The FREE AI framework – Regulating AI in Financial Sector

By Anuradha Gandhi and Rachita Thakur

Introduction

On August 13, 2025[1], the Committee for developing the Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector (hereinafter referred to as the ‘Committee’ or ‘FREE-AI Committee’) constituted by the Reserve Bank of India (hereinafter referred to as ‘RBI’) submitted its report[2] on adopting of Artificial Intelligence (hereinafter referred to as ‘AI’) and Machine Learning (hereinafter referred to as ‘ML’) in the financial sector. The Committee outlined 26 recommendations for AI adoption in the financial sector under 6 main pillars, i.e. Infrastructure, Policy, Capacity, Governance, Protection and Assurance.

How is AI & ML adopted in Financial Sector?

AI and ML systems serve multiple purposes in the global financial sector. They help in mitigating risks through real-time fraud detection, anomaly detection in claims processing, and market forecasting. They also help in productivity gains in compliance, risk management, and customer service.[3]

In the Indian context, AI and ML systems are being used to improve financial inclusion, expand opportunities for innovation and enhance efficiency in financial systems. These systems are being increasingly integrated into high-stakes applications such as credit approvals, fraud detection, and compliance.[4]

Need to regulate

RBI acknowledges that there is a need to ensure that application and adoption of AI and ML systems is responsible and ethical. No harm shall arise from their use in the financial sector. It is essential to ensure that outcomes derived from these AI and ML systems do not undermine public trust. RBI intends to further responsible innovation in AI, while at the same time ensure that consumer interests are protected.[5]

The Seven Sutras – Guiding Principles[6]

The Committee, in the report, prescribe seven guiding principles which shall form the basis of regulating the adoption of AI and ML in the Indian Financial system:

1. Trust is the Foundation – AI Systems in the financial system shall not erode public trust
2. People First – Human oversight over the operations of AI systems is essential
3. Innovation over Restraint – Responsible Innovation must be preferred over cautionary restraint
4. Fairness and Equity – Outcomes must be unbiased and non-discriminatory
5. Accountability – Entity deploying the AI system is accountable for all the outcomes
6. Understandable by Design – AI systems must ensure easy understanding of their functioning amongst users through disclosures
7. Safety, Resilience, and Sustainability – AI systems should ensure resilience to physical, infrastructural and cyber risks and prioritize energy efficiency for sustainable adoption.

Structure of the framework

The Committee prescribes a dual focus approach to regulating adoption of AI and ML systems in the Indian financial sector to both foster innovation and mitigate risks considering both to be complementary forces to be pursued in tandem.

1. Innovation Enablement Framework (hereinafter referred to as ‘IEF’) – Through this focused framework, RBI intends to foster and promote building of the infrastructure required to support AI innovation. This shall be achieved through agile and adaptive policies and regulatory architecture. The framework also promotes the development of human skill and institutional capacity.[7]
2. Risk Mitigation Framework (hereinafter referred to as ‘RMF’) – Through this focused framework, RBI intends to establish a robust governance structure for AI based decisions and actions to ensure strong safeguards for protection from harm. RBI also intends to put in place mechanisms for continuous validation and oversight of AI Systems.[8]

Key Recommendations by the RBI

1. Securing Personal and Confidential Data – The IEF recommends AI and ML system deployers (hereinafter referred to as ‘deployers’) the use of privacy enhancing technologies, anonymization and data aggregation to secure personal and confidential data. It also recommends that AI and ML models using public data be made open source. [9]
2. Establishment of Board approved AI Policy – The RMF recommends the Regulated Entities (hereinafter referred to as ‘REs’) to put in place an AI policy which shall showcase the position of the RE on AI governance, ethics and accountability. The policy must essentially cover governance structure, accountability, risk appetite, operational safeguards, auditability, consumer protection measures, AI disclosures, model life cycle framework, and liability framework. This policy shall have a clear risk classification framework for AI use cases:
   1. Low Risk – This could include internal AI and ML applications such as document summarization and email classification where the outcomes have limited impact.
   2. Medium Risk – This may include customer facing chat bots and applications where AI is used for assistance.
   3. High Risk – This may include critical functions where AI is used for credit underwriting, making financial decisions, or moving customer funds, where errors have a significant impact on customers.[10]
3. Data Lifecycle Governance – The RMF obligates the REs to implement robust governance frameworks including internal controls and policies for data collection, access, usage, retention and deletion for AI systems.[11]
4. Conditions for using autonomous AI – The RMF prescribes that REs must establish clear safeguards and accountability frameworks supported by well-defined testing protocols and standard operating procedures. Consumers must be made aware of all the consequences before using such tools and human oversight must be ensured in all medium risk and high risk tasks.[12]
5. AI Specific Evaluations – Product approval mechanisms of REs must include AI specific evaluations to address fairness, bias, understandability, customer protection, cybersecurity, and compliance across the product lifecycle from pre-development to use.[13]
6. Board approved Consumer protection framework – REs must implement a board approved framework specific to consumer protection which shall ensure that there are clear and accessible safeguards embedded into all AI based offerings. REs shall adequately convey to the customers whenever they are interacting with AI based products. The REs shall also ensure that a customer is able to escalate any AI related issues to human representatives.[14]
7. Secure operation of AI based systems – REs are obligated to make sure that their AI driven systems operate through secure and verifiable channels such as verified 1601 series phone numbers for voice interactions, watermarked digital interfaces for online channels, and clearly labelled platforms.[15]
8. Cyber Security Measures – RMF obligates the REs to identify potential security risks on account of their use of AI and strengthen their hardware, software and processes ecosystem.[16]
9. Regulator Centric Recommendations – The RMF recommends that the financial sector regulators formulate mechanisms for AI incident reporting.[17] Regulators should also provide the REs with AI Compliance toolkits which will help REs demonstrate compliance.[18]

Prateek Chandgothia, Assessment Intern at S.S.Rana & Co. has assisted in the research of this article.

[1] https://caalley.com/news-updates/indian-news/rbi-panel-submits-report-on-framework-for-ai-use-to-foster-innovation-and-mitigate-risks-in-financial-sector

[2] FREE AI Committee Report, Framework for Responsible and Ethical Enablement of Artificial Intelligence – https://rbidocs.rbi.org.in/rdocs/PublicationReport/Pdfs/FREEAIR130820250A24FF2D4578453F824C72ED9F5D5851.PDF

[3] Para 1.2.1, FREE AI Committee Report

[4] Para 1.2.2, FREE AI Committee Report

[5] Executive Summary, FREE AI Committee Report

[6] Para 4.3, FREE AI Committee Report

[7] Para 4.4.3, FREE AI Committee Report

[8] Para 4.4.4, FREE AI Committee Report

[9] Para 4.4.10, FREE AI Committee Report

[10] Para 4.4.44, FREE AI Committee Report

[11] Para 4.4.47, FREE AI Committee Report

[12] Para 4.4.48, FREE AI Committee Report

[13] Para 4.4.50, FREE AI Committee Report

[14] Para 4.4.53, FREE AI Committee Report

[15] Para 4.4.54, FREE AI Committee Report

[16] Para 4.4.56, FREE AI Committee Report

[17] Para 4.4.63, FREE AI Committee Report

[18] Para 4.4.78, FREE AI Committee Report