CERT-In issues mandatory AI security auditing framework for Indian organizations
The Indian Computer Emergency Response Team has introduced a risk-tiered audit framework for AI systems to enhance transparency and security oversight.
India's Computer Emergency Response Team (CERT-In) has released a new auditing framework for AI systems, applying to all entities developing or operating AI within the country or processing Indian data. The directive introduces a four-tier risk classification system—Low, Moderate, High, and Critical—to dictate the stringency of security audits.
Audits are required to cover nine core domains, including model risk management, data privacy, adversarial resilience, and human oversight. Organizations must ensure that human intervention levels align with the risk classification of the AI deployment, ranging from direct oversight in the loop to broader governance monitoring.
Beyond technical performance, the guidelines mandate documentation of decision-making processes and require mechanisms for individuals to contest AI-assisted decisions. Auditors must be authorized by CERT-In for higher-risk tiers, and organizations are subject to strict remediation timelines following any audit findings.
This move signals a shift toward formalized accountability for AI deployments in India. By requiring continuous monitoring and tiered audit frequencies, the regulator aims to mitigate systemic risks posed by autonomous systems and large language models.