A customer chatbot may already need an independent audit in India

The audit may already apply before the refund permission

A refund permission is not what first puts a chatbot under independent audit. In Cyble's example, the bot that cannot issue refunds is already in Tier 2. Tier 2 comes with an independent audit. The refund permission lifts the bot to Tier 3.

One caveat comes first. The tier placement is Cyble's illustrative scoring. It is not a CERT-In ruling. Cyble says real tiers depend on each system's actual capabilities, and auditors will reach their own view.

CERT-In issued its Artificial Intelligence (AI) Security Auditing Guidelines on 4 November 2026. Cyble, a security firm, has published a reading of the 107-page document. This story draws on that reading. Cyble sells threat intelligence, and its post ends with a product pitch. Every guideline detail below is as Cyble reports it.

How the scoring works

Cyble says the guidelines rate every AI system on eight risk factors. Each factor gets a mark between 1 (low) and 4 (critical). The marks are summed to a total between 8 and 32, and the total places the system in one of four tiers.

The tier sets how deep the audit goes, how often it happens and who does it. The only threshold quoted here is Cyble's FAQ line that a score of 13 or above means Tier 2 or higher.

The framework scores what a system can really do. Capability and permissions weigh heavily. Cyble says safeguards an organization only claims to have earn no credit.

The total is not the last word. Some abilities lift a system a tier whatever its score. Cyble lists three: acting without a person to run code, make payments or send messages; deep access to live systems or sensitive data; and no reliable way to stop or undo the system.

Auditors check the tier themselves. If they rate it higher, the higher tier applies. Lowering a tier needs a documented reassessment, approved by the organization's designated risk authority.

What the refund permission changes

Cyble's example is a support bot at a mid-sized Indian online retailer. Version A answers questions and checks order status. It uses retrieval-augmented generation (RAG), meaning the model pulls answers from help articles and order history. People handle refunds.

Version B is the same bot with one change. It can refund up to ₹5,000 with no human sign-off.

Cyble says three factor changes add three points. Version A already sat at the top of Tier 2, so the extra points carry it into Tier 3. Cyble's summary says the autonomy score rises.

There is a plain reason the risk grows. When a person approves refunds, the model's output is only a suggestion. Without that person, the output is an action. Cyble also says a bot facing the internet that can move money is an obvious target for prompt injection. That is an attack where hostile text tricks a model into following an attacker's instructions.

Starting transactions is also a named escalation trigger. Cyble says Tier 3 brings a broader impact assessment, validation by people other than the developers, and a formal AI Governance Committee. Audits can come as often as every six months.

Version A is not exempt. Cyble says Tier 2 already means an internal audit, AI threat modelling, API security testing and a yearly independent audit by a CERT-In empanelled firm. Cyble adds that many firms running customer-facing chatbots on large language models may not know they are already at this level.

Using someone else's model does not remove the duty

The rules reach beyond Indian companies. A foreign vendor is in scope if its AI handles Indian data or serves users in India.

Cyble says a system stays in scope whatever the origin of its model. Internal, vendor, open-weight and API-based models are all covered. If a vendor cannot supply evidence, that is logged as a scope limitation. Missing access is not treated as proof of compliance.

Small firms get limited relief. MSMEs and startups can self-assess simply, but only for Tier 1 systems. For Tier 3 and Tier 4, Cyble says the guidelines allow no exemption for size.

How binding is it?

Cyble's answer is partly, and probably more over time. The document is issued as guidelines. It states no penalty and no deadline. Even so, the text is written with "shall", and each tier carries a minimum audit requirement.

The six-hour reporting deadline and 180-day log retention are not new. Cyble traces them to CERT-In's Directions of 28 April 2022, which already bind. Cyble says AI incidents that meet CERT-In's reportable criteria now fall under them.

The document names RBI, SEBI, IRDAI and TRAI as intended users. Cyble expects sector regulators and buyers to ask for audit evidence. That is Cyble's forecast, not a stated rule.

What to ask your team

The lesson here is that audit scope follows what a system can do. This is WebPulse's argument, not the framework's wording. The question "which model do we use?" may matter less than "what can it do without a person approving it?"

Ask whether there is a full inventory of AI systems. Include vendor APIs, copilots inside SaaS tools and shadow AI adopted without approval. Cyble says a missing inventory is a governance failure by itself.

Ask whether each system has been scored on what it can do today. Flag any that can issue refunds, send messages, run code or call tools. Send every new agent permission through review as a possible tier change. Keep human approval on consequential actions.

Ask whether the team can detect, classify and report an AI incident within six hours. Cyble's examples are a successful prompt injection, data leaking through a model and a poisoned knowledge source.

A convenience feature for support staff can decide who audits the system. Product and security teams should review such changes together.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cyble.