RBI FREE-AI framework compliance is how a bank or NBFC turns the 13 August 2025 committee report into an operating file. The report sets seven sutras and 26 recommendations. It is not a statute that makes ISO 42001 mandatory. An AI management system holds the inventory, the board policy and the evidence.

What RBI FREE-AI framework compliance asks you to hold

On 13 August 2025 the Reserve Bank of India published the committee report Framework for Responsible and Ethical Enablement of Artificial Intelligence. The PDF is on rbi.org.in. It covers banks, NBFCs and other regulated entities. It is not a numbered circular. This article will not invent one.

RBI FREE-AI framework compliance, read the way a supervisor can follow it, means the sutras show up in a record a person uses. A policy that quotes People First, beside a model with no owner, is a failed pair. The owner is a name. The test is a run you can show.

ISO 42001 for banks is the voluntary AIMS many boards ask the CISO to build beside the report. ISO/IEC 42001:2023 is the AI management system standard. Certification is voluntary. The August 2025 text does not make it mandatory. If a later binding instruction says otherwise, follow that instruction. On 31 October 2026, this committee text does not.

The report lists 26 recommendations under six pillars. Do not treat each line as a rule already in force. Do give an owner to every line that touches a live system. Clauses 4 to 10 are the loop: context, leadership, planning, support, operation, evaluation, improvement. Annex A has 38 controls, A.2 through A.10. The Statement of Applicability records which controls apply and why.

A bank that treats RBI FREE-AI framework compliance as a poster will lose when someone opens the model file. Internal audit, a partner, or a certification body at Stage 2 will open it.

The seven sutras and the six pillars

Write the sutras into the AI policy in the committee’s words, then add one line on a product you already run. That is the test of whether RBI FREE-AI framework compliance is real this quarter.

Trust is the Foundation.

People First.

Innovation over Restraint.

Fairness and Equity.

Accountability.

Understandable by Design.

Safety, Resilience and Sustainability.

The six pillars are Infrastructure, Policy, Capacity, Governance, Protection and Assurance. Capacity is the innovation pillar. Assurance is the risk pillar. Policy is the board text. Governance is who decides. Protection is the customer when a decision goes wrong.

MeitY’s India AI Governance Guidelines of 5 November 2025 reuse the sutras for the wider economy. They are not a statute and they are not this report.

The lending model often sits in a spreadsheet named Final_v7, last touched by someone who has left. Put that file on the inventory.

Owners, including the thinner book

AI governance NBFC work is usually a thinner stack than a bank’s. One scorecard, one collections dialer, one vendor chatbot. A bank may add fraud models and copilots staff already use. The AIMS scales. An empty owner field does not.

AI governance NBFC leadership still has to approve a board policy. If the score declines a borrower, say which inputs moved and who may override.

ISO 42001 for banks with a large IT estate usually starts beside an existing ISO 27001 program. Security asks who can read the data. The AI management system asks what the model may decide and who stops it. Each Statement of Applicability stays its own page.

AI governance NBFC firms that already hold ISO 27001 keep that system and add the model file beside it. The DPDP Act, 2023 is the personal-data layer. Main duties, notice, safeguards, breach intimation and rights, start on 13 May 2027. The full rulebook is not in force on 31 October 2026. Flag personal data now.

ISO 42001 for banks gets stuck when the digital team is the owner of forty rows. Name a person. An AI risk assessment sits on higher-impact rows. ISO/IEC 23894:2023 guides it and is not a second certificate. An AI impact assessment, using ISO/IEC 42005 as guidance, asks who is harmed.

For AI governance NBFC work, a vendor score you act on is still your row. The brand on the API does not take it off your register.

Where RBI FREE-AI framework compliance meets the AIMS

Five records do the job: inventory, board policy, consumer disclosure, incident reporting and model monitoring. The report never orders you to buy a certificate. A supervisor and a Stage 2 sample still ask for these.

Mapping RBI FREE-AI framework compliance to an ISO 42001 AI management system
Show Record Tuesday test
Inventory System register Owner, purpose and status on every live row
Board policy Approved AI policy Sutras plus a rule staff can follow
Consumer disclosure Line in the journey Customer told when AI shaped the decision
Incident reporting Ticket and close-out Bad outcome has severity and a fix
Model monitoring Monthly pack Overrides and complaints reviewed on a date

RBI FREE-AI framework compliance is this table filled in, not the table framed in a hallway. A pilot staff already use is production.

RBI FREE-AI framework compliance also covers third parties. A bought score is your decision if you act on it. Annex A expects a contract that says what you may audit.

Put RBI FREE-AI framework compliance on the internal audit plan, with the inventory as the population. Sample a decline and a copilot. Write the finding on the row.

