Introduction
Artificial intelligence now sits inside many products offered by banks and fintechs, from credit underwriting and fraud detection to customer support. The rules for it are still being written. A recent investment commentary on AI regulation observes that policymakers have so far been slow, but that repeated AI safety incidents and a more anxious public may change this quickly. It describes the next phase of AI as a race to govern the technology, after an initial race to build it.
The global debate and then turns to India. As things stand, India has chosen not to enact a standalone AI statute. It relies instead on existing laws, sectoral regulators and, for the financial sector, the Reserve Bank of India’s (“RBI”) FREE-AI framework.
The Global Debate: Uneven Rules and a Strategic Contest
According to the commentary, regulation is likely to be uneven and volatile. In the United States, several bills have been introduced in Congress, ranging from mandatory model testing and government reviews to severe penalties. The White House has also formed a task force on AI-related risks. Current federal policy has leaned towards a lighter touch, with the focus on keeping US leadership against China. The commentary therefore watches state-level action closely, since states often act as precursors to federal rules. One expert quoted would not be surprised by bipartisan federal legislation in 2027 or 2028. These are expectations and not settled law.
The new rules will not start from a blank page. The commentary points to the EU AI Act, safety regulations across several Asian countries, standards bodies such as ISO, IEC and IEEE, and the International Network of AI Safety Institutes, which was set up at the Seoul AI Summit in 2024.
It also notes that rising testing, disclosure, security and governance costs may favour well-capitalised companies, while providers of cybersecurity, verification, auditing and data governance services may gain.
India’s Route: Principles, Existing Laws and Sectoral Regulators
India has taken a different course. The India AI Governance Guidelines, prepared by a committee that the Ministry of Electronics and Information Technology (“MeitY”) constituted in July 2025, adopt a principle-based approach built on seven “sutras”. These were adapted from the RBI’s FREE-AI report. On the current assessment of risks, the Guidelines say a separate law to regulate AI is not needed. Existing laws on information technology, data protection, consumer protection and criminal law are to be applied, and amendments may be considered where gaps appear.
Enforcement stays with sectoral regulators, supported by a proposed AI Governance Group, a Technology and Policy Expert Committee and an AI Safety Institute. For the financial sector, the Guidelines place the responsibility on the Ministry of Finance and the RBI.
RBI’s FREE-AI Framework
The RBI constituted the FREE-AI Committee in December 2024, and the Committee’s report was released on 13 August 2025. Its survey found that about 21% of the surveyed entities were using AI, mainly for customer support, sales, credit underwriting and cybersecurity. Most used simple models, and adoption was concentrated in larger entities.
The report rests on seven sutras: trust as the foundation, people first, innovation over restraint, fairness and equity, accountability, understandable by design, and safety, resilience and sustainability. These are put into practice through 26 recommendations across six pillars. Infrastructure, policy and capacity enable innovation, while governance, protection and assurance manage risk.
Some of the recommendations that matter most for regulated entities and fintechs are as follows:
- A board-approved AI policy covering governance, lifecycle management, risk controls and third-party liabilities.
- An AI inventory within each entity, along with a sector-wide repository.
- Risk-based AI audits, both internal and by third parties.
- An AI incident reporting framework with a non-punitive approach.
- Disclosure when a customer deals with an AI system, and a way to contest AI-driven decisions.
- Red-teaming and AI-specific business continuity plans.
- An AI innovation sandbox for safe testing.
On liability, the report proposes a graded approach. Entities remain accountable for customer losses caused by AI errors, including through compensation. However, supervisors are expected to take a tolerant stance towards first-time or one-off errors where the required safeguards were in place. Persistent failures may invite severe action.
The report follows a two-pronged approach. First, it suggests amending existing RBI directions. For example, the Digital Lending Directions, 2025 would require disclosure of AI-driven credit assessments and fairness audits, and the fraud risk management directions would require AI-driven fraud detection to be tested for accuracy and bias. Second, it proposes a principles-based framework for any new AI-specific rules. The report also takes the view that the Information Technology Act, 2000 and existing RBI guidelines are sufficient for present risks.
Data Protection and the Regulator’s Message
AI in fintech runs on personal data, so the Digital Personal Data Protection Act, 2023 (“DPDP Act”) matters as well. The DPDP Rules, 2025 were notified in November 2025, and the substantive provisions of the Act are scheduled to take effect in May 2027. Section 8(5) requires reasonable security safeguards, and Section 8(6) requires intimation of a personal data breach to the Data Protection Board and to each affected individual. The Schedule provides for penalties that may extend to Rs 250 crore and Rs 200 crore respectively. These are ceilings, and the Board can impose a penalty only after an inquiry. CERT-In’s 2022 directions separately require specified cyber incidents to be reported within six hours. A failure in an AI-driven lending or fraud system that exposes customer data could therefore engage more than one reporting duty at the same time, along with any AI incident reporting the RBI may introduce.
The regulator’s tone is also worth noting. At the Global Fintech Fest 2026, the RBI Governor asked fintechs to manage AI risks such as algorithmic bias, digital exclusion and privacy violations. Regulated entities were cautioned against exploiting regulatory gaps and seeking forgiveness later, and were urged to engage through sandboxes and pilots.
AMLEGALS Remarks
The global debate suggests that AI regulation may be moving from voluntary commitments towards enforceable rules, although the pace and form differ from country to country. India has chosen a middle path, relying on principles, existing law and sectoral regulators. For fintechs and regulated entities, the RBI is the regulator that matters most, and FREE-AI shows where its expectations are likely to head.
It must be noted that the FREE-AI report is a set of recommendations. The obligations described in it remain potential ones until the RBI amends its directions. Even so, entities need not wait. Practical steps include a board-approved AI policy, an inventory of models in use, vendor contracts that address AI risks, regular bias testing, and a response plan that links AI incidents to breach reporting under the DPDP framework. Smaller entities may find the cost of compliance heavy. The commentary’s point that compliance capability can become a competitive advantage applies here as well. The direction of travel is clear. How these principles are converted into binding rules is yet to be seen.
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com or Khilansha.mukhija@amlegals.com