CERT-In sets out how AI systems in India should be security audited

CERT-In sets out how AI systems in India should be security audited

4 November 2026: India's national cyber agency has published AI Security Auditing Guidelines that sort every AI system into one of four risk tiers and call for independent audits by CERT-In empanelled firms at the higher ones. The 107-page document reaches beyond Indian companies to foreign vendors selling AI services to Indian customers, although it gives no start date and names no penalty.

Not yet independently verified. The guidelines state no effective date or penalty, and we have not seen a sector regulator make them binding. Press and the PDF table differ on which tier first needs an independent audit, so we do not state that mapping here. We will update this when it can be confirmed, and remove this note.

Who the guidelines reach

The text covers AI systems "developed, procured, deployed or operated by organisations in India", and also those "processing Indian data or providing AI-enabled services to Indian users". It says it "applies universally to all types and sizes of organisations", listing small businesses, large corporations, multinationals, government bodies and startups.

The clause most likely to reach overseas software companies names AI service providers and platform operators. Indian and international firms offering AI as a service, AI-integrated SaaS, cloud-hosted AI APIs or development tools to Indian customers are "subject to audit obligations both as providers and as third-party vendors to their customers". A SaaS vendor could therefore meet these questions twice, once on its own account and again in a customer's supplier review.

Four tiers and what sets them

Tier 1 is low risk, Tier 2 moderate, Tier 3 high and Tier 4 critical. Placement comes from a composite score, with bands of 8 to 12, 13 to 19, 20 to 26 and 27 to 32, built from factors such as impact severity, autonomy, data sensitivity, scale, explainability, reversibility and adversarial exposure. The tier then decides how deep the audit goes, how often it happens and how independent the auditor must be.

Critical systems get an independent audit with continuous monitoring. High-tier systems may be audited "every six months where risk or material change warrants". Nine core domains run from governance and data lifecycle to model risk, adversarial resilience and human oversight, with further requirements for generative AI, retrieval systems, agentic AI and autonomous systems. Prompt injection, data and model poisoning and improper output handling are all named.

The dates that bite once an audit starts

Three numbers are worth noting now. AI incidents "meeting CERT-In reportable criteria shall be reported within 6 hours", which lines up with CERT-In's existing incident window rather than creating a separate AI list. Logs carry a 180-day minimum retention. An unsatisfactory opinion, or two or more critical findings, "triggers a mandatory re-audit within 3 months (or sooner if directed by the regulator)".

MediaNama adds that moderate findings need a remediation plan within 30 business days and implementation within 60 days. Firms deciding what to do first can score their systems against the factors above and check whether AI logs would survive 180 days, since neither step depends on how the audit question is finally settled.

Sources

• CERT-In: AI Security Auditing Guidelines, version 1.0, 4 November 2026, 4 November 2026
• MediaNama: The Lowdown on the CERT-In AI Security Auditing Guidelines, 6 November 2026, 6 November 2026