Now Reading: CERT-In issues AI security audit rules with four risk tiers
-
01
CERT-In issues AI security audit rules with four risk tiers
The Story in Brief
CERT-In has issued comprehensive security auditing guidelines for artificial intelligence systems, classifying them into four risk tiers: low, moderate, high and critical. The 107-page framework, released on 4 November, applies to organisations that develop or deploy AI in India and to foreign companies offering AI services to Indian users.
High-risk and critical systems require independent audits by CERT-In-empanelled auditors, with critical systems subject to continuous monitoring. The guidelines require AI agents to operate on the principle of least privilege, and high-risk agentic systems must have a ‘kill switch’ mechanism. AI-related security incidents must be reported to CERT-In within six hours.
The document does not specify under which legal provision it was issued, when it takes effect, or the consequences of non-compliance. It names the RBI, SEBI, IRDAI and TRAI as intended users but sets no separate rules for those sectors.
Indian Opinion Analysis
The three outlets report the same CERT-In document with largely uniform factual detail. The Hindu leads with the technical security risks of agentic AI, unauthorised tool use, privilege abuse and memory manipulation, and devotes most of its copy to those items. CNBC-TV18 frames the guidelines through their potential impact on foreign firms such as OpenAI and Anthropic, emphasising the six-hour incident-reporting rule and the ‘kill switch’ requirement. Hindustan Times is the only outlet to note that the document does not specify its legal basis, its effective date or the consequences of non-compliance, a gap the other two omit entirely. The balanced reading is that CERT-In has published detailed security requirements for AI systems, with the most stringent rules reserved for high-risk and critical systems, but the enforceability and timeline are not stated in the document itself.
Coverage: 3 sources, 3 neutral
Sources (3): thehindu.com (neutral report), cnbctv18.com (neutral report), hindustantimes.com (neutral report)
This brief was synthesised by AI from the 3 sources linked above, so one read covers every framing they carry. Methodology and corrections.
