The Reserve Bank of India's FREE-AI framework (Framework for Responsible and Ethical Enablement of Artificial Intelligence) isn't a recommendation. It's a regulatory expectation — and it applies to every NBFC using AI in any part of its lending operations. Here is a practical to-do list, not a summary.
1. Your board needs an AI policy
FREE-AI places AI governance at board level. This is not a technology committee matter. Your board needs a documented AI policy that covers: permitted use cases, human oversight requirements, model risk management, and incident reporting. If your board hasn't discussed AI governance, that conversation is overdue.
The policy doesn't need to be elaborate. It needs to be real — approved by your board, owned by a named executive, and reviewed at least annually.
2. Model risk management framework
FREE-AI expects lenders to maintain a model risk management framework covering model development, validation, deployment and monitoring. For NBFCs using AI from a vendor, this means you cannot simply rely on the vendor's documentation. You need to understand:
- What data was the model trained on? - How is the model validated before deployment? - How is drift monitored after deployment? - Who can stop the model, and how quickly?
If your AI vendor cannot answer these questions with evidence, that is a risk your board should know about.
3. Your AI vendor contracts need updating
FREE-AI's outsourcing provisions apply fully when AI is delivered by a third party. Your vendor contracts must include:
- Audit access for your internal auditors and for RBI - Exit and transition provisions — you must be able to leave without losing your model or your data - Clear ownership of training data and model outputs - Incident notification timelines
If your current AI vendor contract doesn't include these clauses, it needs to be renegotiated before your next regulatory examination.
4. Human oversight is not optional
FREE-AI is explicit: material decisions must have human oversight. For lending NBFCs, this means:
- Credit decisions: a human must make or confirm every credit decision, not an AI system - Settlement offers: must be within pre-approved parameters and confirmed by a human for material amounts - Complaints: every complaint must reach a human within a defined escalation path
AI can assist — it cannot decide, at least not without a human in the loop for the decisions that matter.
5. What to ask any AI vendor
Before you sign with any AI vendor, ask these questions and get written answers:
1. Who owns the model weights after training on our data? 2. Where is our borrower data stored and processed? 3. What audit trail does the system maintain, and can we export it? 4. What is the exit process if we terminate the contract? 5. How do you handle RBI inspection requests that involve our AI systems?
A vendor who cannot answer these questions clearly is not ready for regulated financial services.