From Advisory to Mandatory:
Preparing Your AI Governance Stack Before RBI Codifies FREE-AI

The RBI's Regulatory Pattern: Advisory → Guidelines → Master Directions

The trajectory from advisory framework to binding regulation is not speculative — it is the standard pattern. IT Governance: Advisory → Master Direction on IT Framework (2017). Outsourcing: Advisory → Master Direction on IT Outsourcing (2023). Digital Lending: Working group → Binding Guidelines (2022). FREE-AI: Committee Report published August 2025 → Master Directions expected. The framework itself contemplates indirect extraterritorial reach — offshore technology providers drawn into the compliance net through institutional contractual arrangements.

The Readiness Gap

The RBI conducted two comprehensive surveys revealing a sector that is experimenting but not yet institutionalising AI. Only 10% of institutions use interpretability tools (SHAP, LIME). Only 10% maintain audit logs for AI decisions. Only 10% have bias mitigation protocols. Only 8% conduct periodic independent audits. The pattern is clear: adoption is running ahead of governance. When codification arrives, this gap will not be a documentation problem. It will be an architectural one.

Six Compliance Touchpoints

Board-Approved AI Policy: board-level ownership of AI governance policy covering lifecycle management, risk controls, and third-party vendor liabilities. Model Risk Management: expanded product approval and validation mechanisms explicitly including AI systems — analogous to SR 11-7. Consumer Transparency: customers must be informed of AI interactions and provided challenge mechanisms. Cybersecurity & Incident Reporting: AI-specific vulnerabilities and standardised incident reporting formats. Vendor & Third-Party Risk: outsourcing contracts must explicitly cover AI risks and audit rights. Bias Testing & Explainability: continuous bias monitoring, not just pre-deployment testing.

Confirmation, Not Disruption

The FREE-AI framework is not a surprise. It is the logical extension of a decade of RBI technology governance that has consistently followed the same trajectory. The six compliance touchpoints are not independent requirements for six separate tools — they are interconnected dimensions of a single governance architecture. The institutions that build this architecture now will experience the eventual Master Direction as confirmation of decisions they have already made. The institutions that wait will experience it as disruption.

The FREE-AI framework is more than just a policy document. It is a signal of intent. AI in finance is no longer a side experiment but a matter of regulatory concern at the highest level.

— Legal500 Analysis of the FREE-AI Framework