Cybersecurity
CERT-In AI Audit Guidelines: What Indian Firms Must Do
Affix Center · · 5 min read
In short: On 4 November 2026, CERT-In issued AI Security Auditing Guidelines, version 1.0. They set out a risk-based way to audit AI systems used in India, with four risk tiers, nine audit domains and rules on human oversight and incident reporting. Any organisation using chatbots, AI agents or AI-based decisions should start listing and classifying its AI systems now.
What Happened
CERT-In, India's national cyber security agency, announced on 4 November 2026 that it has issued the Artificial Intelligence (AI) Security Auditing Guidelines, described as a framework for secure, ethical and auditable AI systems. The document is marked version 1.0, dated 04 November 2026, and was prepared by a CERT-In working group. MediaNama published a detailed summary on 6 November 2026, and several security and legal firms have since released explainers.
According to the document, the guidelines apply to AI systems developed, procured, deployed or operated by organisations in India, AI systems that process Indian data, and AI services offered to Indian users. They cover in-house models, third-party and open-source models, and AI-as-a-service tools. Academic research systems not in production, purely rule-based automation without learning components, and personal consumer use are excluded.
The Key Points
Four risk tiers
Each AI system is scored on eight factors, including impact severity, autonomy, data sensitivity, scale, reversibility, sector criticality, adversarial exposure and complexity. The score places the system in one of four tiers.
| Tier | Level | What it means (summary) | Audit approach as described in v1.0 |
|---|---|---|---|
| 1 | Low | Advisory or assistive output, limited impact | Annual review or self-assessment |
| 2 | Moderate | Recoverable operational, financial or data impact | Internal audit, plus independent CERT-In empanelled audit at least annually |
| 3 | High | Consequential decisions or core operations | Independent audit at least annually, more often when risk or change warrants |
| 4 | Critical | Severe or systemic impact, such as critical infrastructure | Independent audit with continuous monitoring and event-triggered reassessment |
A system can be moved to a higher tier regardless of its score, for example if it acts on its own or cannot be safely stopped or rolled back. Tiers must be reviewed at least once a year and after major changes or incidents. Some summaries describe the audit frequencies slightly differently, so check the official PDF for the exact wording that applies to you.
Nine audit domains
Audits look at governance and accountability, data lifecycle and privacy, model risk, bias and fairness, explainability, security and adversarial resilience, monitoring and drift, human oversight, and third-party and AI supply-chain assurance.
Human oversight and the right to review
The guidelines describe human-in-the-loop, human-on-the-loop and human-over-the-loop models. Systems that make consequential decisions are expected to have human approval for consequential actions and a manual override. People affected by AI-assisted decisions should be able to ask for a human review where applicable.
Generative AI, RAG and AI agents
Extra requirements cover risks such as prompt injection, data leakage, data and model poisoning, unsafe output handling, vector database access and AI agents with too many permissions. This follows CERT-In's earlier advisory on AI agents.
Incident reporting
The document says AI security incidents must follow applicable CERT-In reporting rules. MediaNama reports that reportable AI security incidents must be reported within six hours and that relevant logs must be kept for 180 days, which matches CERT-In's existing 2022 directions. The exact definition of a reportable AI incident should be confirmed from the full text.
Who Is Affected
Based on the stated scope, this reaches far beyond AI companies. It is relevant to:
- Banks, NBFCs, insurers and fintechs using AI for credit, fraud or customer service.
- Government departments and PSUs using chatbots, document AI or analytics on citizen data.
- Enterprises and SMEs using AI tools in HR screening, sales, support or internal knowledge search.
- Software vendors that build AI features into products sold in India.
The guidelines use mandatory language ("shall") for many requirements, but the document itself does not spell out how it will be enforced or how it links with sector regulators. Treat it as the benchmark auditors and regulators are likely to use, and check your specific obligations with your legal or compliance adviser.
What to Do Now
- Make an AI inventory. List every AI system and tool in use, including chatbots, AI features inside SaaS products, AI agents and internal models, with an owner for each.
- Classify each system by risk tier. Use the eight factors in the guidelines to place each system in a tier, and record the reasoning.
- Check human oversight. For systems that affect customers, citizens or employees, confirm there is a human approval step, an override and a way for people to ask for review.
- Review data and access. Limit what data each AI tool can see, remove excess permissions from AI agents and confirm where vendor tools store your data.
- Update your incident plan. Add AI-specific incidents such as prompt injection, data leakage through a chatbot or a compromised AI plugin, and map them to your CERT-In reporting process.
- Plan your first audit. For moderate and higher tiers, budget for an independent audit and keep evidence ready: policies, logs, test results and vendor documents.
If you are still deciding where AI fits in your organisation, our AI readiness assessment guide is a useful starting point.
Frequently Asked Questions
When were the CERT-In AI Security Auditing Guidelines issued?
CERT-In issued version 1.0 of the guidelines on 4 November 2026. The document is available on the CERT-In website.
Do the guidelines apply to companies that only use AI tools from vendors?
According to the stated scope, yes. They cover AI systems that organisations procure, deploy or operate, including third-party and AI-as-a-service tools, not only systems they build.
Are small businesses using ChatGPT-style tools in scope?
Business use of AI tools appears to be in scope, while purely personal use is excluded. Low-risk assistive uses fall in the lowest tier with lighter review. Check the full document and take advice for your case.
How Affix Center Can Help
Affix Center helps organisations in Mumbai and across India build and run AI systems safely. Our data and AI team can help you list and classify AI use, and our cybersecurity team can review access controls, logging and incident readiness for AI tools.
To prepare your AI inventory and readiness plan, contact us.