On 13 August 2025 the Reserve Bank of India published the report of its committee on a Framework for Responsible and Ethical Enablement of Artificial Intelligence, known as FREE-AI, chaired by Professor Pushpak Bhattacharyya of IIT Bombay. The report sets out seven guiding principles, which it calls sutras, and 26 recommendations under six pillars (rbi.org.in, press release 13 August 2025 and report page). It is not yet binding regulation. It is, however, the clearest statement any Indian financial regulator has made about how it expects AI to be governed, and for anyone building AI in banking compliance India it functions as a specification in advance of the rules.
Compliance is the natural first home for AI in a bank, for a reason that is easy to miss. Most compliance work is the reading, classification, reconciliation and reporting of text and transactions against rules, which is what language models are good at, and most of its outputs are reviewed by a human before they have any external effect, which is what makes early deployment survivable. But compliance is also where the regulator's attention is sharpest. A model that misreads a circular, misses a suspicious transaction or produces an unexplainable adverse decision is not a product defect; it is a supervisory event.
This article builds a compliance use-case ladder: a sequence of AI applications in a regulated entity ordered from lowest to highest consequence, with each rung mapped to the FREE-AI sutras it most engages and to the existing RBI directions that already bind it. The ladder is an analytical construction. The sutras, pillars and recommendations are quoted from the RBI report and its summaries; the mapping and the ordering are ours.
What FREEAI says, and what status it has
The committee was constituted on 26 December 2024 following the RBI's December 2024 Statement on Developmental and Regulatory Policies. Its seven sutras, as stated in the report, are summarised below with the report's own phrasing where it is available.
The 26 recommendations sit under six pillars in two groups: Innovation Enablement (Infrastructure, Policy, Capacity) and Risk Mitigation (Governance, Protection, Assurance). On the enablement side, the report recommends a financial sector data infrastructure as a digital public infrastructure (Recommendation 1), an AI innovation sandbox with shared compute, models and data (Recommendation 2), indigenous financial-sector AI models offered as a public good (Recommendation 4), a graded liability framework under which regulated entities remain liable to customers but receive tolerance for first-time or one-off failures (Recommendation 8), and a standing AI committee under the RBI (Recommendation 9). On the mitigation side, the report recommends that regulated entities establish "a board- approved AI policy which covers key areas such as governance structure, accountability", risk appetite, safeguards, auditability, consumer protection and disclosure (Recommendation 14), with an outline in Annexure V; it calls for "comprehensive incident reporting, conducting Root Cause Analysis (RCA), regular red teaming, independent audits"; and it is explicit that "since customer protection is non-negotiable, the RE must remain fully responsible for compensating losses". Khaitan & Co's summary of the report adds that it recommends AI inventories and sector-wide repositories "covering models, use cases, dependencies, and risks", AI disclosures in annual reports, and compliance toolkits "to help REs align AI models and applications with regulatory expectations" (khaitanco.com, 28 August 2025).
On status, the position is as follows. The framework is advisory. Bar and Bench's analysis of 18 September 2025 states that "the framework itself is not yet a binding regulation" and that several provisions are expected to be incorporated into Master Directions, which would make them mandatory (barandbench.com). The RBI has since moved on the adjacent question of models generally: on 24 June 2026 it released a draft "Guidance on Regulatory Principles for Model Risk Management" for comment by 24 July 2026, described as "applicable to all models used by regulated entities, including third party models" and covering models employing AI and machine learning, applying to commercial banks, small finance banks, payments banks, regional rural banks, cooperative banks, all-India financial institutions, NBFCs, asset reconstruction companies and credit information companies (rbi.org.in, press release 24 June 2026). That draft cites both the August 2024 draft on model risk in credit and the FREE-AI report as antecedents. A builder should assume the direction of travel is from recommendation to direction, and design to the recommendations now.
The rules that already bind AI in banking compliance India
FREE-AI does not arrive in a vacuum. Three existing instruments already constrain how a regulated entity may deploy a compliance AI system, and a builder who treats FREE-AI as the only reference will fail the procurement review on the others.
The Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023, issued 10 April 2023 and effective 1 October 2023, apply to material outsourcing of IT services by commercial banks, larger urban cooperative banks, upper and middle layer NBFCs, credit information companies and all-India financial institutions. For an AI vendor the operative clauses are that the board remains ultimately responsible for outsourced activities; that the written agreement must provide for "storage of data (as applicable to the concerned REs) only in India"; that the regulated entity and the RBI must have the right to audit the provider, including sub-contractors, and access to "data related to the outsourced activities"; that the policy "shall contain a clear exit strategy"; and that cloud arrangements may be made "only with CSPs subject to jurisdictions that uphold enforceability of agreements" (rbi.org.in, Master Direction, 10 April 2023). An AI compliance product delivered as a service from infrastructure outside India, with no audit right and no exit plan, is non-compliant before the model is evaluated.
The draft circular on Regulatory Principles for Management of Model Risks in Credit, released 5 August 2024 for comment by 4 September 2024, signalled the RBI's intention to treat models used in credit appraisal, scoring, pricing and risk management as objects of governance in their own right (rbi.org.in, press release 5 August 2024). The June 2026 draft generalises that intention to all models. The practical consequence is that a compliance AI system is a model in the regulatory sense, and should expect to be inventoried, validated, documented and monitored like a credit model.
The Digital Personal Data Protection Act 2023 and its Rules, notified 14 November 2025 with an 18-month phased window, add obligations on significant data fiduciaries, including local storage of specified data and the Rule 15 treatment of cross-border transfers. Compliance systems process customer data by definition; the data residency and purpose limitation questions must be answered before deployment.
The compliance use-case ladder
The ladder below orders compliance applications by consequence. Lower rungs produce outputs that a human reads before anything happens; higher rungs produce outputs that affect customers or regulatory filings with less intermediation. Each rung lists the sutras it most engages and the existing instruments that already apply. The principle of the ladder is simple: climb one rung at a time, and do not climb until the evaluation and governance for the current rung are in place.
Three features of the ladder deserve comment.
First, the lowest rungs are the highest value for the least risk, and they are where most Indian regulated entities should start. Rung 1 alone addresses a real operational burden: the RBI, SEBI, IRDAI and other regulators issue a continuous stream of circulars, and the work of reading each one, identifying which obligations apply, and mapping them to internal policy is text-heavy, repetitive and reviewable. An error at rung 1 is a wrong line in a draft register that a compliance officer corrects. The system satisfies the People First sutra by construction, because no output leaves the compliance team unchecked.
Second, the sutra engagement shifts as the ladder climbs. At rungs 1 to 3 the dominant sutra is Understandable by Design: the compliance team needs to see which clause of which circular produced which obligation, and a system that cannot show its source is unusable even if it is accurate. At rungs 4 to 6 Fairness and People First come to the fore, because the output begins to touch customers, and the FREE-AI insistence that "citizens should know when they are dealing with AI" and that humans can override becomes an operating requirement rather than a design preference.
Third, the existing instruments apply from rung 1. A regulated entity cannot deploy even a circular-summarisation tool without satisfying the IT outsourcing directions on data location, audit rights and exit if the tool is externally hosted. This is why on-premise and hybrid deployment features so prominently in Indian BFSI AI procurement, and why the architecture question is answered before the use-case question; a separate PanScience Research piece on the sovereign AI stack for regulated sectors covers the architecture.
What the ladder implies for a builder
The ladder translates into a set of design requirements that are the same regardless of which rung a product targets, plus a set that tightens with each rung.
Design requirements at every rung begin with provenance. Every output must be traceable to the regulatory text, internal document or transaction record that produced it, with the source visible to the reviewer. This is the operational meaning of Understandable by Design, and in compliance it is also simply how the work is checked. They continue with deployment under the IT outsourcing directions: data in India, audit and inspection rights for the regulated entity and the RBI, sub-contractor transparency and a documented exit, which in practice means the customer must be able to extract its data and its configuration and continue operating without the vendor. They include an inventory entry: the system, its model components, its dependencies and its known risks must be documented in a form that can populate the AI inventory the FREE-AI report recommends and the model inventory the June 2026 draft guidance anticipates. And they include a monitoring and incident path: the Safety and Resilience sutra and the report's call for incident reporting, root-cause analysis and red teaming mean the system needs logging, anomaly detection and a defined response before it goes live, not after.
Requirements that tighten with the rung concern evaluation and human control. At rung 1, evaluation is a sample of summaries checked by a compliance officer against the source circulars. At rung 4, it is a measured precision and recall against historical alert dispositions, with attention to whether prioritisation differs across customer segments. At rung 6, it is a validated model under a board-approved policy with documented explainability, a customer redress path and an accountable officer, and it is the rung at which the recommended graded liability framework matters most, because the entity remains liable to the customer regardless of the model's role.
