# CERT-In issues AI security audit rules with four risk tiers 2026-11-05T07:56:43+00:00 | Governance | Indian Opinion Desk Corroboration: 3 independent outlets CERT-In has issued comprehensive security auditing guidelines for artificial intelligence systems, classifying them into four risk tiers: low, moderate, high and critical. The 107-page framework, released on 4 November, applies to organisations that develop or deploy AI in India and to foreign companies offering AI services to Indian users. High-risk and critical systems require independent audits by CERT-In-empanelled auditors, with critical systems subject to continuous monitoring. The guidelines require AI agents to operate on the principle of least privilege, and high-risk agentic systems must have a ‘kill switch’ mechanism. AI-related security incidents must be reported to CERT-In within six hours. The document does not specify under which legal provision it was issued, when it takes effect, or the consequences of non-compliance. It names the RBI, SEBI, IRDAI and TRAI as intended users but sets no separate rules for those sectors. ## Indian Opinion Analysis The three outlets report the same CERT-In document with largely uniform factual detail. The Hindu leads with the technical security risks of agentic AI, unauthorised tool use, privilege abuse and memory manipulation, and devotes most of its copy to those items. CNBC-TV18 frames the guidelines through their potential impact on foreign firms such as OpenAI and Anthropic, emphasising the six-hour incident-reporting rule and the ‘kill switch’ requirement. Hindustan Times is the only outlet to note that the document does not specify its legal basis, its effective date or the consequences of non-compliance, a gap the other two omit entirely. The balanced reading is that CERT-In has published detailed security requirements for AI systems, with the most stringent rules reserved for high-risk and critical systems, but the enforceability and timeline are not stated in the document itself. ## Coverage Coverage: 3 sources, 3 neutral - thehindu.com (neutral report) Leads with agentic AI technical risks, omits legal basis gap - cnbctv18.com (neutral report) Frames rules around impact on OpenAI, Anthropic, highlights kill switch - hindustantimes.com (neutral report) Notes document does not state legal basis, effective date or penalties This brief was synthesised by AI from the 3 sources linked above, so one read covers every framing they carry. Tags: Anthropic, CERT-In, OpenAI, RBI, SEBI Canonical: https://indianopinion.org/cert-in-issues-ai-security-audit-rules-with-four-risk-tiers/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/cert-in-issues-ai-security-audit-rules-with-four-risk-tiers/#story-in-brief How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/