CERT-In introduced comprehensive AI Security Auditing Guidelines establishing risk-tier classifications, mandatory human oversight, and structured incident reporting for AI systems developed, deployed, or operating in India, including those processing Indian data or serving Indian users.
- Four-tier risk classification customizes audit rigor
- Human oversight models required based on AI autonomy and risk
- Audit findings tracked with mandatory remediation and possible re-audit
What happened
On November 4, India's Computer Emergency Response Team (CERT-In) issued a detailed set of AI Security Auditing Guidelines aimed at organizations that develop, procure, deploy, or operate AI systems within India. These directives also apply to AI technologies that process Indian data or provide AI-enabled services to Indian users, expanding the scope beyond domestic development.
The guidelines prescribe a tiered risk framework that classifies AI systems into Low, Moderate, High, and Critical risk categories. This classification affects audit intensity, documentation, and human monitoring requirements. It covers nine core audit domains addressing governance, cybersecurity, data privacy, fairness, transparency, resilience, and auditability. Specialized rules govern newer AI forms like generative AI, large language models, agentic AI, and autonomous systems.
Why it matters
The tiered approach allows regulatory efforts to be proportionate to the potential impact and complexity of AI systems, ensuring that higher-risk technologies receive deeper scrutiny. This can help mitigate harms associated with AI decision-making, cybersecurity vulnerabilities, and data privacy breaches in critical sectors.
Mandatory human oversight and contestability requirements enhance accountability by ensuring that individuals affected by AI-driven outcomes have access to review and remediation options. This addresses ongoing concerns about transparency and fairness in automated decision-making, promoting trust in AI applications across industries.
What to watch next
Industries deploying AI systems in India will need to classify their technologies according to CERT-In’s risk tiers and adhere to the corresponding audit and governance stipulations. Organizations can expect closer scrutiny, especially for AI at higher risk levels, and increased emphasis on documenting and remediating audit findings within regulated timelines.
Regulatory bodies and auditors will monitor the operationalization of human oversight models and contestability mechanisms to ensure effectiveness. Future revisions may refine criteria based on emerging AI capabilities and sector-specific challenges, potentially introducing more granular oversight or expanding technology categories covered.