The Indian Computer Emergency Response Team (CERT-In) on 4 November 2026 issued its Artificial Intelligence (AI) Security Auditing Guidelines, a 107-page framework that sorts AI systems into four risk tiers, sets audit depth by tier, and asks government bodies and companies to report AI-related security incidents to CERT-In within six hours.

The guidelines, numbered CISG-2026-04 and published on the CERT-In website, cover AI systems that are developed, procured, deployed or operated by organisations in India, as well as systems that process Indian data or serve Indian users. They arrive three weeks after CERT-In’s October advisory on AI agents accessing Indian firms’ systems undetected.

What do the CERT-In AI security audit guidelines require?

Every AI system must be classified as low, moderate, high or critical risk. The tier depends on the harm a failure could cause, how autonomously the system acts, the sensitivity and scale of the data it uses, its role in essential services and whether any damage can be reversed.

• Low risk: annual reviews or basic internal assessments.
• Moderate risk: continuous assessment, documented internal audits and at least one independent audit a year by a CERT-In-empanelled auditor.
• High risk: independent audits by CERT-In-empanelled organisations, as often as every six months when risk or material changes warrant it.
• Critical risk: empanelled audits plus continuous monitoring.

Audits must cover nine domains: AI governance and accountability, data quality and privacy, model risk management, bias and fairness, explainability and transparency, cybersecurity, monitoring, human oversight and third-party suppliers.

Six-hour reporting and 180-day logs

The six-hour window extends CERT-In’s 2022 cybersecurity directions to AI incidents. Organisations must also keep security logs for at least 180 days, with synchronised timestamps across AI components, so that investigators can reconstruct what happened after an incident. Training data, model configurations, prompts and later changes must stay traceable and independently verifiable through the system’s life.

“The Guidelines recognise that AI governance cannot be addressed solely through ethical principles or conventional cybersecurity controls,” CERT-In said, adding that assurance needs accountability, technical testing, data and model governance, monitoring, human oversight, incident response and third-party checks.

Extra checks for generative and agentic AI

The framework adds controls for generative AI chatbots, retrieval-augmented generation (RAG) systems, AI agents and multi-agent systems, multimodal AI, and autonomous or cyber-physical AI. This follows CERT-In’s recent work with frontier models, including its access to Anthropic’s Mythos AI for cyber defence.

The guidelines bind CERT-In-empanelled auditors directly, while for AI builders and users they set the benchmark against which their systems will be audited. Sector regulators are moving the same way, with TRAI’s draft responsible AI rules for telecom asking operators to report serious AI failures.

Why it matters for CIOs and CISOs

For enterprise technology leaders, the framework turns AI governance into an audit checklist. Teams will need an inventory of AI use cases with risk tiers, logging that can survive a forensic review, and contracts that let auditors examine third-party models. It also feeds into India’s wider rule-making, as the government prepares its draft AI regulation consultation paper, and into demand for home-grown AI security platforms.

Key takeaways

• CERT-In issued the AI Security Auditing Guidelines (CISG-2026-04) on 4 November 2026.
• AI systems fall into four risk tiers that decide audit frequency and auditor independence.
• AI security incidents must be reported within six hours, and logs kept for 180 days.

FAQ

Who do the CERT-In AI audit guidelines apply to?

They cover AI systems built, bought, deployed or run by organisations in India, and AI systems that process Indian data or serve Indian users.

How fast must AI security incidents be reported?

Reportable AI-related security incidents must be reported to CERT-In within six hours.

Featured image: Server racks in a data centre. Photo: Christopher Bowns via Wikimedia Commons (CC BY-SA 2.0)

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter.

"Exciting news! Elets technomedia is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest insights!" Click here!