MediaNama reported that India's national cyber agency, CERT-In, released AI Security Auditing Guidelines on November 4. They apply to AI systems that organisations in India build, buy or run. They also cover systems that handle Indian data or serve Indian users. Systems are sorted into four risk tiers: Low, Moderate, High and Critical. The tier sets how deep and how often audits run. Moderate systems need yearly independent audits by CERT-In-approved auditors. High-risk systems may be audited every six months. Critical systems get the closest checks, including continuous monitoring.
For reportable AI security incidents, MediaNama says the framework sets a six-hour deadline to tell CERT-In. Organisations must also keep relevant logs for 180 days. Moderate audit findings need a fix plan within 30 business days and a finished fix within 60 days. Low findings must be fixed within three months. A re-audit is required after an unsatisfactory audit, or after two or more Critical findings within three months. The report does not say when the rules take effect, what penalties apply, or which incidents count as reportable.
Teams that build or buy AI for Indian users will need to rank each system by risk and plan for audits. They will also need a way to report incidents within six hours. Extra checks apply to chatbots and AI agents, including prompt injection (tricking a model with hidden instructions) and limiting what agents may access.