CERT-In Issues AI Security Audit Guidelines: Four Risk Tiers

In news

• The Indian Computer Emergency Response Team (CERT-In) released the Artificial Intelligence Security Auditing Guidelines on 4 November 2026.
• The 107-page framework covers secure, ethical and auditable AI systems.
• It applies to AI developers and service providers whose systems handle Indian data or serve Indian users, including global AI companies.

Key features

Item	Detail
Issued by	CERT-In, under the Ministry of Electronics and Information Technology (MeitY)
Nature	Not binding on AI firms; binding on CERT-In-empanelled auditors who audit AI systems
Approach	Risk-based: stricter audits for riskier systems
Coverage	Full AI lifecycle: design, data, development, deployment, monitoring, retirement
Incident reporting	Reportable AI security incidents within 6 hours
Logs	Keep system logs for 180 days

Four risk tiers

Tier	Audit requirement
Low	Annual review or basic internal assessment
Moderate	Internal audits, plus an independent audit at least once a year
High	Independent third-party audit, up to every six months
Critical	Independent audit with continuous monitoring

• Tier depends on: harm if the system fails, level of autonomy, sensitivity of data, scale of use, whether harm can be reversed, and importance to essential services.

Areas audited

• AI governance
• Data quality and privacy
• Model risk management
• Fairness (no bias)
• Transparency (explainable decisions)
• Cybersecurity
• Continuous monitoring
• Human oversight
• Third-party suppliers

AI-specific threats named

• Prompt injection: hidden instructions trick the AI into wrong actions.
• Data poisoning: corrupt training data makes the model behave wrongly.
• Leakage of sensitive data.
• Excessive permissions given to AI agents.
• Unsafe communication between multiple AI agents.
• Compromised models and insecure software components.
• Extra checks for generative AI, chatbots, AI agents, multimodal AI and autonomous systems.

Why it matters

• AI is now used in banking, health, policing and public services. Failures can harm many people at once.
• Common standards make AI in India more accountable.
• Builds trust for wider AI adoption under the IndiaAI Mission.

India vs European Union approach

India (CERT-In guidelines)	European Union (AI Act, 2024)
Audit guidelines; not a law	Binding law with penalties
Four tiers: low, moderate, high, critical	Four tiers: unacceptable (banned), high, limited, minimal
Light-touch; promotes innovation	Strict compliance before market entry

Concerns

• Voluntary for firms: they apply only when an audit is done.
• Shortage of skilled AI auditors.
• Compliance cost for startups.
• Overlap with the Digital Personal Data Protection Act, 2023.

Static connect

• CERT-In: national nodal agency for cyber incidents; set up in 2004; statutory role under Section 70B, Information Technology Act, 2000.
• CERT-In Directions (April 2022): 6-hour reporting of cyber incidents and 180-day log retention. The new guidelines carry these over to AI.
• IndiaAI Mission (2024): ₹10,371.92 crore for AI computing, datasets, skills and safe AI.
• IndiaAI Safety Institute (2025): works on safe and trusted AI.
• India AI Governance Guidelines (2025): principle-based, light-touch governance of AI.

Exam relevance: UPSC Prelims and GS-3 (Science and Technology, Cyber security), GS-2 (Governance); TGPSC, APPSC (Science and Technology).