IndiaCERT-In Artificial Intelligence Security Auditing Guidelines, Version 1.0
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cert-in.org.in/PDF/AI_Security_Auditing_Guidelines.pdfGuidance, not a law: the Indian Computer Emergency Response Team's reading of CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation. It binds nobody by itself; the law it reads does.
Guidance on an AI governance rule, addressed to public and private bodies.
- Instrument type
- guidance published by a regulator
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence, Market targeting
- Obligation class
- Governance, Security, Reporting, DPIA, Retention
- Audit expectation
- periodic
- Who audits it
- Self, Registered or designated auditor
What the regulator expects
- It reaches you if you develop, procure, deploy or operate an AI system in India, or run one that processes Indian data or provides AI-enabled services to Indian users, whether you are a government organization, a public sector entity, a critical infrastructure operator, a regulated entity, a private organization, an AI developer or an AI service provider (Sections 2 and 4.4). These are CERT-In's audit guidelines, developed by a working-group sub-group of CERT-In and not issued as a direction under section 70B(6) of the Information Technology Act, 2000, so their own lines carry no penalty; the 6-hour incident reporting and the 180-day log retention they mention bind through CERT-In's 2022 Directions (clauses (ii) and (iv)).
- Classify each AI system into one of four tiers (Low, Moderate, High, Critical) by scoring eight risk factors from 1 to 4 without taking credit for claimed control effectiveness, then using the composite score: 8 to 12 is Tier 1, 13 to 19 Tier 2, 20 to 26 Tier 3 and 27 to 32 Tier 4 (Sections 5.2 to 5.4, the composite-score table). Each tier carries a minimum audit: Tier 1 a self-assessment or basic internal review with documented evidence; Tier 2 a documented internal audit plus an independent audit by CERT-In empanelled auditing organizations at least annually; Tier 3 a periodic independent third-party audit by CERT-In empanelled auditing organizations, more often where material changes, incidents or risk conditions warrant; Tier 4 an independent audit by a CERT-In empanelled auditing organization with continuous monitoring (Section 5.4, Section 5.5).
- Document the identity, authorized objectives, approved tools, permission boundaries and action limits of each agentic AI system (Section 9.7).
- Run agents under least privilege, and do not let an agent automatically inherit permissions from users, tools or other agents (Section 9.7).
- Put appropriate human approval gates on consequential agent actions (Section 9.7).
- Log agent execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs, enough to reconstruct the execution chain, and protect those logs against unauthorized modification (Section 9.7).
- If your agentic system is high-risk, make it support emergency interruption, credential revocation, rollback and prevention of uncontrolled automatic restart (Section 9.7).
- If your agent interacts with external tool servers, plugins, Model Context Protocol services, agent-to-agent mechanisms or dynamically discovered services, keep an approved inventory of permitted connections, authenticate tool and service identities, give them least privilege, validate connection metadata and tool descriptions, and log security-relevant tool calls (Section 9.7).
- Assess any dynamic or newly introduced tool connection for provenance, integrity and security before production use (Section 9.7).
- Expect an auditor to check that log retention meets the CERT-In 180-day minimum with time synchronization across all AI components, and to look for forensic readiness with 180-day log retention (Section 8.6); the table of AI attack surfaces lists immutable logging and centralized log aggregation with integrity verification among the key security controls for monitoring and logging infrastructure (Section 10.1).
- Report an AI incident that meets CERT-In's reportable criteria within 6 hours (Section 10.6, the AI Incident Response and Business Continuity table; Section 8.6). The 6-hour clock and the reportable criteria are those of CERT-In's 2022 Directions, clause (ii) and Annexure I, which the Guidelines restate and do not replace.
- Where an audit finding is also a reportable cybersecurity incident, follow the applicable reporting mechanism and prescribed timeline; a finding's classification alone does not decide whether external reporting is required (Section 12.7).
- Reassess each AI system's risk tier at least annually, and for a planned material change complete the reassessment before production deployment (Section 5.6).
- Run an AI risk and impact assessment on a scale set by the tier: optional for Tier 1, mandatory in simplified form for Tier 2, mandatory in comprehensive form for Tier 3 and Tier 4, with independent review where appropriate for Tier 4 (Section 5.5).
- Keep a documented rollback or fallback capability for each production AI system; for Tier 3 and Tier 4 systems define and test recovery objectives for restoring a known-good model or alternate processing mode, and keep documented business continuity plans (Section 10.6).
Who enforces it
Enforcement body
CERT-In, the Indian Computer Emergency Response Team, which developed the Guidelines through its Sub-group 03.
What it makes you log
Who may demand the log
Auditor or notified body
What the log must hold
Human involvement, Output reference, Integrity control
Log retention
The Guidelines ask for forensic readiness with 180-day log retention and tell an auditor to check the CERT-In 180-day minimum.