PanScience reports that its venture OnFinance AI builds NeoGPT, a compliance LLM for the BFSI sector, and reports 70 or more agents across 40 or more regulators. The company-reported description is noted here because it illustrates the shape of a rung 1 to 3 product: a system whose primary job is to read regulatory text across many regulators and produce reviewable compliance outputs, which is precisely the layer of the ladder where current deployability and FREE-AI's design requirements align. No claim is made here about its performance or its users.
Where the framework leaves builders uncertain
Three uncertainties remain, and honesty about them is part of the specification.
The first is timing. FREE-AI is advisory; the model risk guidance is a draft; the DPDP Rules are in their phased window. A regulated entity deploying in 2026 is designing against expected rather than current obligations, and a builder who promises "FREE-AI compliance" is promising conformity with recommendations that have not yet been translated into directions. The accurate claim is design alignment with the recommendations and conformity with the directions that already bind.
The second is the boundary between model and system. The June 2026 draft guidance applies to "all models", including third-party models. A compliance product built on a general-purpose foundation model raises the question of what, exactly, the regulated entity is expected to validate: the foundation model it did not build, the retrieval and prompting layer around it, or the end-to-end system. The FREE-AI accountability sutra answers the question of who is responsible, the deploying entity, but not the question of what validation of a third-party foundation model would consist of. Builders should expect that question to be answered conservatively, and should design systems whose behaviour can be evaluated end to end regardless of the foundation model inside.
The third is explainability at the sixth rung. Understandable by Design is achievable at the lower rungs because the outputs are text with sources. At the rung of adverse decisions, the standard of explanation a customer or a supervisor would accept is not yet defined, and the report's call for explainability as a design feature does not tell a builder what level of explanation satisfies it. Until that standard is set, the prudent reading is that rung 6 remains a human decision with AI assistance, which is also what the People First sutra would suggest.
For AI in banking compliance India, then, the framework is less a constraint than a map. It tells a builder where to start, at the text-heavy, human-reviewed, high-provenance end of the compliance function; what to build in from the first version, meaning provenance, Indian data residency, audit rights, inventory and incident handling; and how far to climb before the rules catch up. The regulated entities that adopt early will do so one rung at a time, and the products that succeed with them will be the ones that make each rung auditable before offering the next.
Methodology and sources
The compliance use-case ladder and its mapping to the FREE-AI sutras and existing RBI instruments are an original analytical construction by PanScience Research. The ordering by consequence and the deployability judgements are ours and are offered as a framework; they are not regulatory guidance and should not be read as a statement of what the RBI permits.
Observed material and sources: the FREE-AI committee's constitution, release date and recommendation count are from the RBI press release of 13 August 2025 (https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx? prid=61018). The chair, the seven sutras and their stated wording, the six pillars in two groups, Recommendations 1 to 14 and the quoted passages on incident reporting, red teaming, audits and customer protection are from the report as published on the RBI website (https://www.rbi.org.in/scripts/PublicationReportDetails.aspx?ID=1306), opened 25 October 2026; the published web version was truncated after Recommendation 14, so Recommendations 15 to 26 are described only as summarised in secondary sources. The KPMG summary of 23 September 2025 confirms the sutra and pillar names and the focus areas (https://kpmg.com/in/en/insights/2025/09/rbis-free-ai-committee-report-in-the- financial-sector.html). The Khaitan & Co Ergo note of 28 August 2025 is the source for the AI inventory, annual report disclosure and compliance toolkit recommendations (https://www.khaitanco.com/sites/default/files/2025- 08/Ergo%20-%20FREE%20AI%20Framework%20-%2028%20Augusut%202025.pdf). Bar and Bench's analysis of 18 September 2025 is the source for the framework's advisory status (https://www.barandbench.com/view-point/rbis- free-ai-framework-navigating-the-legal-and-regulatory-landscape). The IT outsourcing requirements are from the Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023 (https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12486). The draft circular on model risk in credit is from the RBI press release of 5 August 2024 (https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=58432). The draft Guidance on Regulatory Principles for Model Risk Management is from the RBI press release of 24 June 2026 (https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=63006). DPDP Act and Rules status is as notified on 14 November 2025 and reported by PIB. The description of OnFinance AI is company-reported by PanScience Innovations (https://panscience.xyz); no client of any PanScience venture is named or implied.