Disclosure, incidents and the monthly pack

If a limit or a fraud hold came from a model, say so in the journey and give a path to a human. A sanction letter can carry that line, with an override reason code on the application. Write it before DPDP notice duties on 13 May 2027.

A leak is one incident. A model that starts declining one district after a refresh is another. Log both. At a surveillance audit the certification body will ask whether the ticket changed a control.

The monthly pack is where RBI FREE-AI framework compliance becomes Assurance rather than a pillar label. Keep override rate, complaint tags and last month’s pack.

When internal audit asks what RBI FREE-AI framework compliance changed, point to closed rows. A partner questionnaire on RBI FREE-AI framework compliance should be answerable from the register. If fairness was never measured, name a date.

Fintechs at the edge of the license

Fintech AI compliance is the same evidence problem with a shorter payroll. The partner asks for the model file before renewal.

Fintech AI compliance that shows up in market proposals usually starts with onboarding checks, a fraud score and a support bot. That pattern is from proposals, not a named client. Seven Step Consulting does not issue ISO certificates. Certification bodies do.

ISO 42001 for banks is a poor template to copy unchanged onto a forty-person fintech. Fintech AI compliance budgets forget staff time. Put the hours for the last test in the plan.

Fintech AI compliance teams that sit with a bank partner should expect four questions: the decision, the data, who can stop it, and the last fairness check. Fintech AI compliance leads should send a short board pack, ten rows not two hundred.

Fintech AI compliance also means a named rollback. Name the rollback owner in the register or RBI FREE-AI framework compliance stays a slogan. Fintech AI compliance files often hide a vendor model inside an API. Fintech AI compliance still needs a personal-data flag, because the May 2027 duties do not skip smaller firms.

What the market is quoting

Figures below are 2026 India market ranges seen across proposals, not a Seven Step rate card. One legal entity. Staff time is extra.

Cost item 2026 India market range, not a Seven Step fee
Gap analysis ₹1.5 lakh to ₹4 lakh
Startup or single-product consulting ₹4 lakh to ₹8 lakh
Mid-market, several AI systems ₹8 lakh to ₹15 lakh
Bank, group, GCC or multi-site ₹15 lakh to ₹30 lakh, sometimes more
Certification body, Stage 1 plus Stage 2 about ₹2 lakh to ₹8 lakh
Annual surveillance often about 40 percent of the initial audit fee

AI governance NBFC programs at mid-size usually sit in the middle consulting band in the table above. Read the quote PDF. The consulting invoice and the certification-body invoice are different papers.

ISO 42001 for banks does not choose your risk appetite. The board does. ISO 42001 for banks does not replace RBI instructions you already follow on IT, outsourcing or digital lending.

AI governance NBFC officers sometimes ask for one circular number. The August 2025 text does not give you one to invent.

A gap review is the honest start for ISO 42001 for banks, before anyone books Stage 1. Treat ISO 42001 for banks as the file you operate, not a binder you refresh before an inspection.

Scope, the board pack, and the 90-day line

RBI FREE-AI framework compliance for a universal bank will not be audit-ready in a fortnight. Work often takes three to six months. A small inventory can be ready for Stage 1 in about 90 days if leadership shows up. Stage 1 is not a certificate. Do not promise one in 90 days. Stage 2 samples live systems. Then a surveillance audit, and recertification around year 3.

Check NABCB or the IAF directory before you sign. NABCB, under QCI, accredits certification bodies in India. Do not treat a body as accredited until you have checked. This article names none.

AI governance NBFC scope can be one product line, written so the app and the vendor tools are obvious.

Staff briefing for RBI FREE-AI framework compliance can be one hour for decision staff and a longer session for owners. Keep one index so RBI FREE-AI framework compliance evidence is not split across mailboxes.

A quote PDF is a price for an audit. It is not, by itself, RBI FREE-AI framework compliance.

The board pack is the production count, the policy, open incidents, and a yes or no on a certificate. RBI FREE-AI framework compliance does not require a certificate on the wall. ISO 42001 for banks that already run a dense control room should add the model pack to that room, not to a side folder. AI governance NBFC boards should ask which declined customer they could explain tomorrow morning.

RBI FREE-AI framework compliance and the DPDP personal-data layer meet in the inventory flag. The flag is not the notice. It keeps the lists aligned before 13 May 2027.

Ask before the board date

If the register is still named Final_v7 and the board date is close, ask for a BFSI AI governance assessment. We read the live systems and the gaps a Stage 1 reviewer would mark. The read is not a certificate. Start here: https://www.sevenstepconsulting.com/contact-us/