- Unit
- Days
- As of
- Basis
- Fixed
- Minimum value
- 180
Logging duty
Section 9.7 says the agent execution chain 'shall be logged and protected against unauthorised modification', and Principle 6 asks every AI system for decision and security-event logging appropriate to its risk.
- Kind
- Explicit
- As of
- Provision
- Section 9.7 (execution-chain logging for agentic AI), with Section 8.6, Section 10.1 and Principle 6 in Section 6.2.6
- Trigger
- all_systems
Why the legislator wanted it
Principle 6, Auditability and Traceability (Section 6.2.6), states the aim of the evidence and logs the Guidelines ask for.
- As of
- Quote
- AI systems shall maintain sufficient evidence and traceability to reconstruct model versions, datasets, configurations, prompts, system changes, security events and consequential actions for audit, incident investigation and independent assurance.
- Source link
- https://web.archive.org/web/20261105065305if_/https://www.cert-in.org.in/PDF/AI_Security_Auditing_Guidelines.pdf
- Source kind
- Regulator guidance
- Purpose
- incident_reconstruction
- accountability_demonstration
What this law does
The Artificial Intelligence (AI) Security Auditing Guidelines are version 1.0, dated , and describe themselves as a framework for secure, ethical and auditable artificial intelligence systems. The Guidelines say they were developed by Sub-group 03 of the Working Group on “Indian Standards for Cybersecurity Auditing” constituted by the Indian Computer Emergency Response Team (CERT-In).
The Guidelines provide a structured framework for conducting security and governance audits of AI systems developed, procured, deployed or operated by organizations in India, as well as AI systems processing Indian data or providing AI-enabled services to Indian users. The Guidelines say they are intended for use by government organizations, public sector entities, critical infrastructure operators, regulated entities, private organizations, AI developers and AI service providers, among others.
The Guidelines define four risk tiers, and each AI system is classified using the assessment factors, scoring methodology and escalation criteria in Sections 5.3 and 5.4. A composite score of 8 to 12 makes a system Tier 1 (Low), whose minimum audit is a self-assessment or basic internal review with documented evidence.
A composite score of 13 to 19 makes a system Tier 2 (Moderate), whose minimum audit is a documented internal audit with evidence of control implementation and effectiveness, together with an independent audit by CERT-In empanelled auditing organisations at least annually.
A composite score of 20 to 26 makes a system Tier 3 (High), whose minimum audit is a periodic independent third-party audit by CERT-In empanelled auditing organisations, with enhanced audit frequency where material changes, incidents or risk conditions warrant. A composite score of 27 to 32 makes a system Tier 4 (Critical), whose minimum audit is an independent audit by a CERT-In empanelled auditing organisation with continuous monitoring.
The Guidelines say Tier 3 and Tier 4 systems remain subject to the full applicable assurance requirements irrespective of organizational size. For an agentic AI system, Section 9.7 calls for documented identities, authorized objectives, approved tools, defined permission boundaries and action limits, least privilege without automatic inheritance of permissions, and human approval gates for consequential actions.
Section 9.7 says agent execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs required to reconstruct the execution chain are to be logged and protected against unauthorized modification. Section 9.7 says high-risk agentic systems are to support emergency interruption, credential revocation, rollback and prevention of uncontrolled automatic restart.
Section 9.7 says an agentic system that interacts with external tool servers, plugins, Model Context Protocol services, agent-to-agent mechanisms or dynamically discovered services is to keep an approved inventory of permitted connections, authenticate tool and service identities, apply least privilege, validate connection metadata and tool descriptions, and log security-relevant tool calls.
Section 9.7 says dynamic or newly introduced tool connections are to undergo provenance, integrity and security assessment before production use. The Guidelines say AI incidents meeting CERT-In reportable criteria are to be reported within 6 hours.
CERT-In's 2022 Directions already require a service provider, intermediary, data centre, body corporate or Government organisation to report the cyber incidents listed in Annexure I to CERT-In within 6 hours of noticing them or being brought to notice about them. Annexure I to the 2022 Directions lists attacks or malicious or suspicious activities affecting systems, servers, software or applications related to artificial intelligence and machine learning.
Clause (iv) of the 2022 Directions requires the same kinds of entity to enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days. The Guidelines say that where an audit identifies a condition that also constitutes a reportable cybersecurity incident, the applicable reporting mechanism and prescribed timeline are to be followed.
The Guidelines say the classification of an audit finding alone does not automatically determine whether external reporting is required. The Guidelines list applicable CERT-In Directions and CERT-In advisories, guidelines and technical references as separate kinds of external requirement relevant to an AI security audit.
Back to the example · Lint your app
Page updated .