Why RBI’s FREE-AI Inventory Should Lead Banks toward an AIBOM

AI went mainstream and became an integral part of every system and process somewhere in 2025. A year before, RBI in a proactive step, set up the FREE-AI committee in 2024. The committee created a framework which recommends that every regulated entity keep an inventory of the AI systems it uses. That recommendation in a committee report was published in 2025.

It is important to note that the framework is not a binding rule yet. More recently, in Jun 2026, RBI released draft guidance on model risk management (MRM) that builds on the FREE-AI report and makes a complete model inventory a core expectation. Final guidance is awaited.

So, what does this mean for banks, NBFCs and other regulated entities? AI inventory as a mandate is inevitable and right now is perhaps the time to decide how your inventory will be built and kept current.

In this blog, we explain:

• what the RBI FREE-AI framework is
• what its AI inventory should contain
• where the regulatory timeline stands today and
• why an AI Bill of Materials (AIBOM) is the practical way to keep that inventory accurate, current and ready for supervisory review.

What is RBI’s FREE-AI framework?

FREE-AI stands for Framework for Responsible and Ethical Enablement of Artificial Intelligence. RBI constituted the committee behind it in December 2024 and published its report in August 2025. The report suggests seven guiding principles, called Sutras, and 26 recommendations under six pillars:

• Infrastructure
• Policy
• Capacity
• Governance
• Protection and
• Assurance

Who it applies to

The framework covers all RBI-regulated entities, including commercial and cooperative banks, NBFCs and payment system operators. We use “banks” here for brevity, but the logic applies across the regulated perimeter.

Advisory designed to become supervisory expectation

The report is advisory and sets no penalties. Its recommendations take effect only when RBI adopts them through directions, circulars or guidance, and they were drafted with that conversion in mind. Compliance teams should track which recommendations move into RBI instruments and prepare early.

The FREE-AI inventory: what RBI expects banks to record

The committee recommends that regulated entities maintain a comprehensive internal AI inventory. Published summaries of the report list six areas it should cover:

• All AI models in use
• The use cases each model supports
• The customer groups it targets
• Its dependencies
• The risks it carries
• Grievances linked to it

A half-yearly update cycle

The inventory should be updated every six months. That cadence makes it a recurring deliverable rather than a one-time project, and each cycle tests whether the list still reflects what is running.

Third-party AI stays the bank’s responsibility

FREE-AI holds the deploying entity accountable for its AI systems and recommends AI-specific safeguards in vendor contracts. AI embedded in a vendor’s lending platform, fraud engine or chatbot therefore belongs in the bank’s inventory too.

The RBI FREE-AI timeline: from committee report to draft rules

FREE-AI and related guidance have moved steadily since RBI announced the committee.

How the draft model risk guidance builds on FREE-AI

The draft Guidance on Regulatory Principles for Model Risk Management covers every model a regulated entity uses, including AI and machine learning models built in-house, sourced from third parties or both. It expects a board-approved model risk management framework, risk-based tiering and a complete model inventory.

What to watch next

As of Oct 2026, the guidance remains in draft. Banks that start their inventory now avoid compressing the work into whatever implementation window RBI sets.

Why a spreadsheet AI inventory falls short

Here are three reasons why we feel traditional AI inventory will fail:

1. Dependencies are the hardest field to keep accurate

Inventory fields usually describe how AI is used. Dependencies describe what it is built from: foundation models, open-source libraries, frameworks, datasets and external APIs. These details live inside code and vendor products, so surveys and questionnaires rarely capture them well.

2. AI systems change between reviews

Models are retrained, fine-tuned and replaced. Vendors can update embedded models on their own release cycles. A list compiled every six months can drift out of date soon after sign-off.

3. Supervisors expect evidence, not declarations

A self-declared inventory is difficult to defend in an audit. Each entry needs a traceable record of what was deployed, when it changed and who approved the change.

Why the FREE-AI inventory should lead banks toward an AIBOM

Now, let’s get into the real takeaways: Given how FREE-AI shows the things to come, why banks should start using AIBOM?

What an AIBOM records

An AIBOM is a machine-readable inventory of the components that make up an AI system. CERT-In’s BOM guidelines describe it as covering models, training datasets, algorithms and dependencies, with details such as model versions, retraining activity and data sources. They also encourage tracking model lineage and updating AIBOMs as systems evolve.

This blog focuses on why FREE-AI points banks toward an AIBOM, not on how the AIBOM itself works. 

 

For that, read our complete guide to AI Bill of Materials. It explains core components, from model lineage and training data sources to dependencies and compliance controls.

Where an AIBOM fills the FREE-AI inventory, and where it does not

An AIBOM supplies the technical evidence behind specific fields.

Use cases, target groups and grievances remain governance records owned by the business. Linking them to AIBOMs gives the bank one inventory that is both complete and verifiable. 

Using AIBOMs in vendor due diligence

CERT-In already recommends that organisations procuring AI, particularly in the public sector and essential services, obtain an AIBOM. Banks can apply the same principle by requesting AIBOMs from AI vendors at onboarding and after material updates, and by writing that obligation into contracts.

How banks can start building AIBOM-backed AI inventories

Building an AIBOM-backed inventory works best as a phased effort, not a one-time documentation exercise. The three steps below help banks move from a first list of AI systems to an inventory that stays current between half-yearly reviews.

Discover AI across in-house, vendor and embedded systems

Start with discovery across models built internally, AI bought from vendors and AI embedded inside larger platforms or cloud services. The goal is a complete list of AI systems before any are documented in depth.

Prioritise high-risk and customer-facing models

Build AIBOMs first for models that influence credit, fraud or customer decisions. These carry the greatest customer impact and are most likely to draw supervisory attention.

Connect AIBOMs to the governance register and keep them current

Link each AIBOM to its governance record, then update it whenever a model, dataset or dependency changes. The half-yearly review becomes a confirmation rather than a rebuild.

Conclusion

RBI’s FREE-AI framework starts with a clear expectation: know every AI system you run and keep that record current. The draft model risk management guidance shows that expectation moving toward supervisory practice. A governance register alone cannot keep pace with how AI systems change. An AIBOM supplies traceable technical evidence for models and dependencies as those systems evolve.

CyberNX’s AIBOM solutions help regulated entities identify AI models, datasets and third-party AI systems, document them in right formats and map them against CERT-In’s AIBOM elements and sectoral expectations. If your organisation is preparing its FREE-AI inventory, speak with our team about what an AIBOM-backed approach would look like for your AI estate.

FAQs

Is RBI’s FREE-AI framework mandatory?

No. FREE-AI is a committee report, and its recommendations are advisory. RBI is carrying its ideas into regulation through instruments such as the draft model risk management guidance, which will apply once finalised.

When should banks update their FREE-AI inventory?

The committee recommends a half-yearly update. Keeping AIBOMs current between reviews makes each update faster and easier to defend.

What is the difference between an AI inventory and an AIBOM?

An AI inventory is a governance register of every AI system, its uses, risks and grievances. An AIBOM is a technical record of what one AI system is built from, providing evidence for the inventory’s model and dependency fields.

Does CERT-In require banks to maintain an AIBOM?

No. CERT-In’s version 2.0 guidelines are best-practice guidance, not a mandate. They do set out minimum AIBOM elements that banks can adopt as an internal standard.