Ten days from now, every bank and NBFC regulated by RBI is supposed to have a board-approved AI risk gap assessment on file. Most credit teams haven't started one.
The deadline comes from the RBI FREE-AI framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence. RBI has asked regulated entities to complete the assessment and submit a time-bound action plan by June 30, 2026. It's not a new law. It's also not optional in any way that matters.
FREE-AI started as a committee report, not a regulation. RBI formed the committee in December 2024, chaired by Prof. Pushpak Bhattacharya of IIT Bombay. The report landed on August 13, 2025 — seven guiding principles, six pillars, 26 recommendations.
For ten months, most of the sector treated it as a discussion paper. Then RBI converted one piece of it into a hard line: a board-approved gap assessment of AI risk, plus a time-bound action plan, due by month-end.
Board-approved is the operative phrase. This isn't a deliverable an IT team can quietly file. It needs board sign-off, which means it needs to exist as a real document, not a slide.
RBI's own survey, cited in the FREE-AI report, found that roughly 20.8% of regulated entities already run AI in production — concentrated in customer support, sales, cybersecurity, and credit underwriting. Another 67% said they were actively exploring AI use cases.
Credit underwriting sits at the center of that list, and it's also where one of the seven Sutras bites hardest: AI systems must be designed and tested for fairness across protected attributes before they go live. For any NBFC running an AI-assisted scoring or approval model, that's not a governance nicety. It's a direct compliance gap if the testing was never documented.
A bias audit nobody wrote down is the same as no bias audit, the day an examiner asks for the file.
The 26 recommendations sit under six pillars: infrastructure, policy, capacity, governance, protection, and assurance. Three of them have immediate, no-excuses implications for NBFC credit teams.
Governance means quarterly board reviews of AI risk and AI disclosures moving into the annual report — not an appendix, a real disclosure section. Protection means a working grievance path for any customer who wants to dispute an AI-influenced credit decision. Assurance means independent audits of model behavior on a recurring schedule, not a one-time vendor certification at launch.
None of this requires new technology. It requires the same operational discipline NBFCs already apply to credit risk and fraud — pointed at the AI system instead of around it.
FREE-AI is still advisory. RBI is expected to fold pieces of it into binding master directions and circulars over the next 12 to 24 months. That gap between "expected practice" and "regulated requirement" is exactly where two kinds of NBFCs are about to diverge.
One kind treats the June 30 deadline as paperwork — a gap assessment written in an afternoon, filed, forgotten. The other kind treats it as the first checkpoint in a governance build-out they'll need anyway, once FREE-AI hardens into law.
The smart bet isn't about complying with what's mandatory today. It's about not having to rebuild the entire governance stack in eighteen months when today's recommendation becomes tomorrow's master direction.
What is the RBI FREE-AI framework deadline for 2026? RBI has directed banks and other regulated entities to complete a board-approved AI risk gap assessment and submit a time-bound action plan by June 30, 2026.
Does the RBI FREE-AI framework apply to NBFCs? Yes. The framework applies across RBI-regulated entities, including commercial banks, cooperative banks, NBFCs, payment system operators, and fintechs offering regulated financial services.
Is FREE-AI legally binding for NBFCs right now? Not yet. The framework is currently advisory, built from a committee report rather than a circular. RBI is expected to operationalize specific recommendations through master directions over the next 12 to 24 months, which is why entities building governance now have a head start.
How does FREE-AI affect AI-based credit underwriting models? One of the framework's seven core principles requires AI systems to be tested for bias across protected attributes before entering production. For NBFCs running AI-assisted credit scoring, this means documented fairness testing is now an explicit expectation, not an optional best practice.
Abhishek Gupta is Co-Founder at Dekrypt Labs, building BIOS — a Business Intelligence Operating System for Indian businesses. dekryptlabs.com