Board AI policy and risk register drafts for small NBFCs and co-op banks
TL;DR Charterline helps smaller lenders write and maintain the AI governance paperwork that RBI's FREE-AI committee has asked for: a board-approved AI policy, a risk tier for each AI use and a living AI inventory. Software drafts the documents, a reviewer tailors them, and the compliance head pays a yearly fee.
RBI's FREE-AI committee surveyed 612 regulated entities in 2025. About a fifth (127) were using or building AI, including 27% of NBFCs surveyed[1]. Governance lagged well behind use. Only about one-third of respondents had any board-level AI oversight, and those were mostly large banks. Only 14% of AI users audited their systems regularly, and about a quarter had a process for AI incidents[1].
Large banks can staff an AI risk team. A mid-sized NBFC with a credit-scoring model and a collections chatbot usually has one compliance officer stretched across dozens of circulars.
So when an inspector asks how the lender classifies and oversees its AI, that poor officer starts from a blank page.
What it does, in regulatory terms - compliance documentation support only. Charterline prepares drafts. The board approves the policy and the lender stays accountable. It gives no legal opinion and makes no regulatory filing.
The compliance team answers a structured intake about each AI system - what it decides, whose data it uses, which vendor built it and who can override it. Charterline then drafts a board policy that follows the eight-part outline in the FREE-AI report[1]. It assigns each use a low, medium or high risk tier with the reasoning shown, and keeps an inventory the team updates at least every six months. A language model writes first drafts, and a human reviewer with banking-compliance experience edits every document before the board sees it.
The seed promised fully automated framework generation. I reframed it, because a board cannot own a policy nobody inside the lender has read. Drafting plus review keeps the speed and lets the lender own the result.
The compliance head or chief risk officer buys, often with the CTO's support. Lenders already pay consultants and audit firms for policy work, and global AI governance platforms sell to large enterprises at prices small lenders rarely see published[2]. If you build this then charge a setup fee plus an annual subscription that covers updates when RBI issues new guidance.
The FREE-AI report came out on 13 August 2025 with 26 recommendations, among them a board AI policy, an AI inventory and a risk-based audit framework[1]. SEBI issued its own consultation on AI and ML use in June 2025[3]. Whether and when RBI turns these into binding directions is the open question to track.
Nobody publishes a figure for AI governance spending by Indian lenders. The narrowest signal is the FREE-AI survey - 127 of 612 supervised entities were using or developing AI, and most of them had no board-level framework[1]. In the same survey, 85% of respondents to its fintech survey said they wanted a regulatory framework. Treat both as demand signals, not revenue.
One global governance platform sells policy packs mapped to the EU AI Act, NIST and ISO 42001[2]. Another offers inventory, testing and policy enforcement for large enterprises[4]. Neither publishes an India-specific RBI pack. Indian audit and consulting firms write AI policies by hand, which costs more and dates quickly. The gap is a low-cost, RBI-specific tool for lenders below the large-bank tier.
| Difficulty | Moderate (39/100) |
| Starting capital | ₹60 L–1.2 Cr |
| Time to launch | 6–9 months |
The software is modest. The hard part is credibility and keeping current. Compliance heads buy from people who have sat through RBI inspections, so you need that experience on the team. And every new circular means updating templates quickly and correctly, which never really ends.
Policy drafting is not a regulated activity, so Charterline itself needs no licence. Your buyers are regulated, and that shapes how you sell.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't trust AI to make the final risk call or to tell a lender what the law requires. The board stays accountable, and a human reviewer signs off every document.
Want to work out the AI layer for Charterline? Talk to Yash →
Here's what can go south -
I like this for a founder with RBI compliance or bank risk experience and a network among NBFC compliance heads. A pure software founder will struggle. Before you build much, prove that five lenders will pay a setup fee for a reviewed policy draft without a binding RBI direction.
Plan for roughly ₹60 L–1.2 Cr, split between the drafting software and reviewers with banking-compliance experience.
No. Drafting compliance documents is not regulated. You need company registration, GST and DPDP compliance, and you must avoid presenting outputs as legal advice.
Yes, but the content changes. FREE-AI is India-specific, so you'd rebuild the templates around your own banking regulator's guidance.
The free Charterline validation kit has the line-by-line capital breakdown, the effort scoring, the RBI and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for compliance heads, and 5 assumptions to test. Download the kit →
Thinking about building Charterline or something close to it? The make-or-break question is whether small lenders will pay before RBI makes any of this binding. That's a question I'm happy to work through with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.