the DPDP Act empowers the central government to restrict cross-border transfers by notification; in the absence of a restriction, transfers are permitted subject to the standard obligations under sections 6, 8, and 11. An Indian regulated entity using a foreign foundation model on personal data therefore carries DPDP cross-border obligations and FREE-AI recommendation 18 outsourcing obligations on the same data flow. The evidence package binds both. For European analog reading on cross-border AI evidence, see /blog/eu-ai-act-article-12.
The Data Protection Board under the DPDP Act and the proposed FREE-AI Standing Committee under recommendation 4 are separate institutional bodies. The Data Protection Board has statutory power to investigate breaches and impose financial penalties (up to INR 250 crore for the most severe categories). The FREE-AI Standing Committee, when constituted, will have advisory rather than enforcement power. Counsel reading both regimes treats the DPDP Board as the binding venue for personal-data questions and the RBI itself (through Master Direction enforcement) as the binding venue for AI-governance questions.
Questions a CCO and an RBI examiner ask first.
Read the source directly.
- FREE-AI Committee Report PDF · rbidocs.rbi.org.in · 13 August 2025
- RBI Press Release 2024-2025/1779 · committee setup · 26 December 2024
- RBI Master Directions index · the codification target
- Digital Personal Data Protection Act 2023 · MeitY canonical text
- IndiaAI Mission · AIKosh and the data infrastructure rail
- Per-recommendation Warrant evidence field mapping (deep-dive)
Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. References to FREE-AI reflect the Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector dated 13 August 2025; the framework remains advisory pending RBI codification into Master Directions or circulars. Quotations from the framework reflect the report's published structure as released by the RBI; the canonical text is the PDF accessible at rbidocs.rbi.org.in via the URL above.