RBI's AI Rules for Banks: FREE-AI, the Draft Model Risk Framework, and What to Build Now
The question we are now asked in almost every bank engagement is some version of: our fraud model was built by a vendor, it retrains itself, and nobody internally can fully explain a given decision — is that a problem? Until recently the honest answer was that it was a governance weakness with no specific regulatory hook. That is changing, and faster than most boards have registered.
Two things happened. In August 2025 the RBI published the FREE-AI committee report, setting out how Indian financial institutions should build and govern AI. Then on 24 June 2026 it issued draft Guidance on Regulatory Principles for Model Risk Management, which closed for public comment on 24 July 2026. That second document is the one with teeth, and the comment window shutting means final guidance is now a question of when, not whether.
First, a distinction that matters
These two documents carry different weight, and conflating them leads to bad planning.
| FREE-AI (Aug 2025) | Model Risk Management guidance (Jun 2026) | |
|---|---|---|
| What it is | Committee report — principles and recommendations | Draft regulatory guidance, issued for comment |
| Status | Published; shapes supervisory expectations | DRAFT — comments closed 24 July 2026, final awaited |
| Weight | Direction of travel, not a directive | Will become the compliance baseline once finalised |
| Planning stance | Align your AI strategy to it | Build to it now; do not wait for the final text |
We are deliberate about that DRAFT label. Anyone telling you the RBI currently mandates a specific model-risk control is ahead of the facts. What you can reasonably infer is direction, and the direction here is unusually clear.
FREE-AI: the shape of the expectation
The FREE-AI report — Framework for Responsible and Ethical Enablement of Artificial Intelligence — was released on 13 August 2025 after consultation with banks, NBFCs, fintechs and other regulators. It is built on seven foundational principles the committee calls Sutras, organised across six pillars: Infrastructure, Policy, Capacity, Governance, Protection and Assurance, with 26 recommendations underneath them.
The structural point worth noticing is that three of those six pillars — Governance, Protection, Assurance — are about control rather than enablement. The RBI is not framing AI adoption as something to be permitted cautiously; it is framing it as something to be enabled deliberately, with assurance built in from the start. That is a meaningfully different posture from "prove it is safe before you deploy", and it puts weight on your ability to evidence oversight continuously.
The draft Model Risk Management guidance is where the work lands
This is the document to read properly. Three features of it will drive most of the effort.
1. It covers more than AI
The draft addresses models generally — traditional statistical models as well as AI and ML systems. That is broader than most AI-governance programmes currently scope. Your credit scorecard, your provisioning model, your ALM assumptions and your ML fraud engine fall under one governance regime. Institutions that stood up an "AI governance" workstream separate from existing model validation will likely find they built two things where one was needed.
2. It applies across the sector, not just to large banks
The draft is written to apply across RBI-regulated entities — commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban and rural co-operative banks, NBFCs across layers, All-India Financial Institutions, ARCs and credit information companies. Smaller REs that assumed model risk was a large-bank concern should read it on that basis. A co-operative bank running a vendor-supplied scoring model is in scope of the thinking.
3. Vendor models remain your accountability
This is the provision most likely to hurt. The draft places clear emphasis on accountability for models supplied by external technology providers. "The vendor built it" has never been a defence in Indian financial regulation, and the draft removes any remaining ambiguity: you are expected to understand, validate, monitor and be answerable for a model you did not build.
In practice that means independent validation you can actually perform. If your contract does not give you enough visibility into a model's logic, data lineage and performance to validate it, that is a procurement problem surfacing as a compliance problem — and renegotiating it takes far longer than writing a policy.
What to build now, without waiting for the final text
The gap between draft and final guidance is rarely the difference between doing nothing and doing everything. Most of what follows is defensible work regardless of how the final wording lands.
- A model inventory that is genuinely complete. Not just the AI ones — every model that informs a decision, including vendor-supplied and spreadsheet-embedded ones. Most institutions discover their inventory is 30–50% short on the first honest pass.
- Board-level ownership, named. The draft points to board-level responsibility for the model risk framework, which means someone specific answers for it, not 'Risk' collectively.
- Independent validation capability, distinct from model development. Independence is the point: the team that built it cannot be the team that signs it off.
- Ongoing performance monitoring, not point-in-time approval. Models drift. A validation from eighteen months ago tells a supervisor little about today.
- Human oversight that is real. Documented intervention points, with a person who has the authority and the information to override — and evidence that they can.
- Vendor governance with contractual teeth: access to documentation, performance data, change notification, and validation rights. Check your existing contracts now.
- Documentation of data quality and lineage feeding each model. Bias and fairness questions are unanswerable without it.
Where this connects to what you already have
Most banks reading this already hold ISO 27001 and run regular VAPT, and some are looking at ISO/IEC 42001 for AI management. None of those substitute for model risk management — 42001 governs how you manage AI as a system, while the RBI draft governs whether a specific model's decisions are sound, validated and overseen. They overlap on governance structure and documentation, so build them to share evidence, but do not present a 42001 certificate as an answer to a model validation question. Supervisors will not read it that way.
The other connection worth making early is with your incident and audit functions. If a model produces a materially wrong outcome at scale, the questions that follow are the ones you would face after any control failure: when did you know, what did you do, who decided, and where is the evidence. Model risk is where AI governance stops being a policy exercise and becomes an operational one.
FAQs
Is the RBI Model Risk Management guidance final?
No. It was issued as draft Guidance on Regulatory Principles for Model Risk Management on 24 June 2026, with public comments open until 24 July 2026. Final guidance has not been issued at the time of writing. Treat the draft as a strong signal of direction and build to its principles rather than waiting.
Does this apply to us if we only use a vendor's AI model?
Yes. The draft places explicit emphasis on accountability for models supplied by external technology providers. You are expected to understand, validate and monitor a model even when you did not build it, which usually means securing contractual rights to documentation, performance data and validation access.
Is FREE-AI mandatory?
FREE-AI is a committee report published in August 2025 containing principles and recommendations, not a directive. It signals supervisory expectations and is worth aligning to, but the draft Model Risk Management guidance is the document likely to set the compliance baseline.
Does this only apply to large commercial banks?
No. The draft is written to cover RBI-regulated entities broadly, including small finance banks, payments banks, regional rural banks, urban and rural co-operative banks, NBFCs across layers, AIFIs, ARCs and credit information companies. Smaller REs using vendor-supplied models are within its scope of thinking.
Does ISO/IEC 42001 certification satisfy the RBI expectations?
No. ISO/IEC 42001 governs an AI management system — how you organise, control and improve AI activity. The RBI draft governs model risk: whether a specific model is sound, validated, monitored and overseen. They share governance and documentation foundations and are worth building together, but one does not answer for the other.
Where should we start if we have nothing today?
The model inventory. Every subsequent control — validation, monitoring, oversight, vendor governance — depends on knowing which models exist, what decisions they influence, who owns them and where they came from. It is also the item most institutions underestimate.
The next few months
With the comment window closed, the sensible assumption is that final guidance follows and supervisory attention follows that. The institutions that will find this straightforward are the ones treating the draft as a planning document today rather than a reading exercise for when it is final. Start with the inventory. Everything else is downstream of knowing what you actually run.
Liked the post? Share on:
Leave A Comment